- wlug - list.wlug.org.nz

Coincidence Of The Week (Or Not?)
by Lawrence D'Oliveiro 21 Jun '19

21 Jun '19

Just reading through this announcement <https://www.theregister.co.uk/2019/06/21/facebook_pyrobot/> of a new Python framework from Facebook called PyRobot, built on top of ROS (the Robot Operating System). Which led me to thinking of the origin of the word “robot”, which comes from a play by Karel Čapek, called “Rossum’s Universal Robots”, from 1920. And the original mastermind behind Python is named Guido van Rossum. And so another circle closes ...

1 0

Enter The Virtual Supercomputer
by Lawrence D'Oliveiro 21 Jun '19

21 Jun '19

A company called Descartes Labs has become number 136 on the top500 supercomputer list just by paying for a large enough collection of nodes on its Amazon Web Services account <https://www.theregister.co.uk/2019/06/20/supercomputer_aws/>. However, Dr Paul Calleja, directory of the University of Cambridge Research Computing Services, argues that this is not really cost-effective compared to buying your own actual gear, and the I/O performance is not that good anyway. Such a cloud cluster may score well on LINPACK, but not so well on real-world supercomputing problems. Dr Calleja advocates using OpenStack to build a “hybrid” combination of on-premise physical hardware backed up by cloud services for those times when you need a bit of a (temporary) boost. And for learner supercomputer drivers, there is always the option of a Raspberry π cluster to practise on, before being allowed behind the wheel of a real big-iron machine ...

1 0

Flushing All iptables Rules
by Lawrence D'Oliveiro 21 Jun '19

21 Jun '19

I have a script that I run on my Internet router machine to set up iptables rules for NAT forwarding and various other things. To ensure things are consistent, it starts by deleting any existing packet filter rules. The following sequence used to work for this: if test -f /proc/net/ip_tables_names; then for table in $(cat /proc/net/ip_tables_names); do iptables -t $table -F done fi However, while the file /proc/net/ip_tables_names still exists in current kernels, it no longer lists the names of tables for which rules are defined; instead, its contents are now always empty. It turns out there is now a new “nftables” interface for managing packet filter rules. The nice thing is, it has a command for listing all defined tables. For example, on my router machine, the command nft list tables prints out table ip filter table ip nat which means there are two tables named “filter” and “nat”, both part of the “ip” protocol stack. Interestingly, the nft(8) man page does not mention the “list tables” command (at least on Debian), only the more specific “list table «table»” form, which print out the rules within a given table. However, the nftables wiki <https://wiki.nftables.org/wiki-nftables/index.php/Quick_reference-nftables_…> does give all the details. As usual, the Arch Linux wiki entry <https://wiki.archlinux.org/index.php/Nftables> offers some additional useful info.

1 0

next lug meet
by Ian Young 20 Jun '19

20 Jun '19

Greets If required I may be able to find a few words about a new project on Distrowatch last week named Resilient Linux. Listed on GitHub. https://github.com/marco-buratto/resilientlinux Seems to have some interesting aspects. It would help if the iso image could unzip successfully. Should anyone obtain such let me know. ~ Ian Y

2 1

Microsoft’s Linux Strategy
by Lawrence D'Oliveiro 19 Jun '19

19 Jun '19

When Microsoft first embraced Docker and containers some years ago, no doubt people thought it was trying to nab some of that “virtualization-lite” action for its own Windows platform--at least I know I did. But with the release of WSL 2, which includes a full Linux kernel in Windows, it looks like this strategy has changed <https://www.theregister.co.uk/2019/06/18/the_future_of_docker_on_windows_is…>: The Docker news is of no interest to developers using Windows Containers, but there are not many of them. At Microsoft's Build conference last month, Gabe Monroy, lead program manager for the Azure Container Compute team, was asked whether Windows Containers are for legacy and Linux Containers for new projects. "I think that is a fair description," he said, demonstrating how the company's thinking on the subject has shifted. It seems Microsoft is now pushing the concept of develop on Windows, deploy on Linux. It is clearly hoping that those Linux deployments will happen on its Azure cloud, and so it still profits that way. Also, WSL 2 actually makes for worse Linux-Windows integration compared to WSL 1, which emulated the Linux APIs on top of Windows: Similarly, WSL 2 makes life better for developing Linux applications on Windows, but there are downsides. Running Linux in a VM as opposed to redirecting system calls is better for compatibility but inherently worse for integration. One aspect of this is that in WSL 2 I/O performance to files within the Linux VM is much faster, but I/O performance between Linux and the host is worse. Another is that WSL 2 has no access to serial or USB ports. Seems to me the obvious way to fix this, at least partially, is to flip things round, so instead of virtualizing Linux on top of Windows, you virtualize Windows on top of Linux. Then both your development and deployment platforms become fundamentally Linux-based. How long before that happens?

2 7

Birthplace Of BASIC Gets A Memorial Marker
by Lawrence D'Oliveiro 18 Jun '19

18 Jun '19

The US state of New Hampshire has added a marker <https://www.theregister.co.uk/2019/06/17/plaque_for_basic_birthplace_new_ha…> commemorating the creation of the BASIC programming language by professors Kemeny and Kurtz and a bunch of their students at Dartmouth College, back in 1964. The marker is not actually on College property, but on the nearest available state highway location.

1 0

Linux PCs, Servers, Gadgets Can Be Crashed by 'Ping of Death' Network Packets
by Peter Reutemann 17 Jun '19

17 Jun '19

'The Register reports that it is possible to crash network-facing Linux servers, PCs, smartphones and tablets, and gadgets, or slow down their network connections, by sending them a series of maliciously crafted packets. It is also possible to hamper FreeBSD machines with the same attack. Patches and mitigations are available, and can be applied by hand if needed, or you can wait for a security fix to be pushed or offered to your at-risk device. A key workaround is to set /proc/sys/net/ipv4/tcp_sack to 0. At the heart of the drama is a programming flaw dubbed SACK Panic aka CVE-2019-11477: this bug can be exploited to remotely crash systems powered by Linux kernel version 2.6.29 or higher, which was released 10 years ago.' -- source: https://linux.slashdot.org/story/19/06/17/2018227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

RKWard on Linux Mint 19.1 fails to start up
by Peter Reutemann 17 Jun '19

17 Jun '19

Hi everyone In case you're trying to use RKWard (GUI environment for the R language) on Linux Mint 19.1 and you keep getting the following error message: "The KDE installation could not be found (kreadconfig5). When moving / copying RKWard, make sure to copy the whole application folder, or create a shorcut / link, instead." Then simply install the following package: libkf5config-bin For instance, you can do this using apt-get: sudo apt-get install libkf5config-bin -- source: https://rkward-devel.narkive.com/M5x9XHCk/rkward-0-7-0-is-available Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A New Hidden Way of Web Browser Profiling, Identification and Tracking
by Peter Reutemann 17 Jun '19

17 Jun '19

'Researchers from Austria's Graz University of Technology "have devised an automated system for browser profiling using two new side channel attacks that can help expose information about software and hardware," reports The Register. The researchers recently presented a paper titled "JavaScript Template Attacks: Automatically Inferring Host Information for Targeted Exploits," which The Register says "calls into question the effectiveness of anonymized browsing and browser privacy extensions... " Long-time Slashdot reader Artem S. Tashkinov shared their report: One of the side-channel attacks developed for JavaScript Template Attacks involve measuring runtime differences between two code snippets to infer the underlying instruction set architecture through variations in JIT compiler behavior. The other involves measuring timing differences in the memory allocator to infer the allocated size of a memory region. The boffins' exploration of the JavaScript environment reveals not only the ability to fingerprint via browser version, installed privacy extension, privacy mode, operating system, device microarchitecture, and virtual machine, but also the properties of JavaScript objects. And their research shows there are far more of these than are covered in official documentation. This means browser fingerprints have the potential to be far more detailed -- have more data points -- than they are now. The Mozilla Developer Network documentation for Firefox, for example, covers 2,247 browser properties. The researchers were able to capture 15,709. Though not all of these are usable for fingerprinting and some represent duplicates, they say they found about 10,000 usable properties for all browsers.' -- source: https://yro.slashdot.org/story/19/06/16/232241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

next meeting - topics?
by Peter Reutemann 14 Jun '19

14 Jun '19

Hi everyone At the moment, we don't have a speaker for this month's meeting (June 24th): https://www.meetup.com/WaikatoLinuxUsersGroup/events/257884282/ Any volunteers? I was thinking of quickly demoing how to generate .deb packages from your code - I've forked an unmaintained plugin, which does that for Maven projects (= java based), i.e., I know a teeny bit about the process. Apart from the command-line tools, there are also GUI tools available for achieving this. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

CERN Ditches Microsoft to 'Take Back Control' With Open Source Software
by Peter Reutemann 14 Jun '19

14 Jun '19

'CERN is best known for pushing the boundaries of science and understanding, but the famed research outfit's next major experiment will be with open-source software. From a report: The European Organization for Nuclear Research, better known as CERN, and also known as home of the Large Hadron Collider, has announced plans to migrate away from Microsoft products and on to open-source solutions where possible. Why? Increases in Microsoft license fees. Microsoft recently revoked the organisations status as an academic institution, instead pricing access to its services on users. This bumps the cost of various software licenses 10x, which is just too much for CERN's budget' -- source: https://news.slashdot.org/story/19/06/12/1839213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

The Unstoppable Rise Of The Machines
by Lawrence D'Oliveiro 14 Jun '19

14 Jun '19

Researchers at the University of Tokyo have developed a robot that will always beat a human at rock-paper-scissors: <https://www.schneier.com/blog/archives/2019/06/rock-paper-scis.html>.

1 0

Windows 10's Linux Kernel Is Now Available
by Peter Reutemann 13 Jun '19

13 Jun '19

'Microsoft released a new Windows 10 Insider Preview build this week featuring the Windows Subsystem for Linux 2. WSL 2 includes a real Linux kernel that lets you run more Linux software on Windows and with better performance than WSL 1. From a report: This is part of Windows 10 Insider Preview build 18917, released on June 12, 2019. It's part of the fast ring of updates. You can experiment with it today, although you'll have to join the Windows Insider program and get unstable builds of Windows 10 on your PC. Microsoft's Windows Command Line blog offers more information about WSL 2, complete with an install guide, list of user experience changes, and more documentation. To install WSL 2 on the latest insider build, run the following command in a PowerShell window launched with Administrator permissions: Enable-WindowsOptionalFeature -Online -FeatureName VirtualMachinePlatform.' -- source: https://linux.slashdot.org/story/19/06/13/1442201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Promises To Play Nice With Ad Blockers (Again)
by Peter Reutemann 13 Jun '19

13 Jun '19

'After being ripped to shreds by angry users, Google engineers have promised this week that the upcoming changes to Chrome's extensions system won't cripple ad blockers, as everyone is fearing. Instead, the company claims that the new extension API changes will actually improve user privacy and bring speed improvements. Furthermore, Google also promised to raise a maximum limit in one of the upcoming APIs that should address and lay to rest the primary criticism brought against the new extensions API by developers of ad blockers during the last six months.' -- source: https://tech.slashdot.org/story/19/06/13/1522245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

System76's Supercharged Linux-powered Gazelle Laptop is Finally Available
by Peter Reutemann 13 Jun '19

13 Jun '19

'The System76 Gazelle laptop is finally available. From a report: What makes this laptop so special (besides its pre-installed Linux-based operating System), is its impressive specifications. You see, System76 has supercharged it with a 9th generation Intel Core i7 Processor (9750H) and NVIDIA GTX 16-Series Graphics. It even has something the pricey MacBook Pro doesn't -- the ability to be configure with up to 64GB. Yeah, Apple's laptop can only have a maximum of 32GB. The Gazelle can be configured with additional top specs, such as an NVMe SSD up to 2TB. Actually, it can accommodate two such drives, so you can theoretically have 4TB of speedy storage. You can opt for either a 15 or 17-inch display, both of which have a 1080p resolution. Regardless of screen size, you get a full keyboard too, meaning it has a number pad on the right. It ships with Ubuntu or Pop!_OS pre-installed and starts at $1099.' -- source: https://hardware.slashdot.org/story/19/06/13/189249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Yubico To Replace Vulnerable YubiKey FIPS Security Keys
by Peter Reutemann 13 Jun '19

13 Jun '19

'Yubico said today it plans to replace certain hardware security keys because of a firmware flaw that reduces the randomness of cryptographic keys generated by its devices. From a report: Affected products include models part of the YubiKey FIPS Series, a line of YubiKey authentication keys certified for use on US government networks (and others) according to the US government's Federal Information Processing Standards (FIPS). According to a Yubico security advisory published today, YubiKey FIPS Series devices that run firmware version 4.4.2 and 4.4.4 contain a bug that keeps "some predictable content" inside the device's data buffer after the power-up operation. This "predictable content" will influence the randomness of cryptographic keys generated on the device for a short period after the boot-up, until the "predictable content" is all used up, and true random data is present in the buffer. This means that for a short period after booting up YubiKey FIPS Series devices with the affected 4.4.2 and 4.4.4 versions will generate keys that can be either recovered partially, or in full, depending on the cryptographic algorithm the key is working with for a particular authentication operation.' -- source: https://tech.slashdot.org/story/19/06/13/1844232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

If you haven’t patched Vim or NeoVim text editors, you really, really should
by Peter Reutemann 13 Jun '19

13 Jun '19

'A recently patched vulnerability in text editors preinstalled in a variety of Linux distributions allows hackers to take control of computers when users open a malicious text file. The latest version of Apple’s macOS is continuing to use a vulnerable version, although attacks only work when users have changed a default setting that enables a feature called modelines. Vim and its forked derivative, NeoVim, contained a flaw that resided in modelines. This feature lets users specify window dimensions and other custom options near the start or end of a text file. While modelines restricts the commands available and runs them inside a sandbox that’s cordoned off from the operating system, researcher Armin Razmjou noticed the source! command (including the bang on the end) bypassed that protection.' -- source: https://arstechnica.com/information-technology/2019/06/if-you-havent-patche… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

WordPress.com VIP Platform Outage Reverts Sites To Default Themes
by Peter Reutemann 12 Jun '19

12 Jun '19

'Web blog hosting platform WordPress.com is currently facing a significant technical issue that has resulted in premium blogs going down or reverting to using default themes. Impacted sites include major news outlets like BBC America, TechCrunch, 9to5Mac, 9to5Google, VentureBeat, DroneDJ, and Electrek; but also many companies that were using the WordPress.com's VIP offering to host corporate blogs, such as Facebook, the Wikimedia Foundation, and others. Automattic, the company behind the WordPress.com service has admitted to the technical issue in a series of tweets and a blog post from its engineering staff.' -- source: https://it.slashdot.org/story/19/06/11/1812219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'RAMBleed' Rowhammer Attack Can Now Steal Data, Not Just Alter It
by Peter Reutemann 12 Jun '19

12 Jun '19

' A team of academics from the US, Austria, and Australia, has published new research today detailing yet another variation of the Rowhammer attack. From a report: The novelty in this new Rowhammer variety -- which the research team has named RAMBleed -- is that it can be used to steal information from a targeted device, as opposed to altering existing data or to elevate an attacker's privileges, like all previous Rowhammer attacks, have done in the past. [...] In a research paper [PDF] published today, academics unveiled RAMBleed, the first Rowhammer attack that can actively deduce and steal data from a RAM card. To do this, researchers had to come up and combine different techniques, which, when assembled, would permit a RAMBleed attack to take place.' -- source: https://tech.slashdot.org/story/19/06/11/1931214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Biggest Data Breach Archive On the Internet Is For Sale
by Peter Reutemann 12 Jun '19

12 Jun '19

'Troy Hunt, the owner and founder of the well-known and respected data breach notification website "Have I Been Pwned," announced today that he's actively looking for a buyer. "To date, every line of code, every configuration and every breached record has been handled by me alone. There is no 'HIBP team,' there's one guy keeping the whole thing afloat," Hunt wrote. "It's time for HIBP to grow up. It's time to go from that one guy doing what he can in his available time to a better-resourced and better-funded structure that's able to do way more than what I ever could on my own." Motherboard reports: Over the years, Have I Been Pwned has become the repository for data breaches on the internet, a place where users can search for their email address and see whether they have been part of a data breach. It's now also a service where people can sign up to get notified whenever their accounts get breached. It's perhaps the most useful, free, cybersecurity service in the world. Hunt said he's already had informal conversations with some organizations that might be interested in buying the service. Hunt said he's engaged the financial consulting firm KPMG to look for a buyer. In the post, Hunt shared some staggering numbers that explain just how big Have I Been Pwned has become: 8 billion breached records, nearly 3 million people subscribed to notifications, who have been emailed about a breach 7 million times, 150,000 unique visitors to the site on a normal day, 10 million on an abnormal day. Regardless of who buys the site, Hunt made a series of commitments on the future of Have I Been Pwned: searches should remain free for consumers, the platform should expand and grow, and, finally, he wants to stay involved in some capacity. ' -- source: https://it.slashdot.org/story/19/06/11/2017231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Security Is Always Down To The Weakest Link
by Lawrence D'Oliveiro 11 Jun '19

11 Jun '19

Nice non-paywalled report <https://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=12235615> into how the National Party (and others) were able to obtain supposedly-confidential details of today’s Budget announcements. In summary, a “clone” was made of the Treasury website, containing the Budget info, that was supposed to be swapped for the current production site later today. It was not publicly accessible, at least directly. However, the search function on the public site was inadvertently sucking up the confidential info from the clone server as well, and carefully-worded searches would reveal bits of such info as search context, even if the actual documents being indexed were not accessible in full. The Police have decided that, even though such leaks are considered a serious matter, the accesses were “not unlawful”. Which seems a refreshing change from, say, the UK, where someone was prosecuted and jailed some years ago just for putting “../” into a URL ...

2 2

Dotcom’s Lawyer Says Movie Copyright Warnings Are “Propaganda”
by Lawrence D'Oliveiro 11 Jun '19

11 Jun '19

The defence in the Kim Dotcom extradition case carefully explains why the cases of copyright infringement at issue are civil, not criminal matters, why there is a need for “safe harbour” provisions for ISPs (and services like Megaupload), and warns against the US Justice Department trying to shop around NZ law to find more criminal charges to hit him with. <https://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=12239483>

1 0

Opera, Brave, Vivaldi To Ignore Chrome's Anti-Ad-Blocker Changes, Despite Shared Codebase
by Peter Reutemann 11 Jun '19

11 Jun '19

'Despite sharing a common Chromium codebase, browser makers like Brave, Opera, and Vivaldi don't have plans on crippling support for ad blocker extensions in their products -- as Google is currently planning on doing within Chrome. From a report: The three browsers makers have confirmed to ZDNet, or in public comments, of not intending to support a change to the extensions system that Google plans to add to Chromium, the open-source browser project on which Chrome, Brave, Opera, and Vivaldi are all based on.' -- source: https://tech.slashdot.org/story/19/06/10/1651256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Large 'GoldBrute' RDP Botnet Hunts For Exposed Servers With Weak Passwords
by Peter Reutemann 08 Jun '19

08 Jun '19

'The Internet Storm Center reports: RDP, the remote desktop protocol, made the news recently after Microsoft patched a critical remote code execution vulnerability (CVE-2019-0708). While the reporting around this "Bluekeep" vulnerability focused on patching vulnerable servers, exposing RDP to the Internet has never been a good idea. Botnets have been scanning for these servers and are using weak and reused passwords to gain access to them. The latest example of such a botnet is an ongoing malicious campaign we are refering to as "GoldBrute". This botnet is currently brute forcing a list of about 1.5 million RDP servers exposed to the Internet... Each bot will only try one particular username and password per target. This is possibly a strategy to fly under the radar of security tools as each authentication attempt comes from different addresses. Long-time Slashdot reader UnderAttack writes: Infected systems will retrieve target lists from the command and control server and attempt to brute force credentials against the list, while at the same time looking for more exposed servers. With all the attention spent on patching RDP servers for the recent "BlueKeep" vulnerability, users should also make sure to just not expose RDP in the first place. Even patched, it will still be susceptible to brute forcing.' -- source: https://it.slashdot.org/story/19/06/08/0322234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu MATE 19.10 Is Ditching VLC for GNOME MPV
by Peter Reutemann 07 Jun '19

07 Jun '19

'GNOME MPV (now known as Celluloid) will be the default media player in Ubuntu MATE 19.10. From a report: The app supplants the versatile VLC meda player, which the MATE desktop-toting distro has shipped with following the results of a community poll back in 2017. So why the change now? Better desktop integration. That's according to Ubuntu MATE's Martin Wimpress who revealed news of the swap in the latest Ubuntu MATE monthly update on Patreon: "We will be dropping VLC from the pre-installed applications and shipping GNOME MPV instead. GNOME MPV will soon be renamed to Celluloid. The reasons for switching to GNOME MPV are similar to swapping out Thunderbird for Evolution; better desktop integration." Size is another factor. GNOME MPV takes up a comparatively svelte 27MB on the ISO image, whereas Qt5-based VLC requires closer to 70MB.' -- source: https://news.slashdot.org/story/19/06/06/1840240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

The Ambitious Plan To Reinvent How Websites Get Their Names
by Peter Reutemann 06 Jun '19

06 Jun '19

'When you type in a URL to your browser and press "enter," your browser sends that name to a network of computers called the Domain Name System (DNS), which converts it into IP addresses. These numbers are what allow your browser to find the right server on the internet and connect to it. When you navigate to a website, you are trusting a handful of organizations that have been charged with keeping the DNS working and secure. "To people like Steven McKie, a developer for and investor in an open-source project called the Handshake Network, this centralized power over internet naming makes the internet vulnerable to both censorship and cyberattacks," reports MIT technology review. "Handshake wants to decentralize it by creating an alternative naming system that nobody controls. In doing so, it could help protect us from hackers trying to exploit the DNS's security weaknesses, and from governments hoping to use it to block free expression." From the report: The system would be based on blockchain technology, meaning it would be software that runs on a widely distributed network of computers. In theory, it would have no single point of failure and depend on no human-run organization that could be corrupted or co-opted. Handshake's software is a heavily modified version ("fork") of Bitcoin, and just as Bitcoin's network of miners protects the cryptocurrency from manipulation and makes it virtually impossible for authorities to shut down, a similar network could keep a permanent, censorship-resistant record of internet names. The Handshake team is far from the first to try to create a decentralized naming system for the web. But unlike previous efforts, Handshake isn't trying to replace DNS but work with it. Besides ICANN, there's yet another class of organization whose job Handshake aims to decentralize. See that little padlock icon in your browser bar, to the left of the domain name? That means your computer has verified that your connection to this website is encrypted and that the site is authentic, not a fake one designed by a criminal trying to steal your login credentials. It does that by checking the veracity of a string of numbers called the site's digital certificate, issued by one of a number of so-called certificate authorities. These entities, many of which are for-profit companies, are crucial to internet security. They can also get hacked. And if one gets breached, and an attacker can start issuing fake certificates, it undermines the security of the whole internet. But if website names are managed on a tamper-resistant blockchain, then you don't need certificate authorities; the naming system itself can provide the guarantee that the site you're connected to is real. That's what Handshake aims to do. ' -- source: https://yro.slashdot.org/story/19/06/06/0028220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New RCE Vulnerability Impacts Nearly Half of the Internet's Email Servers
by Peter Reutemann 06 Jun '19

06 Jun '19

'A critical remote command execution (RCE) security flaw impacts over half of the Internet's email servers, security researchers from Qualys have revealed today. The vulnerability affects Exim, a mail transfer agent (MTA), which is software that runs on email servers to relay emails from senders to recipients. According to a June 2019 survey of all mail servers visible on the Internet, 57% (507,389) of all email servers run Exim -- although different reports would put the number of Exim installations at ten times that number, at 5.4 million. In a security alert shared with ZDNet earlier today, Qualys, a cyber-security firm specialized in cloud security and compliance, said it found a very dangerous vulnerability in Exim installations running versions 4.87 to 4.91. The vulnerability is described as a remote command execution -- different, but just as dangerous as a remote code execution flaw -- that lets a local or remote attacker run commands on the Exim server as root. Qualys said the vulnerability can be exploited instantly by a local attacker that has a presence on an email server, even with a low-privileged account. lBut the real danger comes from remote hackers exploiting the vulnerability, who can scan the internet for vulnerable servers, and take over systems. The vulnerability was patched with Exim 4.92, on February 10, 2019, "but at the time the Exim team released v4.92, they didn't know they fixed a major security hole," reports ZDNet. "This was only recently discovered by the Qualys team while auditing older Exim versions. Now, Qualys researchers are warning Exim users to update to the 4.92 version to avoid having their servers taken over by attackers."' -- source: https://it.slashdot.org/story/19/06/06/0046234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Germany: Backdoor Found in Four Smartphone Models; 20,000 Users Infected
by Peter Reutemann 06 Jun '19

