- wlug - list.wlug.org.nz

Linux Mint 20 is 64-bit Only, Based on Ubuntu 20.04, and Named 'Ulyana'
by Peter Reutemann 01 Apr '20

01 Apr '20

'Today, we learn some new details about the upcoming Linux Mint 20. While most of the newly revealed information is positive, there is one thing that is sure to upset many Linux Mint users. First things first, Linux Mint 20 will be based on the upcoming Ubuntu 20.04. This shouldn't come as a surprise, as Mint only uses Long Term Support versions of Ubuntu, and 20.04 will be an LTS. We also now know the name of Linux Mint 20. The Mint team always uses female names, and this time they chose "Ulyana." This is apparently a Russian name meaning "youthful." So far, all of the news is positive, so what exactly will upset some users? The Linux Mint developers are finally dropping 32-bit support and will only produce 64-bit ISOs.' -- source: https://linux.slashdot.org/story/20/03/31/1842216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

OpenWRT code-execution bug puts millions of devices at risk
by Peter Reutemann 01 Apr '20

01 Apr '20

'For almost three years, OpenWRT—the open source operating system that powers home routers and other types of embedded systems—has been vulnerable to remote code-execution attacks because updates were delivered over an unencrypted channel and digital signature verifications are easy to bypass, a researcher said. OpenWRT has a loyal base of users who use the freely available package as an alternative to the firmware that comes installed on their devices. Besides routers, OpenWRT runs on smartphones, pocket computers and even laptops and desktop PCs. Users generally find OpenWRT to be a more secure choice because it offers advanced functions and its source code is easy to audit. Security researcher Guido Vranken, however, recently found that updates and installation files were delivered over unencrypted HTTPs connections, which are open to attacks that allow adversaries to completely replace legitimate updates with malicious ones. The researcher also found that it was trivial for attackers with moderate experience to bypass digital-signature checks that verify a downloaded update as the legitimate one offered by OpenWTR maintainers. The combination of those two lapses makes it possible to send a malicious update that vulnerable devices will automatically install.' -- source: https://arstechnica.com/information-technology/2020/03/openwrt-is-vulnerabl… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How The ESA Has Kept The Mars Express Probe Doing Useful Science For 16 Years
by Lawrence D'Oliveiro 01 Apr '20

01 Apr '20

Originally designed for a mission lasting one Martian year (about two Earth years), MEX <https://www.theregister.co.uk/2020/03/31/mars_express/> continues to operate even today, and looks likely to manage to stay in action for a few more years. Working around a wiring error that meant it only had 70% of the designed operating power, then dealing with unreliabilities cropping up in the Solid-State Mass Memory system, figuring out how to prolong the life of the maneouvring reaction wheels, actually having to write and upload new software written in Ada-83, where the original contractor was helpful, rather than obstructive for a change: While support had officially ended, ESA did set up a small contract with Airbus (who had acquired the original spacecraft manufacturer) in a role reversal that saw Airbus review the MEX team's work rather than the other way around. As it transpired, Airbus turned out to be hugely helpful, blowing dust off some testing tools, making suggestions and, effectively, "putting the band back together" as those who originally designed and built MEX (and had not yet shuffled off into retirement) were hauled back to offer assistance. All in all, the team operating MEX has done some amazing work so far. Bear in mind that launching probes into space is still a dicey business, prone to embarrassing failures. This is why they have to be over-engineered, then backed up with alternate recovery plans on top of alternate recovery plans.

1 0

Zoom Meetings Aren't End-to-End Encrypted, Despite Misleading Marketing
by Peter Reutemann 01 Apr '20

01 Apr '20

'Zoom, the video conferencing service whose use has spiked amid the Covid-19 pandemic, claims to implement end-to-end encryption, widely understood as the most private form of internet communication, protecting conversations from all outside parties. In fact, Zoom is using its own definition of the term, one that lets Zoom itself access unencrypted video and audio from meetings. With millions of people around the world working from home in order to slow the spread of the coronavirus, business is booming for Zoom, bringing more attention on the company and its privacy practices, including a policy, later updated, that seemed to give the company permission to mine messages and files shared during meetings for the purpose of ad targeting. Still, Zoom offers reliability, ease of use, and at least one very important security assurance: As long as you make sure everyone in a Zoom meeting connects using "computer audio" instead of calling in on a phone, the meeting is secured with end-to-end encryption, at least according to Zoom's website, its security white paper, and the user interface within the app. But despite this misleading marketing, the service actually does not support end-to-end encryption for video and audio content, at least as the term is commonly understood. Instead it offers what is usually called transport encryption.' -- source: https://it.slashdot.org/story/20/03/31/1526250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Zoom is Leaking Peoples' Email Addresses and Photos To Strangers
by Peter Reutemann 01 Apr '20

01 Apr '20

'Popular video-conferencing Zoom is leaking personal information of at least thousands of users, including their email address and photo, and giving strangers the ability to attempt to start a video call with them through Zoom. From a report: The issue lies in Zoom's "Company Directory" setting, which automatically adds other people to a user's lists of contacts if they signed up with an email address that shares the same domain. This can make it easier to find a specific colleague to call when the domain belongs to an individual company. But multiple Zoom users say they signed up with personal email addresses, and Zoom pooled them together with thousands of other people as if they all worked for the same company, exposing their personal information to one another.' -- source: https://yro.slashdot.org/story/20/03/31/201237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

HPE, Intel and Linux Foundation Team Up For Open Source Software for 5G Core
by Peter Reutemann 01 Apr '20

01 Apr '20

'HPE announced on Tuesday it's working with Intel and the Linux Foundation on a new open source software project to help automate the roll out of 5G across multiple sites. From a report: The new partnership, which will be under the Linux Foundation umbrella, is called the Open Distributed Infrastructure Management Framework. The partnership represents HPE's move into the 5G core network space as it branches out from its enterprise roots. Other partners for the open source project include AMI, Apstra, IBM's Red Hat, Tech Mahindra and World Wide Technology. HPE will also introduce an enterprise offering, the HPE Open Distributed Infrastructure Management Resource Aggregator.' -- source: https://news.slashdot.org/story/20/03/31/1947203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Keyring Concept in Ubuntu: What is It and How to Use it?
by Peter Reutemann 31 Mar '20

31 Mar '20

'f you use automatic login in Ubuntu or other Linux distributions, you might have come across a pop-up message of this sort: Enter password to unlock your login keyring The login keyring did not get unlocked when you logged into your computer. It keeps on popping up several times before disappearing if you keep on clicking cancel. You may wonder why do you keep seeing this keyring message all the time? Let me tell you something. It’s not an error. It’s a security feature. Surprised? Let me explain the keyring concept in Linux.' -- source: https://itsfoss.com/ubuntu-keyring/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Internet Pioneer Vint Cerf Tests Positive For Covid-19
by Peter Reutemann 31 Mar '20

31 Mar '20

'Tech pioneer Vint Cerf, one of the co-creators of the modern internet, has tested positive for covid-19, according to a tweet Cerf sent out Monday morning. The 76-year-old tweeted out a clip from HBO's Last Week Tonight with John Oliver about the U.S. response to the global pandemic. "I tested positive for COVID-19 and am recovering," Cerf tweeted. "Listen to what John Oliver has to say about our national response so far." Cerf helped create the modern internet in the 1970s while working at UCLA with other pioneers like Bob Kahn and Leonard Kleinrock. Cerf worked on packet switching for the APRANET under Kleinrock and TCP/IP protocols with ARPA (now DARPA), the plumbing that makes the internet function. DARPA tweeted its support of Cerf, telling him to get well soon.' -- source: https://science.slashdot.org/story/20/03/30/214250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

WireGuard VPN makes it to 1.0.0—and into the next Linux kernel
by Peter Reutemann 31 Mar '20

31 Mar '20

'We've been anticipating WireGuard's inclusion into the mainline Linux kernel for quite some time—but as of Sunday afternoon, it's official. Linus Torvalds released the Linux 5.6 kernel, which includes (among other things) an in-tree WireGuard. Phoronix has a great short list of the most interesting new features in the 5.6 kernel, as well as a longer "everything list" for those who want to make sure they don't miss anything. If this is the first time you're hearing about WireGuard, the TL;DR is that it's a relatively new VPN (Virtual Private Network) application that offers a leaner codebase, easier configuration, faster connect times, and the latest and most thoroughly peer-reviewed and approved encryption algorithms. You can find a more detailed introduction in our initial August 2018 coverage.' -- source: https://arstechnica.com/gadgets/2020/03/wireguard-vpn-makes-it-to-1-0-0-and… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

#IsTheInternetDown
by Lawrence D'Oliveiro 28 Mar '20

28 Mar '20

Parts of it, anyway. Currently having trouble accessing github.com and anz.co.nz. Well, what else is there to do? ;)

3 4

Public Crash Screens: Linux For A Change
by Lawrence D'Oliveiro 27 Mar '20

27 Mar '20

The Register runs a regular series of reports on public signage showing crash messages instead of the ones they are supposed to show. Usually these are Microsoft Windows messages, often for hilariously out-of-date versions of Windows. This one, for a change <https://www.theregister.co.uk/2020/03/24/bork_walmart/>, shows a Linux boot failure. But it is still a hilariously out-of-date version of Linux.

2 2

Moving To Life Online ... With A Vengeance
by Lawrence D'Oliveiro 26 Mar '20

26 Mar '20

ISPs are having a few hiccups adjusting to the massive increase in Internet usage, particularly in the daytime <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=123201…>. Even phone calls, it seems, are overloading the landline network: Meanwhile, Spark says the indu[s]try-wide congestion problems that stopped many voice calls getting through on Monday and Tuesday are slowly starting to ease - but the telco is still encouraging people to use internet apps like Apple Facetime, WhatsApp or Skype for calls to help ease the pressure. Yeah, push even more load onto the Internet ...

2 2

Singapore Government To Make Its Contact-Tracing App Freely Available To Developers Worldwide
by Peter Reutemann 26 Mar '20

26 Mar '20

'In a move to help the international community combat the coronavirus pandemic, the Singapore government will be making the software for its contact-tracing application TraceTogether, which has already been installed by more than 620,000 people, freely available to developers around the world. From a report: In a post on Monday, Minister-in-charge of the Smart Nation Initiative Vivian Balakrishnan said that the app, developed by the Government Technology Agency (GovTech) and the Ministry of Health, will be open-sourced. This means that the software's source code will be made freely available and may be redistributed and modified. "We believe that making our code available to the world will enhance trust and collaboration in dealing with a global threat that does not respect boundaries, political systems or economies," said Dr Balakrishnan, who is also Foreign Minister. "Together, we can make our world safer for everyone."' -- source: https://yro.slashdot.org/story/20/03/25/1651232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The exFAT Filesystem Is Coming To Linux -- Paragon Software's Not Happy About It
by Peter Reutemann 26 Mar '20

26 Mar '20

'When software and operating system giant Microsoft announced its support for inclusion of the exFAT filesystem directly into the Linux kernel back in August, it didn't get a ton of press coverage. But filesystem vendor Paragon Software clearly noticed this month's merge of the Microsoft-approved, largely Samsung-authored version of exFAT into the VFS for-next repository, which will in turn merge into Linux 5.7 -- and Paragon doesn't seem happy about it. Yesterday, Paragon issued a press release about European gateway-modem vendor Sagemcom adopting its version of exFAT into an upcoming series of Linux-based routers. Unfortunately, it chose to preface the announcement with a stream of FUD (Fear, Uncertainty, and Doubt) that wouldn't have looked out of place on Steve Ballmer's letterhead in the 1990s.' -- source: https://linux.slashdot.org/story/20/03/25/2136223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Play’s malicious app problem infects 1.7 million more devices
by Peter Reutemann 25 Mar '20

25 Mar '20

'Google Play, the company’s official repository for Android apps, has once again been caught hosting fraudulent and potentially malicious apps, with the discovery of more than 56 apps—many of them for children—that were installed on almost 1.7 million devices. Tekya is a family of malware that generates fraudulent clicks on ads and banners delivered by agencies including Google’s AdMob, AppLovin’, Facebook, and Unity. To give the clicks the air of authenticity, the well-obfuscated code causes infected devices to use Android’s “MotionEvent” mechanism to imitate legitimate user actions. At the time researchers from security firm Check Point discovered them, the apps went undetected by VirusTotal and Google Play Protect. Twenty-four of the apps that contained Tekya were marketed to children. Google removed all 56 of the apps after Check Point reported them. The discovery “highlights once again that the Google Play Store can still host malicious apps,” Check Point researchers Israel Wernik, Danil Golubenko, and Aviran Hazum wrote in a post published on Tuesday. “There are nearly 3 million apps available from the store, with hundreds of new apps being uploaded daily–making it difficult to check that every single app is safe. Thus, users cannot rely on Google Play’s security measures alone to ensure their devices are protected.”' -- source: https://arstechnica.com/information-technology/2020/03/found-malicious-goog… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Launches New Initiative With Scroll To Fund Publishers
by Peter Reutemann 25 Mar '20

25 Mar '20

'Firefox, the global web browser from Mozilla, is launching a new subscription product Tuesday called the "Firefox Better Web initiative," and it will feature former Chartbeat CEO Tony Haile's new product Scroll as a launch partner. From a report: It's uncommon for a web browser to launch a product that's explicitly tied to paying out publishers. Scroll's business is all about paying publishers for their content while giving users a better ad experience. The test pilot for the product, which is a subscription to a privacy-first Firefox extension, will only be available in the U.S. The money from a membership ($4.99 monthly, $2,99 for first six months) goes directly to fund publishers and writers.' -- source: https://news.slashdot.org/story/20/03/24/145235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Meet the Chinese OS That's Trying To Shift the Country Off Windows
by Peter Reutemann 25 Mar '20

25 Mar '20

'China's homegrown operating systems haven't made much of a dent on the global stage. Now there's a Linux-based system that's aimed at weaning the country off Windows. From a report: UOS, or Unified Operating System, hit a new milestone after its first stable release in January: Union Tech's OS can now boot in 30 seconds on China-made chips. It's an important step as Chinese tech companies look to reduce their dependence on US-made software and hardware. The struggles of ZTE and Huawei illustrate this clearly: The former was reliant on chips made in the US to produce smartphones, while the latter has the difficult task of selling Android handsets outside China without Google apps or services. The "current international climate" has made it imperative for China to have its own foundational software to avoid being cut off by the US, said the general manager of Union Tech, Liu Wenhan. While Chinese operating systems currently account for less than 1% of the market, Liu said he expects them to grow to 20% to 30% in the future. Integrating homegrown Chinese chips could be the biggest accomplishment of UOS if it pans out. Although Chinese computer chips still don't approach the sophistication of those created by US-based companies, Union Tech said that it is actively working with Chinese chipmakers like Loongson and Sunway to facilitate the gradual replacement of American technology in the Chinese government and pillar industries. In December, Beijing ordered all government offices and public institutions to remove foreign computer equipment and software within three years.' -- source: https://tech.slashdot.org/story/20/03/24/1918223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Says Hackers Are Attacking Windows Users With a New Unpatched Bug
by Peter Reutemann 24 Mar '20

24 Mar '20

'Microsoft says attackers are exploiting a previously undisclosed security vulnerability found in all supported versions of Windows, including Windows 10. From a report: But the software giant said there is currently no patch for the vulnerability. The security flaw, which Microsoft deems "critical" -- its highest severity rating -- is found in how Windows handles and renders fonts, according to the advisory posted Monday. The bug can be exploited by tricking a victim into opening a malicious document. Once the document is opened -- or viewed in Windows Preview -- an attacker can remotely run malware, such as ransomware, on a vulnerable device. The advisory said that Microsoft was aware of hackers launching "limited, targeted attacks," but did not say who was launching the attacks or at what scale.' -- source: https://tech.slashdot.org/story/20/03/23/1846216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

WLUG meeting (virtual)
by Peter Reutemann 23 Mar '20

23 Mar '20

Hi everyone Thanks to Aarons tireless efforts, we can have our WLUG meeting despite COVID-19, though in virtual form via Youtube and Google Hangouts (see links below). As a refresher for the topic: The voice interface represents another big shift in user interfaces, and could be as big a shift as the shift from switches to terminals, the switch from terminals to windowed GUIs, or the switch from full computers to small touchscreen devices. Unfortunately, right now most of these devices are little more than a telephone for talking to a server in the cloud. That is a big problem for privacy, and presents the user with a false choice between access and privacy. Today's computers are capable of handling a verbal interface without requiring a cloud service to handle all of your requests. Aaron Chantrill is one of the developers on the Naomi Project, a free and open source voice assistant (https://projectnaomi.com) It is a plugin based system based on Jasper (http://jasperproject.github.io/) and depending on how the user chooses to configure it, can run totally offline. In this presentation, Aaron would like to introduce people to the Naomi Project, talk about the benefits of a verbal interface, talk about the current architectures of virtual assistants, and ways in which that architecture can be altered to provide better privacy, and also do a comparison of offline speech to text and text to speech solutions, including Pocketsphinx, Mozilla Deepspeech, Kaldi, and Julius. Finally, He will invite people to participate in building and improving Naomi. There is a lot to do and much of it is both engaging and cutting-edge. Aaron recorded a video of his presentation that you can watch here before the virtual meeting: https://youtu.be/8383A_t7iKQ The slides are available as well: https://github.com/aaronchantrill/NaomiPresentation/raw/master/Presentation… The Google Hangouts link for the Question & Answer session: https://hangouts.google.com/hangouts/_/calendar/ZHJhc2t5QGdtYWlsLmNvbQ.3j6l… Meetup link: https://www.meetup.com/WaikatoLinuxUsersGroup/events/269578787/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

[OT] The Doctor Who Helped Defeat Smallpox Explains What’s Coming
by Lawrence D'Oliveiro 23 Mar '20

23 Mar '20

I realize this isn’t part of the topic of this group, but this article <https://arstechnica.com/science/2020/03/the-doctor-who-helped-defeat-smallp…> seems to me important enough that everyone should read it. It’s an interview with epidemiologist Larry Brilliant, who was part of the group that helped eradicate smallpox, and who gave a TED talk 14 years ago about what the next epidemic would look like, that is proving rather prescient right now. He gives an overview of where we are at in the knowledge of the SARS-Cov-2† virus that is causing the current COVID-19‡ pandemic. In short, as new as this virus is, it’s going to follow a lot of the same sort of behaviour as every past infectious viral disease. On facemasks: The N95 mask itself is extremely wonderful. The pores in the mask are three microns wide. The virus is one micron wide. So you get people who say, well, it's not going to work. But you try having three big, huge football players who are rushing for lunch through a door at lunchtime—they're not going to get through. In the latest data I saw, the mask provided 5x protection. That's really good. But we have to keep the hospitals going and we have to keep the health professionals able to come to work and be safe. So masks should go where they’re needed the most: in taking care of patients. †Official name of the virus ‡Official name of the disease caused by the virus

1 0

Critical bugs in dozens of Zyxel and Lilin IoT models under active exploit
by Peter Reutemann 22 Mar '20

22 Mar '20

'Criminals are exploiting critical flaws to corral Internet-of-things devices from two different manufacturers into botnets that wage distributed denial-of-service attacks, researchers said this week. Both DVRs from Lilin and storage devices from Zyxel are affected, and users should install updates as soon as possible. Multiple attack groups are exploiting the Lilin DVR vulnerability to conscript them into DDoS botnets known as FBot, Chalubo, and Moobot, researchers from security firm Qihoo 360 said on Friday. The latter two botnets are spinoffs of Mirai, the botnet that used hundreds of thousand of IoT devices to bombard sites with record-setting amounts of junk traffic. The DVR vulnerability stems from three flaws that allow attackers to remotely inject malicious commands into the device. The bugs are: (1) hard-coded login credentials present in the device, (2) command-injection flaws, and (3) arbitrary file reading weaknesses. The injected parameters affect the device capabilities for file transfer protocol, network time protocol, and the update mechanism for network time protocol.' -- source: https://arstechnica.com/information-technology/2020/03/lilin-dvrs-and-zyxel… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Using Employer’s Proprietary Software From Home? It’ll Cost You
by Lawrence D'Oliveiro 21 Mar '20

21 Mar '20

Never mind the security pitfalls of employees working from home, now there are additional licensing headaches to worry about as well, with proprietary software <https://www.theregister.co.uk/2020/03/20/surge_in_home_working/>: ... some vendors have curious rules about remote access to their applications that incur additional fees. Rich Gibbons, a licensing trainer at IT Asset Management (ITAM), noted that Citrix and/or Remote Desktop Services are "the easiest way to quickly become non-compliant with a LOT of vendors." ... Security is one thing, but in the midst of a global pandemic, does anyone care about licensing? "You're not going to get audited right now," Gibbons told The Reg. "But in six months or whenever this is over, you need to know what you've done."

1 0

Open-Source Project Spins Up 3D-Printed Ventilator Validation Prototype In Just One Week
by Peter Reutemann 20 Mar '20

20 Mar '20

'In a great example of what can happen when smart, technically-oriented people come together in a time of need, an open-source hardware project started by a group including Irish entrepreneur Colin Keogh and Breeze Automation CEO and co-founder Gui Calavanti has produced a prototype ventilator using 3D-printed parts and readily available, inexpensive material. The ventilator prototype was designed and produced in just seven days, after the project spun up on Facebook and attracted participation from over 300 engineers, medical professionals and researchers. The prototype will now enter into a validation process by the Irish Health Services Executive (HSE), the country's health regulatory body. This will technically only validate it for use in Ireland, which ironically looks relatively well-stocked for ventilator hardware, but it will be a key stamp of approval that could pave the way for its deployment across countries where there are shortages, including low-income nations. The group behind the ventilator also recently changed the focus of their Facebook community, renaming the group from the Open Source Ventilator Project to the Open Source COVID19 Medical Supplies community. They're looking at expanding their focus to finding ways to cheaply and effectively build and validate other needed equipment, including protective gear like masks, sanitizer and protective face guards for front-line healthcare workers.' -- source: https://science.slashdot.org/story/20/03/19/2047232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Samba and the French Government
by Peter Reutemann 20 Mar '20

20 Mar '20

>From the Catalyst March newsletter: 'For many years, several French Ministries have entrusted Samba with the role of authentication for Windows desktop machines - using Samba's Domain Controller capability. As modern versions of Windows began phasing out the NT4 Domain Control protocols, it became imperative for the French Ministries to upgrade to Active Directory. Thanks to the long-standing success they had had with Samba, the Ministries were keen to continue to use Samba, this time as an Active Directory (AD) Domain Controller (DC). However, the French Ministries faced a problem: the new AD domains would need to be combined so that a single domain serves a whole ministry, not just a single site. This meant that Samba needed to upscale. Samba was successfully operating in the smaller ministries of the French Government, however, scaling from a thousand users up to 100,000 users for the ministry of Finance was a new challenge that required Catalyst's Samba experts.' -- source: https://www.catalyst.net.nz/client-work/samba-and-french-government Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Windows Subsystem for Linux is making inroads with developers
by Peter Reutemann 20 Mar '20

20 Mar '20

'Last week, Microsoft and Canonical (the company behind the Ubuntu Linux distribution) were scheduled to host a developer conference focused on the Windows Subsystem for Linux (WSL) at Microsoft's Redmond campus. Ars was invited, and I had plane tickets in hand—but the physical conference was canceled at the last minute due to the coronavirus. Note that I did say the physical conference was canceled—WSLconf itself went on, with 22 speakers and 21 talks given. Virtual attendees were reportedly more than double the (sold out) physical attendee registration and included developers from all around the world. Presentations were given over the Bluejeans videoconferencing platform, and Canonical's Developer Advocate Hayden Barnes says that the recorded sessions will be made generally available soon.' -- source: https://arstechnica.com/information-technology/2020/03/the-windows-subsyste… Probably useful for developers that are stuck on Windows, but I'm not gonna trade my Linux Desktop for that horrible Windows one... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Pixar Co-Founders Win Turing Award
by Lawrence D'Oliveiro 19 Mar '20

19 Mar '20

Pat Hanrahan and Ed Catmull split the latest ACM Turing award between them <https://www.theregister.co.uk/2020/03/18/pixar_founders_turing_award/>, in recognition of their pioneering work in computer graphics. Catmull has his name in the “Catmull-Clark” subdivision algorithm commonly used in 3D modellers to turn polygonal shapes into more curvy ones. He headed the Computer Graphics Lab at the New York Institute of Technology (NYIT), started in 1974, with the help of a load of funding from a wealthy benefactor. Among their many projects, NYIT tried to create what would have been, in 1984, the first feature-length movie done entirely in CG. It was called “The Works”. Unfortunately they never got much further than tantalizing fragments <https://www.youtube.com/watch?v=jgzAqRyhjVs>. Hanrahan was a key figure in the creation of the RenderMan renderer at Pixar. What was pioneering about that was the concept of a “shader”, written in a specialized programming language designed for describing how light reacts with a material. This was the “RenderMan Shading Language”. The same idea led to GLSL which became part of OpenGL later, and also the “Open Shading Language” (OSL) created and open-sourced at Sony Pictures ImageWorks, and adopted by many 3D software apps, including Blender.

1 0

Purism Librem Mini is a Tiny Linux Desktop
by Peter Reutemann 19 Mar '20

19 Mar '20

'Today, we get another diminutive desktop option, but this one is designed for Linux and privacy. From a report: Yes, Purism is finally launching a tiny desktop, and it will come pre-installed with the Debian-based PureOS. Called "Librem Mini," the cute bugger has 4 USB-A ports on the front, along with a 3.5mm audio jack, and the power button. On the rear, there are two more USB-A ports, a single USB-C port, Ethernet, HDMI, DisplayPort, and the power port. "Announcing the Purism Librem Mini. Our small form-factor mini-PC that puts freedom, privacy and security first. We're really excited about the Librem Mini, it's a device our community have wanted and we've wanted to offer for some time. The Librem Mini is accessible, small, light and powerful featuring a new 8th gen quad core i7 processor, up to 64 GB of fast DDR4 memory and 4k 60 fps video playback. It's a desktop for your home or oïfce, a media center for your entertainment, or an expandable home server for your files and applications," says Purism.' -- source: https://linux.slashdot.org/story/20/03/18/1654232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Open Source Against The Virus
by Lawrence D'Oliveiro 18 Mar '20

18 Mar '20

A researcher at Google has published plans for an Arduino-based DIY ventilator, in case hospitals run short of officially-approved units for patients <https://www.theregister.co.uk/2020/03/18/diy_ventilator_shortage/>. Quite a few other links there to homebrew efforts to address other ways to help deal with Covid-19. All potentially quite risky and unregulated, of course. So let’s just hope we won’t need any of it. And on a sad note: Meanwhile, technician Christian Fracassi reportedly <https://metro.co.uk/2020/03/16/firm-refuses-give-blueprint-coronavirus-equi…> helped make a 3D printed valve that helped save at least 10 lives at a hospital in Italy, although he may now face legal action from the company whose parts he copied.

1 0

Text processing in the shell
by Peter Reutemann 18 Mar '20

18 Mar '20

Hi everyone Just came across this article, which also has real-world examples: 'One of the things that makes the shell an invaluable tool is the amount of available text processing commands, and the ability to easily pipe them into each other to build complex text processing workflows. These commands can make it trivial to perform text and data analysis, convert data between different formats, filter lines, etc. When working with text data, the philosophy is to break any complex problem you have into a set of smaller ones, and to solve each of them with a specialized tool.' -- source: https://blog.balthazar-rouberol.com/text-processing-in-the-shell Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

meeting next Monday - cancelled
by Peter Reutemann 18 Mar '20

18 Mar '20

Hi everyone Due to COVID-19, we are cancelling all WLUG meetings for the foreseeable future. Stay safe and we'll see you again when things are back to normal! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

meeting next Monday (in theory)
by Peter Reutemann 16 Mar '20

16 Mar '20

Hi everyone At this stage, the university is monitoring the COVID-19 situation but (to my knowledge) isn't closing yet nor is it curtailing meetings such as ours. However, this could change any day and I will post an update when this should happen. So, at this stage we have an exciting WLUG meeting scheduled for next Monday: 'The voice interface represents another big shift in user interfaces, and could be as big a shift as the shift from switches to terminals, the switch from terminals to windowed GUIs, or the switch from full computers to small touchscreen devices. Unfortunately, right now most of these devices are little more than a telephone for talking to a server in the cloud. That is a big problem for privacy, and presents the user with a false choice between access and privacy. Today's computers are capable of handling a verbal interface without requiring a cloud service to handle all of your requests. Aaron Chantrill is one of the developers on the Naomi Project, a free and open source voice assistant (https://projectnaomi.com) It is a plugin based system based on Jasper (http://jasperproject.github.io/) and depending on how the user chooses to configure it, can run totally offline. In this presentation, Aaron would like to introduce people to the Naomi Project, talk about the benefits of a verbal interface, talk about the current architectures of virtual assistants, and ways in which that architecture can be altered to provide better privacy, and also do a comparison of offline speech to text and text to speech solutions, including Pocketsphinx, Mozilla Deepspeech, Kaldi, and Julius. Finally, He will invite people to participate in building and improving Naomi. There is a lot to do and much of it is both engaging and cutting-edge.' Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/266792000/ https://gettogether.community/events/3276/wlug-meeting/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ice Lake GPU underperforming? Put it in powersave mode. Wait, what?
by Peter Reutemann 16 Mar '20

16 Mar '20

'Back in December, Linux users were starting to notice that Ice Lake-equipped laptops were getting better framerates in powersave mode than in performance mode. This Tuesday, Intel developer Francisco Jerez released a patchset to address the conundrum. Jerez begins by noting the fact that if your system bottleneck is I/O, boosting CPU performance won't help—the CPU can't process more data if the I/O subsystem isn't providing it fast enough. "In IO-bound scenarios (by definition) the throughput of the system doesn't improve with increasing CPU frequency beyond the threshold value at which the IO device becomes the bottleneck." Jerez goes on to note that pointlessly boosting the CPU into turbo frequencies when there's no additional data for it to process doesn't just hurt power efficiency. In the case of laptop designs, there's typically no room for desktop- or server-style "overengineering"—you've got limited space as well as limited power. This means, among other things, that there's only so much cooling to go around. "With the current governors [...] the CPU frequency tends to oscillate with the load, often with an amplitude far into the turbo range, leading to severely reduced energy efficiency." This is particularly likely to become a problem in games, where the GPU portions of the processor get a much bigger workout than the x86 CPU itself. If you unnecessarily boost CPU frequency, you waste your TDP budget dealing with unnecessary waste heat from the CPU—which may in turn require throttling the GPU, since you've already eaten through your thermal overhead.' -- source: https://arstechnica.com/gadgets/2020/03/power-management-is-hard-linux-patc… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Internet 'is Not Working For Women and Girls', Says Sir Tim Berners-Lee
by Peter Reutemann 13 Mar '20

13 Mar '20

'Women and girls face a "growing crisis" of online harms, with sexual harassment, threatening messages and discrimination making the web an unsafe place to be, Sir Tim Berners-Lee has warned. The inventor of the world wide web said the "dangerous trend" in online abuse was forcing women out of jobs, causing girls to skip school, damaging relationships and silencing female opinions, prompting him to conclude that "the web is not working for women and girls." "The world has made important progress on gender equality thanks to the unceasing drive of committed champions everywhere," Berners-Lee wrote in an open letter to mark the web's 31st birthday on Thursday. "But I am seriously concerned that online harms facing women and girls -- especially those of colour, from LGBTQ+ communities and other marginalised groups -- threaten that progress."' -- source: https://tech.slashdot.org/story/20/03/12/1436247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 74 Slams Facebook In Solitary Confinement: Browser Add-On Stops Social Network Stalking Users Across the Web
by Peter Reutemann 13 Mar '20

13 Mar '20

'Tim Anderson reporting via The Register: The first thing users will see after updating to Mozilla's latest browser, Firefox 74, is a prompt to install the Facebook Container add-on. The Facebook Container add-on is not new, but has been enhanced in its latest version, 2.1.0, with the ability to add custom sites to the container so that you can "login with Facebook wherever you need to." The purpose of the Facebook Container is to let you continue to use Facebook but without having the social network site track your browsing elsewhere. "Installing this extension closes your Facebook tabs, deletes your Facebook cookies, and logs you out of Facebook," say the docs. When you visit Facebook and log in, the cookies it plants are isolated to the container. This prevents Facebook Like buttons and embedded comments from working on other sites. There is also an issue with sites that require or offer a Facebook login, which you can now overcome by adding those sites to the container. Sites are added by clicking a fence icon and selecting "Allow site in Facebook container." The effect is like having two web browsers, one in which you are logged into Facebook and subject to potential tracking on any site which has Facebook content, and another where Facebook has no knowledge of you.' -- source: https://news.slashdot.org/story/20/03/12/2027215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Modern RAM Used For Computers, Smartphones Still Vulnerable To Rowhammer Attacks
by Peter Reutemann 13 Mar '20

13 Mar '20

'According to new research published today, modern RAM cards are still vulnerable to Rowhammer attacks despite extensive mitigations that have been deployed by manufacturers over the past six years. These mitigations, collectively referred to as Target Row Refresh (TRR), are a combination of software and hardware fixes that have been slowly added to the design of modern RAM cards after 2014 when academics disclosed the first-ever Rowhammer attack. But in a new research paper titled today and titled "TRRespass: Exploiting the Many Sides of Target Row Refresh," a team of academics from universities in the Netherlands and Switzerland said they developed a generic tool named TRRespass that can be used to upgrade the old Rowhammer attacks to work on the new-and-improved TRR-protected RAM cards. The new upgraded attacks work on both DIMM and LPDDR4 memory types, and can be used to retrieve encryption keys from memory, or escalate an attacker's access right to sudo/SYSTEM-level.' -- source: https://it.slashdot.org/story/20/03/12/2042242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Security Practices At The CIA
by Lawrence D'Oliveiro 13 Mar '20

13 Mar '20

The trial of an ex-CIA operative accused of leaking some military-grade hacking tools <https://www.schneier.com/blog/archives/2020/03/cia_dirty_laund.html> has exposed some embarrassing details about the security practices of an organization that, you would expect, has security as its core mission. They regularly used (and freely circulated) rubbish passwords for services on their intranet for the elite “Operational Support Branch”, the excuse being that access to that intranet was already being tightly controlled. The old adage that “a system is only as secure as its weakest point”? They have heard of it...

1 0

Want To Use An Open-Source, Royalty-Free Video Codec? Pay Up, Please!
by Lawrence D'Oliveiro 13 Mar '20

13 Mar '20

A company called Sisvel is assembling a pool of patents claiming to cover the AV1 video codec <https://www.techdirt.com/articles/20200312/04075244087/former-refrigerator-…>. They expect to eventually have an arsenal of about 2000 patents, for which they will demand licence fees. If you remember, AV1 was created precisely to avoid the patent morass that surrounds H.265 aka HEVC.

1 0

Microsoft delivers emergency patch to fix wormable Windows 10 flaw
by Peter Reutemann 13 Mar '20

13 Mar '20

'Microsoft on Thursday released an unscheduled fix for a critical security bug that makes it possible for attackers to remotely execute malicious code that can spread from vulnerable machine to vulnerable machine without requiring any interaction from users. The flaw, in version 3 of Microsoft's implementation of the Server Message block protocol, is present only in 32- and 64-bit Windows 10 versions 1903 and 1909 for clients and servers. Although the vulnerability is difficult to exploit in a reliable way, Microsoft and outside researchers consider it critical because it opens large networks to "wormable" attacks, in which the compromise of a single machine can trigger a chain reaction that causes all other Windows machines to quickly become infected. That's the scenario that played on with the WannaCry and NotPetya in 2017. In a bulletin accompanying Thursday's patch, Microsoft said it has no evidence the flaw is being actively exploited, but the company went on to label the bug as "exploitation more likely." That designation means malicious actors will probably develop and use exploits in the future.' -- source: https://arstechnica.com/information-technology/2020/03/microsoft-delivers-e… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Windows has a new wormable vulnerability, and there’s no patch in sight
by Peter Reutemann 12 Mar '20

12 Mar '20

'Word leaked out on Tuesday of a new vulnerability in recent versions of Windows that has the potential to unleash the kind of self-replicating attacks that allowed the WannaCry and NotPetya worms to cripple business networks around the world. The vulnerability exists in version 3.1.1 of the Server Message Block, the service that’s used to share files, printers, and other resources on local networks and over the Internet. Attackers who successfully exploit the flaw can execute code of their choice on both servers and end-user computers that use the vulnerable protocol, Microsoft said in this bare-bones advisory. The flaw, which is tracked as CVE-2020-0796, affects Windows 10, versions 1903 and 1909 and Windows Server versions 1903 and 1909, which are relatively new releases that Microsoft has invested huge amounts of resources hardening against precisely these types of attacks. Patches aren’t available, and Tuesday’s advisory gave no timeline for one being released. Asked if there was a timeline for releasing a fix, a Microsoft representative said, “Beyond the advisory you linked, nothing else to share from Microsoft at this time.” In the meantime, Microsoft said vulnerable servers can be protected by disabling compression to block unauthenticated attackers from exploiting the vulnerability against an SMBv3 server. Users can use the following PowerShell command to turn off compression without needing to reboot the machine: Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" DisableCompression -Type DWORD -Value 1 -Force That fix won't protect vulnerable client computers or servers if they connect to a malicious SMB service, but in that scenario, the attacks aren't wormable. Microsoft also recommended users block port 445, which is used to send SMB traffic between machines.' -- source: https://arstechnica.com/information-technology/2020/03/windows-has-a-new-wo… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Before it sued Google for copying from Java, Oracle got rich copying IBM’s SQL
by Peter Reutemann 11 Mar '20

11 Mar '20

'More than a decade ago, Google re-implemented the Java programming language as part of its new Android mobile operating system. Oracle, the owner of Java, then sued Google for copyright infringement in 2010. Later this month, the Supreme Court will hear oral arguments in this epic copyright case that will have huge implications for the entire software industry—and that could cost Google billions of dollars. Google says it has done nothing wrong. Copyright law specifically excludes "systems" and "methods of operation" from copyright protection. Google argues that the aspects of Java it copied—function names, argument types, and so forth—fit squarely into these exceptions. Google also argues that copyright's fair use doctrine allows for this kind of copying. The case is being closely watched by the software industry. Companies like Microsoft and IBM have warned that Oracle's stance could create chaos for the industry. They argue that making this kind of copying illegal would not only create legal headaches for a lot of software companies—it would be bad for customers, too. Software companies copy software interfaces—known in industry jargon as application programming interfaces (APIs)—of their competitors' products all the time. This allows competing software products to be interoperable so that a customer can take software designed to work on one platform and re-use it on another. That means lower switching costs for customers. It also means lower barriers for entry for software startups, since it's easier to sell a new product if it's compatible with a software product that customers already know and trust. If anyone should understand the importance of such copying, it's Oracle. After all, Oracle got its start in the 1970s selling a database product based on the then-new structured query language (SQL). SQL was invented by IBM. And Oracle doesn't seem to have gotten a license to use it. If Oracle wins its legal battle, one ironic result will be to make the software industry less hospitable to future startups like Oracle. Incumbent software companies would have a greater ability to lock customers into their own proprietary standards. Startups wouldn't be allowed to do what Oracle did four decades ago: make its product compatible with an established competitor, then make that interoperability a selling point. As I'll explain below, Oracle's copying of SQL seems pretty similar to Google's copying of Java. But an Oracle spokeswoman disagrees. "It’s an incorrect premise, comparing apples with broccoli, and being completely divorced from the facts of the case," she wrote in a Tuesday email.' -- source: https://arstechnica.com/tech-policy/2020/03/before-it-sued-google-for-copyi… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 74 Arrives With Stricter Add-on Rules, TLS 1.0 and TLS 1.1 Disabled
by Peter Reutemann 11 Mar '20

11 Mar '20

'Mozilla today launched Firefox 74 for Windows, Mac, and Linux. Firefox 74 includes stricter rules for add-ons, TLS 1.0 and TLS 1.1 disabled by default, and a handful of developer features.' -- source: https://news.slashdot.org/story/20/03/10/1515248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu 20.04’s zsys adds ZFS snapshots to package management [Updated]
by Peter Reutemann 11 Mar '20

11 Mar '20

'Last October, an experimental ZFS installer showed up in Eoan Ermine, the second interim Ubuntu release of 2019. Next month, Focal Fossa—Ubuntu's next LTS (Long Term Support) release—is due to drop, and it retains the ZFS installer while adding several new features to Ubuntu's system management with the fledgling zsys package. Phoronix reported this weekend that zsys is taking snapshots prior to package-management operations now, so we decided to install the latest Ubuntu 20.04 daily build and see how the new feature works.' -- source: https://arstechnica.com/gadgets/2020/03/ubuntu-20-04s-zsys-adds-zfs-snapsho… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AMD Processors From 2011 To 2019 Vulnerable To Two New Attacks
by Peter Reutemann 11 Mar '20

11 Mar '20

'AMD processors manufactured between 2011 and 2019 (the time of testing) are vulnerable to two new attacks, research published this week has revealed (PDF). The two new attacks impact the security of the data processed inside the CPU and allow the theft of sensitive information or the downgrade of security features. The research team said it notified AMD of the two issues in August 2019, however, the company has not released microcode (CPU firmware) updates, claiming these "are not new speculation-based attacks," a statement that the research team disagrees with. The two new attacks target a feature of AMD CPUs known as the L1D cache way predictor. Introduced in AMD processors in 2011 with the Bulldozer microarchitecture, the L1D cache way predictor is a performance-centric feature that reduces power consumption by improving the way the CPU handles cached data inside its memory. A high-level explanation is available below: "The predictor computes a uTag using an undocumented hash function on the virtual address. This uTag is used to look up the L1D cache way in a prediction table. Hence, the CPU has to compare the cache tag in only oneway instead of all possible ways, reducing the power consumption." The two new attacks were discovered after a team of six academics [...] reverse-engineered this "undocumented hashing function" that AMD processors were using to handle uTag entries inside the L1D cache way predictor mechanism. Knowing these functions, allowed the researchers to recreate a map of what was going on inside the L1D cache way predictor and probe if the mechanism was leaking data or clues about what that data may be. While the attacks can be patched, AMD denies that these two new attacks are a concern, claiming they "are not new speculation-based attacks" and that they should be mitigated through previous patches for speculative execution side channel vulnerabilities. The research team says AMD's response is "rather misleading," and that the attacks still work on fully-updated operating systems, firmware, and software even today.' -- source: https://it.slashdot.org/story/20/03/09/2347202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Popular VPN and Ad-Blocking Apps Are Secretly Harvesting User Data
by Peter Reutemann 11 Mar '20

11 Mar '20

'Sensor Tower, a popular analytics platform for tech developers and investors, has been secretly collecting data from millions of people who have installed popular VPN and ad-blocking apps for Android and iOS, a BuzzFeed News investigation has found. These apps, which don't disclose their connection to the company or reveal that they feed user data to Sensor Tower's products, have more than 35 million downloads. Since 2015, Sensor Tower has owned at least 20 Android and iOS apps. Four of these -- Free and Unlimited VPN, Luna VPN, Mobile Data, and Adblock Focus -- were recently available in the Google Play store. Adblock Focus and Luna VPN were in Apple's App Store. Apple removed Adblock Focus and Google removed Mobile Data after being contacted by BuzzFeed News. The companies said they continue to investigate. Once installed, Sensor Tower's apps prompt users to install a root certificate, a small file that lets its issuer access all traffic and data passing through a phone. The company told BuzzFeed News it only collects anonymized usage and analytics data, which is integrated into its products. Sensor Tower's app intelligence platform is used by developers, venture capitalists, publishers, and others to track the popularity, usage trends, and revenue of apps. Randy Nelson, Sensor Tower's head of mobile insights, said the company's apps do not collect sensitive data or personally identifiable information and that "the vast majority of these apps listed are now defunct (inactive) and a few are in the process of sunsetting." But, as BuzzFeed points out, most of the apps are no longer available "because they were removed due to policy violations."' -- source: https://yro.slashdot.org/story/20/03/10/0148245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel CPUs Vulnerable To New LVI Attacks
by Peter Reutemann 11 Mar '20

11 Mar '20

'A team of academics from universities across the world, along with vulnerability researchers from Bitdefender, today disclosed a new security flaw in Intel processors. From a report: Named Load Value Injection, or LVI for short, this is a new class of theoretical attacks against Intel CPUs. While the attack has been deemed only a theoretical threat, Intel has released firmware patches to mitigate attacks against current CPUs, and fixes will be deployed at the hardware (silicon design) level in future generations.' -- source: https://it.slashdot.org/story/20/03/10/176200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DuckDuckGo is Good Enough For Regular Use
by Peter Reutemann 10 Mar '20

10 Mar '20

'Jake Voytko, who previously worked at Google, writing in a blog post: [...] Let's move away from Google's competitive advantages. How does DuckDuckGo perform for most of my search traffic? DuckDuckGo does a good job. I haven't found a reason to switch back to Google. I combed through my browser's history of DuckDuckGo searches. I compared it to my Google search history. When I fell back to Google, I often didn't find what I wanted on Google either. Most of my searches relate to my job, which means that most of my searches are technical queries. DuckDuckGo serves good results for my searches. I'll admit that I'm a paranoid searcher: I reformat error strings, remove identifiers that are unique to my code, and remove quotes before searching. I'm not sure how well DuckDuckGo would handle copy/pasted error strings with lots of quotes and unique identifiers. This means that I don't know if DuckDuckGo handles all technical searches well. But it does a good job for me. There are many domains where Google outperforms DuckDuckGo. Product search and local search are some examples. I recently made a window plug. It was much easier to find which big-box hardware stores had the materials I need with Google. I also recently bought a pair of ANC headphones. I got much better comparison information starting at Google. Google also shines with sparse results like rare programming error messages. If you're a programmer, you know what I'm talking about: imagine a Google search page with three results. One is a page in Chinese that has the English error string, one is a forum post that gives you the first hint that you need to solve the problem, and one is the error string in the original source code in Github. DuckDuckGo often returns nothing for these kinds of searches. Even though Google is better for some specific domains, I am confident that DuckDuckGo can find what I need. When it doesn't, Google often doesn't help either.' -- source: https://search.slashdot.org/story/20/03/09/1554252 I've been using DuckDuckGo for a number of years exclusively now and I agree with the author that when I can't find it with DDG, I can't find it with Google either. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

How Wikipedia's Volunteers Became the Web's Best Weapon Against Misinformation
by Peter Reutemann 10 Mar '20

10 Mar '20

'Fast Company just published a 4,000 appreciation of Wikipedia's volunteer editors: [W]hile places like Facebook, YouTube, and Twitter struggle to fend off a barrage of false content, with their scattershot mix of policies, fact-checkers, and algorithms, one of the web's most robust weapons against misinformation is an archaic-looking website written by anyone with an internet connection, and moderated by a largely anonymous crew of volunteers. "I think there's a part of that that is encouraging, that says that a radically open, collaborative worldwide project can build one of the most trusted sites on the internet," says Ryan Merkley, the chief of staff at the Wikimedia Foundation, the 400-person nonprofit that provides support to Wikipedia's community of editors. "There's another piece of that that is quite sad," he adds, "because it's clear that part of being one of the most trusted sites on the internet is because everything else has collapsed around us...." [U]nlike parts of the web where toxic information tends to spread, the encyclopedia has one big advantage: Its goal is not to "scale." It's not selling anything, not incentivizing engagement, not trying to get you to spend more time on it. Thanks to donations from thousands of donors around the world, there are no advertisers or investors to please, no algorithms to gather data or stir up emotions or personalize pages; everyone sees the same thing. That philanthropic spirit drives Wikipedia's volunteers, too, who come to the website not to share memes or jokes or even discuss the news but, marvelously, to build a reliable account of reality.... Despite the trolls and propagandists, the majority of errors, especially on controversial and highly trafficked pages, go away within minutes or hours, thanks to its phalanx of devoted volunteers. (Out of Wikipedia's 138 million registered users, about 138,000 have actively edited in the past month.) The site is self-governed according to a Byzantine body of rules that aim for courtesy and a "show your work" journalistic ethics built on accurate and balanced reporting. Vigilant community-built bots can alert Wikipedians to some basic suspicious behavior, and administrators can use restrictions to temporarily lock down the most vulnerable pages, keeping them safe from fly-by editors who are not logged in. "Most of these edits are small improvements to phrasing or content," says a 73-year-old retired physicist from Massachusetts who's done hundreds of edits himself. He adds that "a few are masterpieces, and some are vandalism."' -- source: https://news.slashdot.org/story/20/03/09/0346251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Brave Says it Will Generate Random Browser Fingerprints To Preserve User Privacy
by Peter Reutemann 10 Mar '20

10 Mar '20

'The Brave browser is working on a feature that will randomize its "fingerprint" every time a user visits a website in an attempt to preserve the user's privacy. From a report: Brave's decision comes as online advertisers and analytics firms are moving away from tracking users via cookies to using fingerprints. [...] "The unfortunate truth about all these approaches is that, despite being well-intentioned, none of them are very effective in preventing fingerprinting," the Brave team said of other browser makers' approaches. "The enormous diversity of fingerprinting surface in modern browsers makes these 'block', 'lie' or 'permission' approaches somewhere between insufficient and useless, unfortunately," they added. "Brave's new approach aims to make every browser look completely unique, both between websites and between browsing sessions," Brave developers said.' -- source: https://yro.slashdot.org/story/20/03/09/1822258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FSF Plans to Launch 'Forge', a Code-Hosting/Collaboration Platform
by Peter Reutemann 09 Mar '20

09 Mar '20

'The Free Software Foundation (FSF) announced plans to launch a public code hosting and collaboration platform ("forge") this year. Members of the FSF tech team are currently reviewing ethical web-based software that will help teams work on their projects, with features like merge requests, bug tracking, and other common tools. "Infrastructure is very important for free software, and it's unfortunate that so much free software development currently relies on sites that don't publish their source code, and require or encourage the use of proprietary software," FSF wrote in a blog post. "Our GNU ethical repository criteria aim to set a high standard for free software code hosting, and we hope to meet that with our new forge." As of now, the team said it has been researching a list of candidate programs and analyzing them in terms of ethical and practical criteria. The FSF blog post adds that "We plan on contributing improvements upstream for the new forge software we choose, to boost its score on those criteria... "We'll communicate with the upstream developers to request improvements and help clarify any questions related to the ethical repository criteria."' -- source: https://developers.slashdot.org/story/20/03/08/0323217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Blu-ray discs on Linux
by Ian Young 08 Mar '20

08 Mar '20

Hello all, Having acquired a laptop with a Blu-ray drive and then a Blu-ray disc I had a go at playing the disc with various live Linux versions. The closest was having the disc recognised and opening a player window (VLC iirc) but alas with no sound or vision. Other attempts failed with messages about no AACs being available or being unable to recognise the disc. A cursory survey of various web sources indicates that the best plan is to give up or use Windows. Anyone managed to get anywhere with this in Linux? The disc in question is by the band King Crimson live in Mexico titled Meltdown. Described as NTSC, Zone ABC, LPCM playable in all B-R players and drives. Thanks ~ Ian Y

2 1

FreeNAS and TrueNAS Are Merging
by Peter Reutemann 08 Mar '20

08 Mar '20

'FreeNAS is a free and open source operating system designed for network-attached storage (NAS) devices. For much of the past decade, the project has been led by the folks at iXsystems, which has also produced an enterprise version of the software called TrueNAS. Now iXsystems has announced that FreeNAS and TrueNAS are merging. Moving forward there will be a single operating system called TrueNAS rather than two different, but closely related operating systems. According to the company, the latest versions of the operating systems (FreeNAS 11.3 and TrueNAS 11.3) already share about 95-percent of the same source code. Starting with TrueNAS 12, there will only be a single OS image. But the company will offer two editions: TrueNAS CORE: open source edition TrueNAS Enterprise: commercial version with enterprise management and support.' -- source: https://news.slashdot.org/story/20/03/06/234216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

EFF: .Org Sale 'Threatens Instability and Dysfunction'
by Peter Reutemann 08 Mar '20

08 Mar '20

'In a scathing editorial, EFF continues to oppose Ethos Capital's plan to buy the PIR's .org domain registry for $1.1 billion, arguing that "the current system is stable and functional, and changing it threatens to introduce instability and dysfunction with no countervailing benefit to the community..." "[W]hile there is nothing currently wrong with .ORG, there is a lot that could go wrong if this deal moves forward." Ethos and PIR have repeatedly defended the proposed deal by arguing that converting PIR to a privately owned, for-profit enterprise will allow it to offer "new products and services," but without explaining what those new offerings might be. On Thursday, they finally admitted that they actually don't know what additional products and services .ORG registrants want or need, citing a lack of market research... The for-profit PIR that Ethos envisions would be a fundamentally different organization than today's PIR, and we have serious concerns about its business model and financial stability. Nothing we've heard from PIR and Ethos has convinced us that PIR should be transformed from something that we all know works to something that's unproven. To the contrary, the Ethos deal raises concrete dangers of censorship, financial and technical instability, and price-gouging of non-commercial .ORG registrants. And despite making their case for months, proponents of the deal haven't identified any specific benefits it would impart to .ORG users. ICANN can, and should, reject this change to the .ORG registry. But that time is running out; ICANN's current deadline to make a decision is Friday, March 20. You can still speak out: the ICANN Board is holding a public forum next week, Monday March 9 at 10am-11:30am Eastern Daylight Time. Anyone can join by videoconference and address the Board.' -- source: https://yro.slashdot.org/story/20/03/07/0619231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Edge Browser Scores Worst in Test of Telemetry Privacy
by Peter Reutemann 08 Mar '20

08 Mar '20

'"New academic research published last month looked at the phone-home [telemetry] features of six of today's most popular browsers and found that the Brave browser sent the smallest amount of data about its users back to the browser maker's servers," reports ZDNet: The research, conducted by Douglas J. Leith, a professor at Trinity College at the University of Dublin, looked at Google Chrome, Mozilla Firefox, Apple Safari, Brave, Microsoft Edge (the new Chromium-based version), and the Yandex Browser. "In the first (most private) group lies Brave, in the second Chrome, Firefox, and Safari, and in the third (least private) group lie Edge and Yandex...." [T]he professor found evidence that Chrome, Firefox, and Safari all tagged telemetry data with identifiers that were linked to each browser instance. These identifiers allowed Google, Mozilla, and Apple to track users across browser restarts, but also across browser reinstalls... [T]he most intrusive phoning-home features were found in the new version of Microsoft Edge and the official Yandex Browser. According to Prof. Leith, both used unique identifiers that were linked to the device's hardware, rather than the browser installation. Tracking users by hardware allows Microsoft and Yandex to follow users across installations and potentially link browser installs with other apps and online identities. The professor said that Edge collected the hardware UUID of the user's computer, an identifier that cannot be easily changed or deleted without altering a computer's hardware. Similarly, Prof. Leith also found that Yandex transmitted a hash of the hardware serial number and MAC address to its backend servers. "As far as we can tell this behaviour [in Edge and Yandex] cannot be disabled by users," the professor said. The article also points out that Brave was the only browser that didn't use search autocomplete functionality to collect and send back information on a user's visited web pages. (Even though this can be disabled in Firefox, Chrome, and Safari, it's on by default.) But Edge and Yandex "also sent back information about visited web pages that did not appear to be related to the search autocomplete feature, suggesting the browsers had other ways to track users' browsing habits."' -- source: https://apple.slashdot.org/story/20/03/07/0054219 A couple of articles on how to turn off telemetry within Firefox: https://www.askvg.com/tip-disable-telemetry-and-data-collection-in-mozilla-… https://www.howtogeek.com/557929/how-to-see-and-disable-the-telemetry-data-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Could Have Fixed 2FA Code-Stealing Flaw in Authenticator App Years Ago
by Peter Reutemann 08 Mar '20

08 Mar '20

'Last month, a cybersecurity firm discovered the first-ever Android malware that came with the capability to steal the 2FA (two-factor authentication) codes generated by the Google Authenticator app. The malware, discovered by researchers from ThreatFabric, was named Cerberus, and its 2FA OTP code-stealing feature was still under development, yet to have been detected in a real-world attack. According to researchers, the malware was a hybrid between a banking trojan and a remote access trojan (RAT). Once an Android user got infected, the hacker would use the malware's banking trojan features to steal credentials for mobile banking apps. If an account was protected by 2FA, and namely by the Google Authenticator app, the malware was designed to allow the Cerberus gang to connect to a user's device manually, via its RAT features. Hackers would then open the Authenticator app, generate one-time passcodes, take a screenshot of the codes, and then access the user's account. [...] Nightwatch researchers said that Google could have fixed this issue as early as October 2014, when this misconfiguration was first brought to its attention by someone on GitHub.' -- source: https://tech.slashdot.org/story/20/03/07/0918212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hack Turns Apple's iPhone Into An Android
by Peter Reutemann 07 Mar '20

07 Mar '20

'Ten years ago, David Wang pulled off a remarkable trick, installing Android on the first-generation iPhone. Now Wang and his colleagues at cybersecurity startup Corellium are doing it again with the ostentatiously titled Project Sandcastle. From a report: And Forbes got an exclusive hands-on look at their Android for iPhone product ahead of its public release scheduled for later this Wednesday. The timing is sure to have Apple fanboys rubbernecking: Corellium is in the middle of being sued by Apple. As previously reported by Forbes, in August last year, Corellium was taken to court over Apple claims the startup breached copyright laws by creating software versions of the iPhone for security and testing. The case took a surprise turn late last month when Apple subpoenaed Spanish banking giant Santander and the $50 billion U.S. military and intelligence contractor L3Harris. But Corellium has lofty ambitions for Project Sandcastle, saying that it'll actually show how Apple's walled garden, which it has fiercely protected since launching its flagship phone in 2007, can be deconstructed and taken over by others' software. "Project Sandcastle is about having fun building something new from the sand -- from the literal silicon of the hardware," said Corellium CEO Amanda Gorton, in a statement sent to Forbes. "Apple restricts iPhone users to operate inside a sandbox, but users own that hardware, and they should be able to use that hardware the way they want. So where sandboxes create limits and boundaries on the hardware that users own, sandcastles provide an opportunity to create something new and wonderful from the limitless bounds of your imagination."' -- source: https://apple.slashdot.org/story/20/03/06/1954210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

It’s Not All CUDA At The High End
by Lawrence D'Oliveiro 06 Mar '20

06 Mar '20

This item <https://www.nextplatform.com/2020/03/05/software-evolution-on-ornls-summit-…> reports on an interview with Dr Tjerk Straatsma, group lead for scientific computing at ORNL. Seems their supers have made heavy use of NVidia GPUs up to now, but this is set to change: Frontier, the next system for the OLCF, will have AMD CPUs and GPUs. To prepare for this system, software developers may want to make changes to their programming approach, with OpenMP directive-based and HIP native offloading as the most comparable to the OpenACC and CUDA approaches on Summit today. I wonder what happened to OpenCL as the cross-platform architecture for GPU computing?