06 Jun '19

'The German Federal Office for Information Security (or the Bundesamt fur Sicherheit in der Informationstechnik -- BSI) has issued security alerts today warning about dangerous backdoor malware found embedded in the firmware of at least four smartphone models sold in the country. Impacted models include the Doogee BL7000, the M-Horse Pure 1, the Keecoo P11, and the VKworld Mix Plus (malware present in the firmware, but inactive). All four are low-end Android smartphones. The BSI said the phones' firmware contained a backdoor trojan named Andr/Xgen2-CY.' -- source: https://tech.slashdot.org/story/19/06/06/199249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Launches Android Q Beta 4 With Final APIs and Official SDK
by Peter Reutemann 05 Jun '19

05 Jun '19

'Google today launched the fourth Android Q beta with final Android Q APIs and the official SDK. If you're a developer, this is your fourth Android Q preview, and you can start testing your apps against this release by downloading it from developer.android.com/preview. The preview includes system images for the Pixel, Pixel XL, Pixel 2, Pixel 2 XL, Pixel 3, Pixel 3 XL, Pixel 3a, Pixel 3a XL, and the official Android Emulator. If you're already enrolled in the beta program, you'll automatically get the update to Beta 4. Like Beta 3, Google is also bringing Android Q Beta 4 to third-party phones "over the coming weeks." The Beta 4 doesn't bring many new features -- it's more about finalizing what was already added, such as the additional privacy and security features, multitasking bubbles, and system-wide dark mode. Google is however "opening publishing on Google Play to apps that are compiled against, or optionally targeting, API 29," the report adds. "You can thus now push updates to users through Google Play to test your app's compatibility, including on devices running Android Q Beta' -- source: https://mobile.slashdot.org/story/19/06/05/2123245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome 75 Released With Web Share API File Support, Numeric Separators and Secret Reader Mode
by Peter Reutemann 05 Jun '19

05 Jun '19

'Google this week released Chrome 75 for Windows, Mac, Linux, Android, and iOS. The release includes hint for low latency canvas contexts, files supported in the Web Share API, numeric separators, and more developer features. [...] Next, files are now supported by the Web Share API. For years, Google has been working to bring native sharing capabilities to the web. The Web Share API allows web apps to invoke the same share dialog box as a native app. The implementation brings a new method and a new shareData property. Numeric literals now allow underscores (_, U+005F) as separators to make them more readable. Underscores can only appear between digits, and consecutive underscores are not allowed. There is also a reader mode that is not enabled by default. From a report: The big feature included with Chrome 75 is the addition of a hidden Reader Mode, similar to the one included with Firefox. This new Reader Mode is not active by default and must be turned on using one of Google Chrome's experimental flags -- which until recently has only been available in the Chrome Canary distribution. To enable and test Chrome's new Reader Mode, users must visit the chrome://flags/#enable-reader-mode section, and enable the Reader Mode option, as in the screenshot below. Chrome for Android includes these two features: 1. Generate strong and unique passwords with Chrome's built-in password manager. 2. Quickly look up your passwords by tapping any password field and using the new keyboard option.' -- source: https://tech.slashdot.org/story/19/06/05/1357233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

238 Google Play apps with >440 million installs made phones nearly unusable
by Peter Reutemann 04 Jun '19

04 Jun '19

'If the prevalence of abusive Google Play apps has left you numb, this latest report is for you. Carefully concealed adware installed in Google-approved apps with more than 440 million installations was so aggressive that it rendered mobile devices nearly unusable, researchers from mobile security provider Lookout said Tuesday. BeiTaAd, as the adware is known, is a plugin that Lookout says it found hidden in emojis keyboard TouchPal and 237 other applications, all of which were published by Shanghai, China-based CooTek. Together, the 238 unique apps had a combined 440 million installs. Once installed, the apps initially behaved normally. Then, after a delay of anywhere between 24 hours and 14 days, the obfuscated BeiTaAd plugin would begin delivering what are known as out-of-app ads. These ads appeared on users' lock screens and triggered audio and video at seemingly random times or even when a phone was asleep.' -- source: https://arstechnica.com/information-technology/2019/06/238-google-play-apps… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apple Replaces Bash With Zsh as the Default Shell in macOS Catalina
by Peter Reutemann 04 Jun '19

04 Jun '19

'Starting with macOS Catalina, Macs will now use zsh as the default login shell and interactive shell across the operating system. From a report: All newly created user accounts in macOS Catalina will use zsh by default. Bash will still be available, but Apple is signaling that developers should start moving to zsh on macOS Mojave or earlier in anticipation of bash eventually going away in macOS. Apple hasn't explained exactly why it's making this change, but bash isn't exactly a modern shell as it's implemented in macOS, and a switch to something less aging makes a lot more sense for the company. Apple is stuck using version 3.2 of bash that has been licensed under GPLv2, as newer versions are licensed under GPLv3. Apple has kept clear of using GPLv3 packages in macOS as the license is generally more restrictive to companies like Apple that sign their own code and it includes explicit patent grants, ' -- source: https://apple.slashdot.org/story/19/06/04/1645240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Firefox Starts Blocking Third-Party Cookies By Default
by Peter Reutemann 04 Jun '19

04 Jun '19

'Mozilla today announced a slew of privacy improvements. The company has turned on Enhanced Tracking Protection, which blocks cookies from third-party trackers in Firefox, by default. Mozilla has also improved its Facebook Container extension, released a Firefox desktop extension for its rebranded Lockwise password keeper, and updated Firefox Monitor with a dashboard for multiple email addresses. Mozilla added basic Tracking Protection to Firefox 42's private browsing mode in November 2015. The feature blocked website elements (ads, analytics trackers, and social share buttons) based on Disconnect's tracking protection rules. With the release of Firefox 57 in November 2017, Mozilla added an option to enable Tracking Protection outside of private browsing. (Tracking Protection was not turned on by default because it can break websites and cut off revenue streams for content creators who depend on third-party advertising.)' -- source: https://news.slashdot.org/story/19/06/04/1636241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Dell Begins Pre-Installing Linux On Range of Precision Laptops
by Peter Reutemann 31 May '19

31 May '19

'"While Linux-preloaded laptops have been available for years from smaller companies, and have represented a fraction of their own sales with the much-admired XPS 13 developer model, Dell now offers a range of Precision models pre-installed with Ubuntu Linux," writes Slashdot reader Freshly Exhumed. Phoronix reports: At the start of May Dell announced an Ubuntu Linux option for their entry-level ~$700 Precision laptop while now they are closing out May by offering up Ubuntu 18.04 LTS on their higher-tier Precision laptop models. Ubuntu Linux has landed for the rest of Dell's current generation Precision mobile workstation line-up with support for the Precision 5540, 7540, and 7740. The Precision 5540 offers options of Xeon E or 9th Gen Core CPUs with up to 64GB of RAM and options for a NVIDIA Quadro T2000. The Precision 7540/7740 meanwhile are more powerful mobile workstations with supporting up to 128GB of ECC RAM and latest generation processors. The Precision 7740 model can also accomodate NVIDIA Quadro RTX 5000 series graphics. Additional details can be found via this blog post by Dell's Barton George.' -- source: https://linux.slashdot.org/story/19/05/30/2154256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Advanced Linux backdoor found in the wild escaped AV detection
by Peter Reutemann 30 May '19

30 May '19

'Researchers say they’ve discovered an advanced piece of Linux malware that has escaped detection by antivirus products and appears to be actively used in targeted attacks. HiddenWasp, as the malware has been dubbed, is a fully developed suite of malware that includes a trojan, rootkit, and initial deployment script, researchers at security firm Intezer reported on Wednesday. At the time Intezer’s post went live, the VirusTotal malware service indicated Hidden Wasp wasn’t detected by any of the 59 antivirus engines it tracks, although some have now begun to flag it. Time stamps in one of the 10 files Intezer analyzed indicated it was created last month. The command and control server that infected computers report to remained operational at the time this article was being prepared. Some of the evidence analyzed—including code showing that the computers it infects are already compromised by the same attackers—indicated that HiddenWasp is likely a later stage of malware that gets served to targets of interest who have already been infected by an earlier stage. It’s not clear how many computers have been infected or how any earlier related stages get installed. With the ability to download and execute code, upload files, and perform a variety of other commands, the purpose of the malware appears to be to remotely control the computers it infects. That's different from most Linux malware, which exists to perform denial of service attacks or mine cryptocurrencies.' -- source: https://arstechnica.com/information-technology/2019/05/advanced-linux-backd… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

libmtp error: could not delete object.
by John 29 May '19

29 May '19

Hi All, I have just got a 16gig micro sd card with my Granddaughters data on it. I managed to delete almost completely all the data but there are ten files that will not delete either on the phone or my computer the phone say the files are deleted but they remain the computer returns a "could not delete" error. I tried "sudo apt-get install mtp-server libmtpserver-dev" But got a error msg unable to locate mtp and libmtpserver. Any one can help please................ Cheers John..

2 1

Chinese Military To Replace Windows OS Amid Fears of US Hacking
by Peter Reutemann 29 May '19

29 May '19

'Amidst an escalating trade war and political tensions with the US, Beijing officials have decided to develop a custom operating system that will replace the Windows OS on computers used by the Chinese military. From a report: The decision, while not made official through the government's normal press channels, was reported earlier this month by Canada-based military magazine Kanwa Asian Defence. Per the magazine, Chinese military officials won't be jumping ship from Windows to Linux but will develop a custom OS. Thanks to the Snowden, Shadow Brokers, and Vault7 leaks, Beijing officials are well aware of the US' hefty arsenal of hacking tools, available for anything from smart TVs to Linux servers, and from routers to common desktop operating systems, such as Windows and Mac. Since these leaks have revealed that the US can hack into almost anything, the Chinese government's plan is to adopt a "security by obscurity" approach and run a custom operating system that will make it harder for foreign threat actors -- mainly the US -- to spy on Chinese military operations.' -- source: https://news.slashdot.org/story/19/05/28/1613221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

W3C and WHATWG Sign Agreement To Collaborate on a Single Version of HTML and DOM
by Peter Reutemann 29 May '19

29 May '19

'W3C and the WHATWG signed an agreement today to collaborate on the development of a single version of the HTML and DOM specifications. >From a blog post: The Memorandum of Understanding jointly published as the WHATWG/W3C Joint Working Mode gives the specifics of this collaboration. This is the culmination of a careful exploration effective partnership mechanisms since December 2017 after the WHATWG adopted many shared features as their work-mode and an IPR policy. The HTML Working Group which we will soon recharter will assist the W3C community in raising issues and proposing solutions for the HTML and DOM specifications, and bring WHATWG Review Drafts to Recommendation. Motivated by the belief that having two distinct HTML and DOM specifications claiming to be normative is generally harmful for the community, and the mutual desire to bring the work back together, W3C and WHATWG agree to the following terms: W3C and WHATWG work together on HTML and DOM, in the WHATWG repositories, to produce a Living Standard and Recommendation/Review Draft-snapshots. WHATWG maintains the HTML and DOM Living Standards. W3C facilitates community work directly in the WHATWG repositories (bridging communities, developing use cases, filing issues, writing tests, mediating issue resolution). W3C stops independent publishing of a designated list of specifications related to HTML and DOM and instead will work to take WHATWG Review Drafts to W3C Recommendations.' -- source: https://tech.slashdot.org/story/19/05/28/1353243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Google's Chrome Becomes Web 'Gatekeeper' and Rivals Complain
by Peter Reutemann 28 May '19

28 May '19

'Few home-grown Google products have been as successful as Chrome. Launched in 2008, it has more than 63% of the market and about 70% on desktop computers, according to StatCounter data. Mozilla's Firefox is far behind, while Apple's Safari is the default browser for iPhones. Microsoft's Internet Explorer and Edge browsers are punchlines. From a report: Google won by offering consumers a fast, customizable browser for free, while embracing open web standards. Now that Chrome is the clear leader, it controls how the standards are set. That's sparking concern Google is using the browser and its Chromium open-source underpinnings to elbow out online competitors and tilt entire industries in its favor. Most major browsers are now built on the Chromium software code base that Google maintains. Opera, an indie browser that's been used by techies for years, swapped its code base for Chromium in 2013. Even Microsoft is making the switch this year. That creates a snowball effect, where fewer web developers build for niche browsers, leading those browsers to switch over to Chromium to avoid getting left behind. This leaves Chrome's competitors relying on Google employees who do most of the work to keep Chromium software code up to date. Chromium is open source, so anyone can suggest changes to it, but the majority of programmers who approve contributions are Google employees, and any major disagreements get settled by a small circle of senior Google employees. Chrome is so ascendant these days that web developers often don't bother to test their sites on competing browsers. Google services including YouTube, Docs and Gmail sometimes don't work as well on rival browsers, sending frustrated users to Chrome. Instead of just another ship slicing through the sea of the web, Chrome is becoming the ocean.' -- source: https://developers.slashdot.org/story/19/05/28/1845238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Huawei's Android Replacement OS Will Launch in June, Company Exec Says
by Peter Reutemann 28 May '19

28 May '19

'Huawei's home-grown operating system -- codenamed HongMeng -- that's set to replace Android once the Huawei ban from Google comes into full effect, will be commercially rolled out next month, a Middle East head for the firm revealed exclusively to TechRadar Middle East. From a report: On May 20, Google announced that it would partially cut off Huawei devices from its Android operating system but was given an extension till August 19 by the US White House. "Huawei knew this was coming and was preparing. The OS was ready in January 2018 and this was our 'Plan B'," said Alaa Elshimy, Managing Director and Vice President of Huawei Enterprise Business Group Middle East. "We did not want to bring the OS to the market as we had a strong relationship with Google and others and did not want to ruin the relationship. Now, we are rolling it out next month' -- source: https://tech.slashdot.org/story/19/05/28/1524239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Cell phones
by John 25 May '19

25 May '19

Does anyone know where I can re-cycle some cell phones?? Cheers John..

2 1

Programmers’ Question Time
by Lawrence D'Oliveiro 24 May '19

24 May '19

I think Verity Stob <https://www.theregister.co.uk/2019/05/23/verity_stob_column_may/> has outdone herself: Some people, when confronted with a problem, think “I know, I’ll use FP.” Now they have two problems... Although actually they still think they’ve got one problem, because the problem counter is now immutable.

1 0

Antergos Linux Has Been Discontinued
by Peter Reutemann 23 May '19

23 May '19

'An Arch Linux based distribution, Antergos, has been discontinued. The project's primary goal was to make Arch Linux available to a wider audience of users by providing a streamlined, user friendly experience including a safe place for users to communicate, learn, and help one another. There have been 931,439 unique downloads of Antergos Linux since 2014. The primary reason for ending support for it was that the developers no longer have enough free time to properly maintain the distribution. They came to this decision because they believe that continuing to neglect the project would be a huge disservice to the community. Taking this action now, while the project's code still works, provides an opportunity for interested developers to take what they find useful and start their own projects. For existing Antergos users: there is no need to worry about installed systems as they will continue to receive updates directly from Arch. Soon, an update will be released that will remove the Antergos repos from system along with any Antergos-specific packages that no longer serve a purpose due to the project ending. Once that is completed, any packages installed from the Antergos repo that are in the AUR will begin to receive updates from there. The Antergos Forum and Wiki will continue to be available until such time it becomes clear that users have moved on to other projec' -- source: https://linux.slashdot.org/story/19/05/23/1813214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Crowdfunded Android Console Ouya Will Be Shut Down On June 25th
by Peter Reutemann 23 May '19

23 May '19

'Razer, the gaming hardware manufacturing company that purchased Ouya's software assets in mid-2015, announced today that the crowdfunded Android console will cease functioning on June 25th. "That date will mark the unremarkable end of what began as a runaway Kickstarter success story: the inexpensive Ouya mini-console was powered by Android and introduced games such as TowerFall," reports The Verge. "But despite being positioned as the indie console, Ouya never quite took off after its $8.5 million crowdfunding campaign. The goal was to move Android's indie gaming scene to TV screens -- with exclusive Ouya-only titles mixed in -- but the execution didn't pan out." From the report: The hardware has been discontinued ever since Razer acquired Ouya's software assets in 2015. So it's somewhat surprising that the platform has continued to plod along for nearly four additional years. But that all ends next month. Accounts will be deactivated on June 25th. After that, Razer says "access to the Discover section will no longer be available. Games downloaded that appear in Play may still function if they do not require a purchase validation upon launch." But by and large, games on the Ouya platform will stop working after the cutoff date. Razer notes that some developers might choose to help their Ouya customers by activating the same game on some other platform (i.e., Google Play) where available following the shutdown. Razer's own Forge TV device will continue functioning as an Android TV set-top box, but the Forge TV games store is also going offline come the 25th. Part of Razer's thinking behind the Ouya acquisition was to propel its long-term Android TV gaming ambitions. The company has clearly shifted its priorities over the last few years, as indicated by the decision to finally shut down Ouya once and for all.' -- source: https://hardware.slashdot.org/story/19/05/22/2042225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ARM Memo Tells Staff To Stop Working With Huawei
by Peter Reutemann 22 May '19

22 May '19

'UK-based chip designer ARM has told staff it must suspend business with Huawei, according to internal documents obtained by the BBC. ARM instructed employees to halt "all active contracts, support entitlements, and any pending engagementsâ with Huawei and its subsidiaries to comply with a recent US trade clampdown. From a report: ARM's designs form the basis of most mobile device processors worldwide. In a company memo, it said its designs contained "US origin technology." As a consequence, it believes it is affected by the Trump administration's ban. One analyst described the move, if it became long-term, as an "insurmountable" blow to Huawei's business. He said it would greatly affect the firm's ability to develop its own chips, many of which are currently built with ARM's underlying technology, for which it pays a licence.' -- source: https://tech.slashdot.org/story/19/05/22/141215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android and iOS Devices Impacted By New Sensor Calibration Attack
by Peter Reutemann 22 May '19

22 May '19

'A new device fingerprinting technique can track Android and iOS devices across the Internet by using factory-set sensor calibration details that any app or website can obtain without special permissions. From a report: This new technique -- called a calibration fingerprinting attack, or SensorID -- works by using calibration details from gyroscope and magnetometer sensors on iOS; and calibration details from accelerometer, gyroscope, and magnetometer sensors on Android devices. According to a team of academics from the University of Cambridge in the UK, SensorID impacts iOS devices more than Android smartphones. The reason is that Apple likes to calibrate iPhone and iPad sensors on its factory line, a process that only a few Android vendors are using to improve the accuracy of their smartphones' sensors. "Our approach works by carefully analysing the data from sensors which are accessible without any special permissions to both websites and apps," the research team said in a research paper published yesterday. "Our analysis infers the per-device factory calibration data which manufacturers embed into the firmware of the smartphone to compensate for systematic manufacturing errors [in their devices' sensors]," researchers said. This calibration data can then be used as a fingerprint, producing a unique identifier that advertising or analytics firms can use to track a user as they navigate across the internet.' -- source: https://it.slashdot.org/story/19/05/22/1852204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

decompressing large zip files
by Peter Reutemann 22 May '19

22 May '19

Hi there Once in a while, I get large zip files from clients. Since they are running Windows, their zip tool doesn't have the same 4GB limitation that the unzip command-line tool under Linux usually has. Today, I once again had to deal with a large file and had some time to look into a solution that wouldn't involve copying the file onto a Windows box for converting the archive. If you have p7zip-full installed, you can use: 7z x file.zip If you have Java installed, you can use: jar xf file.zip Found here: https://serverfault.com/questions/235139/how-to-unzip-files-bigger-than-4gb Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 13

Google Says Some G Suite User Passwords Were Stored In Plaintext Since 2005
by Peter Reutemann 21 May '19

21 May '19

'Google says a small number of its enterprise customers mistakenly had their passwords stored on its systems in plaintext. The exact number was not disclosed. "We recently notified a subset of our enterprise G Suite customers that some passwords were stored in our encrypted internal systems unhashed," said Google vice president of engineering Suzanne Frey. Slashdot reader pegdhcp appears to be one of the users impacted by this security lapse: I am sharing a message that I received from G Suite, redacted. They are having some serious problem... If you missed the message or somehow tend to ignore sometimes extremely frequent and unnecessary G Suite messages like I do, this one can be important depending on your settings.' -- source: https://it.slashdot.org/story/19/05/21/223208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Huawei Considers Rivals To Google's Android After US Ban
by Peter Reutemann 21 May '19

21 May '19

'Huawei said it's working on its own operating system for its mobile handsets and will consider rivals to Google's Android, after the U.S. blacklisted the company, threatening its partnerships with chip, component and software suppliers. From a report: The Chinese telecom equipment giant said Tuesday it was in talks with the Alphabet about how to proceed after Google confirmed it would cut access to some of Huawei's operating system features for the company's new devices in response to the announcement. Should Google's system no longer be available, "then the alternative option will naturally come out -- either from Huawei or someone else," Abraham Liu, Huawei's representative to the European Union institutions, said at an event in Brussels on Tuesday. Liu said Huawei had been working on its own operating system but that he didn't have the details about when this would be ready. Huawei would do everything in its power to mitigate the impact of the U.S. decisions, Liu said' -- source: https://mobile.slashdot.org/story/19/05/21/1357240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 67 Arrives With New Performance and Privacy Features, Voice Search Widget on Android
by Peter Reutemann 21 May '19

21 May '19

'Mozilla today launched Firefox 67 for Windows, Mac, Linux, and Android. From a report: The 10th release since Mozilla's big Firefox Quantum launch in November 2017 doubles down on performance and privacy. Firefox 67 includes deprioritizing least commonly used features, suspending unused tabs, faster startup, blocking of cryptomining and fingerprinting, Private Browsing improvements, voice input in the Android search widget, and more. [...] Firefox 67 is better at performing tasks at the optimal time, resulting in faster "painting" of the page. Specifically, the browser deprioritizes least commonly used features and delays set Timeout to prioritize scripts for things you need. Mozilla says Instagram, Amazon, and Google searches now execute between 40% and 80% faster. Firefox also now scans for alternative style sheets after page load and doesn't load the auto-fill module unless there is a form to complete. Next, Firefox 67 detects if your computer's memory is running low (under 400MB) and suspends unused tabs. If you do click on a tab that you haven't used or looked at in a while, it will reload where you left off. Finally, Firefox 67 promises faster startup for users that customized their browser with an add-on.' -- source: https://news.slashdot.org/story/19/05/21/1636224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

First Official Version of Tor Browser for Android Released on Play Store
by Peter Reutemann 21 May '19

21 May '19

'The Tor Project today made the first stable version of its privacy-focused browser available on the Google Play Store. From a report: This new mobile browser integrates the Tor protocol stack into a standalone browser and replaces Orfox as the main way to navigate the Tor network from an Android device. Tor Project developers have been working on this browser for eight months now, since September 2018, when they first released an alpha version for public testing. "We made it a priority to reach the rising number of users who only browse the web with a mobile device," said Isabela Bagueros, Executive Director of the Tor Project. "These users often face heavy surveillance and censorship online, so it is critical for us to reach them. We made sure there are no proxy bypasses, that first-party isolation is enabled to protect you from cross-site tracking, and that most of the fingerprinting defenses are working," the Tor team added.' -- source: https://yro.slashdot.org/story/19/05/21/1835256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel Performance Hit 5x Harder Than AMD After Spectre, Meltdown Patches
by Peter Reutemann 21 May '19

21 May '19

'Phoronix has conducted a series of tests to show just how much the Spectre and Meltdown patches have impacted the raw performance of Intel and AMD CPUs. While the patches have resulted in performance decreases across the board, ranging from virtually nothing to significant depending on the application, it appears that Intel received the short end of the stick as its CPUs have been hit five times harder than AMD, according to ExtremeTech. From the report: The collective impact of enabling all patches is not a positive for Intel. While the impacts vary tremendously from virtually nothing to significant on an application-by-application level, the collective whack is about 15-16 percent on all Intel CPUs without Hyper-Threading disabled. Disabling increases the overall performance impact to 20 percent (for the 7980XE), 24.8 percent (8700K) and 20.5 percent (6800K). The AMD CPUs are not tested with HT disabled, because disabling SMT isn't a required fix for the situation on AMD chips, but the cumulative impact of the decline is much smaller. AMD loses ~3 percent with all fixes enabled. The impact of these changes is enough to change the relative performance weighting between the tested solutions. With no fixes applied, across its entire test suite, the CPU performance ranking is (from fastest to slowest): 7980XE (288), 8700K (271), 2990WX (245), 2700X (219), 6800K. (200). With the full suite of mitigations enabled, the CPU performance ranking is (from fastest to slowest): 2990WX (238), 7980XE (231), 2700X (213), 8700K (204), 6800K (159). In closing, ExtremeTech writes: "AMD, in other words, now leads the aggregate performance metrics, moving from 3rd and 4th to 1st and 3rd. This isn't the same as winning every test, and since the degree to which each test responds to these changes varies, you can't claim that the 2990WX is now across-the-board faster than the 7980XE in the Phoronix benchmark suite. It isn't. But the cumulative impact of these patches could result in more tests where Intel and AMD switch rankings as a result of performance impacts that only hit one vendor."' -- source: https://hardware.slashdot.org/story/19/05/20/228218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

>20, 000 Linksys routers leak historic record of every device ever connected
by Peter Reutemann 21 May '19

21 May '19

'This post has been updated to add comments Linksys made online, which says company researchers couldn't reproduce the information disclosure exploit on routers that installed a patch released in 2014. Representatives of Belkin, the company that acquired Linksys in 2013, didn't respond to the request for comment that Ars sent on Monday. Ars saw the statement only after this article went live. More than 20,000 Linksys wireless routers are regularly leaking full historic records of every device that has ever connected to them, including devices' unique identifiers, names, and the operating systems they use. The data can be used by snoops or hackers in either targeted or opportunistic attacks. Independent researcher Troy Mursch said the leak is the result of a flaw in almost three dozen models of Linksys routers. It took about 25 minutes for the Binary Edge search engine of Internet-connected devices to find 21,401 vulnerable devices on Friday. A scan earlier in the week found 25,617. They were leaking a total of 756,565 unique MAC addresses. Exploiting the flaw requires only a few lines of code that harvest every MAC address, device name, and operating system that has ever connected to each of them. The flaw allows snoops or hackers to assemble disparate pieces of information that most people assume aren’t public. By combining a historical record of devices that have connected to a public IP addresses, marketers, abusive spouses, and investigators can track the movements of people they want to track. The disclosure can also be useful to hackers. The Shadowhammer group, for instance, recently infected as many as 1 million people after hacking the software update mechanism of computer maker ASUS. The hackers then used a list of about 600 MAC addresses of specific targets that, if infected, would receive advanced stages of the malware.' -- source: https://arstechnica.com/information-technology/2019/05/33-linksys-router-mo… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Distros Without Systemd (2019)
by Peter Reutemann 20 May '19

20 May '19

'It's 2019 -- who has switched to systemd, who hasn't and what can I use if I don't like systemd? Here's the answer in short. >From the blog post: If you are reading this post you're very much likely not a fan of systemd already. So we won't preach on why systemd is bad, but today we'll focus more on what are the alternatives out there. Our approach is obviously not for settling for less but for changing things for the better. We have started the world after systemd project some time ago and the search isn't over. So what are the non-systemd distros out there? The author makes a case for why you should consider the suggested distros, but here's the list: Devuan, Alpine Linux, Artixlinux, Void, Slackware, Gentoo, and GNU GUIX.' -- source: https://linux.slashdot.org/story/19/05/20/1916226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Opera Reborn 3: No modern browser is perfect, but this may be as close as it gets
by Peter Reutemann 20 May '19

20 May '19

'When Opera Software unveiled a new look and feel for its browser earlier this year, the company made a big deal of the impending changes. "We put Web content at center stage," the Opera team declared on its blog. And early previews of the design appeared to be quite pared down, allowing users to browse "unhindered by unnecessary distractions" as the Opera team put it. Well Opera recently released what the company refers to as Reborn 3, the latest version of its flagship desktop browser, and it's tempting to dismiss the name as little more than marketing hype. But given the relentless and utterly unspectacular updates that the Chromium project releases every six weeks, it can also be hard to denote actual big releases of browsers based on Chromium—hence the "Reborn" moniker. After spending some time with Reborn 3, however, the name seems accurate. For Opera, this is a significant update that goes far beyond what arrived with the move to Chromium 60. Opera Reborn 3—or Opera 60 if you want to stick with version numbers—transitions a slew of features that recently debuted in Opera's mobile browsers to the desktop. The big three in this release are support for blockchain-secured transactions, a crypto wallet to go with the mobile version, and a new overall look with light and dark themes available. So if you haven't checked out Opera lately, it's worth revisiting, especially for those older Opera fans still smarting about the switch from Opera's Presto rendering engine to Google's Blink rendering engine.' -- source: https://arstechnica.com/information-technology/2019/05/review-opera-once-le… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Is The Global Internet Disintegrating?
by Peter Reutemann 20 May '19

20 May '19

''The global internet is disintegrating," argues BBC Future, calling Russia "one of a growing number of countries that has had enough of the Western-built, Western-controlled internet backbone...aided as much by advances in technology as by growing global misgivings about whether the open internet was ever such a good idea to start with." "The new methods raise the possibility not only of countries pulling up their own drawbridges, but of alliances between like-minded countries building on these architectures to establish a parallel internet..." It's DNS that Russia has been setting its sights on... The plan -- which was met with skepticism from much of the engineering community, if not dismissed outright -- was to create a Russia-only copy of the DNS servers (the internet's address book, currently headquartered in California) so that citizens' traffic would be exclusively directed to Russian sites, or Russian versions of external sites. It would send Russian internet users to Yandex if they typed in Google, or the social network VK instead of Facebook. To lay the groundwork for this, Russia spent years enacting laws that force international companies to store all Russian citizens' data inside the country -- leading some companies such as LinkedIn to be blocked when they refused to comply... According to estimates from the International Institute for Strategic Studies in London, China is now engaged in some 80 telecommunications projects around the world -- from laying cables to building core networks in other countries, contributing to a significant and growing Chinese-owned global network... One possibility is a scenario where enough countries join Russia and China to develop a similar infrastructure to a point where they could sustain each other economically without doing business with the rest of the world, meaning they could shut themselves off the Western internet. Smaller countries might prefer an internet built around a non-Western standard, and an economic infrastructure built around China might be the "third way" that allows countries to participate in a semi-global economy while being able to control certain aspects of their populations' internet experience. Maria Farrell of the Open Rights Group (an internet freedom organisation) tells BBC Future that "Nations like Zimbabwe and Djibouti, and Uganda, they don't want to join an internet that's just a gateway for Google and Facebook" to colonise their digital spaces. And there's also fears about western espionage. "Along with every other expert interviewed for this article, Farrell reiterated how unwise it would be underestimate the ongoing reverberations of the Snowden revelations..."' -- source: https://tech.slashdot.org/story/19/05/19/1652253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Ends Android Collaboration With Huawei. No Gmail, Play Store For Future Huawei Phones
by Peter Reutemann 19 May '19

19 May '19

'Alphabet Inc's Google has suspended business with Huawei that requires the transfer of hardware and software products except those covered by open source licenses, a source close to the matter told Reuters on Sunday, in a blow to the Chinese technology company that the U.S. government has sought to blacklist around the world. Huawei Technologies Co Ltd will immediately lose access to updates to the Android operating system, and the next version of its smartphones outside of China will also lose access to popular applications and services including the Google Play Store and Gmail app... Huawei will continue to have access to the version of the Android operating system available through the open source license that is freely open to anyone who wishes to use it. But Google will stop providing any technical support and collaboration for Android and Google services to Huawei going forward, the source said.' -- source: https://mobile.slashdot.org/story/19/05/19/1829216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Pushes Kotlin Over Java for Android Development
by Peter Reutemann 18 May '19

18 May '19

'Google "officially declared Kotlin the go-to language for Android development last week at its Google I/O developer conference," reports Mike Melanson's "This Week in Programming" column, "and the company is backing that up with a couple of initiatives around making it easier (and free) to learn the language now used by a majority of Android developers." Google teamed up with Udacity to offer Developing Android Apps with Kotlin , a free, self-paced online course on how to build Android apps with Jetpack and Kotlin, meant for people who have programming experience and are comfortable with Kotlin basics. Google also announced "Kotlin/Everywhere, a series of community-driven events focussing on the potential of Kotlin on all platforms," which it is putting on in conjunction with JetBrains. Of course, this leaves the question that has been asked many times before -- why Kotlin? -- and IT consultant Kristen Carter offers a take on how Android app development became Kotlin-first. Carter offers some business angles, such as the 2010 lawsuit against Google by Oracle, which predates Kotlin by just a year, and she speculates may have been the impetus behind the language's development as "Google has always wanted to get away from the [Java] ecosystem." At the same time, Carter offers some language-specific reasoning too, such as the comparably succinct nature of Kotlin, the absence of Java's NullPointerExceptions, and the ease with which Java developers could transition to Kotlin. Carter ends her piece by posing the possibility that Oracle "knows the significance of Java in android app development" and could "ship Java with a few upgrades in its next version to take on Kotlin."' -- source: https://developers.slashdot.org/story/19/05/17/2355248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New John the Ripper Cracks Passwords On FPGAs
by Peter Reutemann 18 May '19

18 May '19

'Long-time Slashdot reader solardiz has long bring an advocate for bringing security to open environments. Wednesday he contacted Slashdot to share this update about a piece of software he's authored called John the Ripper: John the Ripper is the oldest still evolving password cracker program (and Open Source project), first released in 1996. John the Ripper 1.9.0-jumbo-1, which has just been announced with a lengthy list of changes, is the first release to include FPGA support (in addition to CPU, GPU, and Xeon Phi). This is a long-awaited (or long-delayed) major release, encompassing 4.5 years of development and 6000+ commits by 80+ contributors. From the announcement: "Added FPGA support for 7 hash types for ZTEX 1.15y boards [...] we support: bcrypt, descrypt (including its bigcrypt extension), sha512crypt & Drupal7, sha256crypt, md5crypt (including its Apache apr1 and AIX smd5 variations) & phpass. As far as we're aware, several of these are implemented on FPGA for the very first time. For bcrypt, our ~119k c/s at cost 5 in ~27W greatly outperforms latest high-end GPUs per board, per dollar, and per Watt. [...] We also support multi-board clusters (tested [...] for up to 16 boards, thus 64 FPGAs, [...] on a Raspberry Pi 2 host)' -- source: https://it.slashdot.org/story/19/05/18/1841245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Severe Linux Kernel Flaw Found In RDS
by Peter Reutemann 18 May '19

18 May '19

'Linux systems running kernels prior to 5.0.8 require patching after news emerged of a high-severity flaw that could be remotely exploited. According to the NIST advisory, CVE-2019-1181 is a race condition affecting the kernel's rds_tcp_kill_sock in net/rds/tcp.c "leading to a use-after-free, related to net namespace cleanup." The RDS bit refers to systems running the Reliable Datagram Sockets (RDS) for the TCP module, which means only systems that run applications using this are affected. The attention-grabbing part is that this opens unpatched systems to remote compromise and denial of service without the need for system privileges or user interaction. On the other hand, the attack complexity is described as 'high', and any such attack would need to be launched from the local network.' -- source: https://linux.slashdot.org/story/19/05/18/2122204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

SoftBank and the 300-year plan
by Ian Young 17 May '19

17 May '19

Perhaps some may not have seen these recent articles about SoftBank which owns ARM. The most detailed I have come across so far. The SoftBank CEO has a 300-year plan it seems. Even the 2035 plan is spectacular. "By 2035 there will be a trillion connected devices, he [Son] said – a vast Internet of Things of autonomous vehicles, smart robots and artificially intelligent sensors, and Arm would be the company behind all these devices." https://www.wired.co.uk/article/softbank-vision-fund https://www.fastcompany.com/90285552/the-most-powerful-person-in-silicon-va…

2 1

Techweek
by Lawrence D'Oliveiro 17 May '19

17 May '19

For those wanting to know what events are on for Techweek next week, start here <https://www.cultivateit.nz/page/techweek-19-waikato/>. Yes, our own little WLUG meeting on Monday is part of the fun. ;)

1 0

Wi-Fi Transmission Overhead?
by Lawrence D'Oliveiro 16 May '19

16 May '19

I’m currently copying a few gigabytes of files from my main workstation onto my laptop via wi-fi. Looking at dstat, on the workstation, it is reading about 4MB/s from the disk, but the network data transmission rate is a bit over twice that, more like 9MB/s. At the laptop end, it is receiving about 4MB/s over the network, which more closely matches the data being read from disk on the transmit side, but not the transmission rate. Has anybody else seen something similar?

1 0

SSH Password-Guessing Attacks
by Lawrence D'Oliveiro 16 May '19

16 May '19

I suppose you know that if you put a machine on the Internet with an SSH server listening on port 22, you are going to get bombarded with password-guessing login attempts. Previously, I thought that moving the SSH server to a nonstandard port was sufficient to block these. But now I am seeing these attacks happening on my Rimu VPS anyway. Should I bother to change the port again?

5 4

Why Linux On Desktop 'Failed': A Discussion With Mark Shuttleworth
by Peter Reutemann 15 May '19

15 May '19

'Mark Shuttleworth, founder and CEO of Canonical, summed it in a few words: "I think the bigger challenge has been that we haven't invented anything in the Linux that was like deeply, powerfully ahead of its time." He also said that "if in the free software community we only allow ourselves to talk about things that look like something that already exists, then we're sort of defining ourselves as a series of forks and fragmentations." He added that it seems the desktop Linux people want to be angry at something. We wanted to do amazing things with Unity but the community won't let us do it, so here we are. He also commended Google folks for what they have built for Chrome OS.' -- source: https://linux.slashdot.org/story/19/05/15/1523252 Hmm... Multiple virtual desktops, natively supported Windows, finally available with Windows 10 (though terrible to use!). Even fvwm2 in 1998 or 1999 was better than Windows' current implementation... Talking about something amazing... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Recalls Its Bluetooth Titan Security Keys Because of a Security Bug
by Peter Reutemann 15 May '19

15 May '19

'Google today disclosed a security bug in its Bluetooth Titan Security Key that could allow an attacker in close physical proximity to circumvent the security the key is supposed to provide. From a report: The company says that the bug is due to a "misconfiguration in the Titan Security Keys' Bluetooth pairing protocols" and that even the faulty keys still protect against phishing attacks. Still, the company is providing a free replacement key to all existing users. The bug affects all Titan Bluetooth keys, which sell for $50 in a package that also includes a standard USB/NFC key, that have a "T1" or "T2" on the back.' -- source: https://it.slashdot.org/story/19/05/15/1728202 Rather than "Titan", they should have called it "Achilles"... ;-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

So Long Dual-Booting Windows on a Chromebook: Project Campfire is deprecated
by Peter Reutemann 15 May '19

15 May '19

'Project Campfire turned up in the Chromium world this past August. The intent was to let a Chromebook boot not just into Chrome OS but directly into another operating system such as Linux or Windows. I thought the latter was a positive outcome since it would allow Chromebooks to natively run Windows desktop apps on a Chromebook, and add value to devices. Unfortunately, the project is shutting down. Spotted in code, there are comments and code removals that make it clear Project Campfire is being deprecated.' -- source: https://linux.slashdot.org/story/19/05/15/1752208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Is About To Have a Lot More Ads On Phones
by Peter Reutemann 14 May '19

14 May '19

'The Verge reports on the new ad types Google announced today that will start showing up throughout its mobile products, including some that interrupt the core Google search and discovery experiences. From the report: Google searches on mobile will soon include "gallery" ads that allow advertisers to display multiple images for users to swipe through. You'll also begin to see ads in Google's discover feed -- the feed of news stories that you find built into many Android home screens, inside the Google app, and on Google's mobile homepage -- though they'll only appear in select locations for now. The new ad formats are meant to make ads a lot more noticeable. In a blog post, Google ad chief Prabhakar Raghavan says that, in tests, gallery ads resulted in "up to 25 percent more interactions" than traditional search ads. Gallery ads will only be launching on mobile, not the desktop. Discover ads will appear in Google's mobile app, as well as on the discover feed on Android phones. Google tells us those ads won't appear in the discover feed that's built into the google.com mobile homepage. [...] The discover feed -- a personalized feed of recommended news stories that Google displays on mobile -- will also be getting ads for the first time. They'll appear just like any other story, with an image on top, a headline, and a subject field with more information. But they'll have a small badge that says "ad" to let users know it's sponsored. Those ads will extend to YouTube as well, where they'll slot in alongside recommended videos. Discover ads will also roll out later this year. ' -- source: https://search.slashdot.org/story/19/05/14/2014207 Time to switch your Google Apps to FOSS ones: https://f-droid.org/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Patches 'Wormable' Flaw in Windows XP, 7 and Windows 2003
by Peter Reutemann 14 May '19

14 May '19

'Microsoft today is taking the unusual step of releasing security updates for unsupported but still widely-used Windows operating systems like XP and Windows 2003, citing the discovery of a "wormable" flaw that the company says could be used to fuel a fast-moving malware threat like the WannaCry ransomware attacks of 2017. From a report: The vulnerability (CVE-2019-0708) resides in the "remote desktop services" component built into supported versions of Windows, including Windows 7, Windows Server 2008 R2, and Windows Server 2008. It also is present in computers powered by Windows XP and Windows 2003, operating systems for which Microsoft long ago stopped shipping security updates. Microsoft said the company has not yet observed any evidence of attacks against the dangerous security flaw, but that it is trying to head off a serious and imminent threat.' -- source: https://tech.slashdot.org/story/19/05/14/1943243 A bit like "what is dead may never die"... ;-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Hard-To-Fix' Cisco Flaw Puts Work Email At Risk
by Peter Reutemann 14 May '19

14 May '19

'Security researchers have discovered serious vulnerabilities affecting dozens of Cisco devices. The flaws allow hackers to deceive the part of the product hardware that checks whether software updates come from legitimate sources. Experts believe this could put emails sent within an organization at risk as they may use compromised routers. Messages sent externally constitute less of a risk, however, as they tend to be encrypted. The California-based firm said it is working on "software fixes" for all affected hardware. "We've shown that we can quietly and persistently disable the Trust Anchor," Red Balloon chief executive Ang Cui, told Wired magazine. "That means we can make arbitrary changes to a Cisco router, and the Trust Anchor will still report that the device is trustworthy. Which is scary and bad, because this is in every important Cisco product. Everything." Security experts believe that the vulnerability could cause a major headache for Cisco, which has listed dozens of its products as vulnerable on its website. "We don't know how many devices could have been affected and it's unlikely Cisco can tell either," said Prof Alan Woodward, a computer security expert based at Surrey University. "It could cost Cisco a lot of money."' -- source: https://it.slashdot.org/story/19/05/14/1945212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Huawei Says It is Willing To Sign 'No-Spy' Agreements With Governments
by Peter Reutemann 14 May '19

14 May '19

'Huawei is willing to sign no-spy agreements with governments, including Britain, the Chinese telecommunications company's chairman said on Tuesday as the United States pressures European countries to shun the firm over spying concerns. From a report: Washington has told allies not to use Huawei's technology to build new 5G telecommunications networks because of worries it could be a vehicle for Chinese spying, an accusation the firm has denied.' -- source: https://tech.slashdot.org/story/19/05/14/1531257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel CPUs Released in Last 8 Years Impacted by New Zombieload Side-Channel Attack
by Peter Reutemann 14 May '19

14 May '19

'Academics have discovered a new class of vulnerabilities in Intel processors that can allow attackers to retrieve data being processed inside a CPU. From a report: The leading attack in this new vulnerability class is a security flaw named Zombieload, which is another side-channel attack in the same category as Meltdown, Spectre, and Foreshadow. Just like the first three, Zombieload is exploited by taking advantage of the speculative execution process, which is an optimization technique that Intel added to its CPUs to improve data processing speeds and performance. For more than a year, academics have been poking holes in various components of the speculative execution process, revealing ways to leak data from various CPU buffer zones and data processing operations. Meltdown, Spectre, and Foreshadow have shown how various CPU components leak data during the speculative execution process. Today, an international team of academics -- including some of the people involved in the original Meltdown and Spectre research -- along with security researchers from Bitdefender have disclosed a new attack impacting the speculative execution process. This one is what researchers have named a Microarchitectural Data Sampling (MDS) attack, and targets a CPU's microarchitectural data structures, such as the load, store, and line fill buffers, which the CPU uses for fast reads/writes of data being processed inside the CPU. [...] In a research paper published today, academics say that all Intel CPUs released since 2011 are most likely vulnerable. Processors for desktops, laptops, and (cloud) servers are all impacted, researchers said on a special website they've set up with information about the Zombieload flaws.' -- source: https://tech.slashdot.org/story/19/05/14/1721242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Academics Improve SHA-1 Collision Attack, Make It Actually Dangerous
by Peter Reutemann 14 May '19

14 May '19

'"Attacks on the SHA-1 hashing algorithm just got a lot more dangerous last week with the discovery of the first-ever 'chosen-prefix collision attack,' a more practical version of the SHA-1 collision attack first carried out by Google two years ago," reports ZDNet. Google's original research allowed attackers to force duplicates for specific files, but this process was often at random. A new SHA-1 collision attack variation (a chosen-prefix attack) detailed last week allows attackers to choose what SHA-1-signed files or data streams they want to forge on demand, making SHA-1 an attack that is now practical in the real world, albeit at a price tag of $100,000 per collision.' -- source: https://it.slashdot.org/story/19/05/13/2255229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Is It Finally the Year of 'Linux on the Desktop' ?
by Peter Reutemann 13 May '19

13 May '19

'"2019 is truly, finally shaping up to be the year of Linux on the desktop," writes PC World's senior editor, adding "Laptops, too!" But most people won't know it. That's because the bones of the open-source operating system kernel will soon be baked into Windows 10 and Chrome OS, as Microsoft and Google revealed at their respective developer conferences this week... Between lurking in Windows 10 and Chrome OS, and the tiny portion of actual Linux distro installs, pretty much any PC you pick up will run a Linux kernel and Linux software. Macs won't, but it's based on a Unix-like BSD system that already runs many Linux apps with relative ease (hence Apple's popularity with developers). You have to wonder where that leaves proper Linux distributions like Ubuntu and Linux Mint, though. They already suffer from a minuscule user share, and developers may shift toward Windows and Chrome if the Linux kernels in those operating systems get the same job done. Could this fruit wind up poisonous over the long term? We'll have to see. That said, Linux is healthier than ever. The major distros are far more polished than they used to be, with far fewer hardware woes than installs of yesteryear. You can even get your game on relatively well thanks to Valve's Proton technology, which gets many (but not all) Steam games working on Linux systems. And hey, Linux is free. Normal users may never be aware of it, but 2019 may finally be the year of Linux on the desktop -- just not Linux operating systems on the desktop. ' -- source: https://linux.slashdot.org/story/19/05/13/0336224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting *next* Monday (May 20th)
by Peter Reutemann 13 May '19

13 May '19

Hi everyone Due to lining up with Techweek 2019, we shifted our monthly WLUG meeting to next week (May 20th). 'Lawrence D'Oliveiro will give an intro to Nagios (https://www.nagios.org/) an extensible system for monitoring all kinds of behaviour on a Linux box. He will also discuss writing your own plugins, to add monitoring of system characteristics that Nagios does not already provide as standard. The examples will be in Python, though they can be done in any language. This Meetup is part of the Techweek19 Waikato festival of innovation.' More details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/257884277/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu 19.04: The Disco Dingo arrives and will really make your IT dept. happy
by Peter Reutemann 12 May '19

12 May '19

'Canonical recently released Ubuntu 19.04, the latest version of its flagship GNOME-based Linux desktop. But if you're a desktop user, you might be feeling a little left out. The big points of emphasis in this latest release are on Ubuntu as a tool for infrastructure development, server deployment, and the good old Internet of Things. For the server version of Ubuntu, the OS ships with all the latest cloud computing tools. In fact, that's already available in optimized builds on the major cloud services. Elsewhere, the latest version of the venerable Ubuntu desktop packs quite a few additional, tempting reasons to upgrade for Linux gamers. Ubuntu 19.04 makes the leap to the Linux kernel 5.x series, for instance, which offers much improved graphics support. Despite all the talk of developer tools and enterprise deployment stacks—Canonical has even taken to calling Ubuntu the "leading OS for cloud operations" lately—Ubuntu 19.04 is ultimately a worthwhile upgrade for all. After spending some time with it recently, we found some nice updates to the desktop, too. So no matter your Ubuntu use case, 19.04 seems to offer users a faster, more polished desktop than its predecessors.' -- source: https://arstechnica.com/gadgets/2019/05/ubuntu-19-04-review-the-disco-dingo… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ImageMagick "not authorized" PDF errors
by Peter Reutemann 12 May '19