1 0

Let’s Encrypt changes course on certificate revocation
by Peter Reutemann 06 Mar '20

06 Mar '20

'Earlier this week, Let's Encrypt announced that it would revoke roughly three million—2.6 percent—of its currently active certificates. Last night, however, the organization announced that it would delay the revocation of many of those certificates in the interest of Internet health. The impact of the revocation on system administrators was and is significant due to the very short window of maintenance allowed before the revocation went into effect. Roughly thirty-six hours were available from the initial announcement to the beginning of scheduled certificate revocation. Half an hour prior to the scheduled revocations, more than one million affected certificates had still not been renewed, and Let's Encrypt announced an additional delay to give administrators more time.' -- source: https://arstechnica.com/information-technology/2020/03/lets-encrypt-holds-o… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Almost Half of Mobile Malware Are Hidden Apps
by Peter Reutemann 06 Mar '20

06 Mar '20

'Certain apps are hiding themselves and stealing resources and data from mobile devices, according to a new report by security firm McAfee. From a report: This is a growing threat comprising almost half of all malicious mobile malware, and a 30% increase from 2018, said Raj Samani, chief scientist and McAfee fellow, who authored the Q1 2020 McAfee Mobile Threat Report. "This shows where the focus from criminals [is] on the mobile platform, which is in stark contrast to non-mobile malware,'' Samani said. A new malware family called LeifAccess or Shopper is taking advantage of the accessibility features in Android to create accounts, download apps, and post reviews, according to the report. LeifAccess, "is a broad campaign [and] is using alternate methods to achieve installation but thereafter trying to achieve legitimacy to the user with fake warnings," Samani said. For example, LeifAccess does not create an icon or shortcut, "so it's not immediately obvious that the app is installed ... but for some of the hidden apps within the report, malicious mobile attacks will even masquerade as a legitimate app," he said.' -- source: https://it.slashdot.org/story/20/03/04/2021233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ampere Altra is the First 80-core ARM-based Server Processor
by Peter Reutemann 06 Mar '20

06 Mar '20

'Ampere has unveiled the industry's first 80-core ARM-based 64-bit server processor today in a bid to outdo Intel and Advanced Micro Devices in datacenter chips. From a report: Ampere announced today that it has begun providing samples of the Ampere Altra processor for modern cloud and edge computing datacenters. The Ampere Altra processor runs on 210 watts and is targeted at such server applications as data analytics, artificial intelligence, database, storage, telco stacks, edge computing, web hosting, and cloud-native applications. Intel dominates about 95.5% of the server chip market with its x86-based processors, and AMD has the rest. But Ampere is targeting power-efficient, high-performance, and high-memory capacity features. Renee James, former president of Intel and CEO of Ampere, said in an interview with VentureBeat that the chip is faster than a 64-core AMD Epyc processor and Intel's 28-core high-end Xeon "Cascade Lake" chip.' -- sources: https://hardware.slashdot.org/story/20/03/04/2027230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel CSME Bug Worse Than Previously Thought
by Peter Reutemann 06 Mar '20

06 Mar '20

'Security researchers say that a bug in one of Intel's CPU technologies that was patched last year is actually much worse than previously thought. From a report: "Most Intel chipsets released in the last five years contain the vulnerability in question," said Positive Technologies in a report published today. Attacks are impossible to detect, and a firmware patch only partially fixes the problem. To protect devices that handle sensitive operations, researchers recommend replacing CPUs with versions that are not impacted by this bug. Only the latest Intel 10th generation chips are not vulnerable, researchers said. The actual vulnerability is tracked as CVE-2019-0090, and it impacts the Intel Converged Security and Management Engine (CSME), formerly called the Intel Management Engine BIOS Extension (Intel MEBx). ' -- source: https://it.slashdot.org/story/20/03/05/149222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GCHQ’s Advice For Securing Smart-Home Gadgets
by Lawrence D'Oliveiro 05 Mar '20

05 Mar '20

For those who can’t be bothered trying to understand the ins and outs of security concerns with “Internet-Of-Things” devices <https://www.theregister.co.uk/2020/03/03/ncsc_smart_gadget_security_tips/> such as cameras and baby monitors, GCHQ advises: * If your camera comes with a default password, change it to a secure one – connecting three random words which you'll remember is a good way to do this. You can usually change your password using the app you use to manage the device. * Keep your camera secure by regularly updating security software. Not only does this keep your devices secure, but often adds new features and other improvements. * If you do not use the feature that lets you remotely access the camera from the internet, it is recommended you disable it.

1 0

Let’s Encrypt discovers CAA bug, must revoke customer certificates
by Peter Reutemann 05 Mar '20

05 Mar '20

'On Leap Day, Let's Encrypt announced that it had discovered a bug in its CAA (Certification Authority Authorization) code. The bug opens up a window of time in which a certificate might be issued even if a CAA record in that domain's DNS should prohibit it. As a result, Let's Encrypt is erring on the side of security and safety rather than convenience and revoking any currently issued certificates it can't be certain are legitimate, saying: Unfortunately, this means we need to revoke the certificates that were affected by this bug, which includes one or more of your certificates. To avoid disruption, you'll need to renew and replace your affected certificate(s) by Wednesday, March 4, 2020. We sincerely apologize for the issue. If you're not able to renew your certificate by March 4, the date we are required to revoke these certificates, visitors to your site will see security warnings until you do renew the certificate.' -- source: https://arstechnica.com/information-technology/2020/03/lets-encrypt-revokin… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

Microsoft Retiring MCSA/MCSD/MCSE Certifications
by Lawrence D'Oliveiro 04 Mar '20

04 Mar '20

Came across this Microsoft article <https://www.microsoft.com/en-us/learning/community-blog-post.aspx?BlogId=8&…> (linked from this YouTube video <https://www.youtube.com/watch?v=laaGuJItNCM>) explaining that Microsoft is “retiring” its more broad-based MCSA, MCSD and MCSE certifications in favour of a range of narrower, “role-based” ones. You’ll notice in the diagram on that page that everything starts with the cloud now: Azure, Dynamics 365 and Microsoft 365. And as we know, Microsoft has previously admitted that Azure is more about Linux instances rather than Windows ones. Myself, I never understood the emphasis on vendor-specific certifications. They have a short shelf-life, requiring continual “refreshing” or “updating” to new product versions--basically another revenue stream for the vendor.

1 0

Cisco: Avoid Coronavirus, Stay Home, Use Webex
by Peter Reutemann 04 Mar '20

04 Mar '20

'Ars Technica: Networking giant Cisco is getting into the coronavirus monitoring and mitigation game with its Webex remote meeting property. The company notes that in the wake of mandates issued to employees to halt travel plans and/or work from home, traffic across its Webex backbone has increased significantly. Webex meeting traffic connecting Chinese users to global workplaces has increased by a factor of 22 since the outbreak began; traffic in other Asian countries is up by 400 percent or more, and free signup rates in impacted countries have increased 700 percent or more. In response, Cisco is offering temporarily unlimited usage (with no time restrictions) in all countries where the service is available (full list here), not just the ones worst hit by coronavirus. The company is also offering free 90-day licenses to businesses that are not currently Webex customers and offering free upgrades to customers whose current plan is insufficient to accommodate increased traffic due to the outbreak. In the worst affected countries, telepresence and remote work software like Webex is currently the only alternative to a complete shutdown of activities. In its press release, Cisco highlights the Nesbitt Center, an organization working with disabled young adults in Hong Kong. All Hong Kong schools, including the Nesbitt Center, have been required to suspend day programs during the outbreak. Webex videoconferencing has allowed the Nesbitt Center to continue delivering educational sessions despite the lockdown. Ars Technica also recommends Jitsi, a "free and open source software, offering video call and screen sharing capabilities." There's also Jitsi Meet for people "who just need to get something done on-the-fly with no setup at all." Do you have a favorite remote work software?' -- source: https://tech.slashdot.org/story/20/03/03/2013226/cisco-avoid-coronavirus-st… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

If You Like RSS, You'll Love Fraidycat
by Peter Reutemann 04 Mar '20

04 Mar '20

'J. Fergus, writing for Input: Someone finally did it. We can now follow who we want on our own terms and get that information chronologically. Fraidycat is an app and browser extension that allows just that. Though it launched in November 2019, Fraidycat recently got a massive update, widening its compatibility and adding a dark mode. The open-source tool, brought to you by Kicks Condor, is available for Linux, Mac, and Windows in addition to Mozilla Firefox and Chrome as an extension. Fraidycat definitely pulls from RSS feeds more easily, but it also works on Twitter, Instagram, and SoundCloud. You drop the link to the account you'd like to follow -- from Medium bloggers to Twitch streamers to vision board Pinterest-ers -- and set how frequently you'd like to see their posts. Label it, hit save, and posts will appear as often as you'd like. The recent update notably folds Kickstarter into the mix and collapses Twitter threads for readability.' -- source: https://tech.slashdot.org/story/20/03/03/1441254 Personally, I use the "Feeder" app on my phone for my RSS feeds: https://f-droid.org/en/packages/com.nononsenseapps.feeder/ But Fraidycat looks like an interesting project. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox: removing "Save link to Pocket" menu item
by Peter Reutemann 04 Mar '20

04 Mar '20

Hi everyone Ever got annoyed at the "Save link to Pocket" in Firefox's right-click popup menu? In case you don't use that feature (like me), here's how you can turn it off (and also re-enable): https://support.mozilla.org/en-US/kb/disable-or-re-enable-pocket-for-firefox It boils down to toggling the following setting ("about:config"): extensions.pocket.enabled Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Freedb.org Is Shutting Down
by Peter Reutemann 03 Mar '20

03 Mar '20

'Freedb, the community-generated database of music CD metadata, is shutting down on March 31, 2020. The service was set up as a free alternative to CDDB. Many CD-ripping applications pull metadata from Freedb to save the user having to type it in manually, but the service has some major limitations and has now been superseded by MusicBrainz. This wouldn't be the first time Freedb shut down. In 2006, the site shut down due to a disagreement among its developers, only to be brought back to life a few months later. It's unclear why Freedb is shutting down after all these years.' -- source: https://developers.slashdot.org/story/20/03/02/2245216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Have I Been Pwned' Is No Longer For Sale
by Peter Reutemann 03 Mar '20

03 Mar '20

'Troy Hunt, the owner and founder of the well-known and respected data breach notification website "Have I Been Pwned," announced in a blog post today that his website is no longer being sold and will continue running independently. The news comes several months after Hunt announced he was actively looking for a buyer. Last June, Hunt wrote: "To date, every line of code, every configuration and every breached record has been handled by me alone. There is no 'HIBP team,' there's one guy keeping the whole thing afloat. It's time for HIBP to grow up. It's time to go from that one guy doing what he can in his available time to a better-resourced and better-funded structure that's able to do way more than what I ever could on my own." Now, according to Hunt, "unexpected changes" with the business model of the party believed to be the purchaser of the service "made the deal infeasible." "It wasn't something I could have seen coming nor was it anything to do with HIBP itself, but it introduced a range of new and insurmountable barriers," writes Hunt in today's blog post. Hunt goes on to explain what's been happening since April 2019 and how the service will operate in the future. ' -- source: https://it.slashdot.org/story/20/03/02/2148230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

An Update On Microsoft's 'GitHub Arctic Vault Program'
by Peter Reutemann 02 Mar '20

02 Mar '20

'news.com.au reports: The GitHub Arctic Vault program is part of the now Microsoft-owned code repository GitHub...aimed at preserving the information for generations to come... "We chose to store GitHub's public repositories in the Arctic World Archive in Svalbard [a Norwegian island] because it is one of the most remote and geopolitically stable places on Earth and is about a mile down the road from the famous Global Seed Vault," said GitHub vice president of special projects Thomas Dohmke. Mr Dohmke said open source code in particular was worth preserving... "Ultimately, it's time to create multiple durable backups of the software our world depends on..." Other treasures include the original source code for MS-DOS (the precursor to Microsoft Windows), the open source code that powers Bitcoin, Facebook's React, and the publishing platform Wordpress... "The Arctic Code Vault was just the beginning of the GitHub Archive Program's journey to secure the world's open source code," GitHub vice president of special projects Thomas Dohmke told news.com.au. "We've partnered with multiple organisations and advisers to help us maximise the GitHub Archive Program's value and preserve all open-source software for future generations." One of those partners is Norwegian archival experts Piql, who specialise in very-long-term data storage. The company uses around 200 silver halide and polyester film reels designed to last a thousand years to store the information... ' -- source: https://developers.slashdot.org/story/20/03/01/2015212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ghostcat Bug Impacts All Apache Tomcat Versions Released in the Last 13 Years
by Peter Reutemann 01 Mar '20

01 Mar '20

'Apache Tomcat servers released in the last 13 years are vulnerable to a bug named Ghostcat that can allow hackers to take over unpatched systems. From a report: Discovered by Chinese cybersecurity firm Chaitin Tech, Ghostcat is a flaw in the Tomcat AJP protocol. AJP stands for Apache JServ Protocol and is a performance-optimized version of the HTTP protocol in binary format. Tomcat uses AJP to exchange data with nearby Apache HTTPD web servers or other Tomcat instances. Tomcat's AJP connector is enabled by default on all Tomcat servers and listens on the server's port 8009. Chaitin researchers say they discovered a bug in AJP that can be exploited to either read or write files to a Tomcat server.' -- source: https://apache.slashdot.org/story/20/02/28/184218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

NZ Domain Costs Going Up
by Lawrence D'Oliveiro 29 Feb '20

29 Feb '20

InternetNZ is seeing fewer registrations of .nz domains, so it is raising prices <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=123126…>. Apparently some are using .kiwi, and others are simply setting up pages on Facebook instead.

1 0

How Melissa Di Donato Is Going To Reinvent SUSE
by Peter Reutemann 28 Feb '20

28 Feb '20

'SUSE is one of the oldest open source companies and the first to market Linux for the enterprise. Even though it has undergone several acquisitions and a merger, it remains a strong player in the business. It has maintained its integrity and core values around open source. It continues to rely on its tried-and-tested Linux business and European markets, and generally shies away from making big moves taking big risks. Until now. SUSE appointed Melissa Di Donato as its first female CEO. She is making some serious changes to the company, from building a diverse and inclusive culture to betting on emerging technologies and taking risks. Soon after taking the helm last year, Di Donato spent the first few months traveling around the globe to meet SUSE teams and customers and get a better sense of the perception of the market about the company. Just like Red Hat CEO Jim Whitehurst, Di Donato didn’t come to the company from an open source background. She had spent the last 25 years of her career as a SUSE customer, so she did have an outsider’s perspective of the company. “I am not interested in what SUSE was when I joined. I am more interested in what we want to become,” she said.' -- source: https://www.linux.com/topic/open-source/how-melissa-di-donato-is-going-to-r… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi 4 Linux Computer Gets Twice the RAM and USB-C Power Fix
by Peter Reutemann 28 Feb '20

28 Feb '20

'Brian Fagioli, writing for BetaNews: The Raspberry Pi line has provided great little Linux computers to nerds -- its low price and small size makes it ideal for tinkering and doing projects. But also, the device has proven to be a solid media device, wonderful for watching videos and emulating classic video games. In other words, it has been a very versatile computer, serving as many things to many people. With the release of the Raspberry Pi 4, however, it finally became powerful enough to serve as a true desktop computer. By installing a Linux distribution, some people can use it for day-to-day computer use, such as web browsing, playing media, and word processing. Unfortunately, the $35 base model came with a paltry 1GB of RAM. Today, this changes, as the company has dropped the price of the 2GB version to $35, effectively doubling the memory for the base model.' -- source: https://linux.slashdot.org/story/20/02/27/1520258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Quotes From RSA
by Lawrence D'Oliveiro 27 Feb '20

27 Feb '20

Among the plethora of pithy apothegms from the panel of crypto experts at the RSA Conference <https://www.theregister.co.uk/2020/02/26/rsa_2020_panel_discussion/>: “I give fusion power a higher chance of succeeding than quantum computing.” -- Ron Rivest “Blockchain is the wrong security technology for voting. I like to think of it as bringing a combination lock to a kitchen fire.” -- Ron Rivest “Intelligence is not about playing fair, it is about succeeding.” -- Whitfield Diffie, on the Crypto AG backdooring saga “I would like to understand how right to be forgotten could be for anything except to keep the little people in line. It is not the right to be forgotten by the secret police.” -- Whitfield Diffie Of course, there were some dissenting opinions to that last one ...

1 0

Smithsonian Releases 2.8 Million Images And 3D Models Into The Public Domain
by Lawrence D'Oliveiro 27 Feb '20

27 Feb '20

Just came across this news report <https://www.techdirt.com/articles/20200225/14150743985/smithsonian-releases…> about the Smithsonian Institution making a whole bunch of stuff available for free download and reuse under a Creative Commons CC0 licence. More info on their home page <https://www.si.edu/OpenAccess>. I had a quick look at one or two 3D models from <https://3d.si.edu/cc0>, and I see OBJ, glTF (OpenGL Transfer Format) and GLB (binary version of glTF) options available. These are all open formats, well-supported in non-proprietary software.

2 1

Ars takes the new Opera R2020 browser for a spin
by Peter Reutemann 27 Feb '20

27 Feb '20

'Conclusion We've been briefly excited by lesser-known browsers many times in the last 20 years, only to eventually gravitate back to the most comfortable of the big, common options. But the tide may be turning for lesser-known options like Opera. Using the same Chromium open source browser upstream as Google Chrome and Microsoft Edge do, there aren't likely to be many compatibility surprises—at least for Windows and Mac users. The Good - Opera feels both fast and familiar (enough) for anyone accustomed to Google Chrome, Microsoft Edge, or Firefox - First-rate Linux installation and update experience - The stand-out features feel immediately useful—Snapshot, VPN, Workspaces, pinned Messengers, and My Flow all fit very neatly and obviously into our existing workflows - Chromium upstream base means sites render familiarly and accurately to Chrome or Edge users - Battery saver feature makes bloated sites feel less bloated and wasteful, even on a desktop The Bad - Unit and currency conversion is still a little wonky and limited - DRM is completely non-functional on Linux The Ugly - Many Linux users won't care about broken DRM for philosophical reasons—but they won't use a non-Libre browser, for the same philosophical reasons' -- source: https://arstechnica.com/gadgets/2020/02/browser-review-opera-r2020-and-oper… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Flaw in Billions of Wi-Fi Devices Left Communications Open To Eavesdropping
by Peter Reutemann 27 Feb '20

27 Feb '20

'Billions of devices -- many of them already patched -- are affected by a Wi-Fi vulnerability that allows nearby attackers to decrypt sensitive data sent over the air, researchers said on Wednesday at the RSA security conference. From a report: The vulnerability exists in Wi-Fi chips made by Cypress Semiconductor and Broadcom, the latter a chipmaker Cypress acquired in 2016. The affected devices include iPhones, iPads, Macs, Amazon Echos and Kindles, Android devices, Raspberry Pi 3's, and Wi-Fi routers from Asus and Huawei. Eset, the security company that discovered the vulnerability, said the flaw primarily affects Cyperess' and Broadcom's FullMAC WLAN chips, which are used in billions of devices. Eset has named the vulnerability Kr00k, and it is tracked as CVE-2019-15126. Manufacturers have made patches available for most or all of the affected devices, but it's not clear how many devices have installed the patches. Of greatest concern are vulnerable wireless routers, which often go unpatched indefinitely. "This results in scenarios where client devices that are unaffected (either patched or using different Wi-Fi chips not vulnerable to Kr00k) can be connected to an access point (often times beyond an individual's control) that is vulnerable," Eset researchers wrote in a research paper published on Wednesday. "The attack surface is greatly increased, since an adversary can decrypt data that was transmitted by a vulnerable access point to a specific client (which may or may not be vulnerable itself)."' -- source: https://mobile.slashdot.org/story/20/02/26/165207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox for Mac and Linux To Get a New Security Sandbox System
by Peter Reutemann 26 Feb '20

26 Feb '20

'Mozilla will add a new security sandbox system to Firefox on Linux and Firefox on Mac. The new technology, named RLBox, works by separating third-party libraries from an app's native code. From a report: This process is called "sandboxing," and is a widely used technique that can prevent malicious code from escaping from within an app and executing at the OS level. RLBox is an innovative project because it takes sandboxing to the next level. Instead of isolating the app from the underlying operating system, RLBox separates an app's internal components -- namely its third-party libraries -- from the app's core engine. This technique prevents bugs and exploits found inside a third-party library from impacting another project that uses the same library.' -- source: https://news.slashdot.org/story/20/02/25/2028214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox To Enable DNS-over-HTTPS by Default To US Users
by Peter Reutemann 26 Feb '20

26 Feb '20

'Mozilla will bring its new DNS-over-HTTPS security feature to all Firefox users in the U.S. by default in the coming weeks, the browser maker has confirmed. From a report: It follows a year-long effort to test the new security feature, which aims to make browsing the web more secure and private. Whenever you visit a website -- even if it's HTTPS enabled -- the DNS query that converts the web address into an IP address that computers can read is usually unencrypted. DNS-over-HTTPS, or DoH, encrypts the request so that it can't be intercepted or hijacked in order to send a user to a malicious site. These unencrypted DNS queries can also be used to snoop on which websites a user visits. DoH works at the app-level, and is baked into Firefox. The feature relies on sending DNS queries to third-party providers -- such as Cloudflare and NextDNS -- both of which will have their DoH offering baked into Firefox and will process DoH queries.' -- source: https://it.slashdot.org/story/20/02/25/1210223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

PayPal Accounts Are Getting Abused En-masse For Unauthorized Payments
by Peter Reutemann 26 Feb '20

26 Feb '20

'Hackers have found a bug in PayPal's Google Pay integration and are now using it to carry out unauthorized transactions via PayPal accounts. From a report: Since last Friday, users have reported seeing mysterious transactions pop up in their PayPal history as originating from their Google Pay account. Issues have been reported on numerous platforms, such as PayPal's forums, Reddit, Twitter, and Google Pay's Russian and German support forums. Victims reported that hackers abused Google Pay accounts to buy products using linked PayPal accounts. According to screenshots and various testimonies, most of the illegal transactions are taking place at US stores, and especially at Target stores across New York. Most of the victims appear to be German users.' -- source: https://it.slashdot.org/story/20/02/25/1213209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Open Source Licences: What, Which & Why
by Lawrence D'Oliveiro 25 Feb '20

25 Feb '20

A good overview <https://arstechnica.com/gadgets/2020/02/how-to-choose-an-open-source-licens…> for anybody having anything to do with Open Source, not just those trying to decide what licence to choose for their own projects. Basic recommendation: stick to something approved by the Open Source Initiative, and above all avoid making up a licence of your own.

2 1

EU Commission To Staff: Switch To Signal Messaging App
by Peter Reutemann 25 Feb '20

25 Feb '20

'The European Commission has told its staff to start using Signal, an end-to-end-encrypted messaging app, in a push to increase the security of its communications. From a report: The instruction appeared on internal messaging boards in early February, notifying employees that "Signal has been selected as the recommended application for public instant messaging." The app is favored by privacy activists because of its end-to-end encryption and open-source technology. "It's like Facebook's WhatsApp and Apple's iMessage but it's based on an encryption protocol that's very innovative," said Bart Preneel, cryptography expert at the University of Leuven. "Because it's open-source, you can check what's happening under the hood," he added. Signal was developed in 2013 by privacy activists. It is supported by a nonprofit foundation that has the backing of WhatsApp founder Brian Acton, who had left the company in 2017 after clashing with Facebook's leadership.' -- source: https://tech.slashdot.org/story/20/02/24/1430211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apple To Release First ARM Mac Without Intel Processor in Next 18 Months, Predicts Kuo
by Peter Reutemann 25 Feb '20

25 Feb '20

Since we were talking about ARM chips at last night's meeting, this seems an interesting bit of news: 'Ming-Chi Kuo is out with a new analyst note today and the most interesting part of his forecast is that Apple will release its first Mac with an ARM processor in the first half of 2021. From a report: Kuo is predicting that one of Apple's new products to be released within the next 12-18 months will be a Mac with an in-house processor, instead of using an Intel CPU. There have been growing reports over the last couple of years about Apple making the switch to a custom-designed ARM processor for its Macs and today's report gives a concrete timeframe for when to expect that launch, which has actually held true since Kuo's prediction back in 2018. Since the coronavirus outbreak, Kuo highlights that Apple has been "more aggressive" with its funding for research, development, and production of 5nm process chips that are expected to show up in the first Macs with ARM CPUs. That's because 5nm chips will be integral to iPhone, iPad later this year, as well as Macs come 2021.' -- source: https://apple.slashdot.org/story/20/02/24/184242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Tablet converted from Win10 to Linux
by Ian Stewart 25 Feb '20

25 Feb '20

Hi Guys, A correction to my story at last nights meeting about converting a tablet from running Win10 to running Debian LXDE. In looking back at the notes I made during this installation, the tablet was an ACER Switch 10 - Model SW5-012. It's CPU is an Intel Atom Processor Z3735F, 4x core, 64-bit, 1.33GHz. Last night I thought its CPU was an ARM chip. However it seems that this CPU has a similarity to ARM in that it needs to initially boot images written in 32-bit code in order to start booting the 64 bit Linux. Although I didn't succeed, in theory I could have installed a 64-bit Ubuntu LXDE 19.10 version, and got it to boot by putting 32 bit images into the /boot partition. That is according to this<https://www.instructables.com/id/Linux-Kiosk-Tablet-From-Acer-Aspire-Switch…> document. Instead I used the debian-live-10.2.0-i386-lxde.iso image and booted it from a USB stick to do an installation to the tablets MMC drive. At the moment the Debian Live team only produce i386 and AMD64 iso's. They do not produce an ARM iso. So the installation approach I took with this tablet, wouldn't work with Mike's PINEBook Pro (ARM) laptop. cheers, Ian.

1 0

Gopher's Rise and Fall Shows How Much We Lost When Monopolists Stole the Net
by Peter Reutemann 23 Feb '20

23 Feb '20

'Science-fiction writer, journalist and longtime Slashdot reader, Cory Doctorow, a.k.a. mouthbeef, writes: The Electronic Frontier Foundation (EFF) just published the latest installment in my case histories of "adversarial interoperability" -- once the main force that kept tech competitive. Today, I tell the story of Gopher, the web's immediate predecessor, which burrowed under the mainframe systems' guardians and created a menu-driven interface to campus resources, then the whole internet. Gopher ruled until browser vendors swallowed Gopherspace whole, incorporating it by turning gopher:// into a way to access anything on any Gopher server. Gopher served as the booster rocket that helped the web attain a stable orbit. But the tools that Gopher used to crack open the silos, and the moves that the web pulled to crack open Gopher, are radioactively illegal today. If you wanted do to Facebook what Gopher did to the mainframes, you would be pulverized by the relentless grinding of software patents, terms of service, anticircumvention law, bullshit theories about APIs being copyrightable. Big Tech blames "network effects" for its monopolies -- but that's a counsel of despair. If impersonal forces (and not anticompetitive bullying) are what keeps tech big then there's no point in trying to make it small. Big Tech's critics swallow this line, demanding that Big Tech be given state-like duties to police user conduct -- duties that require billions and total control to perform, guaranteeing tech monopolists perpetual dominance. But the lesson of Gopher is that adversarial interoperability is judo for network effects.' -- source: https://tech.slashdot.org/story/20/02/21/2240222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Dongle!!
by john 21 Feb '20

21 Feb '20

Hi All, Anyone care to help me with this issue please?? I just bought a USB Bluetooth adapter the icon on the desktop states ' standard: Detected Distance:255;Current State:gone; Status:No bluetooth device configured... Simulation mode (locking disabled)' Output from terminal. lsusb. Bus 003 Device 002: ID 0a12:0001 Cambridge Silicon Radio, Ltd Bluetooth Dongle (HCI mode) Output from "dmesg" 15.616762] Bluetooth: Core ver 2.22 [ 15.616785] NET: Registered protocol family 31 [ 15.616786] Bluetooth: HCI device and connection manager initialized [ 15.616790] Bluetooth: HCI socket layer initialized [ 15.616793] Bluetooth: L2CAP socket layer initialized [ 15.616800] Bluetooth: SCO socket layer initialized [ 18.714533] Bluetooth: BNEP (Ethernet Emulation) ver 1.3stan [ 18.714536] Bluetooth: BNEP filters: protocol multicast [ 18.714542] Bluetooth: BNEP socket layer initialized [ 20.153867] IPv6: ADDRCONF(NETDEV_UP): enp1s0: link is not ready [ 20.246093] r8169 0000:01:00.0 enp1s0: link down [ 20.246348] IPv6: ADDRCONF(NETDEV_UP): enp1s0: link is not ready [ 20.258191] IPv6: ADDRCONF(NETDEV_UP): wlx0019e08c5078: link is not ready [ 20.289093] IPv6: ADDRCONF(NETDEV_UP): wlx0019e08c5078: link is not ready [ 20.548998] IPv6: ADDRCONF(NETDEV_UP): wlx0019e08c5078: link is not ready [ 21.932491] wlx0019e08c5078: authenticate with 18:f1:45:96:63:4b [ 21.937373] wlx0019e08c5078: send auth to 18:f1:45:96:63:4b (try 1/3) [ 21.939214] wlx0019e08c5078: authenticated [ 21.939962] wlx0019e08c5078: associate with 18:f1:45:96:63:4b (try 1/3) [ 21.942561] wlx0019e08c5078: RX AssocResp from 18:f1:45:96:63:4b (capab=0x431 status=0 aid=1) [ 21.943456] wlx0019e08c5078: associated [ 21.981876] IPv6: ADDRCONF(NETDEV_CHANGE): wlx0019e08c5078: link becomes ready [ 26.871648] Bluetooth: RFCOMM TTY layer initialized [ 26.871656] Bluetooth: RFCOMM socket layer initialized [ 26.871663] Bluetooth: RFCOMM ver 1.11

2 1

Google launches the Android 11 Developer Preview today
by Peter Reutemann 21 Feb '20

21 Feb '20

'It's a bit earlier than the usual March release, but today Google is launching the first Android 11 Developer Preview. This first OS preview is coming to the Pixel 2, 3, 3a, and 4, along with generic system images for Project Treble devices. It also has a new name. Typically these releases have been denoted by a letter—Android 10 was the "Android Q Preview"—and while Android 11 is still called "Android R" internally, publicly this is the "Android 11 Developer Preview" to all us non-Googlers. True to form, Google has already started with the Spinal Tap references and starts the blog post with a dial that goes to 11. For now we're just working off a giant blog post with lots of bullet points, and nearly zero screenshots, so we're not sure what the scope of this release is really like. We'll have a hands-on later, but for now, here are some highlights. Android 10—The Ars Technica Review One of the most-used features of Android 11 will probably be a new "one-time permission" option for apps that want to access location, microphone, and camera data. In Android 10, Google added the ability to grant a permission to an app only when it was running in the foreground, and now users will be able to grant access to a permission a single time. This is already in iOS, and it makes a lot of sense for certain apps.' -- source: https://arstechnica.com/gadgets/2020/02/google-launches-the-android-11-deve… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

The Linux Foundation Identifies Most Important Open-Source Software Components and Their Problems
by Peter Reutemann 21 Feb '20

21 Feb '20

'The Linux Foundation's Core Infrastructure Initiative (CII) and the Laboratory for Innovation Science at Harvard (LISH) have revealed -- in "Vulnerabilities in the Core, a preliminary report and Census II of open-source software" -- the most frequently used components and the vulnerabilities they share. From a report: This Census II analysis and report is the first major study of its kind but isn't a final analysis. It takes important first steps and lays out a methodology for understanding and addressing open-source software structural and security complexities. Specifically, it also identifies the most commonly used free and open-source software (FOSS) components in production applications and examines them for potential vulnerabilities. To create this work, CII and LISH partnered with Software Composition Analysis (SCAs) and application security companies such as Snyk and Synopsys Cybersecurity Research Center. They combined private usage data with publicly available datasets for identifying over 200 of the most used open-source software projects. These are not the programs -- Apache, MySQL, Linux -- that probably spring to your mind. For all their foundational importance, it's the small building block programs that are most widely used. They may be small, sometimes less than a hundred lines of code (LoC), but they're vital. As Frank Nagle, a professor at Harvard Business School and co-director of the Census II project, said: "FOSS was long seen as the domain of hobbyists and tinkerers. However, it has now become an integral component of the modern economy and is a fundamental building block of everyday technologies like smart phones, cars, the Internet of Things, and numerous pieces of critical infrastructure. Understanding which components are most widely used and most vulnerable will allow us to help ensure the continued health of the ecosystem and the digital economy."' -- source: https://news.slashdot.org/story/20/02/20/1349241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft To Bring Its Defender Antivirus Software To iOS and Android
by Peter Reutemann 21 Feb '20

21 Feb '20

'Microsoft said today it plans to bring its antivirus software, Defender Advanced Threat Protection, to phones and other devices running Apple's iOS and Google's Android. From a report: The software, also called Defender ATP, is already available on Windows and MacOS. It offers features like preventive protection, post-breach detection and automated investigation and response, according to Microsoft. When it comes to mobile devices, Microsoft's Rob Lefferts said that the Defender software could help companies protect employees from things like malware and phishing attacks. Apple's and Google's app stores are "pretty safe," Lefferts said, but "malware does happen on those platforms."' -- source: https://it.slashdot.org/story/20/02/20/1928225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

VPN
by john 20 Feb '20

20 Feb '20

Are any of the Mozilla add-ons listed in the attachment a good thing to add to Firefox? Cheers John...

2 1

Mozilla's Standalone Firefox VPN is Now Available in Beta
by Peter Reutemann 20 Feb '20

20 Feb '20

'Mozilla has a new virtual private network service and if you have a Chromebook, a Windows 10 computer or an Android device in the US, you can start using a beta version now. From a report: Called Firefox Private Network, the new service is designed to function as a full-device VPN and give better protection when surfing the web or when using public Wi-Fi networks. The company offers two options: a free browser-extension version, which it launched in beta last year, that provides 12 one-hour VPN passes when using the Firefox browser and a Firefox account; and a second, $4.99-a-month option that provides a more complete VPN service across your whole device. The new paid option, which runs off of servers provided by Swedish open-source VPN company Mullvad, can protect up to five devices with one account. It allows for faster browsing and streaming, and gives you the ability to tap into servers located in "30-plus countries" for masking your location data.' -- source: https://news.slashdot.org/story/20/02/19/1910233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Why fixing security vulnerabilities in medical devices, IoT is so hard
by Peter Reutemann 20 Feb '20

20 Feb '20

'When your family opened up that brand-new computer when you were a kid, you didn’t think of all of the third-party work that made typing in that first BASIC program possible. There once was a time when we didn't have to worry about which companies produced all the bits of licensed software or hardware that underpinned our computing experience. But recent malware attacks and other security events have shown just how much we need to care about the supply chain behind the technology we use every day. The URGENT/11 vulnerability, the subject of a Cybersecurity and Infrastructure Security Agency advisory issued last July, is one of those events. It forces us to care because it affects multiple medical devices. And it serves as a demonstration of how the software component supply chain and availability of support can affect the ability of organizations to update devices to fix security bugs—especially in the embedded computing space. URGENT/11 is a vulnerability in the Interpeak Networks TCP/IP stack (IPNet), which was licensed out to multiple vendors of embedded operating systems. IPNet also became the main networking stack in Wind River VxWorks, until Wind River acquired Interpeak in 2006 and stopped supporting IPNet. (Wind River itself was acquired by Intel in 2009 and spun off in 2018.) But the end of support didn’t stop several other manufacturers from continuing to use IPNet. When critical bugs were discovered in IPNet, it set off a scare among the numerous medical device manufacturers that run it as part of their product build.' -- source: https://arstechnica.com/information-technology/2020/02/medical-device-vulne… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 73 Attack Dog
by Lawrence D'Oliveiro 19 Feb '20

19 Feb '20

Did my roughly-monthly update of Debian Unstable yesterday, and got yet another new version of Firefox. Quite sobering to see the extra protections being triggered now, on sites that I regularly visit. I got a warning earlier today about fingerprinters on aljazeera.com, though on revisiting the site a minute ago these no longer show up. Still an amazing number of cross-site tracking cookies, also present on arstechnica.com. The report for the latter shows a couple of fingerprinters currently being blocked, even though I got no explicit warning about that. It also says that “cryptominers” are blocked by default, but when I visited a certain well-known torrent-search site which has a policy of mining bitcoins on users’ machines, it didn’t show any present on that site, even though I could still hear my machine’s fans cranking up from the increased CPU load (which went away when I closed that tab).

1 0

Google Confirms It Again Removed Alleged Spying Tool ToTok From Google Play
by Peter Reutemann 18 Feb '20

18 Feb '20

'Google has confirmed that the popular messaging app ToTok, which is actually a spying tool used by the United Arab Emirates to track the activities of those who download it, has again been removed from the Play Store. But this time they declined to comment as to why. TechCrunch reports: Reached for comment, Google confirmed to TechCrunch that it removed the app from Google Play. In addition, Google noted the enforcement was not done in response to any external direction or request. That means the U.S. government did not get involved here, rather that Google chose to remove the app itself -- likely for a policy violation. According to The NYT's original report, ToTok had been downloaded millions of times from both Apple and Google's app stores by customers across the Middle East, Europe, Asia, Africa and North America in the few months since its launch. Citing unnamed U.S. intelligence sources, the report claimed the app had been used to track its users' "every conversation, movement, relationship, appointment, sound, and image." At the time of the app's removal, Google said the app had violated unspecified Google Play policies. The app had over 10 million installs by then, app intelligence firm Sensor Tower says. In January, ToTok's website announced the app was again available for download. The updated version submitted to Google Play included a new dialog that requested authorization to access and sync users' contact list, Vice reported. Oddly, this updated version of ToTok never ranked on Google Play's charts again.' -- source: https://yro.slashdot.org/story/20/02/17/2136251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bug In WordPress Plugin Can Let Hackers Wipe Up To 200,000 Sites
by Peter Reutemann 18 Feb '20

18 Feb '20

'WordPress site owners who use commercial themes provided by ThemeGrill are advised to update one of the plugins that come installed with these themes in order to patch a critical bug that can let attackers wipe their sites. The vulnerability resides in ThemeGrill Demo Importer, a plugin that ships with themes sold by ThemeGrill, a web development company that sells commercial WordPress themes. The plugin, which is installed on more than 200,000 sites, allows site owners to import demo content inside their ThemeGrill themes so they'll have examples and a starting point on which they can build their own sites. However, in a report published yesterday, WordPress security firm WebARX says that older versions of the ThemeGrill Demo Importer are vulnerable to remote attacks from unauthenticated attackers. Remote hackers can send a specially crafted payload to vulnerable sites and trigger a function inside the plugin. The vulnerable function resets the site's content to zero, effectively wiping the content of all WordPress sites where a ThemeGrill theme is active, and the vulnerable plugin is installed. Furthermore, if the site's database contains a user named "admin," then the attacker is granted access to that user with full administrator rights over the site.' -- source: https://it.slashdot.org/story/20/02/17/2111235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux distro review: Intel’s own Clear Linux OS
by Peter Reutemann 18 Feb '20

18 Feb '20

'Intel's Clear Linux distribution has been getting a lot of attention lately, due to its incongruously high benchmark performance. Although the distribution was created and is managed by Intel, even AMD recommends running benchmarks of its new CPUs under Clear Linux in order to get the highest scores. Recently at Phoronix, Michael Larabel tested a Threadripper 3990X system using nine different Linux distros, one of which was Clear Linux—and Intel's distribution got three times as many first-place results as any other distro tested. When attempting to conglomerate all test results into a single geometric mean, Larabel found that the distribution's results were, on average, 14% faster than the slowest distributions tested (CentOS 8 and Ubuntu 18.04.3). There's not much question that Clear Linux is your best bet if you want to turn in the best possible benchmark numbers. The question not addressed here is, what's it like to run Clear Linux as a daily driver? We were curious, so we took it for a spin.' -- source: https://arstechnica.com/gadgets/2020/02/linux-distro-review-intels-own-clea… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Samsung's Changes To Android Are Making Its Phones Less Secure, Says Google
by Peter Reutemann 18 Feb '20

18 Feb '20

'Google scolded Samsung this week for an issue discovered on the Korean phone maker's Galaxy A50. From a report: Google says Samsung made "unnecessary changes to Android's core kernel," adding the changes Samsung made threaten rather than strengthen the phone's security. The tech giant has a vested interest in making sure Android is secure for OEMs and end users alike. Earlier this week Google announced it has made measurable efforts to limit malicious apps on its Google Play Store and it's clamping down on the permissions apps can request, resulting in a 98% reduction in requests for access to user's call history and text messages. It's also been tackling more worrying bugs, like self-reinstalling ones. But in this instance, it's a hardware partner that's causing the problems. In a detailed blog post from Google's Project Zero Team, researcher Jann Honn outlines the exact issue with Samsung's changes to the Android kernel on the A50. Samsung's changes included a security feature to restrict an attacker from reading or modifying user data, but Honn says the move is "futile" and rather than bolstering security, it introduces vulnerabilities that could increase an attacker's ability to arbitrarily execute code.' -- source: https://tech.slashdot.org/story/20/02/17/1656204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday
by Peter Reutemann 17 Feb '20

17 Feb '20

Hi everyone We have a WLUG meeting next Monday: "Michael Cree will demo his Pinebook Pro and talk about his experiences with it, as well as challenges that he has (or still has to) overcome." Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/266791995/ https://gettogether.community/events/3275/wlug-meeting/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Alternative Browser 'Waterfox' Acquired By System1
by Peter Reutemann 17 Feb '20

17 Feb '20

'Waterfox is an open-source web browser for x64, ARM64, and PPC64LE systems, "intended to be speedy and ethical, and maintain support for legacy extensions dropped by Firefox, from which it is forked," according to Wikipedia. (Its tabs also still have angled sides with rounded corners.) Friday Waterfox's original creator, 24-year-old Alexandros Kontos, announced that the browser "now has funding and a development team, so Waterfox can finally start to grow!" after its acquisition by a company called System1. I started Waterfox when I was 16. It was a way for me to understand how large software projects worked and the Mozilla documentation was a great introduction... I've touted Waterfox as an ethical and privacy friendly browser... I never wanted Waterfox to be a part of the hyper-privacy community. It would just feel like standards that would be impossible to uphold, especially for something such as a web browser on the internet. Throughout the years people have always asked about Waterfox and privacy, and if they've ever wanted more than it can afford, I've always pushed them to use Tor. Waterfox was here for customisations and speed, with a good level of privacy... I wasn't doing anything with Waterfox except developing it and making some money via search. Why I kept going throughout the years, I'll never know... System1 has been to Waterfox a search syndication partner. Essentially a way to have a search engine partnership (such as Bing) is through them, because companies such as Microsoft are too big and too busy to talk to small players such as Waterfox... It's probably the one easy way a browser can make money without doing anything dodgy, and it's a way I've been happy to do it without having to compromise Waterfox (and will be the same way System1 makes money from Waterfox -- nothing else). People also don't seem to understand what System1 does... "Now I can finally focus on making Waterfox into a viable alternative to the big browsers," Kontos concludes. Long-time Slashdot reader Freshly Exhumed contextualized the news with this brief history of the alternate browser ecosystem: As the usage share of web browsers continues to show a lopsideded dominance by Google Chrome, many previously-independent browsers have fallen by the wayside or have been reinvented as Chrome variants (i.e. Opera, Edge, Brave). Apple forges on with its Safari browser while other, smaller projects tend to be quite limited for multi-platform users, such as Dolphin and Bromite. Mozilla continues independently with Firefox for almost every platform, while variants such as Pale Moon and Sea Monkey have attempted to provide products that avoid drastic and/or controversial changes made by Mozilla but sometimes do not match the multi-platform support of Firefox. Let us not forget Tor, the Firefox-based anonymity-focused browser. Alex Kontos is a developer who attempted to provide continuity with dropped Firefox capabilities in his multi-platform Waterfox browser, proudly declaring that Firefox's user data sharing and telemetry collection was not included. For that privacy focus a certain popularity of Waterfox occurred. Now Kontos has revealed that his Waterfox project has been sold to System1, a company describing itself as "a consumer internet and applications company with the most powerful audience expansion platform in the industry." ' -- source: https://tech.slashdot.org/story/20/02/16/2146256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Chrome Will Soon Start Blocking Insecure Downloads
by Peter Reutemann 17 Feb '20

17 Feb '20

'"Google has revealed plans to initially warn Chrome users about 'insecure' downloads and eventually block them outright," reports The Verge. The warnings will begin in April: "Today we're announcing that Chrome will gradually ensure that secure (HTTPS) pages only download secure files," Joe DeBlasio of the Chrome security team wrote in a blog post. "Insecurely-downloaded files are a risk to users' security and privacy. For instance, insecurely-downloaded programs can be swapped out for malware by attackers, and eavesdroppers can read users' insecurely-downloaded bank statements." Beginning with Chrome 82, due for release in April, Chrome will warn users if they're about to download mixed content executables from a secure website. Then, when version 83 is released, those executable downloads will be blocked and the warning will be applied to archive files. PDFs and .doc files will get the warning in Chrome 84, with audio, images, text, and video files displaying it by version 85. Finally, all mixed content downloads — a non-secure file coming from a secure site — will be blocked as of the release of Chrome 86. Right now, Google is estimating an October release for that build of the popular web browsing.' -- source: https://tech.slashdot.org/story/20/02/16/1926231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Do We Need To Talk About 'Cloud Neutrality'?
by Peter Reutemann 17 Feb '20

17 Feb '20

'"A multibillion-dollar, privately-owned infrastructure is now essential to the modern internet economy," writes Wired. And if you care about net neutrality, "That should freak you out." [T]here's an even bigger issue brewing, and it's time to start talking about it: cloud neutrality. "While its name sounds soft and fluffy," Microsoft president and general counsel Brad Smith and coauthor Carol Ann Browne write in their recent book, Tools and Weapons: The Promise and the Peril of the Digital Age, "in truth the cloud is a fortress...." Each data center costs hundreds of millions of dollars to build and many millions more to maintain; and you pretty much can't build a successful new company without them. So, thank goodness for Microsoft, right? The book means to portray this might and power as both a source of wonder and an enabling feature of the modern economy. To me, it reads like a threat. The cloud economy exists at the pleasure, and continued profit, of a handful of companies. The internet is no longer the essential enabler of the tech economy. That title now belongs to the cloud. But the infrastructure of the internet, at least, was publicly financed and subsidized. The government can set rules about how companies have to interact with their customers. Whether and how it sets and enforces those rules isn't the point, for now. It can. That's not the case with the cloud. This infrastructure is solely owned by a handful of companies with hardly any oversight. [Besides Microsoft, the article also notes Google and Amazon.] The potential for abuse is huge, whether it's through trade-secret snooping or the outright blocking, slowing, or hampering of transmission. No one seems to be thinking about what could happen if these behemoths decide it's against their interests to have all these barnacles on their flanks. They should be. Cloud companies "are essentially incubating and hosting their competition..." the article points out. "The problem is that few have the resources to replicate the cloud infrastructure, should the landlords suddenly turn on their tenants."' -- source: https://tech.slashdot.org/story/20/02/16/1847204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

OpenPower Foundation Releases a Friendly EULA For IBM's Power ISA RISC
by Peter Reutemann 17 Feb '20

17 Feb '20

'Michael Larabel, of Phoronix, writes that the OpenPower Foundation has released a license agreement for Hardware Vendors to implement the Power ISA RISC instruction set in their processors. Hugh Blemings, the Director of OpenPower, was responsible for ensuring that the EULA is favourable and friendly towards Libre and Open Hardware projects and businesses. Of particular interest is that IBM's massive patent portfolio is automatically granted, royalty-free as long as two conditions apply: firstly, the hardware must be fully and properly Power ISA compliant, and secondly, the implementor must not "try it on" as a patent troll. Innovation in the RISC space just got a little more interesting. "Amidst the fully free and open RISC-V ISA making headway into the computing market, and ARM feeling pressured to loosen up its licensing, it seems they figured that it's best to join the party early," argues Hackaday.' -- source: https://news.slashdot.org/story/20/02/16/1743222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox, Wordpress Move to Support Lazy Loading of Images and iFrames
by Peter Reutemann 17 Feb '20

17 Feb '20

'"Lazy Loading" would augment HTML's <img> tag (and <iframe> tag) with two new attributes -- "eager" (to load immediately) and "lazy" (to load only when it becomes relevant in the viewport). Felix Arntz, a developer programs engineer at Google (and a WordPress core committer) notes the updates in the HTML specification for the lazy loading attributes, adding that it's "already supported by several browsers, including Chrome and Edge" and also the Android browser and Opera. And lazy loading can now also be toggled on for Firefox 75 Nightly users, reports Neowin, though it's disabled by default: It's not clear if it will be enabled by the time Firefox 75 reaches the stable branch but according to comments on the Bugzilla thread, it's in high demand. Previously, websites could employ lazy loading by using JavaScript but now lazy loading syntax is supported directly in the web browser. The implementation in Firefox comes after Google added the feature to its browser. Google's Arntz has also written a post describing a proposal to begin lazy-loading images by default in Wordpress. The proposed solution is available as a feature plugin WP Lazy Loading in the plugin repository. The plugin is being developed on GitHub. Your testing and feedback will be much appreciated.' -- source: https://news.slashdot.org/story/20/02/16/0229240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FSF Sends Microsoft A Blank Hard Drive For Sending Back The Windows 7 Source Code
by Peter Reutemann 16 Feb '20

16 Feb '20

'The Free Software Foundation sent Microsoft a hard drive for Valentine's Day -- along with a petition calling for the release of the source code for Windows 7 (which is no longer supported by Microsoft): It's as easy as copying the source code, giving it a license notice, and mailing it back to us. As the author of the most popular free software license in the world, we're ready to give them all of the help we can. All they have to do is ask. We want them to show exactly how much love they have for the "open source" software they mention in their advertising. If they really do love free software -- and we're willing to give them the benefit of the doubt -- they have the opportunity to show it to the world. We hope they're not just capitalizing on the free software development model in the most superficial and exploitative way possible: by using it as a marketing tool to fool us into thinking that they care about our freedom. Together, we've stood up for our principles. They can reject us, or ignore us, but what they cannot do is stop us. We'll go on campaigning, until all of us are free.' -- source: https://tech.slashdot.org/story/20/02/15/0213242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linux is Ready for the End of Time
by Peter Reutemann 16 Feb '20

16 Feb '20

'January 19, 2038 is for Linux what Y2K was for mainframe and PC computers in 2000, reports ZDNet. It's the day that the value for time "runs out of numbers" and, in the case of 32-bit Unix-based operating systems like Linux and older versions of macOS, "starts counting time with negative numbers..." "But the fixes are underway to make sure all goes well when that fatal time rolls around." nickwinlund77 shared their report: Linux developers have seen this coming for decades. So, Linux kernel developer Arnd Bergmann and others have been working on a repair. These corrections are now in the forthcoming Linux 5.6 kernel. Bergmann explained, "Linux-5.6, or my backport of the patches to 5.4, should be the first release that can serve as a base for a 32-bit system designed to run beyond year 2038." There are some caveats: - All user space must be compiled with a 64-bit time_t, which will be supported in the coming musl-1.2 and glibc-2.32 releases, along with installed kernel headers from Linux-5.6 or higher. - Applications that use the system call interfaces directly need to be ported to use the time64 syscalls added in Linux-5.1 in place of the existing system calls. - Applications that use a private copy of kernel uapi header files or their contents may need to update to the Linux-5.6 version. - A few remaining interfaces cannot be changed to pass a 64-bit time_t in a compatible way, so they must be configured to use CLOCK_MONOTONIC times... After we fix this, we won't have to worry about 64-bit Linux running out of seconds until 15:30:08 GMT Sunday, December 4, 29,227,702,659. Personally, I'm not going to worry about that one.' -- source: https://linux.slashdot.org/story/20/02/15/0247201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Signal Is Finally Bringing Its Secure Messaging To the Masses
by Peter Reutemann 15 Feb '20

15 Feb '20

'[Cryptographer and coder known as Moxie Marlinspike] has always talked about making encrypted communications easy enough for anyone to use. The difference, today, is that Signal is finally reaching that mass audience it was always been intended for -- not just the privacy diehards, activists, and cybersecurity nerds that formed its core user base for years -- thanks in part to a concerted effort to make the app more accessible and appealing to the mainstream. That new phase in Signal's evolution began two years ago this month. That's when WhatsApp cofounder Brian Acton, a few months removed from leaving the app he built amid post-acquisition clashes with Facebook management, injected $50 million into Marlinspike's end-to-end encrypted messaging project. Acton also joined the newly created Signal Foundation as executive chairman. The pairing up made sense; WhatsApp had used Signal's open source protocol to encrypt all WhatsApp communications end-to-end by default, and Acton had grown disaffected with what he saw as Facebook's attempts to erode WhatsApp's privacy. Since then, Marlinspike's nonprofit has put Acton's millions -- and his experience building an app with billions of users -- to work. After years of scraping by with just three overworked full-time staffers, the Signal Foundation now has 20 employees. For years a bare-bones texting and calling app, Signal has increasingly become a fully featured, mainstream communications platform. With its new coding muscle, it has rolled out features at a breakneck speed: In just the last three months, Signal has added support for iPad, ephemeral images and video designed to disappear after a single viewing, downloadable customizable "stickers," and emoji reactions. More significantly, it announced plans to roll out a new system for group messaging, and an experimental method for storing encrypted contacts in the cloud. Many of those features might sound trivial. They certainly aren't the sort that appealed to Signal's earliest core users. Instead, they're what Acton calls "enrichment features." They're designed to attract normal people who want a messaging app as multifunctional as WhatsApp, iMessage, or Facebook Messenger but still value Signal's widely trusted security and the fact that it collects virtually no user data. Wired explains how adding simple-sounding enhancements can require significant feats of security engineering to fit within Signal's privacy constraints. Adding downloadable customizable stickers, for example, "required designing a system where every sticker 'pack' is encrypted with a 'pack key,'" reports Wired. "That key is itself encrypted and shared from one user to another when someone wants to install new stickers on their phone, so that Signal's server can never see decrypted stickers or even identify the Signal user who created or sent them." For Signal's new group messaging, Signal partnered with Microsoft Research to invent a novel form of "anonymous credentials" that let a server gatekeep who belongs in a group, but without ever learning the members' identities.' -- source: https://it.slashdot.org/story/20/02/14/2216214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

UK West Midlands Police Warn Against Evils Of Kali Linux
by Lawrence D'Oliveiro 15 Feb '20

15 Feb '20

A poster was recently issued <https://www.theregister.co.uk/2020/02/14/silly_police_infosec_parental_advi…> by the West Midlands Regional Organised Crime Unit, also bearing the logo of the National Crime Agency, warning parents to watch out for certain signs of delinquency on their children’s computer, such as use of virtual machines, Kali Linux, Discord and various other things. The NCA have disavowed any knowledge of the poster.