12 May '19

Hi there I was trying to convert some images into PDFs using ImageMagick's "convert" tool and encountered a "not authorized" error, something similar to the following: convert-im6.q16: not authorized `scan.pdf' @ error/constitute.c/WriteImage/1037. Took me a while figuring that one out. As it turns out, this is due to ImageMagick's security policy being tightened up (no default rights for PDF/PS): /etc/ImageMagick-6/policy.xml You can, of course, re-enable support for PDF/PS. See the following post: https://cromwell-intl.com/open-source/pdf-not-authorized.html Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Firefox 66.0.3 disabled all your plugins?
by Peter Reutemann 11 May '19

11 May '19

Hi there I just updated my Firefox to 66.0.3 and all of a sudden, all my installed plugins were disabled (eg uBlock). Turns out that the release was buggy and they are working on a fix. In the meantime, you can get things going again through a trick: by enabling "participating in studies" you can get access to their hotfix to remedy this problem (though it can take some time before you get notified once you enabled this option - up to 6 hours; it only took a minute for me). For more information, see the official blog post: https://blog.mozilla.org/addons/2019/05/04/update-regarding-add-ons-in-fire… If you haven't updated to 66.0.3, then I'd strongly advice to wait for the next version to become available. Will safe you some pain. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 4

New Intel Firmware Boot Verification Bypass Enables Low-Level Backdoors
by Peter Reutemann 11 May '19

11 May '19

'At the Hack in the Box conference in Amsterdam this week, researchers Peter Bosch and Trammell Hudson presented a new attack against the Boot Guard feature of Intel's reference UEFI implementation, known as Tianocore. The attack, which can give an attacker full, persistent access, involves replacing a PC's SPI flash chip with one that contains rogue code, reports Lucian Constantin for CSO. "Even though such physical attacks require a targeted approach and will never be a widespread threat, they can pose a serious risk to businesses and users who have access to valuable information," writes Constantin. Intel has patches available for Tianocore, but as we all remember from the Meltdown and Spectre vulnerabilities, distributing UEFI patches isn't an easy process.' -- source: https://it.slashdot.org/story/19/05/10/2335225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Is Starting To Reveal the Secrets of Its Experimental Fuchsia OS
by Peter Reutemann 10 May '19

10 May '19

'At Google's I/O developer conference this past week, Android and Chrome chief Hiroshi Lockheimer offered some rare insight into Fuchsia, albeit at a very high level, in front of public audiences. The Verge reports: What we do know about Fuchsia is that it's an open source project, similar to AOSP, but could run all manner of devices, from smart home gadgets to laptops to phones. It's also known to be built on an all-new, Google-built kernel called "zircon," formerly known as "magenta," and not the Linux kernel that forms the foundation of Android and Chrome OS. "We're looking at what a new take on an operating system could be like. And so I know out there people are getting pretty excited saying, 'Oh this is the new Android,' or, 'This is the new Chrome OS,'" Lockheimer said. "Fuchsia is really not about that. Fuchsia is about just pushing the state of the art in terms of operating systems and things that we learn from Fuchsia we can incorporate into other products." He says the point of the experimental OS is to also experiment with different form factors, a hint toward the possibility that Fuchsia is designed to run on smart home devices, wearables, or possibly even augmented or virtual reality devices. "You know Android works really well on phones and and you know in the context of Chrome OS as a runtime for apps there. But Fuchsia may be optimized for certain other form factors as well. So we're experimenting." Lockheimer provided some additional details at a separate Android fireside chat held at Google I/O today. "It's not just phones and PCs. In the world of [the Internet of Things], there are increasing number of devices that require operating systems and new runtimes and so on. I think there's a lot of room for multiple operating systems with different strengths and specializations. Fuchsia is one of those things and so, stay tuned," he told the audience.' -- source: https://mobile.slashdot.org/story/19/05/10/0021243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Don Norman: I wrote the book on user-friendly design. What I see today horrifies me
by Peter Reutemann 10 May '19

10 May '19

'The world is designed against the elderly, writes Don Norman, 83-year-old author of the industry bible Design of Everyday Things and a former Apple VP. ' -- source: https://www.fastcompany.com/90338379/i-wrote-the-book-on-user-friendly-desi… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Computerphile YouTube Channel
by Lawrence D'Oliveiro 10 May '19

10 May '19

For those who are interested in short (10-minute or so) videos introducing various computing topics as discussed by lecturers at the University of Nottingham, have a look at the “Computerphile” channel <https://www.youtube.com/user/Computerphile> produced by Sean Riley. He also runs a sister channel which delves into mathematical topics, called “Numberphile” <https://www.youtube.com/user/numberphile>.

1 0

Open source bug poses threat to sites running multiple CMSes
by Peter Reutemann 09 May '19

09 May '19

'Websites running the Drupal, Joomla, or Typo3 content-management systems are vulnerable to attacks that could possibly execute malicious code until administrators install just-released patches, developers and security researchers warned. The vulnerability resides in the PharStreamWrapper, a PHP component developed and open-sourced by CMS maker Typo3. Indexed as CVE-2019-11831, the flaw stems from a path-traversal bug that allows hackers to swap a site's legitimate phar archive with a malicious one. A phar archive is used to distribute a complete PHP application or library in a single file, in much the way a Java archive file bundles many Java files into a single file.' -- source: https://arstechnica.com/information-technology/2019/05/open-source-bug-pose… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

All Chromebooks Will Also Be Linux Laptops Going Forward
by Peter Reutemann 09 May '19

09 May '19

'At Google I/O in Mountain View, Google said "all devices [Chromebook] launched this year will be Linux-ready right out of the box." From a report: In case you've missed it, last year, Google started making it possible to run desktop Linux on Chrome OS. Since then, more Chromebook devices are able to run Linux. Going forward, all of them will be able to do so, too. Yes. All of them. ARM and Intel-based.' -- source: https://linux.slashdot.org/story/19/05/09/1724228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

WordPress Finally Gets the Security Features a Third of the Internet Deserves
by Peter Reutemann 08 May '19

08 May '19

' The WordPress content management system (CMS) is set to receive an assortment of new security features today that will finally add the protection level that many of its users have desired for years. From a report: These features are expected to land with the official release of WordPress 5.2, expected for later today. Included are support for cryptographically-signed updates, support for a modern cryptography library, a Site Health section in the admin panel backend, and a feature that will act as a White-Screen-of-Death (WSOD) protection -- letting site admins access their backend in the case of catastrophic PHP errors. With WordPress being installed on around 33.8 percent of all internet sites, these features are set to put some fears at ease in regards to some attack vectors. Probably the biggest and the most important of today's new security features is WordPress' offline digital signatures system. Starting with WordPress 5.2, the WordPress team will digitally sign its update packages with the Ed25519 public-key signature system so that a local installation will be able to verify the update package's authenticity before applying it to a local site.' -- source: https://it.slashdot.org/story/19/05/07/1930208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android Q Gets Dark Mode, Live Video Captioning, Better Gestures and More
by Peter Reutemann 07 May '19

07 May '19

'At its annual I/O developer event, Google announced a bunch of new features available in the latest Android Q beta. Engadget reports: The most obvious new feature is dark mode, which will be released system-wide in Android Q. It's accessible via a toggle switch in the quick settings area and it'll also be activated when you turn on battery saver mode. We just saw a quick screenshot of it, but it looks like it'll apply to any apps you're using regardless of whether they're Google-made or from other developers. Another notable new feature is called Live Caption. If you're watching a video, Google's machine-learning algorithms can now add captions on the fly by just pressing the volume button and then a "live caption" button that'll show up on on the onscreen volume slider. From there, you can expand and contract the panel as you see fit, and move it up and down on the screen so it doesn't obscure your video. Google is also able to do all of this on-device, so it's more secure and also doesn't need a network connection. [T]he company says that there are 50 new privacy and security settings in Android Q. Perhaps most notable are new location services settings that let you limit location tracking to only when the app is running. It'll also give you notifications to let users see when apps are using your location in the background. New settings also let you keep apps from accessing media on your phone and collecting information about your device like its IMEI and serial number. [...] Google's adding a new "focus mode" to help shut down various distractions. It'll block most app alerts and notifications while allowing important contacts like your family members to reach you. There are also more tools for parents to manage their kids' phone time -- it'll let you review how they're using their phone from your own device, set daily time limits, review app requests and more. There are also tweaks to the gesture-based navigation bar to make it more closely resemble the navigation gestures first introduced in the iPhone X. Google's also adding a new chat-focused interface called "bubbles" that lets users keep messaging conversations accessible regardless of what they're doing with the phone. We can expect the final desert-themed name and release date later in the summer. The Q beta 3 is currently available on 21 devices, including all Pixel devices.' -- source: https://developers.slashdot.org/story/19/05/07/2050236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Cray, AMD to build 1.5 exaflops supercomputer for US government
by Peter Reutemann 07 May '19

07 May '19

'AMD and Cray have announced that they're building "Frontier," a new supercomputer for the Department of Energy at Oak Ridge National Laboratory. The goal is to deliver a system that can perform 1.5 exaflops: 1.5×1018 floating point operations per second. By way of comparison, a single Nvidia RTX 2080 GPU manages about 14 teraflops of compute performance with 32-bit numbers. Frontier will achieve 100,000 times more. The fastest supercomputer in the Top 500 list weighs in at 200 petaflops, or 0.2 exaflops. As things stand, it'd take the top 160 machines on the list to match Frontier's performance. Frontier will use custom versions of AMD's Epyc processors (likely Zen 3 or Zen 4), matched with 4 GPUs, all connected using AMD's Infinity Fabric. Between nodes, Cray's Slingshot interconnect will be used, which has transfer rates of up to 200Gb/s per port. The GPUs will have their own stacked HBM (High Bandwidth Memory). It'll be housed in 100 cabinets, taking about 7,300 square feet of floor space. Power consumption will be 30-40MW. The plan is for Frontier to be delivered in 2021, at a cost of about $500 million for the hardware and $100 million for research and development. It should be the fastest supercomputer in the world when it's delivered, and it will be the US government's second exaflops-capable system; the first will be the 1 exaflops Aurora, built using Intel Xeon SP processors and Intel Xe GPUs.' -- source: https://arstechnica.com/gadgets/2019/05/cray-amd-to-build-1-5-exaflops-supe… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 5.1 Released
by Peter Reutemann 07 May '19

07 May '19

'Linux 5.1 released has been released. The main feature in this release is io_uring, a high-performance interface for asynchronous I/O; there are also improvements in fanotify to provide a scalable way of watching changes on large file systems; it also adds a method to allow safe delivery of signals in presence of PID reuse; persistent memory can be used now as hot-plugabble RAM; Zstd compression levels have been made configurable in Btrfs; there is a new cpuidle governor that makes better power management decisions than the menu governor; all 32 bit architectures have added the necessary syscalls to deal with the y2038 problem; and live patching has added support for creating cumulative patches. There are many other features and new drivers in the changelog.' -- source: https://linux.slashdot.org/story/19/05/06/1436248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Windows 10 will soon ship with a full, open source, GPLed Linux kernel
by Peter Reutemann 06 May '19

06 May '19

'Earlier today, we wrote that Microsoft was going to add some big new features to the Windows Subsystem for Linux, including native support for Docker containers. It turns out that that ain't the half of it. The current Windows Subsystem for Linux uses a Microsoft-authored kernel component that provided the same kernel API as the Linux kernel but written from scratch by Microsoft. Essentially, it translated from Linux APIs to Windows NT kernel APIs. That worked pretty well, but the current subsystem had a few shortcomings: there was no ability to use Linux drivers, in particular file system drivers. Its file system performance, layered on top of Windows' own NTFS, was often 20 times slower than a real Linux kernel. It was also a relatively old version of the kernel; it offered approximately the set of APIs that Linux 4.4 did, and that was released in 2016. Some APIs aren't implemented at all, and others are only partially implemented to meet the needs of specific applications. All is changing with Windows Subsystem for Linux 2. Instead of emulating the Linux kernel APIs on the NT kernel, WSL 2 is going to run a full Linux kernel in a lightweight virtual machine. This kernel will be trimmed down and tailored to this particular use case, with stripped-down hardware support (since it will defer to the host Windows OS for that) and faster booting.' -- source: https://arstechnica.com/gadgets/2019/05/windows-10-will-soon-ship-with-a-fu… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Second Firefox Fix Repairs Broken Browser Extensions For More People
by Peter Reutemann 05 May '19

05 May '19

'An anonymous reader quotes CNET: "Mozilla on Sunday began distributing new Firefox updates to fix a problem that broke extensions for many browser users on Friday," reports CNET: Mozilla had released an update Saturday, but Sunday's fix should help more people who were still affected. "There are some issues we're still working on, but we wanted to get this release out and get your add-ons back up & running before Monday," Mozilla said in a tweet Sunday... "No active steps need to be taken to make add-ons work again. In particular, please do not delete and/or reinstall any add-ons as an attempt to fix the issue," Kev Needham, Mozilla's product manager for add-ons, said in a blog post about the problem.' -- source: https://news.slashdot.org/story/19/05/05/2315224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Does Open Source Have a 'Working For Free' Problem?
by Peter Reutemann 05 May '19

05 May '19

'"Let's abandon the notion that open source is exclusively charity," writes Havoc Pennington, a free software engineer (and former Red Hat engineer) who's now a co-founder of Tidelift: Look around. We do have a problem, and it's time we do something about it.... The lack of compensation isn't just bad for individual developers -- it also creates social problems, by amplifying existing privilege.... The narrative around open source is that it's completely OK -- even an expectation -- that we're all doing this for fun and exposure; and that giant companies should get huge publicity credit for throwing peanuts-to-them donations at a small subset of open source projects. There's nothing wrong with doing stuff for fun and exposure, or making donations, as an option. It becomes a problem when the free work is expected and the donations are seen as enough... What would open source be like if we had a professional class of independent maintainers, constantly improving the code we all rely on? The essay suggests some things consider, including asking people to pay for: * Support requests * Security audits/hardening and extremely good test coverage * Supporting old releases * License-metadata-annotation practices that are helpful for big companies trying to audit the code they use, but sort of a pain in the ass and nobody cares other than these big companies. "Right now many users expect, and demand, that all of this will be free. As an industry, perhaps we should push back harder on that expectation. It's OK to set some boundaries..." "Of course this relates to what we do at Tidelift -- the company came out of discussions about this problem, among others... In our day-to-day right now we're specifically striving to give subscribers a way to pay maintainers of their application dependencies for additional value, through the Tidelift Subscription. But we hope to see many more efforts and discussions in this area.... [I]n between a virtual tip jar and $100 million in funding, there's a vast solution space to explore."' -- source: https://news.slashdot.org/story/19/04/28/0459236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Hard Drive Reliability At Backblaze
by Lawrence D'Oliveiro 05 May '19

05 May '19

This article <https://www.theregister.co.uk/2019/05/03/backblaze_drive_reliability_stats/> on the latest disk reliability report from backup business Backblaze led me to following up some interesting links. In this older item <https://www.theregister.co.uk/2014/02/17/backblaze_how_not_to_evaluate_disk…>, they were criticized for making misleading claims about consumer-grade drives being more reliable than enterprise-grade ones. But I do think it is clear that the difference between them is not worth the cost. One important point I got from the latter is “replacing one drive takes about 15 minutes of work”. That quote ends with “Moral of the story: design for failure and buy the cheapest components you can”. Which seems the logical thing to do anyway. That sentence is followed by a smiley, but as far as I’m concerned, who needs the smiley? I also like this article <https://www.backblaze.com/blog/hard-drive-smart-stats/> from their blog, where they go into which SMART statistics are worth looking at. The one that stands out is counter 187, uncorrectable read errors. If that goes above zero, then the disk is bad and should be replaced.

1 0

Security Lapse Exposed a Chinese Smart City Surveillance System
by Peter Reutemann 04 May '19

04 May '19

'Smart cities are designed to make life easier for their residents: better traffic management by clearing routes, making sure the public transport is running on time and having cameras keeping a watchful eye from above. But what happens when that data leaks? One such database was open for weeks for anyone to look inside. Security researcher John Wethington found a smart city database accessible from a web browser without a password. He passed details of the database to TechCrunch in an effort to get the data secured. The database was an Elasticsearch database, storing gigabytes of data -- including facial recognition scans on hundreds of people over several months. The data was hosted by Chinese tech giant Alibaba. The customer, which Alibaba did not name, tapped into the tech giant's artificial intelligence-powered cloud platform, known as City Brain. "This is a database project created by a customer and hosted on the Alibaba Cloud platform," said an Alibaba spokesperson. "Customers are always advised to protect their data by setting a secure password." "We have already informed the customer about this incident so they can immediately address the issue. As a public cloud provider, we do not have the right to access the content in the customer database," the spokesperson added. The database was pulled offline shortly after TechCrunch reached out to Alibaba. But while Alibaba may not have visibility into the system, we did.' -- source: https://yro.slashdot.org/story/19/05/04/0235239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

After Seven Years, The Gnu Project Releases GNU Guix 1.0.0
by Peter Reutemann 04 May '19

04 May '19

'LWN.net: Version 1.0.0 of the GNU Guix package manager has been released. "This 1.0 release is a major milestone for Guix. It represents 7 years of hard work with more than 40,000 commits by 260 people, 19 releases, and an equally amazing amount of work on documentation, translation, artwork, web design, mentoring, outreach, and many other activities that together have made it a thriving project." See this blog entry for more information. >From the announcement: Whether you're a software developer, a user, or a free software enthusiast, we hope GNU Guix will provide you with the tools to deploy and manage software with confidence and ease, qualities that are not usually associated with software deployment... GNU Guix is a transactional package manager and an advanced distribution of the GNU system that respects user freedom. Guix can be used on top of any system running the kernel Linux, or it can be used as a standalone operating system distribution for i686, x86_64, ARMv7, and AArch64 machines.' -- source: https://news.slashdot.org/story/19/05/03/2326215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DuckDuckGo Proposes 'Do-Not-Track Act of 2019'
by Peter Reutemann 04 May '19

04 May '19

'"When you turn on the setting in your browser that says 'Do Not Track', you probably expect to no longer be tracked on most websites you visit. Right? Well, you would be wrong," explains DuckDuckGo's blog. Their recent study found "a quarter of people have turned on this setting" -- representing hundreds of millions of web surfers -- and that most of them were unaware that in fact, "no law requires websites to respect your Do Not Track signals, and the vast majority of sites, including most all of the big tech companies, sadly choose to simply ignore them." Now they've written draft legislation -- "the Do-Not-Track Act of 2019" -- to "serve as a starting point" for legislators to close this loophole. SearchEngineLand reports: If the act picks up steam and passes into law, sites would be required to cease certain user tracking methods, which means less data available to inform marketing and advertising campaigns. The impact could also cascade into platforms that leverage consumer data, possibly making them less effective. For example, one of the advantages of advertising on a platform like Google or Facebook is the ability to target audiences. If a user enables DNT, the ads displayed to them when browsing those websites won't be informed by their external browsing history... This proposal is quite far from being signed into law, but the technology is already built into Chrome, Firefox, Opera, Edge and Internet Explorer. With the adoption of GDPR just a year behind us and presidential candidate Elizabeth Warren's proposed legislation to regulate "big tech companies" drawing more attention to digital privacy issues in Washington, the Do-Not-Track Act could be a realistic outcome. DuckDuckGo says they're announcing their draft legislation because "It is extremely rare to have such an exciting legislative opportunity like this, where the hardest work -- coordinated mainstream technical implementation and widespread consumer adoption -- is already done.... "We hope the Do-Not-Track Act of 2019 serves as a useful guide to start thinking seriously about this amazing legislative opportunity."' -- source: https://yro.slashdot.org/story/19/05/03/2316223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Don’t Try To Claim That Public Wi-Fi Is “Inherently Insecure”
by Lawrence D'Oliveiro 04 May '19

04 May '19

NordVPN has been told off by the UK Advertising Standards Authority about its misleading claims on the security of public wi-fi <https://www.theregister.co.uk/2019/05/01/nordvpn_tv_ad_rapped_advertising_s…>: Justifying its claims, NordVPN told the ASA that HTTPS encryption of webpages "did not mean the site was legitimate, nor was it any proof that the site had been security-hardened against intrusion from hackers". Yes, HTTPS encryption *is* supposed to mean that the site is legitimate. As for whether the site is security-hardened, it’s going to be just as insecure whether you access it via a VPN or not, isn’t it?

2 2

Putin Signs Law To Create an Independent Russian Internet
by Peter Reutemann 02 May '19

02 May '19

'Russia is one step closer to creating its own, independent internet -- at least legally speaking. Russian President Vladimir Putin has signed into law new measures that would enable the creation of a national network, able to operate separately from the rest of the world, according to documents posted on a government portal this week. >From a report: For now, the network remains largely theoretical though, with few practical details disclosed. In concept, the new law aims to protect Russia from foreign online restrictions by creating what the Kremlin calls a "sustainable, secure and fully functioning" local internet. The legislation takes effect in November, state news agency RIA-Novosti reported. According to a summary from RIA-Novosti, the law calls for the creation of a monitoring and a management center supervised by Roskomnadzor, Russia's telecoms agency. The state agency will be charged with ensuring the availability of communication services in Russia in extraordinary situations. During such situations, it would also be empowered to cut off external traffic exchange, creating a purely Russian web' -- source: https://tech.slashdot.org/story/19/05/02/1535237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Says It Will Ban Firefox Add-ons With Obfuscated Code
by Peter Reutemann 02 May '19

02 May '19

'As Mozilla continues to try to make it safer than ever to use Firefox, the organization has updated its Add-on Policy so that any updates that include obfuscated code are explicitly banned. Mozilla has also set out in plain terms its blocking process for add-ons and extensions. While there is nothing surprising here, the clarification should mean that there are fewer causes for disputes when an add-on is blocklisted. The updated Add-on policy comes into force on June 10, so add-on developers have a little more than a month to take note of the changes and comply. Mozilla says that the move is designed to help it better deal with malicious extensions. Mozilla also plans to be more aggressive towards taking down extensions that break its policies, with a heavy focus on security issues. ZDNet adds: [...] Starting with June 10, Mozilla's team will also be more aggressive in blocking and disabling Firefox add-ons in users' browsers that are found to be violating one of the company's policies."We will continue to block extensions for intentionally violating our policies, critical security vulnerabilities, and will also act on extensions compromising user privacy or circumventing user consent or control," Nieman said.' -- source: https://news.slashdot.org/story/19/05/02/1653228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hamster Time Tracker on Ubuntu 18.04/Bionic
by Peter Reutemann 02 May '19

02 May '19

Hi everyone I've been using the Hamster Time Tracking applet (https://github.com/projecthamster/hamster) for many years, keeping track of my time spent on commercial projects. However, this project is undergoing a major refactoring and is no longer available available from the Ubuntu repositories. Sadly, a fact that I discovered after upgrading my Laptop from Linux Mint 18.2 to 19.1. Using instructions from a github comment (https://github.com/projecthamster/hamster/issues/356#issuecomment-385093502) I was able to get it installed and working on my Ubuntu 18.04 (which underpins Linux Mint 19.1), using packages from 17.10: Install some dependencies first: sudo apt-get install python-gnome2 python-gconf python-pyorbit liborbit2 libidl-2-0 Download the following libraries - python-wnck_2.32.0+dfsg-4_amd64.deb http://mirrors.edge.kernel.org/ubuntu/pool/universe/g/gnome-python-desktop/… - hamster-applet_2.91.3+git20120514.b9fec3e1-1ubuntu2_all.deb https://launchpadlibrarian.net/202355025/hamster-applet_2.91.3+git20120514.… Install the downloaded debian packages: sudo dpkg -i python-wnck_2.32.0+dfsg-4_amd64.deb hamster-applet_2.91.3+git20120514.b9fec3e1-1ubuntu2_all.deb Since this was a fresh install, I had to copy my old Hamster database across. The database is located in: $USER/.local/share/hamster-applet/hamster.db And we're back in business! :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Blender Developers Find Old Linux Drivers Are Better Maintained Than Windows
by Peter Reutemann 01 May '19