1 0

An Old Android Virus is Reinstalling Itself Even After Factory Resets
by Peter Reutemann 14 Feb '20

14 Feb '20

'A particularly persistent malware infection has been spreading amongst Android phones -- and removing it only seems to bring it back with a vengeance. From a report: The Trojan xHelper, which Malwarebytes first wrote about last year, is reportedly re-spawning on devices where it's already been removed. If virus-removal software doesn't take care of a nasty infection, a hard reset will usually do the trick. But users report that even a full factory reset of an infected device doesn't wipe xHelper out completely. Within an hour the malware is usually back and ready to wreak havoc.' -- source: https://it.slashdot.org/story/20/02/13/1745252 The above news article has a link on how to remove it. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

500 Chrome Extensions Secretly Uploaded Private Data From Millions of Users
by Peter Reutemann 14 Feb '20

14 Feb '20

'More than 500 browser extensions downloaded millions of times from Google's Chrome Web Store surreptitiously uploaded private browsing data to attacker-controlled servers, researchers said on Thursday. Ars Technica reports: The extensions were part of a long-running malvertising and ad-fraud scheme that was discovered by independent researcher Jamila Kaya. She and researchers from Cisco-owned Duo Security eventually identified 71 Chrome Web Store extensions that had more than 1.7 million installations. After the researchers privately reported their findings to Google, the company identified more than 430 additional extensions. Google has since removed all known extensions. "In the case reported here, the Chrome extension creators had specifically made extensions that obfuscated the underlying advertising functionality from users," Kaya and Duo Security Jacob Rickerd wrote in a report. "This was done in order to connect the browser clients to a command and control architecture, exfiltrate private browsing data without the users' knowledge, expose the user to risk of exploit through advertising streams, and attempt to evade the Chrome Web Store's fraud detection mechanisms." The extensions were mostly presented as tools that provided various promotion- and advertising-as-a service utilities. In fact, they engaged in ad fraud and malvertising by shuffling infected browsers through a maze of sketchy domains. Each plugin first connected to a domain that used the same name as the plugin (e.g.: Mapstrek[.]com or ArcadeYum[.]com) to check for instructions on whether to uninstall themselves. The plugins then redirected browsers to one of a handful of hard-coded control servers to receive additional instructions, locations to upload data, advertisement feed lists, and domains for future redirects. Infected browsers then uploaded user data, updated plugin configurations, and flowed through a stream of site redirections. The researchers say the campaign dates back to at least January 2019, but it's possible that the operators were active "as early as 2017."' -- source: https://yro.slashdot.org/story/20/02/13/2355237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Announces Windows 10X
by Lawrence D'Oliveiro 13 Feb '20

13 Feb '20

A report <https://www.theregister.co.uk/2020/02/12/microsoft_previews_windows_10x/> on major new changes coming to the architecture of Microsoft Windows. This includes locking up all Win32 apps, that is to say the majority of Windows apps (now considered “legacy”), in a sandbox where they are strictly limited in what they can do to your OS, and even your documents. Access by the user to these apps is constrained through a channel very similar to RDP, which is normally only used for remote access. Interesting to see that, in 2020, Microsoft is still battling “OS rot”, which computer humourist Verity Stob was making fun of nearly two decades ago.

1 0

KDE Plasma 5.18 Released
by Peter Reutemann 12 Feb '20

12 Feb '20

'The KDE community today announced the release of Plasma 5.18. This version of the popular desktop environment is the latest long-term supported release and brings an emoji selector, user feedback capabilities, a global edit mode, and improvements to System Settings, the Discover software manager, widgets, GTK integration and much more.' -- source: https://news.slashdot.org/story/20/02/11/224207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 73 Arrives With Default Zoom Level and Readability Backplate
by Peter Reutemann 12 Feb '20

12 Feb '20

'Mozilla today released Firefox 73 for Windows, Mac, Linux, and Android. Firefox 73 includes a default zoom level setting, a readability backplate option, and a handful of developer features.' -- source: https://news.slashdot.org/story/20/02/11/1953208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

One of the most destructive botnets can now spread to nearby Wi-Fi networks
by Peter Reutemann 12 Feb '20

12 Feb '20

'Over the past half decade, the Emotet malware has emerged as a top Internet threat that pillages people’s bank accounts and installs other types of malware. The sophistication of its code base and its regularly evolving methods for tricking targets into clicking on malicious links—in September, for instance, it began a spam run that addresses recipients by name and quotes past emails they sent or received—has allowed it to spread widely. Now, Emotet is adopting yet another way to spread: using already compromised devices to infect devices connected to nearby Wi-Fi networks. World’s most destructive botnet returns with stolen passwords and email in tow Last month, Emotet operators were caught using an updated version that uses infected devices to enumerate all nearby Wi-Fi networks. It uses a programming interface called wlanAPI to profile the SSID, signal strength, and use of WPA or other encryption methods for password-protecting access. Then, the malware uses one of two password lists to guess commonly used default username and password combinations. After successfully gaining access to a new Wi-Fi network, the infected device enumerates all non-hidden devices that are connected to it. Using a second password list, the malware then tries to guess credentials for each user connected to the drive. In the event no connected users are infected, the malware tries to guess the password for the administrator of the shared resource.' -- source: https://arstechnica.com/information-technology/2020/02/one-of-the-most-dest… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bash Insulter
by Lawrence D'Oliveiro 12 Feb '20

12 Feb '20

How would you like your shell (Bash or Zsh) to insult you every time you typed a wrong command? You need wait no longer, just install this <https://gitlab.com/dwt1/bash-insulter>. Of course, the insults list is customizable. The guy who wrote it also runs the DistroTube channel on YouTube <https://www.youtube.com/channel/UCVls1GmFKf6WlTraIb_IaJg/videos>.

2 1

South Korea's Government Explores Move From Windows To Linux Desktop
by Peter Reutemann 11 Feb '20

11 Feb '20

'In May 2019, South Korea's Interior Ministry announced plans to look into switching to the Linux desktop from Windows. It must have liked what it saw. According to the Korean news site Newsis, the South Korean Ministry of Strategy and Planning has announced the government is exploring moving most of its approximately 3.3 million Windows computers to Linux. The reason for this is simple. It's to reduce software licensing costs and the government's reliance on Windows. As Choi Jang-hyuk, the head of the Ministry of Strategy and Finance, said, "We will resolve our dependency on a single company while reducing the budget by introducing an open-source operating system." How much? South Korean officials said it would cost 780 billion won (about $655 million) to move government PCs from Windows 7 to Windows 10. [...] Windows will still have a role to play for now on South Korean government computers. As the Aju Business Daily, a South Korean business news site, explained: Government officials currently use two physical, air-gapped PCs. One is external for internet use, and the other is internal for intranet tasks. Only the external one will use a Linux-based distro. Eventually, by 2026, most civil servants will use a single Windows-powered laptop. On that system, Windows will continue to be used for internal work, while Linux will be used as a virtual desktop via a Linux-powered cloud server. This looks to eventually end up as a Desktop-as-a-Service (DaaS) model. The report notes that the Ministry of National Defense and National Police Agency are already using the Ubuntu Linux 18.04 LTS-based Harmonica OS 3.0. "Meanwhile, the Korean Postal Service division is moving to TMaxOS," reports ZDNet. "The Debian Linux-based South Korean Gooroom Cloud OS is also being used by Defense and the Ministry of Public Administration and Security."' -- source: https://linux.slashdot.org/story/20/02/10/2133246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Companies That Buy Data Derived From Scraping the Contents of Your Email Inbox
by Peter Reutemann 11 Feb '20

11 Feb '20

'The popular Edison email app, which is in the top 100 productivity apps on the Apple app store, scrapes users' email inboxes and sells products based off that information to clients in the finance, travel, and e-Commerce sectors. The contents of Edison users' inboxes are of particular interest to companies who can buy the data to make better investment decisions, according to a J.P. Morgan document obtained by Motherboard. On its website Edison says that it does "process" users' emails, but some users did not know that when using the Edison app the company scrapes their inbox for profit. Motherboard has also obtained documentation that provides more specifics about how two other popular apps -- Cleanfox and Slice -- sell products based on users' emails to corporate clients. Some of the companies listed in the J.P. Morgan document sell data sourced from "personal inboxes," the document adds. A spokesperson for J.P. Morgan Research, the part of the company that created the document, told Motherboard that the research "is intended for institutional clients." That document describes Edison as providing "consumer purchase metrics including brand loyalty, wallet share, purchase preferences, etc." The document adds that the "source" of the data is the "Edison Email App." On the product section of its website, Edison offers "Edison Trends" and "Trends Direct." The company says it can provide "Detailed behavior patterns to improve your customers' experience and business results." Edison is just one of several companies that offer free email apps which then sell anonymized or pseudonymized data derived from users' inboxes. Another company that mines inboxes called Foxintelligence has data that comes from users of the Cleanfox app, which tidies up users' inboxes. Some of the "examples of clients" mentioned in a confidential Foxintelligence presentation include PayPal, consulting giants Bain & Company, and McKinsey & Company. "A spreadsheet containing data from Rakuten's Slice, an app that scrapes a user's inbox so they can better track packages or get their money back once a product goes down in price, contains the item that an app user bought from a specific brand, what they paid, and an unique identification code for each buyer," adds Motherboard. "An email obtained by Motherboard appeared to show the price for access to Rakuten data for one product category as over $100,000."' -- source: https://yro.slashdot.org/story/20/02/10/2158242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Windows 10 Start Menu Now Harasses Firefox Users
by Peter Reutemann 11 Feb '20

11 Feb '20

'The "Suggested" section on the Windows 10 Start Menu used to just promote its own apps, reports MSPowerUser. But for some users (who haven't disable Microsoft's "Suggestions"), that menu is now showing a new kind of ad listing: The listing displays "Still using Firefox? Microsoft Edge is here", to all users of the former -- even with the latter already installed. The ad provides a link to download the chromium-based browser. Undoubtedly, the suggestions won't end here. Microsoft is reportedly planning to sprawl similar ads out to Wordpad, to encourage users to download official Office apps. The Windows Latest blog points out that Microsoft's "Suggestions" can be "permanently disabled with a few tweaks unlike the Chrome ads in Google search results."' -- source: https://news.slashdot.org/story/20/02/10/0014245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Suspicion and Anger Towards Microsoft Rises After Windows 10 Search Failure
by Peter Reutemann 10 Feb '20

10 Feb '20

'Earlier this week, searching in Windows 10 was broken, "with a black bar showing where search results should be, even for those who tried to perform a local search of their files." Microsoft issued a fix and blamed the issue on a "third-party networking fiber provider". But unfortunately, Microsoft's fix isn't working for everyone -- and that's just the beginning. Long-time Slashdot reader Futurepower(R) shares Forbes' report: Second, and more worryingly, Microsoft's explanation doesn't add up and it has prompted serious questions to be asked about how the operating system works and what personal data it is sharing. Popular Microsoft pundit Woody Leonard led the charge, writing: "If you believe that yesterday's worldwide crash of Windows 10 Search was caused by a bad third-party fiber provider, I have a bridge to sell you." In an open letter to new Windows head Panos Panay, Susan 'Patch Lady' Bradley was similarly sceptical, noting that today "we all found out that our local search boxes are somehow dependent on some service working at Microsoft." She attacked the company for a lack of transparency and gave it a maximum 'Pinocchio score' for a lack of trust... Similarly, Engadget writer Richard Lawler revealed that users were now trying to hack the Windows 10 registry to disconnect their local file searches from Microsoft servers "and I can't say I blame them after this episode. Microsoft owes users a better explanation than this and should make sure it's impossible for offline features to get taken out when the cloud is having an issue." In fact, Forbes writes that "the aforementioned Windows 10 registry hack appears to be the only 100% fix for this issue and it also disconnects Bing and Cortana online services from Windows 10 search." And then on Saturday the Windows Latest blog also noticed that Microsoft's release notes for Windows 10 20H1 Build 19035 reveal that Microsoft is apparently now delaying the roll-out of a widely-anticipated "Optional Updates" option. "It appears that the new Optional updates experience will come out in October/November 2020, not this spring as previously planned."' -- source: https://tech.slashdot.org/story/20/02/09/2241212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel's 'Clear Linux' Distro Beats Ubuntu and Windows 10 -- on an AMD Laptop
by Peter Reutemann 10 Feb '20

10 Feb '20

'Intel's Clear Linux distribution looks like it could be the best operating system to run on cheap AMD hardware, with benchmarks showing it outperforms Windows 10 and Ubuntu on a $199 laptop with a budget AMD Ryzen 3200U processor. The Phoronix website ran a series of benchmarks on a super-cheap AMD laptop from Walmart, and found that Intel Clear Linux beat popular Linux distros Fedora and Ubuntu for 78% of the tests. Not only is it remarkable that a relatively unknown Linux distro is so easily outperforming established operating systems, the fact that Intel is the company behind the distro is particularly ironic. As you can imagine, Clear Linux is optimized for Intel processors, but it seems like it works brilliantly on AMD hardware as well.' -- source: https://linux.slashdot.org/story/20/02/08/1849207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Almost Every Website You Visit Records Exactly How Your Mouse Moves
by Peter Reutemann 09 Feb '20

09 Feb '20

'Medium's technology blog OneZero reports that many websites today use a service that collects all of your mouse movements, enabling "replays" of every move. "What surprised me was that the software even recorded when I shook my mouse around while deciding what to click on. It felt like observing digital body language." Session replay services have been around for over a decade and are widely used. One service, called FullStory, lists popular sites like Zillow, TeeSpring, and Jane as clients on its website. Another, called LogRocket, boasts Airbnb, Reddit, and CarFax, and a third called Inspectlet lists Shopify, ABC, and eBay among its users. They bill themselves as tools for designing sites that are easy to use and increase desired user behavior, such as buying an item. If many users add items to their cart, but then abandon the purchase at a certain rough part of the checkout process, for instance, the service helps site owners figure out how to change the site's design to nudge users over the checkout line... FullStory even has a feature that tracks what it calls "rage clicks." This is when a user gets frustrated with a site and starts angrily clicking over and over. In a semi-related story, a reporter for The Markup also recently discovered Amazon had apparently collected 90,000 rows of timestamped data about every tap they'd made on their Kindle.' -- source: https://yro.slashdot.org/story/20/02/08/002242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Elementary OS Wants to Crowdfund a Better Distro-Independent 'AppCenter for Everyone'
by Peter Reutemann 09 Feb '20

09 Feb '20

'In 2017 Elementary OS built a pay-what-you-want app store -- funded with $10,000 raised on IndieGogo. Now they're trying to raise another $10,000 for a one-week, in-person sprint in Denver, Colorado, Forbes reports, to upgrade the store while bringing an even grander concept to reality: That concept comprises 4 main goals: - Enable open source developers to monetize their apps on every other Linux distribution - Empower developers to ship apps with cutting-edge technologies - Improve privacy, security, and stability - Streamline the payments process On the technical side of things, the team plans to rebuild AppCenter's backend from the ground up to enable newer technologies developers are asking for, and they're rallying behind the Flatpak packaging format to get it done. They've already been collaborating with the FlatHub team, and plan to bring in developers from Endless and GNOME to ensure that "our solution can be reused and improved by other Flatpak stores and the greater open source desktop ecosystem." For a donation of $10, "you'll have your name immortalized in the AppCenter code on GitHub," explains a promotional video. (There's already 70 backers who have claimed this perk.) In fact, "Less than 8 hours ago we launched #AppCenterForEveryone, and we're 50% funded," announced an update Friday on Twitter. The campaign's web page shared this note of appreciation. "With your support, we'll be able to accelerate the timeline on adopting cutting edge technology and making an even more competitive Open Source operating system and a compelling foundation for all Flatpak stores."' -- source: https://linux.slashdot.org/story/20/02/08/1813251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Security In 2020: Revisited
by Lawrence D'Oliveiro 08 Feb '20

08 Feb '20

Security guru Bruce Schneier revisits <https://www.schneier.com/blog/archives/2020/02/security_in_202_1.html> an essay he wrote 10 years ago, looking ahead in security-related computing trends. If you can stomach the neologisms: Trend over the decade up to 2010: * deperimeterization -- the realization that securing the boundary isn’t enough, you have to have defence in depth. Also known as “submarine warfare”. Trends already becoming apparent in 2010: * consumerization -- the idea that computing needs in workplaces will be following the trends in consumer devices, not leading them * decentralization -- or rather, recentralization in the cloud Trends he forecast in 2010: * deconcentration -- the replacement of general-purpose computers with special-purpose devices. But he also includes special-purpose apps installed on more general-purpose devices like smartphones. * decustomerization -- the idea that we get more of our IT functionality without any business relationship. But beware the maxim: “if you’re not paying for the product, then you are the product”. Also this has been tried with hardware before without success, but he thinks it’s something that will be tried again. * depersonization -- software agents taking decisions on your behalf. Gadgets in your house (and your car) won’t even need you to manage them.

1 0

Google Fixes No-User-Interaction Bug In Android's Bluetooth Component
by Peter Reutemann 08 Feb '20

08 Feb '20

'Google has patched this week a critical security flaw in Android's Bluetooth component. If left unpatched, the vulnerability can be exploited without any user interaction and can even be used to create self-spreading Bluetooth worms. Researchers said that exploiting the bug requires no user interaction. All that is required is that the user has Bluetooth enabled on his device. However, while this requirement would have limited the attack surface in past years, it does not today since modern Android OS versions ship with Bluetooth enabled by default and many Android users use Bluetooth-based headphones meaning the Bluetooth service is likely to be enabled on many handsets. The bug can lead to remote code execution and the hijacking of a device. Fixes for the bug are available via the Android February 2020 Security Bulletin, which has been available for download starting this week. Android 9 and earlier are impacted.' -- source: https://tech.slashdot.org/story/20/02/07/0220203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Testing Disk Performance With fio
by Lawrence D'Oliveiro 07 Feb '20

07 Feb '20

Intro to a tool I hadn’t heard of before <https://arstechnica.com/gadgets/2020/02/how-fast-are-your-disks-find-out-th…>, but for which standard packages are available for Debian and derivatives. Lets you do all kinds of performance tests on your persistent storage (disks, SSDs), including hammering them with multiple concurrent I/O requests. Also I see Debian has “gfio”, which is a GUI front end based on GTK. (Just a quick *sigh* to see someone else use the old cliché of referring to magnetic media as “rust”. FYI, rust isn’t magnetic.)

2 1

Google Does Badly
by Lawrence D'Oliveiro 04 Feb '20

04 Feb '20

Kind of fun to read this report <https://www.aljazeera.com/ajimpact/alphabet-shares-fall-google-misses-sales…>, saying Google’s parent company Alphabet had its “worst fourth-quarter revenue growth since 2015”. Then you look at the numbers, showing ad revenue was up about 17% year-on-year, and while costs also went up: That left profit of $10.67bn, or $15.35 per share, compared with the analysts' average estimate of $8.787bn, or $12.53 per share. That’s right, Google was substantially *more* profitable than analysts were expecting. And yet its share price still apparently fell 3% after the news came out. That’s Wall Street for you...

1 0

A Reminder Of Why Removable Disk Packs Went Out Of Fashion
by Lawrence D'Oliveiro 04 Feb '20

04 Feb '20

Tricky things, removeable storage devices. Requiring fine tolerances between medium and drive is just asking for trouble. Here <https://www.theregister.co.uk/2020/02/03/who_me/> is a story of how a crash in one removeable 1960s-era unit ended up destroying a whole string of disk drives. I can remember also reading, in an old Computer Centre bulletin from an Australian university archived on Bitsavers, an item on their policy on removeable drive cartridges: you could only use cartridges allocated by them, you were not allowed to bring in cartridges from elsewhere. A similar thing happened to me, when the Zip drive in my 1998-vintage PowerMac G3 developed the infamous “click of death”, I only killed a couple of cartridges before I realized I should never use that drive again. Nowadays we have SD cards and hot-pluggable USB drives, which are a bit more robust against such failure modes. Or are they ... ?

1 0

Google Maps Hacks, Or, A Traffic Jam In A Cart
by Lawrence D'Oliveiro 04 Feb '20

04 Feb '20

A German artist named Simon Weckert has tricked Google Maps into thinking a major traffic jam was going on, simply by pulling a cart full of old mobile phones around Berlin <https://www.theregister.co.uk/2020/02/03/google_maps_hack_cartful_phones/>.

1 0

Cringely Predicts IBM 'Disappears Into Red Hat'
by Peter Reutemann 03 Feb '20

03 Feb '20

'Tech pundit Robert X. Cringely has been sharing technology predictions every January for over two decades -- and he made another big one on Friday: IBM has three divisions — Global Technology Services (GTS), Global Business Services (GBS), and Red Hat. GTS is the legacy IT business, GBS is the professional services business invented by Lou Gerstner to save IBM the last time it was in huge trouble, and Red Hat is Linux. GTS — that part of IBM most of us still think of as IBM — will probably be sold by summer. Either it will go to private equity (depends on the total debt load) or it will be sold to HPE or maybe to Oracle. Either way, it's not a likely success story, but [current CEO Ginni] Rometty has no real choice. IBM is, at this point, smoke, mirrors, and buybacks. The GTS windfall will land in Ginni's final quarter, juicing her payout, which might be the major point of the deal... IBM's new CEO is Arvind Krishna, formerly head of the Cognitive Computing unit — IBM's cloud guy. Except Cognitive Computing was never really cloud. Cognitive has been a mishmash of cloud, supported by revenue streams that are anything but cloud. It's cloud in name only and will be the part that goes next summer, possibly with Mr. Krishna still at its head. The next chairman of IBM after Rometty will be current Red Hat CEO Jim Whitehurst. If Whitehurst is as smart as I think he is, he started yesterday looking for a new job. It's not that he really intends to leave, but as the next savior of IBM, Ginni et al will pay anything to keep him. Cut your new deal now, Jim, while demand is greatest....Whitehurst will turn IBM into Red Hat, which will take HQ to North Carolina and mean most of the remaining GBS staff will be gone in a year... It still won't save IBM. They'll go down in the coming year or two along with the rest of the industry we used to call IT... Let's just say that IBM's loss is AWS's gain.' -- source: https://linux.slashdot.org/story/20/02/02/0448233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

MIT Numerical Courses Moving From MATLAB To Julia
by Lawrence D'Oliveiro 03 Feb '20

03 Feb '20

Came across this <https://github.com/mitmath/julia-mit> repo, which is an intro to the Julia language. Apparently this is increasingly being used in place of MATLAB in numerical-computation courses at MIT. Why not Python? Because it is fine as long as you can use existing computational kernels, but as soon as you need custom ones, it gets slow if you do them in Python, or requires special skills to write them in C or Fortran, and make them callable from Python. Julia incorporates a “just-in-time” compiler using LLVM to achieve speed close to that of C in this case. Why not MATLAB? Because it is proprietary: Unlike Matlab, [Julia] is free/open-source software, which eliminates licensing headaches and allows you to look inside the Julia implementation to see how it works (since Julia is mostly written in Julia, its code is much more readable than a language like Python that is largely implemented in low-level C). They do like using Julia in Jupyter notebooks. I see a few .ipynb files in the repos for other courses (along with a few .pptx ones as well, unfortunately). Also several “.jmd” files, which look like some variety of markdown.

2 1

The State Of Video Streaming In NZ
by Lawrence D'Oliveiro 03 Feb '20

03 Feb '20

Apple’s TV+ streaming service is coming soon, followed by Disney’s one <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=122666…>. Note: Disney+ will break Sky's longtime near-monopoly on Disney content in these parts. Disney says that, ultimately, Disney+ will be the exclusive home of its content. So to get a comparable range of TV content to that you currently have free-to-air, you are going to have to subscribe to two or three or maybe more different streaming services. The increasing multitude of things to pay for isn’t about choice, but about no choice at all.