01 May '19

'To not a lot of surprise compared to the world of proprietary graphics drivers on Windows where once the support is retired the driver releases stop, old open-source Linux OpenGL drivers are found to be better maintained. From a report: Blender developers working on shipping Blender 2.80 this July as the big update to this open-source 3D modeling software today rolled out the Linux GPU requirements for this next release. The requirements themselves aren't too surprising and cover NVIDIA GPUs released in the last ten years, AMD GCN for best support, and Intel Haswell graphics or newer. In the case of NVIDIA graphics they tend to do a good job maintaining their legacy driver branches. With the AMD Radeon and Intel graphics, Blender developers acknowledge older hardware may work better on Linux. ' -- source: https://tech.slashdot.org/story/19/05/01/191257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mark Shuttleworth Sees Increased Demand For Enterprise Ubuntu Linux Desktop
by Peter Reutemann 01 May '19

01 May '19

'Canonical's real money comes from the cloud and Internet of Things, but AI and machine learning developers are demanding -- and getting -- Ubuntu Linux desktop with enterprise support. From a report: In a wide-ranging conversation at Open Infrastructure Summit, Mark Shuttleworth, founder of Ubuntu Linux and its corporate parent Canonical, said: "We have seen companies signing up for Linux desktop support, because they want to have fleets of Ubuntu desktop for their artificial intelligence engineers." This development caught Shuttleworth by surprise. "We're starting actually now to commercially support the desktop in a way that we've never been asked to before," he said. Of course, Ubuntu has long been used by developers, but Shuttleworth explained, "Previously, those were kind of off the books, under the table. You know, 'Don't ask don't tell deployments.' "But now suddenly, it's the AI team and they've got to be supported."' -- source: https://news.slashdot.org/story/19/04/30/1641242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Vodafone Denies Bloomberg Report on Security Flaws in Huawei Equipment
by Peter Reutemann 30 Apr '19

30 Apr '19

'Vodafone denied a Bloomberg report on Tuesday that stated it had found "backdoors" hidden in Huawei equipment supplied to its Italian business dating back years, per BBC . From a report: What they're saying: Vodafone said the "backdoors" in the report were actually a common industry protocol: "The 'backdoor' that Bloomberg refers to is Telnet, which is a protocol that is commonly used by many vendors in the industry for performing diagnostic functions. It would not have been accessible from the internet. Bloomberg is incorrect in saying that this 'could have given Huawei unauthorised access to the carrier's fixed-line network in Italy.' In addition, we have no evidence of any unauthorised access. This was nothing more than a failure to remove a diagnostic function after development."' -- source: https://tech.slashdot.org/story/19/04/30/1542202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Fedora 30 Linux Distro Is Here
by Peter Reutemann 30 Apr '19

30 Apr '19

'Fedora 30, the newest release of the venerable Linux distribution that serves (in part) as the staging environment for Red Hat Enterprise Linux, was released Tuesday, bringing with it a number of improvements and performance optimizations. From a report: The most exciting aspect, for workstation/desktop users at least, is the update to GNOME 3.32. Of course, that is hardly the only notable update -- the DNF package manager is getting a performance boost, for instance. In other words, this is a significant operating system upgrade that should delight both existing Fedora users and beginners alike. "Fedora 30 brings enhancements to all editions with updates to the common underlying packages, from bug fixes and performance tweaks to new versions. In Fedora 30, base updates include Bash shell 5.0, Fish 3.0, the GNU Compiler Collection (GCC) 9 and Ruby 2.6. Fedora 30 also now uses the zchunk format for data compression within the DNF repository. When metadata is compressed using zchunk DNF will only download the differences between earlier copies of metadata and the current versions, saving on resources and increasing efficiency," says The Fedora Project.' -- source: https://linux.slashdot.org/story/19/04/30/1742231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apache Software Foundation joins GitHub open source community
by Peter Reutemann 30 Apr '19

30 Apr '19

'Today we’re excited to welcome the Apache Software Foundation (ASF) to GitHub. Apache is the world’s largest open source foundation, with over 200 million lines of code managed by an all-volunteer community of 730 members and 7,000 code contributors. Over their 20 year history, one billion lines of code have been committed across three million code commits. In 2016, Apache made the decision to start integrating GitHub’s repository and tooling with their own services. After solidifying the integration over the years, they decided to simplify how they work and move all Git projects to GitHub. As of February 2019, Apache’s migration to GitHub was complete, enabling all these projects with a simple platform to host and review code, collaborate on projects, and build software alongside 31 million developers around the world.' -- source: https://github.blog/2019-04-29-apache-joins-github-community/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How an Obsolete Medical Device With a Security Flaw Became a Must-Have For Some Patients With Type 1 Diabetes
by Peter Reutemann 30 Apr '19

30 Apr '19

'In 2014, a few hackers realized that the security flaw in certain Medtronic pumps could be exploited for a DIY revolution. Type 1 diabetes is a disease where the pancreas is unable to produce insulin to control blood sugar. For years, Boss (the anecdote in the story who purchased used insulin pumps from some dealer on Craiglist) had counted, down to the gram, the carbohydrates in every meal and told his pump how much insulin to dispense. [...] By 2014, the hardware components of a DIY artificial pancreas -- a small insulin pump that attaches via thin disposable tubing to the body and a continuous sensor for glucose, or sugar, that slips just under the skin -- were available, but it was impossible to connect the two. That's where the security flaw came in. The hackers realized they could use it to override old Medtronic pumps with their own algorithm that automatically calculates insulin doses based on real-time glucose data. It closed the feedback loop. They shared this code online as OpenAPS, and "looping," as it's called, began to catch on. Instead of micromanaging their blood sugar, people with diabetes could offload that work to an algorithm. In addition to OpenAPS, another system called Loop is now available. Dozens, then hundreds, and now thousands of people are experimenting with DIY artificial-pancreas systems -- none of which the Food and Drug Administration has officially approved. And they've had to track down discontinued Medtronic pumps. It can sometimes take months to find one. Obviously, you can't just call up Medtronic to order a discontinued pump with a security flaw. "It's eBay, Craigslist, Facebook. It's like this underground market for these pumps," says Aaron Kowalski, a DIY looper and also CEO of JDRF, a nonprofit that funds type 1 diabetes research. This is not exactly how a market for lifesaving medical devices is supposed to work. And yet, this is the only way it can work -- for now.' -- source: https://science.slashdot.org/story/19/04/29/2051257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Finally ... The Vertical TV
by Lawrence D'Oliveiro 29 Apr '19

29 Apr '19

I’ve been wondering when this was going to happen. Just as widescreen TVs and computer monitors have become standard, more and more video footage is being shared, whether on broadcast TV, social media or whatever, that was captured on mobile phones in *portrait* mode. So you get the awkward problem of filling in the gaps on the sides of the screen with something useless but unobtrusive (heavily-blurred portions of the actual content seems popular right now), and wasting all that display resolution to boot. Seems like going back to 4:3 monitors, or even an orientation-neutral square 1:1 shape, is not an option. But Samsung has the solution: a TV that can rotate to portrait mode! <https://arstechnica.com/gadgets/2019/04/samsung-embraces-vertical-videos-wi…>

1 0

Designers Release 'Aweigh', An Open Source Alternative to GPS
by Peter Reutemann 28 Apr '19

28 Apr '19

'"A team of student designers and engineers from the RCA and Imperial College have designed an open-source alternative to GPS, called Aweigh, that does not rely on satellites," reports the design magazine Dezeen. It's similar to the sextant, calculating positions by measuring the angular distances between the horizon and the sun.' -- source: https://news.slashdot.org/story/19/04/27/1813237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

The Mysterious History of the MIT License
by Peter Reutemann 28 Apr '19

28 Apr '19

'Red Hat technology evangelist Gordon Haff explains why it's hard to say exactly when the MIT license created. Citing input from both Jim Gettys (author of the original X Window System) and Keith Packard (a senior member on the X Windows team), he writes that "The best single answer is probably 1987. But the complete story is more complicated and even a little mysterious."' -- source: https://news.slashdot.org/story/19/04/28/0326207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How the Boeing 737 Max Disaster Looks to a Software Developer
by Lawrence D'Oliveiro 27 Apr '19

27 Apr '19

The author of this article <https://spectrum.ieee.org/aerospace/aviation/how-the-boeing-737-max-disaste…> (archive.org copy at <https://web.archive.org/web/20190418200057/https://spectrum.ieee.org/aerosp…>) is both a pilot and a software developer. He looks into the root causes of the Boeing 737 MAX crashes in Indonesia and Ethiopia. Basic points: * The new aircraft has sufficiently different airframe handling characteristics to be classified as a new model. * Boeing didn’t want it to be treated as a new model, because of the extra regulatory costs, pilot training etc this would entail. * So they implemented software (“MCAS”) that actively managed the handling characteristics to make it behave to pilots like previous 737 models. * They neglected to tell the pilots about the software. * It also turns out that correct operation of this software depends on a hardware component that is known to be unreliable. Commentary from Bruce Schneier <https://www.schneier.com/blog/archives/2019/04/excellent_analy.html> and Glyn Moody <https://www.techdirt.com/articles/20190424/06571442075/shoddy-software-is-e…>.

1 0

Inside the Team at Facebook That Dealt with the Christchurch Shooting
by Lawrence D'Oliveiro 27 Apr '19

27 Apr '19

Interesting backgrounder <https://www.newyorker.com/news/news-desk/inside-the-team-at-facebook-that-d…> on what went on at Facebook in the aftermath of Shooty McShootFace posting his “manifesto” rant and live-streaming his murderous rampage. Note that it took Facebook about an hour to determine that the video should be taken down. Was this too slow? Is there ever a time when leaving footage of such carnage up can serve a constructive purpose? Yes, surprisingly, there is. Further commentary: <https://www.techdirt.com/articles/20190425/15315242087/behind-scenes-look-h…>

1 0

Vodafone’s “Free E-Mail Forwarding For Life” Comes To End Of Life
by Lawrence D'Oliveiro 26 Apr '19

26 Apr '19

When Vodafone shut down its e-mail services in 2017, it promised to continue autoforwarding e-mail to customers’ new addresses indefinitely. Well, now that “indefinitely” is coming to a definite end. It is just becoming too hard to maintain the service, particularly when other e-mail services start treating such auto-forwarded messages as spam or blocking them altogether. <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=122233…>

2 1

encrypted hard drive laptop
by Ian Young 25 Apr '19

25 Apr '19

Excuse me if not on topic ... Was somewhat bemused on looking through this article about trying to purchase a laptop with encryption. Partly because it mentions hardware aspects hitherto unknown to me. https://www.theguardian.com/technology/askjack/2019/apr/25/how-do-i-buy-a-l… Is this sort of thing easier with Linux?

3 2

When Is Hate Speech Not Hate Speech?
by Lawrence D'Oliveiro 23 Apr '19

23 Apr '19

Is it “hate speech” to tell NRA supporters to “f*** off”? One high-profile user got banned (supposedly permanently) by Twitter for doing this sort of thing ... only to have the ban reversed, simply because there was so much support for his position. Seems like, when it comes to social media services clamping down on hate speech, they are simultaneously doing “not enough” and “too much”... <https://www.techdirt.com/articles/20190421/16313642055/twitter-permanently-…>

1 0

Copies Of Mueller Report Taken Down Because Of ... Copyright Infringement?
by Lawrence D'Oliveiro 23 Apr '19

23 Apr '19

For those pushing for mandatory copyright filtering, here’s yet another cautionary tale: copies of the (redacted) Mueller Report were taken down from PDF-hosting site Scribd, even though it is in the public domain. It seems clear this was an inadvertent result of automatic filtering policies; one of the many big-name publishers who had put out for-sale copies of the report had used automated processes to pass the information to Scribd, and these processes had blocked everybody’s attempts to upload copies of the report, even though it didn’t own the copyright. <https://www.techdirt.com/articles/20190420/23233942052/scribds-takedown-pub…>

1 0

Streaming TV Has Become An Expensive, Complicated Mess
by Lawrence D'Oliveiro 22 Apr '19

22 Apr '19

<https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=122224…>: But this entertainment nirvana never actually arrived. First came pricey broadband services required to stream Internet video, often delivered by the same cable wires consumers longed to cut. Then came a proliferation of services - offered by Netflix, Amazon, Hulu plus and more - each with a bill of its own. Then came more boxes, wires and remotes. And finally came the question: How exactly do I get my Star Wars fix? Maybe a bit US-centric, but I think that also reflects the situation for streaming here as well. The article talks about “cord-cutting” -- as you may know, most people in the US have been watching conventional TV stations through cable connections, not through broadcasts. “Cord-cutting” is the increasing tendency of customers to terminate their cable TV accounts. But those same cable companies are also ISPs, and given the limitations on competition between ISPs in the US (thanks to the current regime’s allergy to enforcing meaningful net-neutrality legislation), those same companies will get the money from customers wanting to watch streaming video.

1 1

Why are you still using Excel? Is it time to up your game and move to Python and Pandas or R?
by Lawrence D'Oliveiro 19 Apr '19

19 Apr '19

A heartfelt plea to habitual spreadsheet-wielders in favour of more advanced data-analysis tools <https://www.youtube.com/watch?v=S8wO4ppE9L8>. Also mentions some of the more notorious cases of Excel bugs/misfeatures impacting the correctness of scientific research results.

1 0

Olive Video Editor
by Lawrence D'Oliveiro 17 Apr '19

17 Apr '19

Came across this tryout <https://www.youtube.com/watch?v=1AvfMMjHX-M> of yet another open-source video editor, called Olive. The project is only about a year old, but it’s looking very promising. I recall Thomas wanting the ability to enable/disable clips in the timeline; I believe this one can do that. It may still be under development, but for what it’s worth, the reviewer didn’t suffer a single crash or loss of work during the video. ;)

1 0

DARPA Wants To Make a Better, More Secure Version of WhatsApp
by Peter Reutemann 15 Apr '19

15 Apr '19

'The Defense and Advanced Research Projects Agency (DARPA) appears to be in the process of developing its own ultra secure communication platform. The program is called "Resilient Anonymous Communication for Everyone," or RACE, and it will be similar to WhatsApp in that it will be for everyone to use. Trusted Reviews reports: The objectives of the program are to create a distributed messaging system that can do three things: Exist completely within a network; Provide confidentiality, integrity and availability of messaging; and Preserve privacy to any participant in the system. DARPA seem to be putting security front and center, and the description of the project claims that "compromised system data and associated networked communications should not be helpful for comprising any additional parts of the system," meaning that DARPA are keen that one breach shouldn't also give them a leg up on access to other parts of the system. So, will we soon be using a U.S government branded DARPA? Probably not, but the chances are that RACE will go some way to creating a messaging app that's resilient to attacks, with the protocol and security they find no doubt dripping through to consumer tech and features in the coming years. ' -- source: https://it.slashdot.org/story/19/04/15/2052250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers Could Read Your Hotmail, MSN, and Outlook Emails by Abusing Microsoft Support
by Peter Reutemann 15 Apr '19

15 Apr '19

'On Saturday, Microsoft confirmed that some users of the company's email service had been targeted by hackers. A hacker or group of hackers had first broken into a customer support account for Microsoft, and then used that to gain access to information related to customers' email accounts such as the subject lines of their emails and who they've communicated with. But the issue is much worse than previously reported, with the hackers able to access email content from a large number of Outlook, MSN, and Hotmail email accounts, according to a source who witnessed the attack in action and described it before Microsoft's statement, as well as screenshots provided to Motherboard. Microsoft confirmed to Motherboard that hackers gained access to the content of some customers' emails.' -- source: https://it.slashdot.org/story/19/04/15/1554226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Hacker Has Dumped Nearly One Billion User Records Over the Past Two Months
by Peter Reutemann 15 Apr '19

15 Apr '19

'A hacker who spoke with ZDNet in February about wanting to put up for sale the data of over one billion users is getting dangerously close to his goal after releasing another 65.5 million records last week and reaching a grand total of 932 million records overall. From a report: The hacker's name is Gnosticplayers, and he's responsible for the hacks of 44 companies, including last week's revelations. Since mid-February, the hacker has been putting batches of hacked data on Dream Market, a dark web marketplace for selling illegal products, such as guns, drugs, and hacking tools. He's released data from companies like 500px, UnderArmor, ShareThis, GfyCat, and MyHeritage, just to name the bigger names. Releases have been grouped in four rounds -- Round 1 (620 million user records), Round 2 (127 million user records), Round 3 (93 million user records), and Round 4 (26.5 million user records).' -- source: https://tech.slashdot.org/story/19/04/15/1920217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Former Firefox VP on What It's Like To Be Both a Partner of Google and a Competitor via Google Chrome
by Peter Reutemann 15 Apr '19

15 Apr '19

'Sidewalk Labs, the urban innovation arm of Google's parent company Alphabet, plans to build a $1 billion high-tech neighborhood in Toronto. The problem? It is facing an opposition from residents who have called for its demise. As the backlash gains momentum, it could force Sidewalk Labs to abandon or alter its vision. On paper, Sidewalk Labs' idea arguably has some merits: It wishes to "set new standards" for how cities are designed and built. But some are apprehensive of Google's plans, because the company has a knack for assuming more control over things and killing local competition. Johnathan Nightingale, a former VP of Firefox, has seen such behavior first hand. He draws some parallels: I spent 8 years at Mozilla working on Firefox and for almost all of that time Google was our biggest partner. Our revenue share deal on search drove 90% of Mozilla's income. When I started at Mozilla in 2007, there was no Google Chrome and most folks we spoke with inside were Firefox fans. They were building an empire on the web, we were building the web itself. I think our friends inside Google genuinely believed that. At the individual level, their engineers cared about most of the same things we did. Their product and design folks made many decisions very similarly and we learned from watching each other. But Google as a whole is very different than individual Googlers. Google Chrome ads started appearing next to Firefox search terms. Gmail and Google Docs started to experience selective performance issues and bugs on Firefox. Demo sites would falsely block Firefox as "incompatible." All of this is stuff you're allowed to do to compete, of course. But we were still a search partner, so we'd say "hey what gives?" And every time, they'd say, "oops. That was accidental. We'll fix it in the next push in 2 weeks." Over and over. Oops. Another accident. We'll fix it soon. We want the same things. We're on the same team. There were dozens of oopses. Hundreds maybe? I'm all for "don't attribute to malice what can be explained by incompetence" but I don't believe Google is that incompetent. This is not a thread about blaming Google for Firefox troubles though. We at Mozilla wear that ourselves, me more than anyone for my time as Firefox VP. But I see the same play happening here in my city and I don't like it. And for me it means two things: 1. The question is not whether individual Sidewalk Labs people have pure motives. I know some of them, just like I know plenty on the Chrome team. They're great people. But focus on the behavior of the organism as a whole. At the macro level, Google/Alphabet is very intentional. When Google wants to get a thing done, it is very effective. Mistakes happen, but when you see a sustained pattern of "oops" and delays from this organization -- you're being outfoxed. Get there faster than I did.' -- source: https://tech.slashdot.org/story/19/04/15/0326208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Is The Linux Desktop In Trouble?
by Peter Reutemann 14 Apr '19

14 Apr '19

'"I believe that, as Microsoft keeps moving Windows to a Desktop-as-a-Service model, Linux will be the last traditional PC desktop operating system standing," writes ZDNet contributing editor Steven J. Vaughan-Nichols. "But that doesn't mean I'm blind to its problems." First, even Linus Torvalds is tired of the fragmentation in the Linux desktop. In a recent [December 2018] TFiR interview with Swapnil Bhartiya, Torvalds said, "Chromebooks and Android are the path toward the desktop." Why? Because we don't have a standardized Linux desktop. For example, better Linux desktops, such as Linux Mint, provide an easy way to install applications, but under the surface, there are half-a-dozen different ways to install programs. That makes life harder for developers. Torvalds wishes "we were better at having a standardized desktop that goes across the distributions." Torvalds thinks there's been some progress. For software installation, he likes Flatpak. This software program, like its rival Snap, lets you install and maintain programs across different Linux distros. At the same time, this rivalry between Red Hat (which supports Flatpak) and Canonical (which backs Snap) bugs Torvalds. He's annoyed at how the "fragmentation of the different vendors have held the desktop back." None of the major Linux distributors -- Canonical, Red Hat, SUSE -- are really all that interested in supporting the Linux desktop. They all have them, but they're focused on servers, containers, the cloud, and the Internet of Things (IoT). That's, after all, is where the money is. Linux desktop distros "tend to last for five or six years and then real life gets in the way of what's almost always a volunteer effort..." the article argues. "It is not easy building and supporting a Linux desktop. It comes with a lot of wear and tear on its developers with far too little reward." His solution? Having a foundation create a common desktop for all Linux distros, so the Linux world could finally reap the benefits of standardization. "This would mean that many more Linux desktop developers could make a living from their work. That would improve the Linux desktop overall quality. "It's a virtuous cycle, which would help everyone."' -- source: https://linux.slashdot.org/story/19/04/13/0151256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

android browsers rated
by Ian Young 14 Apr '19

14 Apr '19

Saw this while looking at the Exton Linux website. May be of interest to those with recent Android phones. https://joyofandroid.com/fastest-browsers-for-android/ ~ Ian Y

2 1

Internet Explorer Exploit Steals Data From Windows Users-- Even If They Never Use Internet Explorer
by Peter Reutemann 14 Apr '19

14 Apr '19

'Security researcher John Page has revealed a new zero-day exploit that allows remote attackers to exfiltrate Local files using Internet Explorer. "The craziest part: Windows users don't ever even have to open the now-obsolete web browser for malicious actors to use the exploit," reports Mashable. "It just needs to exist on their computer..." [H]ackers are taking advantage of a vulnerability using .MHT files, which is the file format used by Internet Explorer for its web archives. Current web browsers do not use the .MHT format, so when a PC user attempts to access this file Windows opens IE by default. To initiate the exploit, a user simply needs to open an attachment received by email, messenger, or other file transfer service... Most worrisome, according to Page, is that Microsoft told him that it would just "consider" a fix in a future update. The security researcher says he contacted Microsoft in March before now going public with the issue. As ZDNet points out, while Internet Explorer usage makes up less than 10 percent of the web browser market, it doesn't particularly matter in this case as the exploit just requires a user to have the browser on their PC.' -- source: https://it.slashdot.org/story/19/04/14/2232252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Does Wi-Fi Security Really Matter?
by Lawrence D'Oliveiro 11 Apr '19

11 Apr '19

Seems the Wi-Fi Alliance is having yet another crack at coming up with a really secure protocol, this time to be called WPA3 <http://www.theregister.co.uk/2018/01/09/wi_fi_wpa3/>. Does anybody care? Remember that on the Internet, security is implemented between the endpoints, the protocols are designed not to care that everything in-between might be pawed through by eavesdroppers, or even active attackers trying to inject fake data.

1 1

Dragonblood Vulnerabilities Disclosed in Wi-Fi WPA3 Standard
by Peter Reutemann 11 Apr '19

11 Apr '19

'Two security researchers disclosed details this week about a group of vulnerabilities collectively referred to as Dragonblood that impact the Wi-Fi Alliance's recently launched WPA3 Wi-Fi security and authentication standard. From a report: If ever exploited, the vulnerabilities would allow an attacker within the range of a victim's network to recover the Wi-Fi password and infiltrate the target's network. In total, five vulnerabilities are part of the Dragonblood ensemble -- a denial of service attack, two downgrade attacks, and two side-channel information leaks. While the denial of service attack is somewhat unimportant as it only leads to crashing WPA3-compatible access points, the other four are the ones that can be used to recover user passwords. Both the two downgrade attacks and two side-channel leaks exploit design flaws in the WPA3 standard's Dragonfly key exchange -- the mechanism through which clients authenticate on a WPA3 router or access point. In a downgrade attack, Wi-Fi WPA3-capable networks can be coerced in using an older and more insecure password exchange systems, which can allow attackers to retrieve the network passwords using older flaws.' -- source: https://mobile.slashdot.org/story/19/04/11/1431219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Gmail Becomes First Major Email Provider To Support MTA-STS and TLS Reporting
by Peter Reutemann 11 Apr '19

11 Apr '19

'Google announced this week that Gmail has become the first major email provider to support two new security standards, namely MTA-STS and TLS Reporting. From a report: Both are extensions to the Simple Mail Transfer Protocol (SMTP), the protocol through which all emails are sent today. The purpose of MTA-STS and TLS Reporting is to help email providers establish cryptographically secure connections between each other, with the main goal of twarthing SMTP man-in-the-middle attacks. SMTP man-in-the-middle attacks are a major problem for today's email landscape, where rogue email server operators can intercept, read, and modify the contents of people's emails. The two new standards will prevent this by allowing legitimate email providers to create a secure channel for exchanging emails.' -- source: https://tech.slashdot.org/story/19/04/11/1822228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Amazon Workers Are Listening To What You Tell Alexa
by Peter Reutemann 11 Apr '19

11 Apr '19

'Amazon reportedly employs thousands of people around the world to help improve its Alexa digital assistant. "The team listens to voice recordings captured in Echo owners' homes and offices," reports Bloomberg. "The recordings are transcribed, annotated and then fed back into the software as part of an effort to eliminate gaps in Alexa's understanding of human speech and help it better respond to commands." From the report: The team comprises a mix of contractors and full-time Amazon employees who work in outposts from Boston to Costa Rica, India and Romania, according to the people, who signed nondisclosure agreements barring them from speaking publicly about the program. They work nine hours a day, with each reviewer parsing as many as 1,000 audio clips per shift, according to two workers based at Amazon's Bucharest office, which takes up the top three floors of the Globalworth building in the Romanian capital's up-and-coming Pipera district. The modern facility stands out amid the crumbling infrastructure and bears no exterior sign advertising Amazon's presence. The work is mostly mundane. One worker in Boston said he mined accumulated voice data for specific utterances such as "Taylor Swift" and annotated them to indicate the searcher meant the musical artist. Occasionally the listeners pick up things Echo owners likely would rather stay private: a woman singing badly off key in the shower, say, or a child screaming for help. The teams use internal chat rooms to share files when they need help parsing a muddled word -- or come across an amusing recording. Sometimes they hear recordings they find upsetting, or possibly criminal. Two of the workers said they picked up what they believe was a sexual assault. When something like that happens, they may share the experience in the internal chat room as a way of relieving stress. Amazon says it has procedures in place for workers to follow when they hear something distressing, but two Romania-based employees said that, after requesting guidance for such cases, they were told it wasn't Amazon's job to interfere. [...] Amazon, in its marketing and privacy policy materials, doesn't explicitly say humans are listening to recordings of some conversations picked up by Alexa. "We use your requests to Alexa to train our speech recognition and natural language understanding systems," the company says in a list of frequently asked questions. In Alexa's privacy settings, the company gives users the option of disabling the use of their voice recordings for the development of new features. A screenshot reviewed by Bloomberg shows that the recordings sent to the Alexa auditors don't provide a user's full name and address but are associated with an account number, as well as the user's first name and the device's serial number. An Amazon spokesperson said in a statement to Bloomberg: "We take the security and privacy of our customers' personal information seriously. We only annotate an extremely small sample of Alexa voice recordings in order [to] improve the customer experience. For example, this information helps us train our speech recognition and natural language understanding systems, so Alexa can better understand your requests, and ensure the service works well for everyone." They added: "We have strict technical and operational safeguards, and have a zero tolerance policy for the abuse of our system. Employees do not have direct access to information that can identify the person or account as part of this workflow. All information is treated with high confidentiality and we use multi-factor authentication to restrict access, service encryption and audits of our control environment to protect it."' -- source: https://yro.slashdot.org/story/19/04/10/2340251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

You Can Now Use Your Android Phone as a 2FA Security Key for Google Accounts
by Peter Reutemann 10 Apr '19

10 Apr '19

'Google said today it will now enable Android users to use their smartphones as a Fast Identity Online (FIDO) security key (for two-step authentication) for their Google accounts, thereby addressing one of the biggest challenges that has slowed the adoption of this security measure: convenience. A report adds: You can thus use your Android phone to protect your personal Google account, and your G Suite, Cloud Identity, and Google Cloud Platform work accounts. (Android tablets aren't supported -- Google specifically limited the functionality since users are more likely to have phones with them.) This means Android phones can move from two-step verification (2SV) to two-factor authentication (2FA). 2SV is a method of confirming a user's identity using something they know (password) and a second thing they know (a code sent via text message). 2FA is a method of confirming a user's identity by using a combination of two different factors: something they know (password), something they have (security key), or something they are (fingerprint). The feature is coming only to Android devices versions 7 and up.' -- source: https://tech.slashdot.org/story/19/04/10/1621253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Chrome Wants To Block Some HTTP File Downloads
by Peter Reutemann 10 Apr '19

10 Apr '19

'Google wants to block some file downloads carried out via HTTP on websites that use HTTPS. The plan is to block EXE, DMG, CRX, ZIP, GZIP, BZIP, TAR, RAR, and 7Z file downloads when the download is initiated via HTTP but the website URL shows HTTPS. Google said it's currently not thinking of blocking all downloads started from HTTP sites, since the browser already warns users about a site's poor security via the "Not Secure" indicator in the URL bar. The idea is to block insecure downloads on sites that appear to be secure (loaded via HTTPS) but where the downloads take place via plain ol' HTTP.' -- source: https://tech.slashdot.org/story/19/04/10/1758206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mysterious safety-tampering malware infects a second critical infrastructure site
by Peter Reutemann 10 Apr '19

10 Apr '19

'Sixteen months ago, researchers reported an unsettling escalation in hacks targeting power plants, gas refineries, and other types of critical infrastructure. Attackers who may have been working on behalf of a nation caused an operational outage at a critical-infrastructure site after deliberately targeting a system that prevented health- and life-threatening accidents. Game-changing attack on critical infrastructure site causes outage There had been compromises of critical infrastructure sites before. What was unprecedented in this attack—and of considerable concern to some researchers and critical infrastructure operators—was the use of an advanced piece of malware that targeted the unidentified site’s safety processes. Such safety instrumented systems (SIS) are a combination of hardware and software that many critical infrastructure sites use to prevent unsafe conditions from arising. When gas fuel pressures or reactor temperatures rise to potentially unsafe thresholds, for instance, a SIS will automatically close valves or initiate cooling processes to prevent health- or life-threatening accidents. Russia was likely behind dangerous critical infrastructure attack, report says By focusing on the site’s SIS, the malware carried the threat of physical destruction that depending on the site and the type of accident had the potential to be serious if not catastrophic. The malware was alternately named Triton and Trisis, because it targeted the Triconex product line made by Schneider Electric. It’s development was ultimately linked to a Russian government-backed research institute.' -- source: https://arstechnica.com/information-technology/2019/04/mysterious-safety-ta… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Windows XP Dies Final Death As Embedded POSReady 2009 Reaches End of Life
by Peter Reutemann 10 Apr '19

10 Apr '19

'Extended support for Windows Embedded POSReady 2009 -- the last supported version of Windows based on Windows XP -- ended on April 9, 2019, marking the final end of the Windows NT 5.1 product line after 17 years, 7 months, and 16 days. Counting this edition, Windows XP is the longest-lived version of Windows ever -- a record which is unlikely to be beaten. Despite the nominal end of support for Windows XP five years ago, the existence of POSReady 2009 allowed users to receive security updates on Windows XP Home and Professional SP3 through the use of a registry hack. Microsoft dissuaded users from doing this, stating that they "do not fully protect Windows XP customers," though no attempt was apparently made to prevent users from using this hack. With POSReady reaching the end of support, the flow of these security updates will likewise come to an end.' -- source: https://tech.slashdot.org/story/19/04/10/0017208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Most Public Windows Error-Message Screen Ever?
by Lawrence D'Oliveiro 09 Apr '19

09 Apr '19

There has long been a history of Windows error messages popping up in the most embarrassing public places, like on status displays in train stations, shopping malls and the like. Could this example be some kind of record for being the most public? Being wrapped right round the top of one of the tallest buildings in London, after all. <https://www.theregister.co.uk/2019/04/08/bt_tower_broadcasts_error_message_…>

1 0

meeting next Monday
by Peter Reutemann 09 Apr '19

09 Apr '19

Hi everyone Due to Easter falling on our usual WLUG meeting slot on the 22nd and the university no longer allowing rooms to be used on public holidays, this month's meeting will happen next Monday, a week earlier. At this stage, I'm still looking for a speaker. A talk on Wayland was suggested, but I never received a confirmation/blurb, unfortunately. https://www.meetup.com/WaikatoLinuxUsersGroup/events/257884273/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Opera Adds Crypto Wallet To Its Desktop Browser, Launches Anti-Chrome Campaign in Europe
by Peter Reutemann 09 Apr '19

09 Apr '19

'Opera has updated its eponymous web browser for the desktop with a crypto-makeover and a number of additional features. From a report: The Norway-headquartered browser maker has also launched a marketing campaign to cash in on the EU regulatory order that requires Google to give Android users in Europe more options to choose their preferred browser. Dubbed 'Reborn 3,' the latest version of Opera for Windows, macOS, and Linux includes a native cryptocurrency wallet, which follows Opera's Android app getting this feature in December. The wallet keys and transactions are synced between the desktop and mobile browsers with the latter also serving as a way for the user to authenticate their identity, the company said. [...] Additionally, Opera is speeding up the free VPN feature, after adding this feature to its Android app last month.' -- source: https://tech.slashdot.org/story/19/04/09/1356246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla is Launching Curated Recommended Extensions Program This Summer
by Peter Reutemann 09 Apr '19

09 Apr '19

'However much you love your chosen web browser, you have probably enhanced its capabilities through the use of add-ons. Finding decent, reliable add-ons can be tricky, and this is why Mozilla is launching the Recommended Extensions program. This editor-curated program will surface the very best vetted extensions for Firefox, and it is due to roll out in stages later this summer. Mozilla says that any extensions it recommends through the program will be highlighted across its portfolio of websites and products, including addons.mozilla.org (AMO) and on Firefox's Get Add-Ons page. The company is already identifying extensions it likes the look of, and will soon be reaching out to developers. Changes should be seen on AMO around June.' -- source: https://tech.slashdot.org/story/19/04/09/1444248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Several Major Browsers to Prevent Disabling of Click-Tracking 'Hyperlink Auditing'
by Peter Reutemann 08 Apr '19

08 Apr '19

'A HTML standard called hyperlink auditing that allows sites to track link clicks is enabled by default on Safari, Chrome, Opera, and Microsoft Edge, but will soon have no way to disable it. As it is considered a privacy risk, browsers previously allowed you to disable this feature. Now they are going in the opposite direction. Hyperlink auditing is an HTML standard that allows the creation of special links that ping back to a specified URL when they are clicked on. These pings are done in the form of a POST request to the specified web page that can then examine the request headers to see what page the link was clicked on. The article concludes that "Firefox and Brave win the award" for people who want this click-tracking capability disabled -- since "only Brave and Firefox currently disable it by default, and do not appear to have any plans on enabling it in the future."' -- source: https://news.slashdot.org/story/19/04/07/2338244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Why Aren't People Abandoning Windows For Linux?
by Peter Reutemann 08 Apr '19

08 Apr '19

'This weekend SlashGear published "Reasons to Abandon Windows For Linux," making their case to "Windows users who are curious about the state of Linux for mainstream computing." It tries to enumerate specific reasons why Linux might be the better choice, arguing among other things that: * Updates on Linux are fast and "rarely call for a restart" -- and are also more complete. "Updates are typically downloaded through a 'Software Updater' application that not only checks for operating system patches, but also includes updates for the programs that you've installed from the repository." * Windows "tries to serve a variety of markets...cramming in a scattered array of features" -- and along those lines, that Microsoft "has gradually implemented monetization schemes and methods for extracting user data." And yet you're still paying for that operating system, while Linux is less bloated and "free forever." * "Because less people use Linux, the platform is less targeted by malware and tends to be more secure than Windows" The article also touches on a few other points (including battery life), and predicts that problems with Windows are "bound to get worse over time and will only present more of a case for making the switch to Linux." Long-time Slashdot reader shanen shared the article, along with some new thoughts on why people really stay with Windows: I think the main "excuse" is the perception of reliability, which is really laughable if you've actually read the EULA. Microsoft certainly doesn't have to help anyone at all. I would argue that Windows support is neither a bug nor a feature, but just a marketing ploy. Their original submission suggests that maybe Linux needs to buttress the perception of its reliability with a better financial model -- possibly through a new kind of crowd funding which could also be extended to all open source software, or even to journalism).' -- source: https://linux.slashdot.org/story/19/04/07/2111218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Provably unbreakable encryption
by Wolf 07 Apr '19

07 Apr '19

Is this something fit for this list? https://www.quantamagazine.org/how-the-evercrypt-library-creates-hacker-pro… Wolf

2 1

Ongoing DNS hijackings target unpatched consumer routers
by Peter Reutemann 05 Apr '19

05 Apr '19

'A wave of DNS hijacking attacks that abuse Google's cloud computing service is causing consumer routers to connect to fraudulent and potentially malicious websites and addresses, a security researcher has warned. By now, most people know that Domain Name System servers translate human-friendly domain names into the numeric IP addresses that computers need to find other computers on the Internet. Over the past four months, a blog post published Thursday said, attackers have been using Google cloud service to scan the Internet for routers that are vulnerable to remote exploits. When they find susceptible routers, the attackers then use the Google platform to send malicious code that configures the routers to use malicious DNS servers.' -- source: https://arstechnica.com/information-technology/2019/04/ongoing-dns-hijackin… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The End of the Desktop?
by Peter Reutemann 04 Apr '19

04 Apr '19

'Steven J. Vaughan-Nichols, writing for ComputerWorld : Of course, at one time, to get any work done with a computer, you first had to learn a lot, about computers, operating systems, commands and more. Eventually, "friendly" became the most important adverb in computing circles, and we've reached the point in user-friendliness that people don't even talk about it anymore. Today, Google has shown with its Chrome OS that most of us can pretty much do anything we need to do on a computer with just a web browser. But Google's path is not Microsoft's path. Instead, it's moving us first to Windows as desktop as a service (DaaS) via Microsoft Managed Desktop (MMD). This bundles Windows 10 Enterprise, Office 365 and Enterprise Mobility + Security and cloud-based system management into Microsoft 365 Enterprise. The next step, Windows Virtual Desktop, enables companies to virtualize Windows 7 and 10, Office 365 ProPlus apps and other third-party applications on Azure-based virtual machines. If all goes well, you'll be able to subscribe to Windows Virtual Desktop this fall. Of course, Virtual Desktop is a play for business users -- for now. I expect Virtual Desktop to be offered to consumers in 2020. By 2025, Windows as an actual desktop operating system will be a niche product. Sound crazy? Uh, you do know that Microsoft already really, really wants you to "rent" Office 365 rather than buy Office 2019, don't you? But what about games, you say? We'll always have Windows for games! Will we? Google, with its Google Stadia gaming cloud service, is betting we're ready to move our games to the cloud as well. It's no pipe dream. Valve has been doing pretty well for years now with its Steam variation on this theme. So where is all this taking us? I see a world where the PC desktop disappears for all but a few. Most of us will be writing our documents, filling out our spreadsheets and doing whatever else we now do on our PCs via cloud-based applications on smart terminals running Chrome OS or Windows Lite. If you want a "real" PC, your choices are going to be Linux or macOS.' -- source: https://tech.slashdot.org/story/19/04/04/1724248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft and Canonical Launch Visual Studio Code Snap For Linux
by Peter Reutemann 04 Apr '19

04 Apr '19

'Following the release of Visual Studio 2019 for Windows and Mac platforms, Microsoft today is releasing a snap version of Visual Studio Code. A report adds: No, the source-code editor is not the Windows-maker's first snap -- it also released one for Skype, for instance. "As of today, Visual Studio Code is available for Linux as a snap, providing seamless auto-updates for its users. Visual Studio Code, a free, lightweight code editor, has redefined editors for building modern web and cloud applications, with built-in support for debugging, task running, and version control for a variety of languages and frameworks," says Canonical. Joao Moreno, Software Development Engineer, Microsoft Visual Studio Code offers the following statement: "The automatic update functionality of snaps is a major benefit. It is clear there is a thriving community around snaps and that it is moving forward at great pace. The backing of Canonical ensures our confidence in its ongoing development and long-term future."' -- source: https://linux.slashdot.org/story/19/04/04/1854252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'SPURV' Project Brings Windowed Android Apps To Desktop Linux
by Peter Reutemann 04 Apr '19

04 Apr '19

'A new "experimental containerized Android environment" from a company called Collabora allows Android apps to run in floating windows alongside native applications on desktop Linux. You can read all the technical details at the source link, but put simply, 'SPURV' creates a virtual Android device on your Linux computer, much like Bluestacks and other similar tools. There are various components of SPURV that allow the Android environment to play audio, connect to networks, and display hardware-accelerated graphics through the underlying Linux system. The most interesting part is 'SPURV HWComposer,' which renders Android applications in windows, alongside the windows from native Linux applications. This is what sets SPURV apart from (most) other methods of running Android on a computer. For this to work, the Linux desktop has to be using the Wayland display server (some Linux-based OSes use X11). Pre-built binaries for SPURV are not currently available -- you have to build it yourself from the source code. Still, it's an interesting proof-of-concept, and hopefully someone turns it into a full-featured product. ' -- source: https://linux.slashdot.org/story/19/04/03/2222207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Serious Apache server bug gives root to baddies in shared host environments
by Peter Reutemann 04 Apr '19

04 Apr '19

'The Apache HTTP Server, the Internet’s most widely used Web server, just fixed a serious vulnerability that makes it possible for untrusted users or software to gain unfettered control of the machine the software runs on. CVE-2019-0211, as the vulnerability is indexed, is a local privilege escalation, meaning it allows a person or software that already has limited access to the Web server to elevate privileges to root. From there, the attacker could do just about anything. The vulnerability makes it possible for unprivileged scripts to overwrite sensitive parts of a server’s memory, Charles Fol, the independent researcher who discovered the bug, wrote in a blog post. A malicious script could exploit the vulnerability to gain root. The vulnerability poses the most risk inside Web-hosting facilities that offer shared instances, in which a single physical machine serves content for more than one website. Typically, such servers prevent an administrator of one site from accessing other sites or from accessing sensitive settings of the machine itself.' -- source: https://arstechnica.com/information-technology/2019/04/serious-apache-serve… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Millions of Facebook Records Found on Amazon Cloud Servers
by Peter Reutemann 03 Apr '19

03 Apr '19

'Researchers at UpGuard, a cybersecurity firm, found troves of Facebook user information hiding in plain sight, inadvertently posted publicly on Amazon.com's cloud computing servers. From a report: The discovery shows that a year after the Cambridge Analytica scandal exposed how unsecure and widely disseminated Facebook users' information is online, companies that control that information at every step still haven't done enough to seal up private data, Bloomberg News reports. In one instance, Mexico City-based media company Cultura Colectiva openly stored 540 million records on Facebook users, including identification numbers, comments, reactions and account names. That database was closed on Wednesday after Bloomberg alerted Facebook to the problem and Facebook contacted Amazon. Facebook shares pared their gains after the Bloomberg News report. UpGuard adds: The data sets vary in when they were last updated, the data points present, and the number of unique individuals in each. What ties them together is that they both contain data about Facebook users, describing their interests, relationships, and interactions, that were available to third party developers. As Facebook faces scrutiny over its data stewardship practices, they have made efforts to reduce third party access. But as these exposures show, the data genie cannot be put back in the bottle. Data about Facebook users has been spread far beyond the bounds of what Facebook can control today. Combine that plenitude of personal data with storage technologies that are often misconfigured for public access, and the result is a long tail of data about Facebook users that continues to leak' -- source: https://yro.slashdot.org/story/19/04/03/182215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds on Social Media: 'It's a Disease. It Seems To Encourage Bad Behavior.'
by Peter Reutemann 03 Apr '19

03 Apr '19

'From a wide-ranging interview of Linus Torvalds with Linux Journal on the magazine's 25th anniversary: Linux Journal: If you had to fix one thing about the networked world, what would it be? Linus: Nothing technical. But, I absolutely detest modern "social media" -- Twitter, Facebook, Instagram. It's a disease. It seems to encourage bad behavior. I think part of it is something that email shares too, and that I've said before: "On the internet, nobody can hear you being subtle". When you're not talking to somebody face to face, and you miss all the normal social cues, it's easy to miss humor and sarcasm, but it's also very easy to overlook the reaction of the recipient, so you get things like flame wars, etc., that might not happen as easily with face-to-face interaction. But email still works. You still have to put in the effort to write it, and there's generally some actual content (technical or otherwise). The whole "liking" and "sharing" model is just garbage. There is no effort and no quality control. In fact, it's all geared to the reverse of quality control, with lowest common denominator targets, and click-bait, and things designed to generate an emotional response, often one of moral outrage. Add in anonymity, and it's just disgusting. When you don't even put your real name on your garbage (or the garbage you share or like), it really doesn't help. I'm actually one of those people who thinks that anonymity is overrated. Some people confuse privacy and anonymity and think they go hand in hand, and that protecting privacy means that you need to protect anonymity. I think that's wrong. Anonymity is important if you're a whistle-blower, but if you cannot prove your identity, your crazy rant on some social-media platform shouldn't be visible, and you shouldn't be able to share it or like it. Linux Journal: Is there any advice you'd like to give to young programmers/computer science students? Linus: I'm actually the worst person to ask. I knew I was interested in math and computers since an early age, and I was largely self-taught until university. And everything I did was fairly self-driven. So I don't understand the problems people face when they say "what should I do?" It's not where I came from at all.' -- source: https://tech.slashdot.org/story/19/04/03/1829244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How (Not) To Damage A Flash Storage Device
by Lawrence D'Oliveiro 02 Apr '19

02 Apr '19

Came across this article <http://wiki.laptop.org/go/How_to_Damage_a_FLASH_Storage_Device> on the OLPC wiki about some of the things to beware of when reformatting a flash device (USB stick or SD card -- what about SSDs?). Basically, if there is a mismatch between the blocking of data at the filesystem level and the device page size, then you could be increasing the number of hardware-level writes by a factor of 2 or more. This leads to a corresponding reduction in the life of the device.

1 0

Mozilla Will Run Two Experiments This Month With Firefox To Explore Ways To Fight Push Notification Permission Spam
by Peter Reutemann 02 Apr '19

02 Apr '19

'Mozilla said this week that it intends to run two experiments over the course of this month to determine the most adequate way of dealing with push notification spam, a growing problem that is slowly deteriorating the web experience for everyone. From a report: The experiments will run in Firefox Nightly (v68) and Firefox Beta (v67). The Firefox Nightly experiment will run from April 1 to April 29. During this time, Mozilla said Firefox Nightly would only allow websites to show a push notification permission only after the user has clicked or pressed a key while on a website. All attempts to show a push notification permission request before a click or key press will be blocked by default. [...] In the last two weeks of the experiment, Firefox will show an icon in the URL bar, but with no visible popup on the page. Users can click this icon and accept any push notification permission requests if they wish so.' -- source: https://news.slashdot.org/story/19/04/02/1941232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Introducing Google Tulip
by Ian Stewart 02 Apr '19

02 Apr '19

For those of you with two minutes to spare, here<https://www.youtube.com/watch?v=nsPQvZm_rgM> is a video clip introducing the Google Tulip product which was released on 1st April 2019.