1 2

Should Huawei Just Abandon Android?
by Peter Reutemann 03 Feb '20

03 Feb '20

'Due to a U.S. government ban on sales to Huawei, Google revoked its license for popular apps last spring (including Gmail and the Play Store). But this week Huawei executive Fred Wangfei suggested that even if that ban is lifted, Huawei would continue developing its own app ecosystem instead to avoid the possibility of future political complications. The vice president of risk management and partner relations at Huawei later called those remarks "incorrect," while elsewhere Huawei issued a slightly different statement -- that "An open Android ecosystem is still our first choice, but if we are not able to continue to use it, we have the ability to develop our own." But BGR was already noting that Huawei "is ready to invest $3 billion this year to incentivize more than 4,000 developers to improve its Huawei Mobile Services system. Another billion is reserved for marketing purposes." And Android Authority suggests Huawei should stick to its original statement. "Maybe it's time for Huawei to go all-in on Harmony OS and do what it can to bring a viable alternative to Android and iOS..." If there's any company today that has the financial resources and raw talent necessary to bring in a viable third choice for smartphone operating systems, it's Huawei... Sure, it would be a long-term investment and there would inevitably be short-term losses as the company tries to find its footing and develop Harmony OS to have its own identity. But it would prevent something like the Huawei ban from happening to the company again as well as further the company's ambitions as not only a smartphone manufacturer but as a technology creator.... Huawei would have major difficulties in encouraging wide adoption of Harmony OS for one major reason: it's Huawei. The Huawei ban exists because the United States government doesn't trust Huawei and there are numerous (as yet unproven) accusations against the company related to espionage, IP theft, fraud, and even violations of international treaties... Huawei is already in a bad situation. It's going to need to dig itself out of the hole it's in regardless, so why not use this opportunity to turn lemons into lemonade and develop Harmony OS as a viable third option on the way? Maybe the industry needs a shake-up... Maybe a new operating system is just the kind of fire OEMs need to turn the market around. Maybe a real, potent threat that the billions of people who use Android and iOS just might jump ship to something else would scare companies into taking some real risks. As I said earlier, there aren't too many companies out there right now that could do this, but Huawei could. ' -- source: https://tech.slashdot.org/story/20/02/01/0152225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linus Torvalds Pulls WireGuard VPN into Linux 5.6 Kernel Source Tree
by Peter Reutemann 02 Feb '20

02 Feb '20

'"The WireGuard VPN protocol will be included into the next Linux kernel as Linus Torvalds has merged it into his source tree for version 5.6," reports TechRadar: While there are many popular VPN protocols such as OpenVPN, WireGuard has made a name for itself by being easy to configure and deploy as SSH... The WireGuard protocol is a project from security researcher and kernel developer Jason Donenfeld who created it as an alternative to both IPsec and OpenVPN. Since the protocol consists of around just 4,000 lines of code as opposed to the 100,000 lines of code that make up OpenVPN, it is much easier for security experts to review and audit for vulnerabilities. While WireGuard was initially released for the Linux kernel, the protocol is now cross-platform and can be deployed on Windows, macOS, BSD, iOS and Android. Ars Technica notes that with Linus having merged WireGuard into the source tree, "the likelihood that it will disappear between now and 5.6's final release (expected sometime in May or early June) is vanishingly small." WireGuard's Jason Donenfeld is also contributing AVX crypto optimizations to the kernel outside the WireGuard project itself. Specifically, Donenfeld has optimized the Poly1305 cipher to take advantage of instruction sets present in modern CPUs. Poly1305 is used for WireGuard's own message authentication but can be used outside the project as well — for example, chacha20-poly1305 is one of the highest-performing SSH ciphers, particularly on CPUs without AES-NI hardware acceleration. Other interesting features new to the 5.6 kernel will include USB4 support, multipath TCP, AMD and Intel power management improvements, and more.' -- source: https://it.slashdot.org/story/20/02/01/1846256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

OpenBSD Mail Server Bug Allowed Remotely Executing Shell Commands As Root
by Peter Reutemann 02 Feb '20

02 Feb '20

'This week a remotely-exploitable vulnerability (granting root privileges) was discovered in OpenSMTPD (OpenBSD's implementation of server-side SMTP). ZDNet notes that the library's "portable" version "has also been incorporated into other OSes, such as FreeBSD, NetBSD, and some Linux distros, such as Debian, Fedora, Alpine Linux, and more." To exploit this issue, an attacker must craft and send malformed SMTP messages to a vulnerable server... OpenSMTPD developers have confirmed the vulnerability and released a patch earlier Wednesday -- OpenSMTPD version 6.6.2p1... The good news is that the bug was introduced in the OpenSMTPD code in May 2018 and that many distros may still use older library versions, not affected by this issue. For example, only in-dev Debian releases are affected by this issue, but not Debian stable branches, which ship with older OpenSMTPD versions. Technical details and proof of concept exploit code are available in the Qualys CVE-2020-7247 security advisory. Hackaday has a more detailed description of the vulnerability, while the Register looks at the buggy C code. Interestingly, Qualys researchers exploited this vulnerability using a technique from the Morris Worm of 1988.' -- source: https://it.slashdot.org/story/20/02/01/2254237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Moves To Monetize Thunderbird, Transfers Project To New Subsidiary
by Peter Reutemann 31 Jan '20

31 Jan '20

'The Mozilla Foundation announced today that it was moving its Thunderbird email client to a new subsidiary named the MZLA Technologies Corporation. From a report: Mozilla said that Thunderbird will continue to remain free and open source, but by moving the project away from its foundation into a corporate entity they will be able to monetize the product and pay for its development easier than before. Currently, Thunderbird is primarily being kept alive through charitable donations from the product's userbase. "Moving to MZLA Technologies Corporation will not only allow the Thunderbird project more flexibility and agility, but will also allow us to explore offering our users products and services that were not possible under the Mozilla Foundation," said Philipp Kewisch, Mozilla Product Manager. "The move will allow the project to collect revenue through partnerships and non-charitable donations, which in turn can be used to cover the costs of new products and services," Kewisch added.' -- source: https://tech.slashdot.org/story/20/01/29/1430253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

64-Bit Times On 32-Bit Linux
by Lawrence D'Oliveiro 31 Jan '20

31 Jan '20

Some more patches have gone into the Linux kernel <https://www.theregister.co.uk/2020/01/30/linux_5_6_2038/> to allow 32-bit builds to deal with times past the year-2038 barrier. Basically the fix involves offering a 64-bit alternative to the original time_t type, without the whole app having to go 64-bit. One point I noticed is that certain filesystems (e.g. ext2, presumably ext3 as well) store on-disk fields with 32-bit timestamps, so if you’re using one of these, you’ll have to reformat the disks as well. And that would apply even if you’re already using a 64-bit OS.

1 0

GetTogether.community - alternative to meetup.com
by Peter Reutemann 30 Jan '20

30 Jan '20

Hi everyone Based on our discussions at the AGM on Monday night... Next year, I'll be advertising our meetings also on GetTogether, a free/open-source alternative to meetup.com. If you've been using meetup.com, please consider helping me test-drive GetTogether by creating an account and joining the WLUG team/group. WLUG is accessible here on GetTogether: https://gettogether.community/waikato-linux-users-group/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

autoremove
by john 29 Jan '20

29 Jan '20

Hi all, At our last meeting Tom was concerned about Linux bloating with surplus files. I have always found this to seldom be the case due to : a. The new download removes the older files or: b. The command autoremove clears the unused kernels and other not required files. eg. john(a)polomint:~$ sudo apt autoremove Reading package lists... Done Building dependency tree Reading state information... Done The following packages will be REMOVED: linux-headers-4.15.0-72 linux-headers-4.15.0-72-generic linux-image-4.15.0-72-generic linux-modules-4.15.0-72-generic linux-modules-extra-4.15.0-72-generic 0 upgraded, 0 newly installed, 5 to remove and 4 not upgraded. After this operation, 332 MB disk space will be freed. Do you want to continue? [Y/n] Cheers John..

1 0

Intel Is Patching Its 'Zombieload' CPU Security Flaw For the Third Time
by Peter Reutemann 28 Jan '20

28 Jan '20

'For the third time in less than a year, Intel has disclosed a new set of vulnerabilities related to the speculative functionality of its processors. On Monday, the company said it will issue a software update "in the coming weeks" that will fix two more microarchitectural data sampling (MDS) or Zombieload flaws. This latest update comes after the company released two separate patches in May and November of last year. Compared to the MDS flaws Intel addressed in those two previous patches, these latest ones have a couple of limitations. To start, one of the vulnerabilities, L1DES, doesn't work on Intel's more recent chips. Moreover, a hacker can't execute the attack using a web browser. Intel also says it's "not aware" of anyone taking advantage of the flaws outside of the lab. In response to complaints of the company's piecemeal approach, Intel said that it has taken significant steps to reduce the danger the flaws represent to its processors. "Since May 2019, starting with Microarchitectural Data Sampling (MDS), and then in November with TAA, we and our system software partners have released mitigations that have cumulatively and substantially reduced the overall attack surface for these types of issues," a spokesperson for the company said. "We continue to conduct research in this area -- internally, and in conjunction with the external research community.' -- source: https://it.slashdot.org/story/20/01/27/2126231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

European Processor Initiative
by Lawrence D'Oliveiro 28 Jan '20

28 Jan '20

Here’s a report <https://www.nextplatform.com/2020/01/27/european-processor-initiative-readi…> on a Europe-wide effort to produce a processor chip for an “exascale” supercomputer. It will have an ARM CPU core, with a RISC-V-based accelerator and a few other special-purpose units on the side. I was intrigued to see mention of an “AI-inspired bfloat16 format”. Floating-point numbers commonly come in 32-bit and 64-bit sizes. There is also a “half-precision” 16-bit format, with reduced precision and dynamic range, commonly used in computer graphics, for example. This new format keeps the full dynamic range of 32-bit floats, at the expense of even further reduced precision. Apparently this works better for various machine-learning algorithms.

1 0

ProtonVPN Open Sources All Its Code
by Peter Reutemann 28 Jan '20

28 Jan '20

'ProtonVPN open sourced its code this week, ZDNet reports: On Tuesday, the virtual private network (VPN) provider, also known for the ProtonMail secure email service, said that the code backing ProtonVPN applications on every system -- Microsoft Windows, Apple macOS, Android, and iOS -- is now publicly available for review in what Switzerland-based ProtonVPN calls "natural" progression. "There is a lack of transparency and accountability regarding who operates VPN services, their security qualifications, and whether they fully conform to privacy laws like GDPR," the company says. "Making all of our applications open source is, therefore, a natural next step." Each application has also undergone a security audit by SEC Consult, which ProtonVPN says builds upon a previous partnership with Mozilla... The source code for each app is now available on GitHub (Windows, macOS, Android, iOS). "As a community-supported organization, we have a responsibility to be as transparent, accountable, and accessible as possible," ProtonVPN says. "Going open source helps us to do that and serve you better at the same time." They're also publishing the results of an independent security audit for each app. "As former CERN scientists, publication and peer review are a core part of our ethos..." the company wrote in a blog post. They also point out that Switzerland has some of the world's strongest privacy laws -- and that ProtonVPN observes a strict no-logs policy. But how do they feel about their competition? "Studies have found that over one-third of Android VPNs actually contain malware, many VPNs suffered from major security lapses, and many free VPN services that claimed to protect privacy are secretly selling user data to third parties."' -- source: https://yro.slashdot.org/story/20/01/27/0352244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Do Emails Contribute to Global Warming?
by Peter Reutemann 28 Jan '20

28 Jan '20

'"Cut back on email if you want to fight global warming," read the headline on a recent article at Bloomberg: [A]ll those messages require energy to preserve them. And despite the tech industry's focus on renewables, the advents of streaming and artificial intelligence are only accelerating the amount of fossil fuels burned to keep data servers up. Right now, data centers consume about 2 percent of the world's electricity, but that is expected to reach 8 percent by 2030. Moreover, only about 6 percent of all data ever created is in active use today, according to research from Hewlett Packard Enterprise. That means 94 percent is sitting in a vast "landfill" with a massive carbon footprint. "It's costing us the equivalent of maintaining the airline industry for data we don't even use," said Andrew Choi, a senior research analyst at Parnassus Investments, a $27 billion environmental, social and governance firm in San Francisco. Kirk Bresniker, chief architect of Hewlett Packard Labs, said these server farms use energy both to retain your data and when you use it... And when you empty the email trash, you probably aren't actually erasing the data. Multiple copies of even decade-old emails are stored on servers around the world, still using energy... Bresniker says the tech industry is "flying blind" when it comes to the true cost of storing data. The picture is clouded by a constant stream of efficiency and memory upgrades, increased renewable power and AI aimed at data-center efficiency. "We don't really understand what the footprint is," he said... The sum of all the world's data in 2018 was 33 zettabytes — 33 trillion gigabytes — but by 2025 it could increase fivefold, to 175 zettabytes, according to International Data Corp. Every day, the world produces about 2.5 quintillion bytes of data... Computing workloads are likely to more than double as more AI comes online, more devices are connected and people do more work in the cloud... Choi says the problem is getting too big, too fast... Training an AI model emits about as much carbon as the lifetime emissions associated with running five cars' -- source: https://hardware.slashdot.org/story/20/01/27/0149253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 5.5 Released
by Peter Reutemann 28 Jan '20

28 Jan '20

'Linus Torvalds has announced Linux 5.5 release, codenamed as Kleptomaniac Octopus.The latest version of the open source operating system kernel brings RAID1 with 3- and 4- copies to btrfs filesystem, ext4 gets direct I/O via iomap together with fscrypt supporting smaller block sizes, and you can now use SMB as root filesystem. AMD OverDrive overclocking is now supported on Navi GPUS, wake-on-voice on newer Google Chromebooks is now supported. Added was a Logitech keyboard driver. KUnit is a new unit testing framework for the kernel. There are many more new features which you can read about on Kernel Newbies changelog page. For downloads visit The Linux Kernel Archives.' -- source: https://linux.slashdot.org/story/20/01/27/144259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Leaked Documents Expose the Secretive Market for Your Web Browsing Data
by Peter Reutemann 28 Jan '20

28 Jan '20

'An antivirus program used by hundreds of millions of people around the world is selling highly sensitive web browsing data to many of the world's biggest companies, a joint investigation by Motherboard and PCMag has found. From the report: Our report relies on leaked user data, contracts, and other company documents that show the sale of this data is both highly sensitive and is in many cases supposed to remain confidential between the company selling the data and the clients purchasing it. The documents, from a subsidiary of the antivirus giant Avast called Jumpshot, shine new light on the secretive sale and supply chain of peoples' internet browsing histories. They show that the Avast antivirus program installed on a person's computer collects data, and that Jumpshot repackages it into various different products that are then sold to many of the largest companies in the world. Some past, present, and potential clients include Google, Yelp, Microsoft, McKinsey, Pepsi, Sephora, Home Depot, Conde Nast, Intuit, and many others. Some clients paid millions of dollars for products that include a so-called "All Clicks Feed," which can track user behavior, clicks, and movement across websites in highly precise detail.' -- source: https://yro.slashdot.org/story/20/01/27/1453226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Has Banned Nearly 200 Malicious Firefox Add-ons Over the Last Two Weeks
by Peter Reutemann 28 Jan '20

28 Jan '20

'Over the past two weeks, Mozilla's add-on review team has banned 197 Firefox add-ons that were caught executing malicious code, stealing user data, or using obfuscation to hide their source code. From a report: The add-ons have been banned and removed from the Mozilla Add-on (AMO) portal to prevent new installs, but they've also been disabled in the browsers of the users who already installed them. The bulk of the ban was levied on 129 add-ons developed by 2Ring, a provider of B2B software. The ban was enforced because the add-ons were downloading and executing code from a remote server. According to Mozilla's rules, add-ons must self-contain all their code, and not download code dynamically from remote locations. Mozilla has recently begun strictly enforcing this rule across its entire add-on ecosystem. A similar ban for downloading and executing remote code in users' Firefox browsers was also levied against six add-ons developed by Tamo Junto Caixa, and three add-ons that were deemed fake premium products (their names were not shared).' -- source: https://news.slashdot.org/story/20/01/27/1646207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux on laptops: Ubuntu 19.10 on the HP Dragonfly Elite G1
by Peter Reutemann 28 Jan '20

28 Jan '20

'Last month, Ars Associate Reviewer Valentina Palladino treated us to a thorough hands-on review of HP's ultra-sleek, ultra-chic Dragonfly Elite G1. Shortly afterward at CES, HP announced a second-generation Dragonfly Elite, the G2, with Ice Lake CPU, optional LTE modem, and more. We haven't had a chance to get our hands on the G2 yet—but while we wait, we wanted to evaluate the Elite G1 not only with the OEM Windows it ships with, but with a fresh Linux installation. We can't evaluate a laptop with every possible Linux distribution, but in the case of noteworthy designs like the Dragonfly Elite, we want to at least see if one of the more popular distros installs cleanly, detects all the hardware, and is a good daily driver. Our first try was Ubuntu 18.04.3, "Bionic Beaver," the most recent Long Term Support release of Ubuntu. For the most part, the installation went well—the keyboard and touchpad were responsive, the screen looked fine, and so forth—but unfortunately, the Intel Wi-Fi chipset used in the Dragonfly Elite is new enough that 18.04.3 doesn't have an in-kernel driver. If you're a hardcore Linux type, that might not be enough to stop you—you have many possible options, such as installing a backported newer version of the Linux kernel—but we wanted to see if we could get a "just works" experience rather than a "percussive maintenance required" experience, so we regretfully shelved Ubuntu 18.04.3 and went to the newest interim Ubuntu release—October 2019's 19.10 "Eoan Ermine." Again, the actual installation went fine—but this time, we have Wi-Fi as well without touching a thing. Success!' -- source: https://arstechnica.com/gadgets/2020/01/linux-on-laptops-ubuntu-19-10-on-th… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apps for PC
by danny.techfizz＠gmail.com 28 Jan '20

28 Jan '20

In this website, we can see the topics like Best apps for smartphones and PC, Apps for PC, Latest mobile news, How to fix etc. https://www.bolsterfizz.com/

2 1

The GlossnGlass are the best bridal makeup artist in bangalore
by Gloss andglass 28 Jan '20

28 Jan '20

The GlossnGlass are the best bridal makeup artist in bangalore go beyond just creating immaculate makeup looks. We also train and produce the finest makeup artists through our professional makeup artist courses.With a team of expert trainers from the makeup industry, our makeup academy offers various intensive professional and personal grooming courses. Visit : https://www.glossnglass.com/courses.html

1 0

The GlossnGlass are the best bridal makeup artist in bangalore
by Glossandglassblr＠Gmail.Com 28 Jan '20

28 Jan '20

<a href="https://https://www.maachairtransplantbangalore.com/">bridal makeup in bangalore</a> Hair fall! It’s not easy to deal with it, every individual irrespective of their gender both male and female commonly in their day to day lifestyle they face this major problem, but maac deals with hair plantation in bangalore. Hair fall can happen due to many possible causes including genetics, hormonal imbalance, lack of sleep, stress, improper diet, certain medications, chemical salon services etc. And for many people hair fall or thinning of hair mostly results in loss of self –esteem and leads to depression, anxiety and other emotional issues.

1 0

Re: prp treatment in bangalore
by mailinglist 27 Jan '20

27 Jan '20

Sent from my Samsung Galaxy smartphone.In was wondering... But then, a lot of email addresses, mine included, sound a bit odd but are from totally legit people. Don't really have the time to moderate posts initially from everyone signing up till I'm satisfied that they are OK... :-(This doesn't happen too often. Lots of spam gets caught and I (though not so much recently ) just quickly check and discard whatever needs review. Maybe wait and see.Or if someone knows of any changes to the mailing list host....

1 0

Librem 5 phone hands-on—Open source phone shows the cost of being different
by Peter Reutemann 26 Jan '20

26 Jan '20

'It is hard to do something truly different in the smartphone industry. Companies, especially smaller companies, are all working from the same parts bin with the same manufacturing partners. You take your Qualcomm SoC, your Samsung display, and your Sony camera sensor—and you take a flight to China and visit Foxconn, which, in addition to manufacturing, will even do engineering for you if you want. Smartphones are so samey because they have an established, for-hire supply chain that has a certain way of doing things, and it's much cheaper, faster, and easier if you just "go with the flow" and do what everyone else is doing. Big companies like Samsung and Apple have enough money, control, and connections to move the supply chain in whatever direction they want. In terms of smaller companies, though, there is a single one trying to blaze its own path: Purism, the maker of open source Linux laptops, is building the Librem 5 smartphone. Not only is the OS open source and based on GNU/Linux—not Android—the hardware is open source, too. The core components have open source firmware, and there are even public hardware schematics. This is as close as you're going to get to a totally open source smartphone. If you haven't noticed, open source smartphone hardware is not a thing that existed before now. There have been phones that run open source builds of Android, but those are full of closed-source firmware from non-open components. The usual hardware companies cautiously guard their hardware designs and drivers, and Purism's hardline stance on open source has ruled out almost the entire established smartphone supply chain. As the company writes in a blog post, "When we first approached hardware manufacturers almost two years ago with this project most of them instantly said 'No, sorry, impossible, we can not help you'." Others warned us, that it could never work, that it was too complicated, 'the industry does not do that,' and so forth." What followed was a long and winding road, but after two years of work, Purism is finally shipping the Librem 5 smartphones to customers. We were able to spend a few days with a device, and it's definitely one of the most unusual smartphones in recent memory. The thing to keep in mind here is that Purism has taken on an absolutely gargantuan task. It somehow scraped together a new supply chain of mostly open source components, it came up with a smartphone design from scratch, and it is building its own smartphone distribution of Linux. Two years is not enough time to do this. The OS and app package is not nearly finished, and it lacks basic smartphone functionality. The hardware is nearly finished, but you'll have a hard time taking advantage of it right now since the power management isn't really implemented, and support for things like the cameras are non-existent. If you really want open source smartphones to be a thing, though, this is where you need to start. The Librem 5 is a proof of concept.' -- source: https://arstechnica.com/gadgets/2020/01/librem-5-phone-hands-on-a-proof-of-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel CPU Chip Shortages
by Lawrence D'Oliveiro 24 Jan '20

24 Jan '20

This article <https://www.theregister.co.uk/2020/01/20/intel_hpe_xeon_shortage/> talks about the shortage of Intel server chips. But it also mentions that Intel’s attempts to crank up production of these is “to the detriment of desktop and mobile parts”. So there are shortages of CPU chips all round, and AMD is benefiting somewhat from this. Who is buying most of these server chips? It appears it’s not actual hardware vendors like Dell, HP etc, who apparently only buy about half a million CPUs per year each. These are dwarfed by “hyperscaler” companies that are named by one commenter as Alibaba, AWS, Azure, Baidu, Facebook, Google and Tencent, each taking over a million CPUs per year.

1 1

Apple's Privacy Software Allowed Users To Be Tracked, Says Google
by Peter Reutemann 23 Jan '20

23 Jan '20

'Google researchers have exposed details of multiple security flaws in its rival Apple's Safari web browser that allowed users' browsing behavior to be tracked, despite the fact that the affected tool was specifically designed to protect their privacy. From a report: The flaws, which were ironically found in an anti-tracking feature known as Intelligent Tracking Prevention, were first disclosed by Google to Apple in August last year. In a soon-to-be published paper seen by the Financial Times, researchers in Google's cloud team have since identified five different types of potential attack that could have resulted from the vulnerabilities, allowing third parties to obtain "sensitive private information about the user's browsing habits." "You would not expect privacy-enhancing technologies to introduce privacy risks," said Lukasz Olejnik, an independent security researcher who has seen the paper. "If exploited or used, [these vulnerabilities] would allow unsanctioned and uncontrollable user tracking. Apple rolled out Intelligent Tracking Prevention in 2017, with the specific aim of protecting Safari browser users from being tracked around the web by advertisers' and other third-parties' cookies.' -- source: https://tech.slashdot.org/story/20/01/22/2119245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Wine 5.0 Released
by Peter Reutemann 22 Jan '20

22 Jan '20

'Wine 5.0 has been released today and contains over 7,400 bug fixes and numerous audio and graphics improvements that will increase performance in gaming on Linux. With the release of Wine 5.0, WineHQ hopes to resolve many of these issues, with the main improvements being: -Builtin modules in PE format: To make games think Wine is a real Windows environment, most Wine 5.0 modules have been converted into the PE format rather than ELF binaries. It is hoped that this will allow copy-protection and anti-cheat programs to not flag games running under Wine as being modified. -Multi-monitor support: Multiple displays adapters and multi-monitor configurations are now supported under Wine. -XAudio2 reimplementation: XAudio2 libraries have been added back to Wine and will use the FAudio library for better compatibility. -Vulkan 1.1 support: "The Vulkan driver supports up to version 1.1.126 of the Vulkan spec."' -- source: https://tech.slashdot.org/story/20/01/21/223205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Reuters: Apple cut backup end-to-end encryption plans after FBI complained
by Peter Reutemann 22 Jan '20

22 Jan '20

'Two years ago, Apple dropped a plan that would have made it impossible for the company to decrypt iPhone and iPad backups for law enforcement, according to a Reuters report today. Reuters wrote that "six sources familiar with the matter" confirmed that Apple dropped the end-to-end encryption plan for iCloud Backup "after the FBI complained that the move would harm investigations." Apple had "told the FBI that it planned to offer users end-to-end encryption when storing their phone data on iCloud" more than two years ago, Reuters wrote. "Under that plan, primarily designed to thwart hackers, Apple would no longer have a key to unlock the encrypted data, meaning it would not be able to turn material over to authorities in a readable form even under court order," the report continued. But the FBI objected, and Apple dropped the plan, although the exact reason for doing so isn't clear. One former Apple employee told Reuters that the company "decided they weren't going to poke the bear anymore." However, another former Apple employee "said it was possible the encryption project was dropped for other reasons, such as concern that more customers would find themselves locked out of their data more often."' -- source: https://arstechnica.com/tech-policy/2020/01/apple-reportedly-nixed-plan-for… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Notorious Crime Gang Targets Internet Routers Using Tomato Firmware
by Peter Reutemann 22 Jan '20

22 Jan '20

'Internet routers running the Tomato alternative firmware are under active attack by a self-propagating exploit that searches for devices using default credentials. When credentials are found, the exploit then makes the routers part of a botnet that's used in a host of online attacks, researchers said on Tuesday. The Muhstik botnet came to light about two years ago when it started unleashed a string of exploits that attacked Linux servers and Internet-of-things devices. It opportunistically exploited a host of vulnerabilities, including the so-called critical Drupalgeddon2 vulnerability disclosed in early 2018 in the Drupal content management system. Muhstik has also been caught using vulnerabilities in routers that use Gigabit Passive Optical Network (GPON) or DD-WRT software. The botnet has also exploited previously patched vulnerabilities in other server applications, including the Webdav, WebLogic, Webuzo, and WordPress. On Tuesday, researchers from Palo Alto Networks said they recently detected Muhstik targeting Internet routers running Tomato, an open-source package that serves as an alternative to firmware that ships by default with routers running Broadcom chips. The ability to work with virtual private networks and provide advanced quality of service control make Tomato popular with end users and in some cases router sellers. The exploits use already infected devices to scan the Internet for Tomato routers and, when found, to check if they use the default username and password of "admin:admin" or "root:admin" for remote administration. The exploit causes Tomato routers that haven't been locked down with a strong password to join an IRC server that's used to control the botnet. The infection also causes the routers to scan the Internet for servers or devices running WordPress, Webuzo, or WebLogic packages that are vulnerable.' -- source: https://it.slashdot.org/story/20/01/21/2039246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

14% of Android App Privacy Policies Contain Contradictions About Data Collection
by Peter Reutemann 22 Jan '20

22 Jan '20

'A large number of Android mobile apps listed on the official Google Play Store contain self-contradictory language in their privacy policies in regards to data collection practices. From a report: In an academic study published last year, researchers created a tool named PolicyLint that analyzed the language used in the privacy policies of 11,430 Play Store apps. They found that 14.2% (1,618 apps) contained a privacy policy with logical contradicting statements about data collection. Examples include privacy policies that stated in one section that they do not collect personal data, only to contradict themselves in subsequent sections, where they state they collect emails or customer names -- which are clearly personally-idenfiable information. While the research team could not determine the app maker's intent in using contradicting statements in their privacy policy, researchers feel the primary purpose was to mislead users if they ever took the time to read the policies.' -- source: https://yro.slashdot.org/story/20/01/21/188216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Official Kubuntu 'Focus' Linux Laptop Goes on Sale
by Peter Reutemann 21 Jan '20

21 Jan '20

'You can buy an official Kubuntu laptop. Called "Focus". It is an absolutely powerhouse with top specs. From a report: Here's the specs list: CPU: Core i7-9750H 6c/12t 4.5GHz Turbo GPU: 6GB GTX-2060 RAM: 32GB Dual Channel DDR4 2666 RAM Storage: 1TB Samsung 970 EVO Plus NVMe Display: 16.1" matte 1080p IPS Keyboard: LED backlit, 3-4mm travel User expandable SDD, NVMe, and RAM Superior cooling The starting price for the Kubuntu Focus Laptop is $2395. ' -- source: https://linux.slashdot.org/story/20/01/20/1856240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