2 1

Linux Mint 19.2 'Tina' is On the Way, But the Developers Seem Defeated and Depressed
by Peter Reutemann 02 Apr '19

02 Apr '19

'Brian Fagioli, reporting for BetaNews: Today should be happy times for the Linux Mint community, as we finally learn some new details about the upcoming version 19.2! It will be based on Ubuntu 18.04 and once again feature three desktop environments -- Xfce, Mate, and Cinnamon. We even found out the code name for Linux Mint 19.2 -- "Tina." And yet, it is hard to celebrate. Why? Because the developers seem to be depressed and defeated. They even appear to be a bit disenchanted with Free Software development overall. Clement Lefebvre, leader of the Linux Mint project, shared a very lengthy blog post today, and it really made me sad. He wrote, "For a team to work, developers need to feel like heroes. They want the same things as users, they are users, they were 'only' users to start with. At some stage they decide to get involved and they start investing time, efforts and emotions into improving our project. What they're looking for the most is support and happiness. They need feedback and information to understand bugs or feature requests and when they're done implementing something, they need to feel like heroes, they literally do, that's part of the reason they're here really." Upon publication of the article, Jason Hicks, Muffin maintainer and member of the Linux Mint team, corroborated the claims made by others.' -- source: https://linux.slashdot.org/story/19/04/02/1359246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

SUSE Will Soon Be the Largest Independent Linux Company
by Peter Reutemann 02 Apr '19

02 Apr '19

'At SUSECon in Nashville, Tennessee, European Linux power SUSE CEO Nils Brauckmann said his company would soon be the largest independent Linux company. "That's because, of course, IBM is acquiring Red Hat," reports ZDNet. "But, simultaneously, SUSE has continued to grow for seven-straight years." From the report: Brauckmann said, "We believe that makes our status as a truly independent open source company more important than ever. Our genuinely open-source solutions, flexible business practices, lack of enforced vendor lock-in, and exceptional service are more critical to customer and partner organizations, and our independence coincides with our single-minded focus on delivering what is best for them." Practically speaking, SUSE has been growing by focusing on delivering high-quality Linux and open-source programs and services to enterprise customers. Looking ahead Brauckmann said, "SUSE is better positioned to bring more innovation to customers and partners faster through both organic growth and acquisitions, keeping us on track to provide them with the open solutions that keep them ahead with their own customers in their own markets. We continue to adapt so our customers and partners can succeed." Last year SUSE's revenue grew by 15 percent in fiscal year 2018, and the business is about to surpass the $400 million revenue mark for the first time. SUSE, which sees not quite half of its business in Europe, is also seeing revenue growth around the world. North America, for example, now accounts for almost 40 percent of SUSE's revenues. The company is also expanding. SUSE added more than 300 employees in the last 12 months. For the most part this has been in engineering followed by sales and services. SUSE staff is now approaching 1,750 globally and its plans on continuing to hire aggressively. ' -- source: https://news.slashdot.org/story/19/04/01/222245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Sway – Tiling Window Manager Specially Crafted for Wayland
by Peter Reutemann 01 Apr '19

01 Apr '19

'Tiling window managers are popular lightweight alternatives to full desktop environments, especially among power users. Recently, a newer window manager reached its 1.0 release. This window manager, named Sway, is designed solely for systems that can use Wayland).' -- source: https://itsfoss.com/sway-window-manager/ Funny that, only came across Sway at the last meeting. :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Devuan.org Now Points To 'Pwned' Page With Gopher URLs
by Peter Reutemann 31 Mar '19

31 Mar '19

'"DEVUAN.ORG HAS BEEN PWNED" reads a new message at the home page for Devuan (a fork of Debian without systemd) -- which re-redirects to a new page named pwned.html, reports Slashdot reader DevNull127: In all capital letters, its carefully-indented message (complete with an ascii-art logo) now informs visitors that "the web sucks -- JavaScript sucks -- browsers suck." Posting the URLs to several gopher sites, it adds that "Gopher is the way -- gopher is the future." "Kiss port 80 goodbye. Join the revolution on port 70." The attackers identify themselves as "Green Hat Hackers," a term generally understood to mean ambitious newbie hackers who want to improve their skills. "Stop the madness," continues their message, which appeared just hours before the first day of April. "Get yourself a gopher client."' -- source: https://idle.slashdot.org/story/19/03/31/212227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

File-transfer Android to Linux using rsync
by tom butz 31 Mar '19

31 Mar '19

1 0

Fwd: File-transfer between Android amd Linux using rsync
by tom butz 31 Mar '19

31 Mar '19

HOW TO TRANSFER FILES FROM ANDROID-PDA TO LINUX-LAPTOP ====================================================== I'm running Android 7.1 on an OPPO A73 phone/PDA, and sometimes need to transfer photos and other files to a laptop running Linux Mint 19.1. Steps required on the PDA: 1) install termux from Android PlayStore 2) install rsync (in termux, type: pkg install rsync) 3) install perl (in termux, type: pkg install perl) 4) in termux, type: termux-setup-storage (also automatically creates links) 5) in termux, type: cd storage, then type: ls to see the following directories: dcim: photos/videos taken with the PDA downloads: stuff you downloaded movies: music: pictures: shared: everything (includes the above directories) In the following examples we will use /dcim/ and /downloads/: oppopictures.prl ================ In termux, type: perl system "rsync -av /sdcard/DCIM/ username_on_laptop\@1.2.3.4:/oppo_pictures/" This will transfer photos (*.jpg) and videos (*.mp4) to /oppo_pictures/Camera/, and screenshots to /oppo_pictures/Screenshots/. Directory /oppo/pictures/ must exist on the laptop and grant world-access (chmod 777). Ignore rsync error-messages regarding file-attributes. oppodownloads.prl ================= In termux, type: perl system "rsync -av /storage/downloads/ username_on_laptop\@1.2.3.4:/oppo_downloads/" This will transfer files to /oppo_downloads/. Directory /oppo_downloads/ must exist on laptop and grant world-access (chmod 777). Ignore rsync error-messages regarding file-attributes. NOTE: REPLACE the numbers 1.2.3.4 in the above examples with your laptop's IP-address (as provided by your IP-router). Get them using ifconfig. Theoretically you could do the above using the /shared/ directory to get a copy of Android-files.

1 0

Researchers Find 36 New Security Flaws In LTE Protocol
by Peter Reutemann 28 Mar '19

28 Mar '19

'A group of academics from South Korea have identified 36 new vulnerabilities in the Long-Term Evolution (LTE) standard used by thousands of mobile networks and hundreds of millions of users across the world. The vulnerabilities allow attackers to disrupt mobile base stations, block incoming calls to a device, disconnect users from a mobile network, send spoofed SMS messages, and eavesdrop and manipulate user data traffic. They were discovered by a four-person research team from the Korea Advanced Institute of Science and Technology Constitution (KAIST), and documented in a research paper they intend to present at the IEEE Symposium on Security and Privacy in late May 2019. The Korean researchers said they found 51 LTE vulnerabilities, of which 36 are new, and 15 have been first identified by other research groups in the past. They discovered this sheer number of flaws by using a technique known as fuzzing --a code testing method that inputs a large quantity of random data into an application and analyzes the output for abnormalities, which, in turn, give developers a hint about the presence of possible bugs. The resulting vulnerabilities, see image below or this Google Docs sheet, were located in both the design and implementation of the LTE standard among the different carriers and device vendors. The KAIST team said it notified both the 3GPP (industry body behind LTE standard) and the GSMA (industry body that represents mobile operators), but also the corresponding baseband chipset vendors and network equipment vendors on whose hardware they performed the LTEFuzz tests.' -- source: https://it.slashdot.org/story/19/03/28/2035257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ASUS Releases Fix For ShadowHammer Malware Attack
by Peter Reutemann 26 Mar '19

26 Mar '19

'ASUS may have inadvertently pushed malware to some of its computers through its update tool, but it at least it has a fix ready to go. The PC maker has released a new version of its Live Update software for laptops that addresses the ShadowHammer backdoor attack. It also promised "multiple security verification mechanisms" to reduce the chances of further attacks, and started using an "enhanced end-to-end encryption mechanism." There are upgrades to the behind-the-scenes server system to prevent future attacks, ASUS added. The company simultaneously reiterated the narrow scope of ShadowHammer, noting that the malware targeted a "very small and specific user group." It's believed to be an Advanced Persistent Threat -- that is, a state-backed assault against organizations rather than everyday users. Other ASUS devices weren't affected, according to a notice. While the fix is reassuring, it also raises questions as to why the systems weren't locked down earlier. Update tools are prime targets for hackers precisely because they're both trusted and have deep access to the operating system -- tight security is necessary to prevent an intruder from hijacking the process.' -- source: https://hardware.slashdot.org/story/19/03/26/2025229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Refuse To Be Terrorized
by Lawrence D'Oliveiro 26 Mar '19

26 Mar '19

I have written up some thoughts about those horrible happenings in Christchurch today. You can read them here <https://default-cube.deviantart.com/journal/Refuse-To-Be-Terrorized-Christc…>. I hope we learn the right lessons from others who have been here before us, and not repeat too many of their mistakes.

1 2

Firefox Lockbox Comes To Android To Ease Password Pain
by Peter Reutemann 26 Mar '19

26 Mar '19

'If you're a Firefox true believer, or even just a Firefox user, your password struggles just got a little easier with the release of Firefox Lockbox for Android devices. From a report: The password manager, based on login information already in Firefox, makes it easier to sign into apps as well. It integrates with login autocomplete systems in both Apple's iOS and Google's Android software, Mozilla said. It's not as fancy as password managers like LastPass, BitWarden, 1Password and Dashlane, and the only browser it works with is Firefox. On the other hand, if you're already in the Firefox world, it's basically already set up for you. There's no migration process as with dedicated password managers.' -- source: https://news.slashdot.org/story/19/03/26/1559243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Makes Emails More Dynamic With AMP For Email
by Peter Reutemann 26 Mar '19

26 Mar '19

'Google today officially launched AMP for Email, its effort to turn emails from static documents into dynamic, web page-like experiences. >From a report: AMP for Email is coming to Gmail, but other major email providers like Yahoo Mail, Outlook and Mail.ru will also support AMP emails. It's been more than a year since Google first announced this initiative. Even by Google standards, that's a long incubation phase, though there's also plenty of backend work necessary to make this feature work. The promise of AMP for Email is that it'll turn basic messages into a surface for actually getting things done. "Over the past decade, our web experiences have changed enormously -- evolving from static flat content to interactive apps -- yet email has largely stayed the same with static messages that eventually go out of date or are merely a springboard to accomplishing a more complex task," Gmail product manager Aakash Sahney writes. "If you want to take action, you usually have to click on a link, open a new tab, and visit another website." With AMP for Email, those messages become interactive. That means you'll be able to RSVP to an event right from the message, fill out a questionnaire, browse through a store's inventory or respond to a comment -- all without leaving your web-based email client.' -- source: https://tech.slashdot.org/story/19/03/26/1838254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android Users' Security and Privacy At Risk From Shadowy Ecosystem of Pre-Installed Software, Study Warns
by Peter Reutemann 25 Mar '19

25 Mar '19

'Researchers behind a large-scale independent study of pre-installed Android apps "unearthed a complex ecosystem of players with a primary focus on advertising and 'data-driven services' -- which they argue the average Android user is likely to be unaware of (while also likely lacking the ability to uninstall/evade the baked in software's privileged access to data and resources themselves)," reports TechCrunch. From the report: The study, which was carried out by researchers at the Universidad Carlos III de Madrid (UC3M) and the IMDEA Networks Institute, in collaboration with the International Computer Science Institute (ICSI) at Berkeley (USA) and Stony Brook University of New York (US), encompassed more than 82,000 pre-installed Android apps across more than 1,700 devices manufactured by 214 brands, according to the IMDEA institute. "The study shows, on the one hand, that the permission model on the Android operating system and its apps allow a large number of actors to track and obtain personal user information," it writes. "At the same time, it reveals that the end user is not aware of these actors in the Android terminals or of the implications that this practice could have on their privacy. Furthermore, the presence of this privileged software in the system makes it difficult to eliminate it if one is not an expert user." In all 1,200 developers were identified behind the pre-installed software they found in the data-set they examined, as well as more than 11,000 third party libraries (SDKs). Many of the preloaded apps were found to display what the researchers dub potentially dangerous or undesired behavior. The data-set underpinning their analysis was collected via crowd-sourcing methods -- using a purpose-built app (called Firmware Scanner), and pulling data from the Lumen Privacy Monitor app. The latter provided the researchers with visibility on mobile traffic flow -- via anonymized network flow metadata obtained from its users. They also crawled the Google Play Store to compare their findings on pre-installed apps with publicly available apps -- and found that just 9% of the package names in their dataset were publicly indexed on Play. Another concerning finding relates to permissions. In addition to standard permissions defined in Android (i.e. which can be controlled by the user) the researchers say they identified more than 4,845 owner or "personalized" permissions by different actors in the manufacture and distribution of devices. So that means they found systematic user permissions workarounds being enabled by scores of commercial deals cut in a non-transparency data-driven background Android software ecosystem. The researchers address the lack of transparency and accountability in the Android ecosystem by suggesting the introduction and use of certificates signed by globally-trusted certificate authorities, or a certificate transparency repository "dedicated to providing details and attribution for certificates used to sign various Android apps, including pre-installed apps, even if self-signed." They also suggest Android devices should be required to document all pre-installed apps, plus their purpose, and name the entity responsible for each piece of software -- and do so in a manner that is "accessible and understandable to users."' -- source: https://tech.slashdot.org/story/19/03/25/2058215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Fixes Chrome 'Evil Cursor' Bug Abused by Tech Support Scam Sites
by Peter Reutemann 25 Mar '19

25 Mar '19

'Google has patched a Chrome bug that was being abused in the wild by tech support scammers to create artificial mouse cursors and lock users inside browser pages by preventing them from closing and leaving browser tabs. From a report: The trick was first spotted in September 2018 by Malwarebytes analyst Jerome Segura. Called an "evil cursor," it relied on using a custom image to replace the operating system's standard mouse cursor graphic. A criminal group that Malwarebytes called Partnerstroka operated by switching the standard OS 32-by-32 pixels mouse cursor with one of 128 or 256 pixels in size. A normal cursor would still appear on screen, but in the corner of a bigger transparent bounding box. [...] The "evil cursor" fix is currently live for Google Canary users, and is scheduled to land in the Chrome 75 stable branch, to be released later this spring.' -- source: https://tech.slashdot.org/story/19/03/25/210220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Telegram Adds 'Delete Everywhere' Nuclear Option -- Killing Chat History
by Peter Reutemann 25 Mar '19

25 Mar '19

'Instant messaging service Telegram has added a feature that lets a user delete messages in one-to-one and/or group private chats, after the fact, and not only from their own inbox. From a report: The new 'nuclear option' delete feature allows a user to selectively delete their own messages and/or messages sent by any/all others in the chat. They don't even have to have composed the original message or begun the thread to do so. They can just decide it's time. Let that sink in. All it now takes is a few taps to wipe all trace of a historical communication -- from both your own inbox and the inbox(es) of whoever else you were chatting with (assuming they're running the latest version of Telegram's app).' -- source: https://tech.slashdot.org/story/19/03/25/1641204 Something that WhatsApp could add as well... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Hackers Hijacked ASUS Software Updates To Install Backdoors on Thousands of Computers
by Peter Reutemann 25 Mar '19

25 Mar '19

'ASUS is believed to have pushed malware to hundreds of thousands of customers through its trusted automatic software update tool after attackers compromised the company's server and used it to push the malware to machines. From a report: Researchers at cybersecurity firm Kaspersky Lab say that ASUS, one of the world's largest computer makers, was used to unwittingly to install a malicious backdoor on thousands of its customers' computers last year after attackers compromised a server for the company's live software update tool. The malicious file was signed with legitimate ASUS digital certificates to make it appear to be an authentic software update from the company, Kaspersky Lab says. ASUS, a multi-billion dollar computer hardware company based in Taiwan that manufactures desktop computers, laptops, mobile phones, smart home systems, and other electronics, was pushing the backdoor to customers for at least five months last year before it was discovered, according to new research from the Moscow-based security firm. The researchers estimate half a million Windows machines received the malicious backdoor through the ASUS update server, although the attackers appear to have been targeting only about 600 of those systems. The malware searched for targeted systems through their unique MAC addresses. Once on a system, if it found one of these targeted addresses, the malware reached out to a command-and-control server the attackers operated, which then installed additional malware on those machines. Kaspersky Lab said it uncovered the attack in January after adding a new supply-chain detection technology to its scanning tool to catch anomalous code fragments hidden in legitimate code or catch code that is hijacking normal operations on a machine. The company plans to release a full technical paper and presentation about the ASUS attack, which it has dubbed ShadowHammer, next month at its Security Analyst Summit in Singapore' -- source: https://yro.slashdot.org/story/19/03/25/144248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

topic for meeting this month?
by Peter Reutemann 24 Mar '19

24 Mar '19

Hi everyone Anyone got a topic that they'd like to present on? Any interesting open-source software that they've come across and would like to demo for a few minutes? Linux distro roundup? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

Two serious WordPress plugin vulnerabilities are being exploited in the wild
by Peter Reutemann 24 Mar '19

24 Mar '19

'Attackers have been actively exploiting serious vulnerabilities in two widely used WordPress plugins to compromise websites that run the extensions on top of the content management system. The two affected plugins are Easy WP SMTP with 300,000 active installations and Social Warfare, which has about 70,000 active installations. While developers have released patches for both exploited flaws, download figures indicate many vulnerable websites have yet to install the fixes. Figures for Easy WP SMTP, which was fixed five days ago, show the plugin has just short of 135,000 downloads in the past seven days. Figures for Social Warfare show it has been downloaded fewer than 20,000 times since a patch was published on WordPress on Friday. Sites that use either plugin should disable them immediately and then ensure they have been updated to version 1.3.9.1 of Easy WP SMTP and 3.5.3 of Social Warfare.' -- source: https://arstechnica.com/information-technology/2019/03/two-serious-wordpres… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Stallman Suggests Install Fest 'Deals With Devil' Include Actual Man Dressed As Devil
by Peter Reutemann 24 Mar '19

24 Mar '19

'This weekend's annual LibrePlanet conference, hosted by the Free Software Foundation, prompted a new essay about "install fests" from Richard Stallman: Install fests invite users to bring their computers so that experts can install GNU/Linux on them... The problem is that most computers can't run with a completely free GNU/Linux distro. They contain peripherals, or coprocessors, that won't operate unless the installed system contains some nonfree drivers or firmware... This presents the install fest with a dilemma. If it upholds the ideals of freedom, by installing only free software from 100%-free distros, partly-secret machines won't become entirely functional and the users that bring them will go away disappointed. However, if the install fest installs nonfree distros and nonfree software which make machines entirely function, it will fail to teach users to say no for freedom's sake. They may learn to like GNU/Linux, but they won't learn what the free software movement stands for.... In effect, the install fest makes the deal with the devil, on the user's behalf, behind a curtain so the user doesn't recognize that it is one. I propose that the install fest show users exactly what deal they are making. Let them talk with the devil individually, learn the deal's bad implications, then make a deal -- or refuse! As always, I call on the install fest itself to install only free software, taking a strict stance. In this way it can set a clear moral example of rejecting nonfree software. My new idea is that the install fest could allow the devil to hang around, off in a corner of the hall, or the next room. (Actually, a human being wearing a sign saying "The Devil," and maybe a toy mask or horns.) The devil would offer to install nonfree drivers in the user's machine to make more parts of the computer function, explaining to the user that the cost of this is using a nonfree (unjust) program... Those users that get nonfree drivers would see what their moral cost is, and that there are people in the community who refuse to pay that cost. They would have the chance to reflect afterwards on the situation that their flawed computers have put them in, and about how to change that situation, in the small and in the large. Stallman adds that the Free Software Foundation itself would never let a devil near its events. "But given the fact that most install fests quietly play the role of the devil, I think that an explicit devil would be less bad. "It would convert the install-fest dilemma from a debilitating contradiction into a teaching experience."' -- source: https://news.slashdot.org/story/19/03/23/1624242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Play Store Mistakenly Removed KDE Connect
by Peter Reutemann 24 Mar '19

24 Mar '19

'Google's Play Store made a bad mistake on Tuesday, long-time Slashdot reader sombragris writes: KDE Connect, a project designed to enable seamless communcation and control between a desktop computer and a mobile phone, was suddenly removed from Android's Google Play store. According to a Twitter thread by Albert Vaca, KDE Connect's maintainer, the removal was allegedly because the app was in breach of Google's new SMS policy. There's an exemption which applies to KDE Connect, but the maintainer was unable to contact anyone at Google to provide support. "There is simply no way to talk to a human being at @Google", he said. Cintora also announced on Twitter that while trying to comply with the Play Store's new policy, he'd initially been stopped again by technical problems. "The @GooglePlay console gives me an internal error, so I can't upload the version without SMS support." But on Thursday Cintora tweeted that KDE Connect "finally got approved, and SMS support is back in version 1.12.4, both on the Play Store and F-Droid!" Cintora credits this resolution partly to his Twitter thread, which got over half a million impressions. Its last tweet now features a picture of a celebrating parrot.' -- source: https://tech.slashdot.org/story/19/03/23/1852220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Share Buybacks
by Lawrence D'Oliveiro 23 Mar '19

23 Mar '19

Seems that Oracle has been buying back its own shares to keep its share price high <https://www.theregister.co.uk/2019/03/22/oracle_buyback_programme/>. On its own, this is not automatically a bad thing. I remember reading about a conversation between Steve Jobs and Warren Buffett some years ago, along the lines of: WB: You think your company shares are undervalued? SJ: Yes. WB: You have plenty of spare cash on hand? SJ: Yes. WB: Then use some of that cash to buy back some of your own shares. If you can spend 80¢ and get a dollar, why wouldn’t you? However, the warning sign in the above article is this: The overall effect is that Oracle is now in a net debt position for the first time since 2008, the Wall Street Journal reported this week. In other words, it seems to be borrowing in order to boost its share price. This might not end well ...

2 1

Tor-Powered Tails 3.13 Anonymous Linux OS Adds Extra Security and Latest Updates
by Peter Reutemann 21 Mar '19

21 Mar '19

'Powered by the Linux 4.19.28 kernel, the Tails 3.13 operating system is now available with latest TOR technologies to help you stay hidden while surfing the Internet, including the Tor Browser 8.0.7 anonymous web browser and Tor 0.3.5.8 client and server for the anonymous Tor network. However, probably the most important addition in the Tails 3.13 release is the updated Intel microcode to version 3.20180807a.2, which adds an extra security measure against more variants of the well-known Spectre, Meltdown, and L1TF (Level 1 Terminal Fault) security vulnerabilities. Furthermore, Tails 3.13 updates the Mozilla Thunderbird email and news client to version 65.1.0, adds support for the Bopomofo input method and improves support for the Pinyin input method for Chinese users, and implements automatic backup of the persistent storage's configuration whenever a change occurs.' -- source: https://news.softpedia.com/news/tor-powered-tails-3-13-ethical-hacking-linu… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

For Years, Hundreds of Millions of Facebook Users Had Their Account Passwords Stored in Plain Text and Searchable By Thousands of Facebook Employees
by Peter Reutemann 21 Mar '19

21 Mar '19

'Hundreds of millions of Facebook users had their account passwords stored in plain text and searchable by thousands of Facebook employees -- in some cases going back to 2012, KrebsOnSecurity reported Thursday. From the report: Facebook says an ongoing investigation has so far found no indication that employees have abused access to this data. Facebook is probing the causes of a series of security failures in which employees built applications that logged unencrypted password data for Facebook users and stored it in plain text on internal company servers. That's according to a senior Facebook employee who is familiar with the investigation and who spoke on condition of anonymity because they were not authorized to speak to the press. The Facebook source said the investigation so far indicates between 200 million and 600 million Facebook users may have had their account passwords stored in plain text and searchable by more than 20,000 Facebook employees. The source said Facebook is still trying to determine how many passwords were exposed and for how long, but so far the inquiry has uncovered archives with plain text user passwords in them dating back to 2012.' -- source: https://yro.slashdot.org/story/19/03/21/1525243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

SGM next week
by Peter Reutemann 19 Mar '19

19 Mar '19

Hi everyone Just a reminder for our (paying) society members that our SGM is on next Monday at 7pm: https://www.meetup.com/WaikatoLinuxUsersGroup/events/259341905/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How a wireless keyboard lets hackers take full control of connected computers
by Peter Reutemann 19 Mar '19

19 Mar '19

'There’s a critical vulnerability in a model of Fujitsu wireless keyboard that makes it easy for hackers to take full control of connected computers, security researchers warned on Friday. Anyone using the keyboard model should strongly consider replacing it immediately. The Fujitsu Wireless Keyboard Set LX901 uses a proprietary 2.4 GHz radio communication protocol called WirelessUSB LP from Cypress Semiconductor. While the keyboard and mouse send input that’s protected with the time-tested Advanced Encryption Standard, the USB dongle that accepts the input accepts unencrypted packets as well, as long as they’re in the proper format. Researchers with the Germany-based penetration-testing firm SySS developed a proof-of-concept attack that exploits the insecure design. Using a small hardware device, they are able to send commands to vulnerable Fujitsu keyboard receiver dongles that are within range. As the video below demonstrates, the researchers were able to send input of their choice that’s automatically funneled to the connected computer.' -- source: https://arstechnica.com/information-technology/2019/03/how-a-wireless-keybo… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Are Large Cloud Providers a Threat To Open Source Vendors?
by Peter Reutemann 18 Mar '19

18 Mar '19

'Stephen O'Grady, co-founder of the industry analyst firm RedMonk, asks whether open source vendors are marching towards an inevitable and damaging war with big cloud providers: In the last twelve to eighteen months...a switch has been flipped. Companies have gone from regarding cloud providers like Amazon, Google or Microsoft as not even worth mentioning as competition to dreadful, existential threat. The fear of these cloud providers has become so overpowering, in fact, that commercial open source vendors have chosen -- against counsel, in many cases -- to walk down strategic paths that violate open source cultural norms, trigger massive and sustained negative PR and jeopardize relationships with developers, partners and customers. Specifically, commercial open source providers have increasingly turned to models that blur the lines between open source and proprietary software in an attempt to access the strengths of both, with the higher probability outcome of ending up with their weaknesses instead. That commercial open source providers took these actions having been advised of these and other risks in advance says everything about how these businesses view their prospects in a world increasingly dominated by massive providers of cloud infrastructure and an expanding array of services that sit on top of that. The strategic decisions inarguably have major, unavoidable negative consequences, but commercial open source providers -- or their investors, at least -- believe that a lack of action would be even more damaging.' -- source: https://news.slashdot.org/story/19/03/16/0118259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

How Debian Almost Failed to Elect a Project Leader
by Peter Reutemann 17 Mar '19

17 Mar '19

'Five candidates now are running to be Debian's project leader for the coming year. But earlier this week, Slashdot reader Seven Spirals shared LWN's story about what a difficult election it's been: This year, the call for nominations was duly sent out by project secretary Kurt Roeckx on March 3. But, as of March 10, no eligible candidates had put their names forward... There is nobody there to do any campaigning. This being Debian, the constitution naturally describes what is to happen in this situation: the nomination period is extended for another week... Should this deadline also pass without candidates, it will be extended for another week; this loop will repeat indefinitely until somebody gives in and submits their name... In the absence of a project leader, the chair of the technical committee and the project secretary are empowered to make decisions -- as long as they are able to agree on what those decisions should be. Since Debian developers are famously an agreeable and non-argumentative bunch, there should be no problem with that aspect of things... One might well wonder, though, why there seems to be nobody who wants to take the helm of this project for a year. The fact that it is an unpaid position requiring a lot of time and travel might have something to do with it. If that were indeed to prove to be part of the problem, Debian might eventually have to consider doing what a number of similar organizations have done and create a paid position to do this work' -- source: https://linux.slashdot.org/story/19/03/16/2317214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

F5 Acquired NGINX For $670M
by Peter Reutemann 17 Mar '19

17 Mar '19

'F5 Networks on Monday announced that it will acquire NGINX, which provides popular open-source software of the same name, for $670 million. The deal advances F5's aim of capitalizing on the trend toward multi-cloud deployments. F5 plans to enhance NGINX's current offerings with F5 security solutions and will integrate F5 cloud-native technology with NGINX's software load balancing technology. This should accelerate F5's time to market of application services for containerized applications. Meanwhile, NGINX will benefit from F5's global salesforce, channel infrastructure and partner ecosystem. The acquisition adds "the power of NGINX's open source innovation to F5's ADC leadership and enterprise reach," NGINX CEO Gus Robertson said in a statement ' -- source: https://slashdot.org/story/19/03/16/1957241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Two-Thirds of Android Antivirus Apps Are Total BS
by Peter Reutemann 14 Mar '19

14 Mar '19

'Austrian antivirus-testing lab AV-Comparatives tested 250 antivirus apps in Google Play against 2,000 malware samples. They found that only 80 of the apps could stop even a minimal amount of malware. "Less than one in 10 of the apps tested defended against all 2,000 malicious apps, while over two-thirds failed to reach a block rate of even 30 percent," the lab said in a press release. To make sure you're protecting your Android device properly, stick to apps from well-known antivirus companies. Basically, AV-Comparatives said, most Android antivirus apps are phony, and many of them seemed to have been created only to display ads or promote a developer's career. "The main purpose of these apps seems to be generating easy revenue for their developers, rather than actually protecting their users," the AV-Comparatives report said' -- source: https://it.slashdot.org/story/19/03/13/213255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

Amazon May Finally Get .amazon Domain
by Lawrence D'Oliveiro 14 Mar '19

14 Mar '19

Amazon has been trying to register the .amazon top-level domain for years, but the governments of Brazil and Peru have been trying to stall this, just ignoring the established procedures for resolving domain disputes, which keep going against them. But it seems ICANN has finally lost patience and is going to stop bending over backwards to placate those governments, and grant the registration <https://www.theregister.co.uk/2019/03/12/amazon_domain_spat/>.