Why This Time The New Browser Wars Are Different
by Peter Reutemann 21 Jan '20

21 Jan '20

'The Verge argues that the browser wars "are back, but it's different this time." The mobile web is broken and unfettered tracking and data sharing have made visiting websites feel toxic, but since the ecosystem of websites and ad companies can't fix it through collective action, it falls on browser makers to use technological innovations to limit that surveillance, however each company that makes a browser is taking a different approach to creating those innovations, and everybody distrusts everybody else to act in the best interest of the web instead of the best interest of their employers' profits... I've been avoiding getting into the precise details of the proposals out there to fix the tracking problem because things are changing so quickly across so many different tracks... Until then, know that there are two important things to know. First: there are new browser technologies and limits coming that could radically change how ads work and could make it easier for you to protect your privacy no matter what browser you use. Since this is the web, it'll take time, but everybody seems committed. Second: the way many of us think about a Browser War is in terms of marketshare -- and that is the wrong metric this time. There is a browser war, but it won't be won or lost based on who can convince the most people to switch to their browser. Because most people can't or won't switch on the platform that matters: mobile. In 2020, the desktop is a minor skirmish compared to browsers on phones. On phones, many people aren't really free to choose their browser. That's literally true on the iPhone, which Apple locks down so apps can only use its web rendering technology. And it's for-intents-and-purposes true on Android, where the vast majority of browsers just use Chromium. Yes, there is an Android browser ballot happening in Europe, but it's much too early to know what its effects will be.... The new Browser Wars aren't about who makes the fastest or best browser, they're about whose services you want and whose data policies you trust. ' -- source: https://news.slashdot.org/story/20/01/20/048217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Opera Accused of Offering Predatory Loans Through Android apps
by Peter Reutemann 21 Jan '20

21 Jan '20

'"It's no secret that Opera isn't doing so well in the era of Chrome dominance," reports Android Police. "According to a report published by Hindenburg Research, the company's losses in browser revenue have apparently led it to create multiple loan apps with short payment windows and interest rates of ~365-876%, which are in violation of new Play Store rules Google enacted last year." The apps are aimed at India, Kenya and Nigeria, reports Engadget: The apps would claim to offer maximum annual percentage rate (APR) of 33 percent or less, but the actual rates were much higher, climbing to 438 percent in the case of OPesa. And while they publicly offered reasonable loan terms of 91 to 365 days, the real length was no more than 29 days (for OKash) and more often 15 days -- well under Google's 60-day minimum. The conditions only got worse for borrowers who missed their payments. Falling short by just a day could raise the APR as high as 876 percent. Also, the apps reportedly scraped phone contacts to harass family, friends and others with calls and texts in hopes this would pressure customers into paying up. These same notices often threatened legal action. Android Police points out that Opera became a public company in mid-2017, shortly after it was purchased by a China-based investor group. But since then, "Opera's market share has continued to fall, due to the increasing dominance of Chrome.' -- source: https://slashdot.org/story/20/01/20/0329242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday
by Peter Reutemann 20 Jan '20

20 Jan '20

Hi everyone We have a meeting schedule for *next* Monday (a week earlier than usual due to Auckland Anniversary holiday): 'Is your Android phone no longer supported by your manufacturer? Then you might able to update it using a custom ROM from LineageOS (https://wiki.lineageos.org/devices/) or AospExtended ROM (https://www.aospextended.com/devices/pie) Peter Reutemann will show the process of updating the ROM on an Android phone.' Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/266791984 https://gettogether.community/events/3274/wlug-meeting/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Researchers find serious flaws in WordPress plugins used on 400k sites
by Peter Reutemann 20 Jan '20

20 Jan '20

'Serious vulnerabilities have recently come to light in three WordPress plugins that have been installed on a combined 400,000 websites, researchers said. InfiniteWP, WP Time Capsule, and WP Database Reset are all affected. The highest-impact flaw is an authentication bypass vulnerability in the InfiniteWP Client, a plugin installed on more than 300,000 websites. It allows administrators to manage multiple websites from a single server. The flaw lets anyone log in to an administrative account with no credentials at all. From there, attackers can delete contents, add new accounts, and carry out a wide range of other malicious tasks.' -- source: https://arstechnica.com/information-technology/2020/01/researchers-find-ser… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Another Project Goes Private: Amara Stops Being Developed As Open Source
by Peter Reutemann 20 Jan '20

20 Jan '20

'Slashdot reader northar writes: Subtitling project Amara closes its repository as focus is shifting... Amara was AGPL up until going private. While future improvements to the code base from the Participatory Culture Foundation (PCF) will not be public, a copy of the last public code base has been preserved at Gitlab, should anyone be interested in the work done up until now. Note that no support is given from PCF for this code >From Amara's official statement on the move: The Participatory Culture Foundation began as a nonprofit in 2006 with a focus on creating open source software to ensure that emerging video technologies were accessible to all.... For an organization like PCF, which relies on revenue generated from sustainability initiatives to fund social impact work, we believe the risk to these initiatives outweighs the potential or perceived public benefit from maintaining open code. Releasing software as open source unfortunately does not provide protection against well-funded technology firms that are driven by profit... Without the proper market position and resources, a smaller organization that relies on revenue from software they build can be outmaneuvered or overpowered with the very technology they created (assuming their code is open source). This is not only a threat to smaller organizations, but has also become a bigger debate that much larger companies are also hashing out. For venture-funded or publicly traded firms, the open source approach can be a calculated risk that makes business sense. But for less-capitalized organizations or nonprofits, like PCF, who lack significant market power, making software open source puts other more well-resourced players in position to leverage the technology in ways that may undermine the sustainability and/or the values of the original developer. With these shifts in the computing landscape, PCF has not seen individuals or communities as the primary beneficiary of releasing Amara code as open source. Instead, we have unfortunately had firsthand experience with a venture-funded organization deploying code we created and using it in ways that we did not think aligned well with our values.... As we undertake this shift in 2020, we are aware that the computing landscape will continue to change and thus we remain open to newer and better strategies for making source code available in the long-term. Future strategies might include data trusts and/or new licenses that better align with our sustainability initiatives and mission.' -- source: https://news.slashdot.org/story/20/01/18/1753246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Are Software Designers Ignoring The Needs of the Elderly?
by Peter Reutemann 20 Jan '20

20 Jan '20

'"[A]t the very time that it's become increasingly difficult for anyone to conduct their day to day lives without using the Net, some categories of people are increasingly being treated badly by many software designers," argues long-time Slashdot reader Lauren Weinstein: The victims of these attitudes include various special needs groups — visually and/or motor impaired are just two examples — but the elderly are a particular target. Working routinely with extremely elderly persons who are very active Internet users (including in their upper 90s!), I'm particularly sensitive to the difficulties that they face keeping their Net lifelines going. Often they're working on very old computers, without the resources (financial or human) to permit them to upgrade. They may still be running very old, admittedly risky OS versions and old browsers — Windows 7 is going to be used by many for years to come, despite hitting its official "end of life" for updates a few days ago. Yet these elderly users are increasingly dependent on the Net to pay bills (more and more firms are making alternatives increasingly difficult and in some cases expensive), to stay in touch with friends and loved ones, and for many of the other routine purposes for which all of us now routinely depend on these technologies.... There's an aspect of this that is even worse. It's attitudes! It's the attitudes of many software designers that suggest they apparently really don't care about this class of users much — or at all. They design interfaces that are difficult for these users to navigate. Or in extreme cases, they simply drop support for many of these users entirely, by eliminating functionality that permits their old systems and old browsers to function. He cites the example of Discourse, the open source internet forum software, which recently announced they'd stop supporting Internet Explorer. Weinstein himself hates Microsoft's browser, "Yet what of the users who don't understand how to upgrade? Who don't have anyone to help them upgrade? Are we to tell them that they matter not at all?" So he confronted Stack Exchange co-founder Jeff Atwood (who is also one of the co-founders of Discourse) on Twitter — and eventually found himself blocked. "Far more important though than this particular case is the attitude being expressed by so many in the software community, an attitude that suggests that many highly capable software engineers don't really appreciate these users and the kinds of problems that many of these users may have, that can prevent them from making even relatively simple changes or upgrades to their systems — which they need to keep using as much as anyone — in the real world."' -- source: https://developers.slashdot.org/story/20/01/19/0255220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Telnet Passwords Leaked For More Than 500,000 Servers, Routers, and IoT Devices
by Peter Reutemann 20 Jan '20

20 Jan '20

'ZDNet is reporting on a security breach leaking "a massive list of Telnet credentials for more than 515,000 servers, home routers, and IoT (Internet of Things) 'smart' devices." The list, which was published on a popular hacking forum, includes each device's IP address, along with a username and password for the Telnet service, a remote access protocol that can be used to control devices over the internet... Some devices were located on the networks of known internet service providers (indicating they were either home router or IoT devices), but other devices were located on the networks of major cloud service providers... According to experts to who ZDNet spoke this week, and a statement from the leaker himself, the list was compiled by scanning the entire internet for devices that were exposing their Telnet port. The hacker then tried using (1) factory-set default usernames and passwords, or (2) custom, but easy-to-guess password combinations.... To our knowledge, this marks the biggest leak of Telnet passwords known to date. As ZDNet understands, the list was published online by the maintainer of a DDoS-for-hire (DDoS booter) service... When asked why he published such a massive list of "bots," the leaker said he upgraded his DDoS service from working on top of IoT botnets to a new model that relies on renting high-output servers from cloud service providers.' -- source: https://it.slashdot.org/story/20/01/19/1649234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Why Did Red Hat Drop Its Support for Docker's Runtime Engine?
by Peter Reutemann 19 Jan '20

19 Jan '20

'"I've grown quite fond of the docker container runtime. It's easy to install and use, and many of the technologies I write about depend upon this software," writes TechRepublic/Linux.com contributor Jack Wallen. "But Red Hat has other plans." The company decided -- seemingly out of the blue -- to drop support for the docker runtime engine. In place of docker came Podman. When trying to ascertain why Red Hat split with Docker, nothing came clear. Sure, I could easily draw the conclusion that Red Hat had grown tired of the security issues surrounding Docker and wanted to take matters in their own hands. There was also Red Hat's issue with "no big fat daemons." If that's the case, how do they justify their stance on systemd? Here's where my tinfoil hat comes into play. Understand this is pure conjecture here and I have zero facts to back these claims up... Red Hat is now owned by IBM. IBM was desperate to gain serious traction within the cloud. To do that, IBM needed Red Hat, so they purchased the company. Next, IBM had to score a bit of vendor lock-in. Using a tool like docker wouldn't give them that lock-in. However, if Red Hat developed and depended on their own container runtime, vendor lock-in was attainable.... Red Hat has jettisoned a mature, known commodity for a less-mature, relatively unknown piece of software -- without offering justification for the migration.... Until Red Hat offers up a sound justification for migrating from the docker container engine to Podman, there's going to be a lot of people sporting tinfoil hats. It comes with the territory of an always-connected world. And if it does turn out to be an IBM grab for vendor lock-in, there'll be a lot of admins migrating away from RHEL/CentOS to the likes of Ubuntu Server, SUSE/openSUSE, Debian, and more. Red Hat's product manager of containers later touted Podman's ability to deploy containers without root access privileges in an interview with eWeek. "We felt the sum total of its features, as well as the project's performance, security and stability, made it reasonable to move to 1.0. Since Podman is set to be the default container engine for the single-node use case in Red Hat Enterprise Linux 8, we wanted to make some pledges about its supportability." And a Red Hat spokesperson also shared their position with The New Stack. "We saw our customer base wanting the container runtime lifecycle baked-in to the OS or in delivered tandem with OpenShift."' -- source: https://linux.slashdot.org/story/20/01/18/0236253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Tuxedo's New Manjaro Linux Laptops Will Include Massive Customization
by Peter Reutemann 19 Jan '20

19 Jan '20

'Tuxedo Computers "has teamed up with Manjaro to tease not one, not two, but several" Linux laptops, Forbes reports: The Tuxedo Computers InfinityBook Pro 15...can be loaded with up to 64GB of RAM, a 10th-generation Intel Core i7 CPU, and as high as a 2TB Samsung EVO Plus NVMe drive. You can also purchase up to a 5-year warranty, and user-installed upgrades will not void the warranty... Manjaro Lead Project Developer Philip Müller also teased a forthcoming AMD Ryzen laptop [on Forbes' "Linux For Everyone" podcast]. "Yes, we are currently evaluating which models we want to use because the industry is screaming for that," Müller says. "In the upcoming weeks we might get some of those for internal testing. Once they're certified and the drivers are ready, we'll see when we can launch those." Müller also tells me they're prepping what he describes as a "Dell XPS 13 killer." "It's 10th-generation Intel based, we will have it in 14-inch with a 180-degree lid, so you can lay it flat on your desk if you like," he says. The Manjaro/Tuxedo Computers partnership will also offer some intense customization options, Forbes adds. "Want your company logo laser-etched on the lid? OK. Want to swap out the Manjaro logo with your logo on the Super key? Sure, no problem. Want to show off your knowledge of fictional alien races? Why not get a 100% Klingon keyboard?"' -- source: https://linux.slashdot.org/story/20/01/18/0045242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

“Windows Refund Day” Retrospective
by Lawrence D'Oliveiro 18 Jan '20

18 Jan '20

Just been watching this video <https://www.youtube.com/watch?v=1j9j-Ywjmbk> about that day in 1999 when open-source fans in a number of countries (including NZ) staged a march to demand a refund for the copies of Microsoft Windows that were bundled with hardware that they bought, even though they didn’t want that OS. It also recounts the story of the first person to actually get such a refund, and the rigmarole she had to go through to get it. Nowadays, I expect such a demand would be even less effective than it was then. The price of Windows to the hardware manufacturers is heavily offset (likely by more than 100%) by payments they get for preinstalling “crapware” (demo, time-limited and “lite” versions of various apps) from software vendors. So if they have to refund you the one, they will also deduct the other, and you end up with a net pittance, or very likely nothing at all, for saying no to Windows.

1 0

Do Parents Think Free Software Is Malware?
by Lawrence D'Oliveiro 18 Jan '20

18 Jan '20

Came across this article <https://opensource.com/life/15/12/dear-parents-let-your-kids-use-open-sourc…> from a few years ago, relating the tale of a teenager who was given an expensive laptop, who chose to replace its Windows OS (and included software) with Ubuntu. His parents were livid when they found out--two years after the fact. They jumped to the conclusion that his machine was now under the control of malware and hackers and all the rest of it, not to mention his throwing away the software they had paid good money for. So he resorted to Reddit (!) to get advice on how to explain things to his parents. The thread <https://www.reddit.com/r/linux/comments/3rfukp/i_really_need_advice/> has, in perhaps typical Reddit fashion, a mix of useful and not-so-useful responses. Though the upshot was, he was able to come to an accommodation with his parents, even if it did involve paying back the cost of the firewall/antivirus subscription that he didn’t use. That teen is an adult now. I wonder if it was an isolated case...

3 2

Marketroid boilerplate text
by Lawrence D'Oliveiro 17 Jan '20

17 Jan '20

I came across what might be described as a more “modern” alternative to the well-known “lorem ipsum” text for dummying up article layouts. You can find lots of occurrences of this all over the web with this search <https://www.google.com/search?q=Capitalize+on+low+hanging+fruit>, and frankly, most of them look like accidents. But I can’t find where this text originally came from. Anyone have any idea?

2 3

Pinebook Pro Review - US$199 Linux Powered ARM laptop
by Lawrence D'Oliveiro 17 Jan '20

17 Jan '20

Part <https://www.youtube.com/watch?v=dgNYQsdxlMw> of a series reviewing an ARM-based device that is not a Chromebook. Seems to have remarkable build quality for its price, offers versatility for those who like to tinker, and the battery life and performance are also quite reasonable. The main downside is some issues with multimedia in browsers (e.g. YouTube).

3 5

Bruce Schneier on 5G Security
by Peter Reutemann 17 Jan '20

17 Jan '20

'Bruce Schneier comments on the issues surrounding 5G security: [...] Keeping untrusted companies like Huawei out of Western infrastructure isn't enough to secure 5G. Neither is banning Chinese microchips, software, or programmers. Security vulnerabilities in the standards, the protocols and software for 5G, ensure that vulnerabilities will remain, regardless of who provides the hardware and software. These insecurities are a result of market forces that prioritize costs over security and of governments, including the United States, that want to preserve the option of surveillance in 5G networks. If the United States is serious about tackling the national security threats related to an insecure 5G network, it needs to rethink the extent to which it values corporate profits and government espionage over security. To be sure, there are significant security improvements in 5G over 4G in encryption, authentication, integrity protection, privacy, and network availability. But the enhancements aren't enough. The 5G security problems are threefold. First, the standards are simply too complex to implement securely. This is true for all software, but the 5G protocols offer particular difficulties. Because of how it is designed, the system blurs the wireless portion of the network connecting phones with base stations and the core portion that routes data around the world. Additionally, much of the network is virtualized, meaning that it will rely on software running on dynamically configurable hardware. This design dramatically increases the points vulnerable to attack, as does the expected massive increase in both things connected to the network and the data flying about it. Second, there's so much backward compatibility built into the 5G network that older vulnerabilities remain. 5G is an evolution of the decade-old 4G network, and most networks will mix generations. Without the ability to do a clean break from 4G to 5G, it will simply be impossible to improve security in some areas. Attackers may be able to force 5G systems to use more vulnerable 4G protocols, for example, and 5G networks will inherit many existing problems. Third, the 5G standards committees missed many opportunities to improve security. Many of the new security features in 5G are optional, and network operators can choose not to implement them. The same happened with 4G; operators even ignored security features defined as mandatory in the standard because implementing them was expensive. But even worse, for 5G, development, performance, cost, and time to market were all prioritized over security, which was treated as an afterthought.' -- source: https://mobile.slashdot.org/story/20/01/16/1514231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Browser Benchmark Battle: Chrome Vs. Firefox Vs. Edge Vs. Brave
by Peter Reutemann 17 Jan '20

17 Jan '20

'It's been some 18 months since VentureBeat's last browser benchmark battle. What better time to get the latest results than the start of a new year? Over the past year and a half, Google Chrome has continued to dominate market share, Mozilla Firefox has doubled down on privacy, Microsoft Edge has embraced Chromium, and Brave launched out of beta. You can click on the individual test to see the results: SunSpider: Edge wins! Octane: Chrome wins! Kraken: Firefox wins! JetStream: Edge wins! MotionMark: Edge wins! Speedometer: Edge wins! Basemark: Brave wins! WebXPRT: Firefox wins! The Chromium version of Edge did a lot better given that the stable release only arrived this week. We were expecting improvements, but not so many outright wins. That said, browser performance was solid across all four contestants -- each browser won at least one test. Performance of course shouldn't be your only consideration when picking your preferred app for consuming internet content. As long as you're using a browser that receives regular updates (and all four of these meet that criteria), you can expect performance to be solid. There is certainly room for improvement, but Chrome, Firefox, and now Edge, as well as Brave, are all quite capable.' -- source: https://news.slashdot.org/story/20/01/16/180227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The PinePhone starts shipping—a Linux-powered smartphone for $150
by Peter Reutemann 17 Jan '20

17 Jan '20

'Pine64 has announced that it is finally shipping the PinePhone, a smartphone that takes the rare step outside the Android/iOS duopoly and is designed to run mainline Linux distributions. The PinePhone starts shipping January 17 in the "Braveheart" developer edition. This initial "Braveheart" batch of devices is meant for "developer and early adopter" users, according to the Pine64 Store. The phone doesn't come with an end-user OS pre-installed and, instead, only comes with a factory test image that allows for easy verification that the hardware works. Users are expected to flash their own OS to the device. There are several available, from Ubuntu Touch to Sailfish OS, but they are all currently in an unfinished alpha state. Pine64 says that only enthusiasts with "extensive Linux experience" are the intended customer here—this isn't (yet?) a mainstream product. It's hard to mention PinePhone without mentioning that other Linux smartphone, the Purism Librem 5. They could both end up running the same software one day, but the two companies are taking totally different approaches to hardware. Purism has a hardline requirement for the hardware: it needs to be as open and freedom-focused as possible, which means the company couldn't use the typical supply chain that exists for Android phones. Purism has only a limited amount of open source-compatible vendors to choose from, and it uses M.2 socketed chips for the closed-source Wi-Fi/Bluetooth and Cell modem. The result is a device that is very thick (16mm), hot, and expensive, at $750. The PinePhone is less averse to binary blobs and is a lot closer to a normal smartphone. It's a more reasonable thickness (9mm) and a more reasonable price: $150.' -- source: https://arstechnica.com/gadgets/2020/01/the-pinephone-starts-shipping-a-lin… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

NexDock 2 Review
by Lawrence D'Oliveiro 16 Jan '20

16 Jan '20

A look <https://www.theregister.co.uk/2020/01/15/nexdock_2_review/> at a device that looks like a laptop, but is really just a dock that can be used with either a Raspberry π or an Android phone. Apparently the Android experience is less than wonderful, but a Raspberry π 4 worked great, apart from its high power consumption.

1 0

Mozilla Lays Off 70 As It Waits For New Products To Generate Revenue
by Peter Reutemann 16 Jan '20

16 Jan '20

'According to TechCrunch, Mozilla has laid off about 70 employees today. From the report: In an internal memo, Mozilla chairwoman and interim CEO Mitchell Baker specifically mentions the slow rollout of the organization's new revenue-generating products as the reason for why it needed to take this decision. The overall number may still be higher, though, as Mozilla is still looking into how this decision will affect workers in the UK and France. In 2018, Mozilla Corporation (as opposed to the much smaller Mozilla Foundation) said it had about 1,000 employees worldwide. Baker says laid-off employees will receive "generous exit packages" and outplacement support. She also notes that the leadership team looked into shutting down the Mozilla innovation fund but decided that it needed it in order to continue developing new products. In total, Mozilla is dedicating $43 million to building new products. "You may recall that we expected to be earning revenue in 2019 and 2020 from new subscription products as well as higher revenue from sources outside of search. This did not happen," Baker writes in her memo. "Our 2019 plan underestimated how long it would take to build and ship new, revenue-generating products. Given that, and all we learned in 2019 about the pace of innovation, we decided to take a more conservative approach to projecting our revenue for 2020. We also agreed to a principle of living within our means, of not spending more than we earn for the foreseeable future." "As we look to the future, we know we must take bold steps to evolve and ensure the strength and longevity of our mission," Baker adds. "Mozilla has a strong line of sight to future revenue generation, but we are taking a more conservative approach to our finances. This will enable us to pivot as needed to respond to market threats to internet health, and champion user privacy and agency."' -- source: https://news.slashdot.org/story/20/01/15/2048210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Launches Chromium Edge for Windows 7, Windows 8, Windows 10, and macOS
by Peter Reutemann 16 Jan '20

16 Jan '20

'Microsoft today launched its new Edge browser based on Google's Chromium open source project. You can download Chromium Edge now for Windows 7, Windows 8, Windows 10, and macOS directly from microsoft.com/edge in more than 90 languages. From a report: Business features aside, there's also support for Chrome-based extensions, 4K streaming, Dolby audio, inking in PDF, and privacy tools. For the last one, it's worth noting that tracking prevention is on by default and offers three levels of control, like Firefox's tracking protection. Chrome extension support is probably the most important feature for most users. By default, extensions that have been ported over to Edge can be downloaded from the Microsoft Store. Chromium Edge also has an option to "Allow extensions from other stores" to get Chrome extensions from the Chrome Web Store. There are still a few features missing from Chromium Edge, most notably history sync and extension sync. Microsoft is working on these and some other inking functionality that it still wants to port from legacy Edge, as Microsoft is calling it. Microsoft also claims that Chromium Edge is "twice as fast as legacy Edge." Curiously, the team isn't making any claims against other browsers -- at least not yet.' -- source: https://tech.slashdot.org/story/20/01/15/187215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

More Than Half a Billion Android Users Have Installed 'Fleeceware' Apps
by Peter Reutemann 16 Jan '20

16 Jan '20

'Security researchers from Sophos say they've discovered a new set of "fleeceware" apps that appear to have been downloaded and installed by more than 600 million Android users. From a report: The term fleeceware is a recent addition to the cyber-security jargon. It was coined by UK cyber-security firm Sophos last September following an investigation that discovered a new type of financial fraud on the official Google Play Store. It refers to apps that abuse the ability for Android apps to run trial periods before a payment is charged to the user's account. By default, all users who sign up for an Android app trial period, have to cancel the trial period manually to avoid being charged. However, most users just uninstall an app when they don't like it. The vast majority of app developers interpret this action -- a user uninstalling their app -- as a trial period cancelation and don't follow through with a charge. But last year, Sophos discovered that some Android app developers didn't cancel an app's trial period once the app is uninstalled and they don't receive a specific request from the user. Sophos said it initially discovered 24 Android apps that were charging obscene fees (between $100 and $240 per year) for the most basic and simplistic apps, such as QR/barcode readers and calculators.' -- source: https://news.slashdot.org/story/20/01/15/1721256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds Versus ZFS
by Lawrence D'Oliveiro 14 Jan '20

14 Jan '20

Came across this article <https://arstechnica.com/gadgets/2020/01/linus-torvalds-zfs-statements-arent…> reporting that Linus Torvalds recommends against using Sun/Oracle’s ZFS with Linux. The licensing issue (on top of Oracle’s infamous litigiousness) is a real concern, but the author also has a problem with Torvalds’ claims over filesystem performance and whether the code base is still being maintained or not. Out of curiosity, I went to read the original discussion thread. Not far along, I came across this <https://www.realworldtech.com/forum/?threadid=189711&curpostid=189959> later clarification by Torvalds: > Please, Linus, stop being arrogant and ignorant, read this > release note and tell us why you think ZFS is more of a buzzword > and has no real maintenance. I'm talking about small details like the fact that Oracle owns the copyrights, but turned things closed-source, so the "other" ZFS project is a fork of an old code base. If you are talking about ZFS, you're talking about the Oracle version. Do you think it has a lot of development going on? I don't know. And if you're talking about OpenZFS, then yes, there's clearly maintenance there, but it has all the questions about what happens if Oracle ever decides - again - that "copyright" means something different than anybody else thinks it means. Also the Ars Technica author seemed to feel that the kernel developers closed off certain kernel symbols to non-GPL code out of “spite”, to which Torvalds replies: > Not going out of your way to support ZFS is one thing. That we > completely perfectly understand. Going out of your way to > deliberately break ZFS is another thing. The kernel developers > are being assholes for doing that! We didn't go out of our way to deliberately break anything. But we do occasionally turn symbols that aren't meant to be used outside the kernel into GPL-only, because they have some internal implementation issues. The fact is, the whole point of the GPL is that you're being "paid" in terms of tit-for-tat: we give source code to you for free, but we want source code improvements back. If you don't do that but instead say "I think this is _legal_, but I'm not going to help you" you certainly don't get any help from us. So things that are outside the kernel tree simply do not matter to us. They get absolutely zero attention. We simply don't care. It's that simple. And things that don't do that "give back" have no business talking about us being assholes when we don't care about them.