1 0

Google Quietly Adds DuckDuckGo as a Search Engine Option for Chrome Users in About 60 Markets
by Peter Reutemann 13 Mar '19

13 Mar '19

'In an update to the chromium engine, which underpins Google's popular Chrome browser, the search giant has quietly updated the lists of default search engines it offers per market -- expanding the choice of search product users can pick from in markets around the world. Most notably it's expanded search engine lists to include pro-privacy rivals in more than 60 markets globally. The changes, which appear to have been pushed out with the Chromium 73 stable release yesterday, come at a time when Google is facing rising privacy and antitrust scrutiny and accusations of market distorting behavior at home and abroad' -- source: https://tech.slashdot.org/story/19/03/13/1521235 Including NZ! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Launches Android Q Beta 1
by Peter Reutemann 13 Mar '19

13 Mar '19

'Google said today it is rolling out the first beta version of Android Q, the newest version of its mobile operating system. The company will roll out a stable version of Android Q later this year. From a report: The first beta includes a preview SDK for developers with system images for the Pixel, Pixel XL, Pixel 2, Pixel 2 XL, Pixel 3, Pixel 3 XL, and the official Android Emulator. This is the fourth year running that Google has released the first developer preview of the next Android version in March -- Android N (later named Android Nougat), Android O (Android Oreo), and Android P (Android Pie). For the past two years, Google did not use the Android Beta Program, which lets you get early Android builds via over-their-air updates on select devices. That changes with Android Q -- Google is making the first preview available as a beta, not just as a developer preview. That signals that it is ready for early adopters to try, in addition to developers. As before, this preview version will be referred to as Android Q until Google picks a name starting with that letter.' -- source: https://developers.slashdot.org/story/19/03/13/196215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Send Lets You Share 1GB Files With No Strings Attached
by Peter Reutemann 13 Mar '19

13 Mar '19

'In 2017, Mozilla experimented with a service that let you transfer 1GB files by sharing a web address with the recipient. Firefox Send is now out of testing and boasts a magnified 2.5GB file-size limit if you log into your Firefox account. From a report: Firefox Send is handy for those moments when you need to share video, audio or photo files that can be too big to squeeze into an email attachment. [...] Firefox Send, which will also be available as an Android app, illustrates one of Mozilla's efforts to diversify beyond the Firefox browser. Mozilla touts Firefox Send as focusing on privacy and uses encryption to protect files. Firefox Send files are available for up to seven days and can be password-protected. You can also limit the number of times they're downloaded.' -- source: https://hardware.slashdot.org/story/19/03/12/1439222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Russia Blocks Encrypted Email Provider ProtonMail
by Peter Reutemann 12 Mar '19

12 Mar '19

'Russia has told internet providers to enforce a block against encrypted email provider ProtonMail, the company's chief has confirmed. The block was ordered by the state Federal Security Service, formerly the KGB, according to a Russian-language blog, which obtained and published the order after the agency accused the company and several other email providers of facilitating bomb threats. Several anonymous bomb threats were sent by email to police in late January, forcing several schools and government buildings to evacuate. In all, 26 internet addresses were blocked by the order, including several servers used to scramble the final connection for users of Tor, an anonymity network popular for circumventing censorship. Internet providers were told to implement the block "immediately," using a technique known as BGP blackholing, a way that tells internet routers to simply throw away internet traffic rather than routing it to its destination. But the company says while the site still loads, users cannot send or receive email. The way the KGB blocked ProtonMail is "particularly sneaky," ProtonMail chief executive Andy Yen said. "ProtonMail is not blocked in the normal way, it's actually a bit more subtle. They are blocking access to ProtonMail mail servers. So Mail.ru -- and most other Russian mail servers -- for example, is no longer able to deliver email to ProtonMail, but a Russian user has no problem getting to their inbox." "That's because the two ProtonMail servers listed by the order are its back-end mail delivery servers, rather than the front-end website that runs on a different system," adds TechCrunch.' -- source: https://yro.slashdot.org/story/19/03/12/0329259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Knoppix 8.5 iso?
by Ian Young 12 Mar '19

12 Mar '19

Anyone have an iso file for Knoppix 8.5, or know of a source for download? This appears to be the latest version, but so far is apparently only available with a copy of Linux Magazine linked with a Linux event in Germany. ~ Ian Y

2 1

Samsung Galaxy S10 Facial Recognition Fooled by a Video of the Phone Owner
by Peter Reutemann 11 Mar '19

11 Mar '19

'Experts have proven once again that facial recognition on modern devices remains hilariously insecure and can be bypassed using simple tricks such as showing an image or a video in front of a device's camera. From a report: The latest device to fall victim to such attacks is Samsung Galaxy S10, Samsung's latest top tier phone and considered one of the world's most advanced smartphones to date. Unfortunately, the Galaxy S10's facial recognition feature remains just as weak as the one supported in its previous versions or on the devices of its competitors, according to Lewis Hilsenteger, a smartphone reviewer better known as Unbox Therapy on YouTube. Hilsenteger showed in a demo video uploaded on his YouTube channel last week how putting up a video of the phone owner in front of the Galaxy S10 front camera would trick the facial recognition system into unlocking the device.' -- source: https://mobile.slashdot.org/story/19/03/11/166239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

EU's Plan To Ban Sale of User-Moddable RF Devices Draws Widespread Condemnation
by Peter Reutemann 11 Mar '19

11 Mar '19

'The Register is reporting that the EU is looking to block users from tinkering the firmware/software of their RF devices. This seems to have been very under reported, with a fairly short consultation period that has now expired. It could force manufacturers to lock down phones and routers etc to stop you from installing the likes of Lineage OS or OpenWRT. The way this is written it could stop devices like laptops or Raspberry Pi's having their software changed. >From the report: The controversy centres on Article 3(3)(i) of the EU Radio Equipment Directive, which was passed into law back in 2014. However, an EU working group is now about to define precisely which devices will be subject to the directive -- and academics, researchers, individual "makers" and software companies are worried that their activities and business models will be outlawed. Article 3(3)(i) states that RF gear sold in the EU must support "certain features in order to ensure that software can only be loaded into the radio equipment where the compliance of the combination of the radio equipment and software has been demonstrated." If the law is implemented in its most potentially harmful form, no third-party firmware could be installed onto something like a home router, for example.' -- source: https://tech.slashdot.org/story/19/03/11/1835239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Debian Package Maintainer Steps Down, Complaining About 'Old Infrastructure'
by Peter Reutemann 11 Mar '19

11 Mar '19

'Michael Stapelberg, maintains "a bunch" of Debian packages and services, and says the free software Linux distro "has been in my life for well over 10 years at this point." Today he released a 2,255-word essay explaining why he's "winding down" his involvement in Debian to a minimum, citing numerous complaints including Debian's complicated build stack, waits of up to seven hours before package uploads can be installed, leading to "asynchronous" feedback -- and Debian's lack of tooling for large changes. The closest to "sending out a change for review" is to open a bug report with an attached patch... Culturally, reviews and reactions are slow. There are no deadlines. I literally sometimes get emails notifying me that a patch I sent out a few years ago (!!) is now merged. This turns projects from a small number of weeks into many years, which is a huge demotivator for me. Interestingly enough, you can see artifacts of the slow online activity manifest itself in the offline culture as well: I don't want to be discussing systemd's merits 10 years after I first heard about it. Lastly, changes can easily be slowed down significantly by holdouts who refuse to collaborate. My canonical example for this is rsync, whose maintainer refused my patches to make the package use debhelper purely out of personal preference. Granting so much personal freedom to individual maintainers prevents us as a project from raising the abstraction level for building Debian packages, which in turn makes tooling harder. There's also several complaints about old infrastructure -- for example, "I dread interacting with the Debian bug tracker. debbugs is a piece of software (from 1994) which is only used by Debian and the GNU project these days." Stapelberg also complains that the "painful" experience of developing using Debian "leaves a lot to be desired," and adds that "It baffles me that in 2019, we still don't have a conveniently browsable threaded archive of mailing list discussions." "My frustration level ultimately exceeded the threshold," Stapelberg writes in the essay, adding "I hope this post inspires someone, ideally a group of people, to improve the developer experience within Debian." He'll soon transition packages to be team-maintained "where it makes sense," but also "orphan packages where I am the sole maintainer... For all intents and purposes, please treat me as permanently on vacation..." "I will try to keep up best-effort maintenance of the manpages.debian.org service and the codesearch.debian.net service, but any help would be much appreciated."' -- source: https://linux.slashdot.org/story/19/03/10/2245221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Fine And Ancient Art Of Letterlocking
by Lawrence D'Oliveiro 07 Mar '19

07 Mar '19

Came across this linked from computer security expert Bruce Schneier’s blog: how did people in pre-industrial times protect paper letters from prying eyes? There were no mass-produced envelopes in those days, so they resorted to “letterlocking” -- intricate ways of folding and sealing a letter to form its own envelope <https://www.atlasobscura.com/articles/what-did-people-do-before-envelopes-l…>. And yes, there is a whole website devoted to this: <http://letterlocking.org/>.

1 0

Researchers Uncover Ring of GitHub Accounts Promoting 300+ Backdoored Apps
by Peter Reutemann 05 Mar '19

05 Mar '19

'A security researcher has uncovered a ring of malicious GitHub accounts promoting over 300 backdoored Windows, Mac, and Linux applications and software libraries. The malicious apps contained code to gain boot persistence on infected systems and later download other malicious code -- which appeared to be a "sneaker bot," a piece of malware that would add infected systems to a botnet that would later participate in online auctions for limited edition sneakers. All the GitHub accounts that were hosting these files -- backdoored versions of legitimate apps -- have now been taken down. One account, in particular, registered in the name of Andrew Dunkins, hosted 305 backdoored ELF binaries. Another 73 apps were hosted across 88 other accounts. ' -- source: https://developers.slashdot.org/story/19/03/05/1351217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Firefox Fears UAE Government's Cybersecurity Company 'DarkMatter' May Be Tied To a Cyber Espionage Program
by Peter Reutemann 05 Mar '19

05 Mar '19

'Firefox browser-maker Mozilla is considering whether to block cybersecurity company DarkMatter from serving as one of its internet security gatekeepers after a Reuters report linked the United Arab Emirates-based firm to a cyber espionage program. Reuters reported in January that DarkMatter provided staff for a secret hacking operation, codenamed Project Raven, on behalf of an Emirati intelligence agency. The unit was largely comprised of former U.S. intelligence officials who conducted offensive cyber operations for the UAE government. Former Raven operatives told Reuters that many DarkMatter executives were unaware of the secretive program, which operated from a converted Abu Dhabi mansion away from DarkMatter's headquarters. Those operations included hacking into the internet accounts of human rights activists, journalists and officials from rival governments, Reuters found. DarkMatter has denied conducting the operations and says it focuses on protecting computer networks. While Mozilla had been considering whether to grant DarkMatter the authority to certify websites as safe, two Mozilla executives said in an interview last week that Reuters' report raised concerns about whether DarkMatter would abuse that authority. Mozilla said the company has not yet come to a decision on whether to deny the authority to DarkMatter, but expects to decide within weeks.' -- source: https://news.slashdot.org/story/19/03/05/0424249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

All Intel Chips Open To New 'Spoiler' Non-Spectre Attack
by Peter Reutemann 05 Mar '19

05 Mar '19

'Spoiler is the newest speculative attack affecting Intel's micro-architecture. From a report: Like the Spectre and Meltdown attacks revealed in January 2018, Spoiler also abuses speculative execution in Intel chips to leak secrets. However, it targets a different area of the processor called the Memory Order Buffer, which is used to manage memory operations and is tightly coupled with the cache. Researchers from Worcester Polytechnic Institute, Massachusetts, and the University of Lubeck in north Germany detail the attack in a new paper, 'Spoiler: Speculative load hazards boost Rowhammer and cache attacks'. The paper [PDF] was released this month and spotted by The Register. The researchers explain that Spoiler is not a Spectre attack, so it is not affected by Intel's mitigations for it, which otherwise can prevent other Spectre-like attacks such as SplitSpectre.' -- source: https://it.slashdot.org/story/19/03/05/1524251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 5.1 Continues The Years-Long Effort Preparing For Year 2038
by Peter Reutemann 05 Mar '19

05 Mar '19

'Linux 5.1 continues the massive undertaking in preparing the kernel for the Year 2038 problem. Phoronix: The Linux kernel has been seeing "Y2038" work for years and the effort is far from over. Thomas Gleixner (a Linux kernel developer who serves as a member of the technical advisory board at The Linux Foundation) sent in the latest Y2038 work for the Linux 5.1 kernel, which after a lot of ground work in previous kernels has introduced the first set of syscalls that are Year 2038 safe.' -- source: https://linux.slashdot.org/story/19/03/05/1929233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Why 'ji32k7au4a83' is a Remarkably Common Password
by Peter Reutemann 05 Mar '19

05 Mar '19

'A seemingly complex set of characters like "ji32k7au4a83" is a very common password among users, it turns out. From a report: This interesting bit of trivia comes from self-described hardware/software engineer Robert Ou, who recently asked his Twitter followers if they could explain why this seemingly random string of numbers has been seen by Have I Been Pwned (HIBP) over a hundred times. Have I Been Pwned is an aggregator that was started by security expert Troy Hunt to help people find out if their email or personal data has shown up in any prominent data breaches. One service it offers is a password search that allows you to check if your password has shown up in any data breaches that are on the radar of the security community. In this case, "ji32k7au4a83" has been seen by HIBP in 141 breaches. Several of Ou's followers quickly figured out the solution to his riddle. The password is coming from the Zhuyin Fuhao system for transliterating Mandarin. The reason it's showing up fairly often in a data breach repository is because "ji32k7au4a83" translates to English as "my password."' -- source: https://it.slashdot.org/story/19/03/05/203253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 5.0 Released
by Peter Reutemann 04 Mar '19

04 Mar '19

'Linus Torvalds has released Linux 5.0 in kicking off the kernel's 28th year of development. Linux 5.0 features include AMD FreeSync support, open-source NVIDIA Turing GPU support, Intel Icelake graphics, Intel VT-d scalable mode, NXP PowerPC processors are now mitigated for Spectre Variant Two, and countless other additions. eWeek adds: Among the new features that have landed in Linux 5.0 is support for the Adiantum encryption system, developed by Google for low power devices. Google's Android mobile operating system and ChromeOS desktop operating system both rely on the Linux kernel. "Storage encryption protects your data if your phone falls into someone else's hands," Paul Crowley and Eric Biggers, Android Security and Privacy Team at Google wrote in a blog post. "Adiantum is an innovation in cryptography designed to make storage encryption more efficient for devices without cryptographic acceleration, to ensure that all devices can be encrypted. Memory management in Linux also gets a boost in the 5.0 kernel with a series of improvements designed to help prevent memory fragmentation, which can reduce performance.' -- source: https://linux.slashdot.org/story/19/03/04/1329227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

News articles on privacy...
by Peter Reutemann 03 Mar '19

03 Mar '19

"Leaked Documents Reveal Facebook's Global War On Data Privacy Laws" -- source: https://tech.slashdot.org/story/19/03/03/1623229 "Massive Database Leak Exposes China's 'Digital Surveillance State'" -- source: https://developers.slashdot.org/story/19/03/03/053253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Researchers Break Digital Signatures For Most Desktop PDF Viewers
by Peter Reutemann 26 Feb '19

26 Feb '19

'A team of academics from the Ruhr-University Bochum in Germany say they've managed to break the digital signing system and create fake signatures on 21 of 22 desktop PDF viewer apps and five out of seven online PDF digital signing services. This includes apps such as Adobe Acrobat Reader, Foxit Reader, and LibreOffice, and online services like DocuSign and Evotrust --just to name the most recognizable names. The five-person research team has been working since early October 2018 together with experts from Germany's Computer Emergency Response Team (BSI-CERT) to notify impacted services. The team went public with their findings over the weekend after all affected app makers and commercial companies finished patching their products. In research published today, the Ruhr-University Bochum team described three vulnerabilities that they found in the digital signing process used by several desktop and web-based PDF signing services. Summarized, they are: 1. Universal Signature Forgery (USF) -- vulnerability lets attackers trick the signature verification process into showing users a fake panel/message that the signature is valid. 2. Incremental Saving Attack (ISA) -- vulnerability lets attackers add extra content to an already signed PDF document via the "incremental saving (incremental update)" mechanism, but without breaking the already-existing signature. 3. Signature Wrapping (SWA) -- vulnerability is similar to ISA, but the malicious code also contains extra logic to fool the signature validation process into "wrapping" around the attacker's extra content, effectively digitally signing the incremental update.' -- source: https://it.slashdot.org/story/19/02/25/2126208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

“Netflix Is Killing Piracy In NZ”
by Lawrence D'Oliveiro 25 Feb '19

25 Feb '19

<https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=122073…>: Independent research commissioned by Vocus indicates "piracy is dying a natural death," ... ... Peer-to-peer services, usually associated with piracy, used to be "the dominant source of traffic on our network." Today, about 80 per cent of Vocus' peak-time traffic is for legal streaming sites like Netflix and YouTube. Ah, don’t you just love that simplistic conflation: P2P ≡ piracy, YouTube ≡ legit. I wonder when they will discover youtube-dl...

1 0

Android Is Helping Kill Passwords on a Billion Devices
by Peter Reutemann 25 Feb '19

25 Feb '19

'The FIDO Alliance -- a consortium that develops open source authentication standards -- has been pushing to expand its secure login protocols to make seamless logins a reality for several years. Today, it has hit the jackpot: Google. From a report: On Monday, Google and the FIDO Alliance announced that Android has added certified support for the FIDO2 standard, meaning that the vast majority of devices running Android 7 or later will now be able to handle password-less logins in mobile browsers like Chrome. Android already offered secure FIDO login options for mobile apps, where you authenticate using a phone's fingerprint scanner or with a hardware dongle like a YubiKey. But FIDO2 support will make it possible to use these easy authentication steps for web services in a mobile browser instead of laboriously typing in your password every time you want to log in. Web developers can now design their sites to interact with Android's FIDO2 management infrastructure.' -- source: https://tech.slashdot.org/story/19/02/25/1440241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Australian Email Service FastMail Says It is Losing Customers and Facing Calls To Move Operations Outside of the Country Over Local Anti-Encryption Laws
by Peter Reutemann 25 Feb '19

25 Feb '19

'Email provider FastMail says it has lost customers and faces "regular" requests to shift its operations outside Australia following the passage of anti-encryption laws. The Victorian company, which offers ad-free email services to users in 150 countries, told a senate committee that the now-passed laws were starting to bite. "The way in which [the laws] were introduced, debated, and ultimately passed ... creates a perception that Australia has changed - that we are no longer a country which respects the right to privacy," FastMail CEO Bron Gondwana said. "We have already seen an impact on our business caused by this perception. Our particular service is not materially affected as we already respond to warrants under the Telecommunications Act." "Still, we have seen existing customers leave, and potential customers go elsewhere, citing this bill as the reason for their choice. We are [also] regularly being asked by customers if we plan to move.' -- source: https://tech.slashdot.org/story/19/02/25/1329204 That's what the tech community had to say earlier about this bill: https://alp.fail/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla and Scroll Partner To Test Alternative Funding Models for the Web
by Peter Reutemann 25 Feb '19

25 Feb '19

'News subscription service Scroll, which is yet to launch to consumers but has received the backing of several top publishers, courted another major player today: Mozilla. The browser maker says it will work with Scroll to better understand how consumers react to ad-free experiences on the web and subscription-based funding models. As part of the deal, Mozilla said it would test features and product ideas provided by Scroll, which itself has been conducting internal tests with a number of outlets. Small groups of Firefox users will be invited at random to share feedback and also respond to surveys, Mozilla said.' -- source: https://news.slashdot.org/story/19/02/25/1819244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Drupal 7 Will Reach End-of-Life in November of 2021
by Peter Reutemann 25 Feb '19

25 Feb '19

'Drupal 7, which was first released in January 2011, will reach end of life (EOL) in November of 2021, the Drupal Association said today. What this means for your Drupal 7 sites is, as of November 2021: 1. Drupal 7 will no longer be supported by the community at large. The community at large will no longer create new projects, fix bugs in existing projects, write documentation, etc. around Drupal 7. 2. There will be no more core commits to Drupal 7. 3. The Drupal Security Team will no longer provide support or Security Advisories for Drupal 7 core or contributed modules, themes, or other projects. Reports about Drupal 7 vulnerabilities might become public creating 0 day exploits. 4. All Drupal 7 releases on all project pages will be flagged as not supported. Maintainers can change that flag if they desire to. 5. On Drupal 7 sites with the update status module, Drupal Core will show up as unsupported. 6. After November 2021, using Drupal 7 may be flagged as insecure in 3rd party scans as it no longer gets support. 7. Best practice is to not use unsupported software, it would not be advisable to continue to build new Drupal 7 sites. 8. Now is the time to start planning your migration to Drupal' -- source: https://developers.slashdot.org/story/19/02/25/1953224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0