1 0

Unpatched Citrix Vulnerability Now Exploited, Patch Weeks Away
by Peter Reutemann 14 Jan '20

14 Jan '20

'On December 16, 2019, Citrix revealed a vulnerability in the company's Application Delivery Controller and Gateway products -- commercial virtual-private-network gateways formerly marketed as NetScaler and used by tens of thousands of companies. The flaw, discovered by Mikhail Klyuchnikov of Positive Technologies, could give an attacker direct access to the local networks behind the gateways from the Internet without the need for an account or authentication using a crafted Web request. Citrix has published steps to reduce the risk of the exploit. But these steps, which simply configure a responder to handle requests using the text that targets the flaw, breaks under some circumstances and might interfere with access to the administration portal for the gateways by legitimate users. A permanent patch will not be released until January 20. And as of January 12, over 25,000 servers remain vulnerable, based on scans by Bad Packets. This is not surprising, considering the number of Pulse Secure VPNs that have not yet been patched over six months after a fix was made available, despite Pulse Secure executives saying that they have "worked aggressively" to get customers to patch that vulnerability. And given that vulnerable Pulse Secure servers have been targeted now for ransomware attacks, the same will likely be true for unprotected Citrix VPN servers -- especially since last week, proof-of-concept exploits of the vulnerability began to appear, including at least two published on GitHub, as ZDNet's Catalin Cimpanu reported. "The vulnerability allows the remote execution of commands in just two HTTP requests, thanks to a directory traversal bug in the implementation of the gateway's Web interface," the report adds. "The attacks use a request for the directory '/vpn/../vpns/' to fool the Apache Web server on the gateway to point to the '/vpns/' directory without authentication. The attacks then inject a command based on the template returned from the first request." You can check for the vulnerability here. ' -- source: https://it.slashdot.org/story/20/01/13/2116206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bing Loses Out To DuckDuckGo in Google's New Android Search Engine Ballot
by Peter Reutemann 14 Jan '20

14 Jan '20

'Google announced last week the alternative search engines it will show to new Android users in the EU, with DuckDuckGo the most frequently offered choice and Bing tied for last place. From a report: EU citizens setting up Android devices from March 1 will given a choice of four search engines to use as their default, including Google. Whichever provider they chose will become the default for searches made in Chrome and through Android's home screen search box. A dedicated app for that provider will also be installed on their device. ' -- source: https://search.slashdot.org/story/20/01/13/2042211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ICANN Wants to Let VeriSign Raise Prices on .Com Domains
by Peter Reutemann 14 Jan '20

14 Jan '20

'VeriSign has released a "proposed agreement" with ICANN to amend their exclusive .com registry agreement to allow them to raise the price of dotcom registrations up to 28% every six years. Those new terms "are now open to public comment" -- and the Register points out that ICANN's decision seems to come with a corresponding $20 million for ICANN: Operator of the dot-com registry, Verisign, has decided to pay DNS overseer ICANN $4 million a year for the next five years in order to "educate the wider ICANN community about security threats." Even though the generous $20 million donation has nothing to do with ICANN signing off on an extension of the dot-com contract until 2024, the "binding letter of intent" [PDF] stating the exact amount of funding will be appended to the registry agreement that Verisign has with ICANN to run the dot-com registry. That extension lifts a price freeze put in place several years ago and will allow Verisign to increase prices by seven per cent a year [in each of the last four years of each six year contract renewal]. It's an increase that we calculated was worth $993 million and which the stock market appeared to agree with when it raised the company's share price by 16 per cent when the agreement was first flagged in November 2018... ICANN explains the $20 million this time will be used to "support ICANN's initiatives to preserve and enhance the security, stability and resiliency of the DNS, including root server system governance, mitigation of DNS security threats, promotion and/or facilitation of DNSSEC deployment, the mitigation of name collisions, and research into the operation of the DNS." Which is all entirely above board and not at all shady.' -- source: https://tech.slashdot.org/story/20/01/13/0512230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

linux.conf.au: 2020 live streams
by Peter Reutemann 13 Jan '20

13 Jan '20

Hi everyone This just came through on my twitter feed, the live feeds of linux.conf.au 2020: https://www.youtube.com/playlist?list=PLD8dAKx4J2I45efawJoyCJ0CGjqi7Q78w -- source: https://twitter.com/xfxf/status/1216514835057238016 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

This Year's Y2K20 Bug Came Directly From 'A Lazy Fix' to the Y2K Bug
by Peter Reutemann 13 Jan '20

13 Jan '20

'Slashdot reader The8re still remembers the Y2K bug. Now he shares a New Scientist article explaining how it led directly to this year's Y2020 bug -- which affected more than just parking meters: WWE 2K20, a professional wrestling video game, also stopped working at midnight on 1 January 2020. Within 24 hours, the game's developers, 2K, issued a downloadable fix. Another piece of software, Splunk, which ironically looks for errors in computer systems, was found to be vulnerable to the Y2020 bug in November. The company rolled out a fix to users the same week -- which include 92 of the Fortune 100, the top 100 companies in the US.... The Y2020 bug, which has taken many payment and computer systems offline, is a long-lingering side effect of attempts to fix the Y2K, or millennium bug. Both stem from the way computers store dates. Many older systems express years using two numbers -- 98, for instance, for 1998 -- in an effort to save memory. The Y2K bug was a fear that computers would treat 00 as 1900, rather than 2000. Programmers wanting to avoid the Y2K bug had two broad options: entirely rewrite their code, or adopt a quick fix called "windowing", which would treat all dates from 00 to 20, as from the 2000s, rather than the 1900s. An estimated 80 percent of computers fixed in 1999 used the quicker, cheaper option. "Windowing, even during Y2K, was the worst of all possible solutions because it kicked the problem down the road," says Dylan Mulvin at the London School of Economics.... Another date storage problem also faces us in the year 2038. The issue again stems from Unix's epoch time: the data is stored as a 32-bit integer, which will run out of capacity at 3.14 am on 19 January 2038.' -- source: https://it.slashdot.org/story/20/01/12/0221226 Laziness always bites you in the bum in the end... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

'Why I Finally Switched from Chrome to Firefox - and You Should Too'
by Peter Reutemann 13 Jan '20

13 Jan '20

'In 2018 an associate technology editor at Fast Company's Co.Design wrote an article titled "Why I'm switching from Chrome to Firefox and you should too." Today shanen shared a similar article from Digital Trends. Their writer announces that after years of experimenting with both browsers, they've also finally switched from Chrome to Mozilla Firefox -- "and you should too." The biggest draw for me was, of course, the fact that Mozilla Firefox can finally go toe-to-toe with Google Chrome on the performance front, and often manages to edge it out as well... Today, in addition to being fast, Firefox is resource-efficient, unlike most of its peers. I don't have to think twice before firing up yet another tab. It's rare that I'm forced to close an existing tab to make room for a new one. On Firefox, my 2015 MacBook Pro's fans don't blast past my noise-canceling headphones, which happened fairly regularly on Chrome as it pushed my laptop's fans to their helicopter-like limits to keep things running. This rare balance of efficiency and performance is the result of the countless under-the-hood upgrades Firefox has rolled out in the last couple of years... Its Enhanced Tracking Protection framework keeps your identity safe by blocking trackers and cookies that otherwise follow you around the internet and collect sensitive information you probably didn't even know you were giving up. On top of that, Firefox can warn if a website is covertly mining cryptocurrency in the background. Most of these protections kick in by default and you have an exhaustive set of options to customize them the way you want. Firefox also lets you look into just how invasive a website is. It actively updates your personal privacy report so you can check how many trackers it has shut overall and for a specific website... What really clinched the switch to Mozilla Firefox was the fact that it's the only cross-platform browser that's not running Google's open-source Chromium platform. Microsoft's Edge, Brave, Opera, Vivaldi -- each of these browsers run on Chromium, accelerating Google's dominance over the web even when you're not directly using a Chrome user. Firefox, on the other hand, is powered by Mozilla's in-house Gecko engine that's not dependent on Chromium in any way. It may not seem like as vital of a trait as I make it sound, but it truly is, even though Chromium is open-source. Google oversees a huge chunk of the web, including ads, browser, and search, and this supremacy has allowed the company to pretty much run a monopoly and set its own rules for the open internet... Mozilla as a company has, despite a rocky journey, often taken bold stances in complex situations. In the Cambridge Analytica aftermath, Mozilla announced it would no longer run Facebook advertisements, cutting off direct marketing to over 2 billion users. In a world of tech companies taking frail, facile shots at protecting user privacy and barely delivering on their commitments, Mozilla is a breath of fresh air and you no longer have to live with any compromises to support it.' -- source: https://news.slashdot.org/story/20/01/11/2246247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds: Avoid Oracle's ZFS Kernel Code Until 'Litigious' Larry Signs Off
by Peter Reutemann 12 Jan '20

12 Jan '20

'"Linux kernel head Linus Torvalds has warned engineers against adding a module for the ZFS filesystem that was designed by Sun Microsystems -- and now owned by Oracle -- due to licensing issues," reports ZDNet: As reported by Phoronix, Torvalds has warned kernel developers against using ZFS on Linux, an implementation of OpenZFS, and refuses to merge any ZFS code until Oracle changes the open-source license it uses. ZFS has long been licensed under Sun's Common Development and Distribution License as opposed to the Linux kernel, which is licensed under GNU General Public License (GPL). Torvalds aired his opinion on the matter in response to a developer who argued that a recent kernel change "broke an important third-party module: ZFS". The Linux kernel creator says he refuses to merge the ZFS module into the kernel because he can't risk a lawsuit from "litigious" Oracle -- which is still trying to sue Google for copyright violations over its use of Java APIs in Android -- and Torvalds won't do so until Oracle founder Larry Ellison signs off on its use in the Linux kernel. "If somebody adds a kernel module like ZFS, they are on their own. I can't maintain it and I cannot be bound by other people's kernel changes," explained Torvalds. "And honestly, there is no way I can merge any of the ZFS efforts until I get an official letter from Oracle that is signed by their main legal counsel or preferably by Larry Ellison himself that says that yes, it's OK to do so and treat the end result as GPL'd," Torvalds continued. "Other people think it can be OK to merge ZFS code into the kernel and that the module interface makes it OK, and that's their decision. But considering Oracle's litigious nature, and the questions over licensing, there's no way I can feel safe in ever doing so."' -- source: https://linux.slashdot.org/story/20/01/11/0421238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Computer stuff
by Noel Villamor 12 Jan '20

12 Jan '20

Hi, I cleaned my garage and I have some stuff which might be useful to some - see attached pdf. Email me back if you need my address for pickup. I live in Fitzroy. With regards, Noel

2 2

Hundreds of Millions of Cable Modems Are Vulnerable To New Cable Haunt Vulnerability
by Peter Reutemann 11 Jan '20

11 Jan '20

'A team of four Danish security researchers has disclosed this week a security flaw that impacts cable modems that use Broadcom chips. From a report: The vulnerability, codenamed Cable Haunt, is believed to impact an estimated 200 million cable modems in Europe alone, the research team said today. The vulnerability impacts a standard component of Broadcom chips called a spectrum analyzer. This is a hardware and software component that protects the cable modem from signal surges and disturbances coming via the coax cable. The component is often used by internet service providers (ISPs) in debugging connection quality. On most cable modems, access to this component is limited for connections from the internal network. The research team says the Broadcom chip spectrum analyzer lacks protection against DNS rebinding attacks, uses default credentials, and also contains a programming error in its firmware.' -- source: https://it.slashdot.org/story/20/01/10/1914204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox gets patch for critical 0-day that’s being actively exploited
by Peter Reutemann 10 Jan '20

10 Jan '20

'Mozilla has released a new version of Firefox that fixes an actively exploited zero-day that could allow attackers to take control of users' computers. In an advisory, Mozilla rated the vulnerability critical and said it was "aware of targeted attacks in the wild abusing this flaw." The US Cybersecurity and Infrastructure Security Agency said one or more exploits were "detected in the wild" and warned that attacks could be exploited to "take control of an affected system." The Mozilla advisory credited researchers at China-based Qihoo 360 with reporting the flaw. No other details about the attacks were immediately available. Neither Mozilla nor Qihoo 360 responded to emails asking for more information. CVE-2019-17026, as the vulnerability is indexed, is a type confusion, a potentially critical error that can result in data being written to, or read from, memory locations that are normally off-limits. These out-of-bounds reads may allow attackers to discover memory locations where malicious code is stored so that protections such as address space layout randomization can be bypassed. Out-of-bounds reads can also cause crashes. The flaw is fixed in Tuesday's release of Firefox 72.0.1. The patch came a day after version 72 fixed 11 other vulnerabilities, six of which were rated high. Three of those six bugs might make it possible for attackers to run malicious code on affected computers.' -- source: https://arstechnica.com/information-technology/2020/01/firefox-gets-patch-f… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

4 3

Huawei Unveils OpenEuler, CentOS-Based Linux Distribution
by Peter Reutemann 10 Jan '20

10 Jan '20

'Huawei has released the source code of openEuler, its distribution of Linux based on CentOS. The operating system was formally launched by Huawei in September 2019 in response to U.S. sanctions, which had briefly affected the company's access to Windows and Android operating systems. The source code has now been published on Gitee, the Chinese version of Github. OpenEuler comprises two organizations on Gitee, one for source code and one for package sources. The openEuler organization was keen to highlight two particular packages, iSulad and A-Tune, among the openEuler source code. "iSulad is a lightweight gRPC service-based container runtime. Compared to runc, iSulad is written in C, but all interfaces are compatible with OCI. A-Tune is a system software to auto-optimize the system adaptively to multiple scenarios with embedded AI-engine." The announcement continues: "You will also see several infrastructure-supported projects that set up the community's operating systems... these systems are built on the Huawei Cloud through script automation." Among the package sources, covered by the src-openeuler organization on Gitee, are around 1,000 packages with versions in both ARM64 and X86 architecture packages. Huawei claims its developers have made a number of enhancements to ARM64 openEuler code to improve multi-core efficiency. It is also working on a "green computing" ecosystem with Linaro and the Green Industry Alliance. At the moment, the organization claims, there are more than 50 contributors and just under 600 commits. The openEuler community has around 20 SIGs or project groups.' -- source: https://tech.slashdot.org/story/20/01/09/058218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How Ars tests Wi-Fi gear (and you can, too)
by Peter Reutemann 09 Jan '20

09 Jan '20

'The tools and methodology we test Wi-Fi with are open source—so you can use them, too. After our review of Google's Nest Wi-Fi kit last fall, we received an unexpected request: Ars reader GerbilMagnus hopped into the comments and asked for an explainer about how we test Wi-Fi. Machination minutiae hadn't necessarily struck us as something of interest, but ask and you shall receive dear readers. Today, we're taking GerbilMagnus' lead and taking readers behind the scenes of our Wi-Fi testing process—we'll also toss in a little theory and practice along the way. If you want to try our methods at home, know up front that you don't necessarily have to replicate our entire test setup to start seeing useful results for yourself. But if you want to put the latest and greatest mesh gear through the gauntlet, we'll absolutely cover everything from top to bottom before we're done.' -- source: https://arstechnica.com/gadgets/2020/01/how-ars-tests-wi-fi-gear-and-you-ca… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Chrome To Hide Notification Spam Starting February 2020
by Peter Reutemann 09 Jan '20

09 Jan '20

'Following in Mozilla's footsteps, Google announced today plans to hide notification popup prompts inside Chrome starting next month, February 2020. ZDNet reports: According to a blog post published today, Google plans to roll out a "quieter notification permission UI that reduces the interruptiveness of notification permission requests." The change is scheduled for Google Chrome 80, scheduled for release on February 4, next month. Starting with Chrome 80 next month, Google's browser will also block most notification popups by default, and show an icon in the URL bar, similar to Firefox. When Chrome 80 launches next month, a new option will be added in the Chrome settings section that allows users to enroll in the new "quieter notification UI." Users can enable this option as soon as Chrome 80 is released, or they can wait for Google to enable it by default as the feature rolls out to the wider Chrome userbase in the following weeks. According to Google, the new feature works by hiding notification requests for Chrome users who regularly dismiss notification prompts. Furthermore, Chrome will also automatically block notification prompts on sites where users rarely accept notifications. ' -- source: https://it.slashdot.org/story/20/01/08/0632203 Nice to see the "[f]ollowing in Mozilla's footsteps". :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Half of the Websites Using WebAssembly Use it for Malicious Purposes
by Peter Reutemann 09 Jan '20

09 Jan '20

'Around half of the websites that use WebAssembly, a new web technology, use it for malicious purposes, according to academic research published last year. From a report: WebAssembly is a low-level bytecode language that was created after a joint collaboration between all major browser vendors. It introduces a new binary file format for transmitting code from a web server to a browser. Once it reaches the browser, WebAssembly code (Wasm) executes with near-native speed, similar to compiled C, C++, or Rust code. WebAssembly was created for both speed and performance. Due to its binary machine-friendly format, Wasm code is smaller than its equivalent JavaScript form, but also many times faster when executing. This has made WebAssembly the next incarnation of Adobe Flash, allowing websites to run complex CPU-intensive code without freezing a browser, a task for which JavaScript was never designed or optimized for.' -- source: https://it.slashdot.org/story/20/01/08/1421216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Coming Soon: The Web “Thin Client”
by Lawrence D'Oliveiro 08 Jan '20

08 Jan '20

Here’s a new trend to watch out for: it’s being called “browser isolation” <https://www.theregister.co.uk/2020/01/07/cloudflare_buys_s2/>: S2 developed a ... headless version of Chromium – the open-source foundation of Chrome and about two dozen other browsers – that runs in the cloud and intercepts calls to the browser's Skia graphics layer. "Before it actually draws anything virtual, we intercept those Skia calls, we tokenize them, we compress them, we send them through to any HTML5 browser, where we redraw them locally, right on the machine," Remington explained. "We use WebAssembly. We push a little Skia library that runs local in your browser, any browser. ... Turns out, it's very secure, because that is not an attack vector. It's only draw commands." ... According to Harnett, S2's scheme results in a 60 per cent bandwidth savings. "People are surprised when we say that in many cases, it's faster than local" ...

1 0

PGP keys, software security, and much more threatened by new SHA1 exploit
by Peter Reutemann 08 Jan '20

08 Jan '20

'Three years ago, Ars declared the SHA1 cryptographic hash algorithm officially dead after researchers performed the world’s first known instance of a fatal exploit known as a "collision" on it. On Tuesday, the dead SHA1 horse got clobbered again as a different team of researchers unveiled a new attack that’s significantly more powerful. The new collision gives attackers more options and flexibility than were available with the previous technique. It makes it practical to create PGP encryption keys that, when digitally signed using SHA1 algorithm, impersonate a chosen target. More generally, it produces the same hash for two or more attacker-chosen inputs by appending data to each of them. The attack unveiled on Tuesday also costs as little as $45,000 to carry out. The attack disclosed in 2017, by contrast, didn’t allow forgeries on specific predetermined document prefixes and was evaluated to cost from $110,000 to $560,000 on Amazon’s Web Services platform, depending on how quickly adversaries wanted to carry it out. The new attack is significant. While SHA1 has been slowly phased out over the past five years, it remains far from being fully deprecated. It’s still the default hash function for certifying PGP keys in the legacy 1.4 version branch of GnuPG, the open-source successor to PGP application for encrypting email and files. Those SHA1-generated signatures were accepted by the modern GnuPG branch until recently, and were only rejected after the researchers behind the new collision privately reported their results. Git, the world's most widely used system for managing software development among multiple people, still relies on SHA1 to ensure data integrity. And many non-Web applications that rely on HTTPS encryption still accept SHA1 certificates. SHA1 is also still allowed for in-protocol signatures in the Transport Layer Security and Secure Shell protocols.' -- source: https://arstechnica.com/information-technology/2020/01/pgp-keys-software-se… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 72 Arrives With Fingerprinting Blocked By Default, Picture-in-Picture on macOS and Linux
by Peter Reutemann 08 Jan '20

08 Jan '20

'Mozilla today launched Firefox 72 for Windows, Mac, Linux, and Android. Firefox 72 includes fingerprinting scripts blocked by default, less annoying notifications, and Picture-in-Picture video on macOS and Linux. There isn't too much else here, as Mozilla has now transitioned Firefox releases to a four-week cadence (from six to eight weeks).' -- source: https://news.slashdot.org/story/20/01/07/143225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome OS Has Stalled Out
by Peter Reutemann 07 Jan '20

07 Jan '20

'Speaking of Chromebooks, David Ruddock, opines at AndroidPolice: Chrome OS' problems really became apparent to me when Android app compatibility was introduced, around five years ago. Getting Android apps to run on Chrome OS was simultaneously one of the Chrome team's greatest achievements and one of its worst mistakes. In 2019, two things are more obvious than ever about the Android app situation on Chrome. The first is that the "build it and they will come" mantra never panned out. Developers never created an appreciable number of Android app experiences designed for Chrome (just as they never did for Android tablets). The second is that, quite frankly, Android apps are very bad on Chrome OS. Performance is highly variable, and interface bugs are basically unending because most of those apps were never designed for a point-and-click operating system. Sure, they crash less often than they did in the early days, but anyone saying that Android apps on Chrome OS are a good experience is delusional. Those apps are also a crutch that Chrome leans on to this day. Chrome OS doesn't have a robust photo editor? Don't worry, you can download an app! Chrome doesn't have native integration with cloud file services like Box, Dropbox, or OneDrive? Just download the app! Chrome doesn't have Microsoft Office? App! But this "solution" has basically become an insult to Chrome's users, forcing them to live inside a half-baked Android environment using apps that were almost exclusively designed for 6" touchscreens, and which exist in a containerized state that effectively firewalls them from much of the Chrome operating system. As a result, file handling is a nightmare, with only a very limited number of folders accessible to those applications, and the task of finding them from inside those apps a labyrinthine exercise no one should have to endure in 2019. This isn't a tenable state of affairs -- it's computing barbarism as far as I'm concerned. And yet, I've seen zero evidence that the Chrome team intends to fix it. It's just how it is. But Android apps, so far as I can tell, are basically the plan for Chrome. Certainly, Linux environment support is great for enthusiasts and developers, but there are very few commonly-used commercial applications available on Linux, with no sign that will change in the near future. It's another dead end. And if you want an even more depressing picture of Chrome's content ecosystem, just look at the pitiable situation with web apps.' -- source: https://developers.slashdot.org/story/20/01/06/1626227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

“Open Source” Journalism
by Lawrence D'Oliveiro 06 Jan '20

06 Jan '20

This week’s “Listening Post” on Al Jazeera (viewable here <https://www.aljazeera.com/programmes/listeningpost/2019/09/xinjiang-story-c…>) talks, in the latter part, about this new phenomenon of “open source” journalism. My understanding is, the meaning of “source” here is not that of “source code” familiar to software developers, but “source of information” as understood by journalists. That means getting information from public sources available to all. Even a tightly-controlled society like China makes a surprising amount of information freely available online--more than it really wants to make available, sometimes. And this information can be pieced together like a puzzle by perceptive investigators, to point to conclusions which can be directly at odds with public pronouncements from Government officials.

1 1

Linus Torvalds Calls Blogger's Linux Scheduler Tests 'Pure Garbage'
by Peter Reutemann 06 Jan '20

06 Jan '20

'On Wednesday Phoronix cited a blog post by C++ game developer Malte Skarupke claiming his spinlocks experiments had discovered the Linux kernel had a scheduler issue affecting developers bringing games to Linux for Google Stadia. Linus Torvalds has now responded: The whole post seems to be just wrong, and is measuring something completely different than what the author thinks and claims it is measuring. First off, spinlocks can only be used if you actually know you're not being scheduled while using them. But the blog post author seems to be implementing his own spinlocks in user space with no regard for whether the lock user might be scheduled or not. And the code used for the claimed "lock not held" timing is complete garbage. It basically reads the time before releasing the lock, and then it reads it after acquiring the lock again, and claims that the time difference is the time when no lock was held. Which is just inane and pointless and completely wrong... [T]he code in question is pure garbage. You can't do spinlocks like that. Or rather, you very much can do them like that, and when you do that you are measuring random latencies and getting nonsensical values, because what you are measuring is "I have a lot of busywork, where all the processes are CPU-bound, and I'm measuring random points of how long the scheduler kept the process in place". And then you write a blog-post blamings others, not understanding that it's your incorrect code that is garbage, and is giving random garbage values... You might even see issues like "when I run this as a foreground UI process, I get different numbers than when I run it in the background as a batch process". Cool interesting numbers, aren't they? No, they aren't cool and interesting at all, you've just created a particularly bad random number generator... [Y]ou should never ever think that you're clever enough to write your own locking routines.. Because the likelihood is that you aren't (and by that "you" I very much include myself -- we've tweaked all the in-kernel locking over decades, and gone through the simple test-and-set to ticket locks to cacheline-efficient queuing locks, and even people who know what they are doing tend to get it wrong several times). There's a reason why you can find decades of academic papers on locking. Really. It's hard. "It really means a lot to me that Linus responded," the blogger wrote later, "even if the response is negative." They replied to Torvalds' 1,500-word post on the same mailing list -- and this time received a 1900-word response arguing "you did locking fundamentally wrong..." The fact is, doing your own locking is hard. You need to really understand the issues, and you need to not over-simplify your model of the world to the point where it isn't actually describing reality any more... Dealing with reality is hard. It sometimes means that you need to make your mental model for how locking needs to work a lot more complicated...' -- source: https://linux.slashdot.org/story/20/01/06/012251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Open Source Initiative Co-Founder Bruce Perens Resigns, Citing Move Toward License 'That Isn't Freedom Respecting'
by Peter Reutemann 06 Jan '20

06 Jan '20

'Bruce Perens (Slashdot reader #3872) co-founded the Open Source Initiative with Eric Raymond in 1998. But on Thursday Perens posted "it seems to me that the organization is rather enthusiastically headed toward accepting a license that isn't freedom respecting. Fine, do it without me, please. "I asked Patrick to cancel my membership, and I would have unsubscribed from OSI lists, including this one, if your server was working..." The issue is a new software license drafted by lawyer Van Lindberg called the Cryptographic Autonomy License (or CAL). Another open-source-community leader familiar with the debate -- who spoke with The Register on condition of anonymity -- claimed Lindberg lobbied OSI directors privately to green-light the license, contrary to an approval process that's supposed to be carried out in public. "I don't think that's an appropriate characterization," said Lindberg, of law firm Dykema, in a phone interview with The Register. "I think there are number of people who from the beginning made up their minds about the Cryptographic Autonomy License. You'll see a lot of people jumping onto any pretext they can find in order to oppose it. With regard to this idea of lobbying, there have been procedural-type communications that I think are entirely reasonable," he added. "But all the substantive debate has been on the license review and license discussion forums...." Perens said he resigned because the OSI appears to have already decided to accept the license. He said he's headed in a different direction, which he called "coherent open source." "We've gone the wrong way with licensing," he said, citing the proliferation of software licenses. He believes just three are necessary, AGPLv3, the LGPLv3, and Apache v2. Meanwhile, the Cryptographic Autonomy License is envisioned for use with the distributed development platform Holo, notes the Register: According to Holo co-founder Arthur Brock, distributed peer-to-peer software needs a license that addresses cryptographic key rights, which is why the Cryptographic Autonomy License has been proposed. "We are trying to say: the only valid way to use our code is if that developer's end-users are the sole authors and controllers of their own private crypto keys," he wrote in a post last year. Lindberg said the Cryptographic Autonomy License is applicable to current web applications but it more meaningful in the context of distributed workloads and distributed computation, which he contends will become more important as people seek alternatives to the centralization of today's cloud-based systems. "A lot of people are very concerned about this concept of owning your data, owning your computer, having the ability to really control your computing experience and have it not be controlled by your cloud provider," said Lindberg. Perens said, "It's a good goal but it means you now need to have a lawyer to understand the license and to respond to your users." Slashdot asked Bruce Perens for details on "Coherent Open Source." Here's what he wrote back...' -- source: https://news.slashdot.org/story/20/01/05/208249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Dell's Upcoming XPS 13 Linux Laptop Includes a Fingerprint Reader
by Peter Reutemann 06 Jan '20

06 Jan '20

'If you've been following the steady march of progress from Dell's Linux-first Project Sputnik team, you're no doubt aware that the "Developer Edition" variant of the XPS 13 is one of the finest Linux-ready ultrabooks you can buy. Just ahead of CES 2020, Dell is pushing out a few more improvements including a feature that's been hotly requested: fingerprint-reader support. It's one of several enhancements Dell is promising to Linux users for its 10th-generation XPS 13, including a new maximum of 32GB RAM and a redesigned "InfinityEdge" display that adds even more screen real estate, resulting in an adjusted 16:10 aspect ratio to match... Details on fingerprint-reader support are still a bit vague, but Dell says it will be released shortly after the system's February 2020 launch as an OTA (over-the-air) update, and then as part of the preloaded Ubuntu Developer Edition image it ships with the system. Dell's lead on Project Sputnik developer systems, Barton George, also blogged about Dell's new 86-inch 4K interactive touch monitor, as well as their upcoming Latitude 9510 notebook and 2-in-1 laptops, promising "a new ultra-premium class of products" offering 5G mobile broadband capabilities, AI-based productivity capabilities, and 30-plus hours of battery life. The blog post ends by noting that "While project Sputnik is the most visible Linux-based offerings from Dell, it is only a small fraction of the over 150 systems that make up Dell's Linux portfolio."' -- source: https://linux.slashdot.org/story/20/01/05/0137242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1