- wlug - list.wlug.org.nz

Eight New Meltdown-Like Flaws Found
by Peter Reutemann 06 May '18

06 May '18

'Researchers have found eight new flaws in computer central processing units that resemble the Meltdown and Spectre bugs revealed in January, a German computing magazine reported on Thursday. The magazine, called c't, said it was aware of Intel Corp's plans to patch the flaws, adding that some chips designed by ARM Holdings, a unit of Japan's Softbank, might be affected, while work was continuing to establish whether Advanced Micro Devices chips were vulnerable... The magazine said Google Project Zero, one of the original collective that exposed Meltdown and Spectre in January, had found one of the flaws and that a 90-day embargo on going public with its findings would end on May 7... "Considering what we have seen with Meltdown and Spectre, we should expect a long and painful cycle of updates, possibly even performance or stability issues," said Yuriy Bulygin, chief executive officer of hardware security firm Eclypsium and a former Intel security researcher. "Hopefully, Meltdown and Spectre led to improvements to the complicated process of patching hardware." Neowin now reports that Intel "is expected to release microcode updates in two waves; one in May, and the other in August."' -- source: https://it.slashdot.org/story/18/05/05/1730203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Drive-by Rowhammer attack uses GPU to compromise an Android phone
by Peter Reutemann 03 May '18

03 May '18

'Over the past few years, there has been a steady evolution in Rowhammer, the once largely theoretical attack that exploits physical defects in memory chips to tamper with the security of the devices they run on. On Thursday, researchers are unveiling the most practical demonstration yet of Rowhammer's power and reach: an exploit that remotely executes malicious code on Android phones by harnessing their graphical processors.' -- source: https://arstechnica.com/information-technology/2018/05/drive-by-rowhammer-a… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

More Dead Microsoft Technologies
by Lawrence D'Oliveiro 01 May '18

01 May '18

A roundup <http://www.theregister.co.uk/2018/05/01/windows_10_april_update_casualties/> of what’s gone in the latest Windows 10 update mentions that HomeGroup, Microsoft’s attempt to let a bunch of machines share files and printers on an ad-hoc basis, has now gone the way of Windows Home Server and Windows Media Center. Also it looks like XPS, Microsoft’s NIH alternative to PDF, has also bitten the dust. And the Windows Help Viewer may be next...

1 0

Fedora 28 Featuring GNOME 3.28 Released
by Peter Reutemann 01 May '18

01 May '18

'Fedora 28 has many new features, but one in particular will surely excite desktop/workstation users -- GNOME 3.28, which introduces Thunderbolt 3 support and improved laptop battery life. Fedora has long used GNOME as the default desktop environment, and best of all, it is mostly a stock affair -- no silly tweaks enabled by default. In other words, you get a very pure GNOME experience, making Fedora Workstation the preferred OS for many hardcore fans of the DE. "GNOME 3.28 adds the capability to favorite files, folders, and contacts for easier organization and access. Additionally, the new application Usage is included to help users more easily diagnose and resolve performance and capacity issues," says The Fedora Project.' -- source: https://linux.slashdot.org/story/18/05/01/1727233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

USB 3.2 Work Is On The Way For The Linux 4.18 Kernel: Report
by Peter Reutemann 30 Apr '18

30 Apr '18

'USB 3.2 was announced last summer as an incremental update to the USB standard to double the bandwidth for existing USB Type-C cables. We haven't seen much in the way of USB 3.2 mentions in the Linux kernel yet but then again we haven't really seen USB 3.2 devices yet. USB 3.2 brings a multi-lane operation mode for hosts and devices using existing Type-C cables as well as a minor update to the USB hub specification. USB 3.2 allows for new 10 Gbit/s and 20 Gbit/s rates using two lanes, USB 3.2 Gen 1x2 and USB 3.2 Gen 2x2, respectively. It looks like kernel developers are now working on getting their USB 3.2 Linux support in order. We were tipped off that as of last week there are some USB 3.2 patches queued in the usb-next tree maintained by Greg Kroah-Hartman's.' -- source: https://linux.slashdot.org/story/18/04/30/1558201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Sinclair ZX Spectrum Designer Rick Dickinson Succumbs To Cancer
by Lawrence D'Oliveiro 27 Apr '18

27 Apr '18

Rick Dickinson, the designer for several machines sold by Sinclair in the 1980s, has died <http://www.theregister.co.uk/2018/04/26/rick_dickinson_dies/>. More recently, he was involved in the campaign to create the “ZX Spectrum Next” machine. Commenters have offered up some useful links: his Flickr gallery <https://www.flickr.com/photos/9574086(a)N02/albums> with some peeks at concept renders, and this item <https://www.youtube.com/watch?v=TAwHIcdidzI> from 2003 where he talks about his designs for Sinclair.

1 0

Microsoft Quarterly Report
by Lawrence D'Oliveiro 27 Apr '18

27 Apr '18

Just some items I found notable from here <https://arstechnica.com/gadgets/2018/04/even-windows-revenue-is-up-in-micro…>: * Office 365 is up, traditional MS Office is down. * Corporate sales of Windows are up, while consumer sales are down (“below the general decline of the PC market”). In each case, the former is growing faster than the latter is declining, so overall business is up.

1 0

Linux At The Leading Edge Of Enterprise-Level Storage
by Lawrence D'Oliveiro 26 Apr '18

26 Apr '18

First of all, some background (as I understand it): * “NVMe” is a standard for accessing storage (normally flash rather than hard drives) via a PCI-E bus <https://en.wikipedia.org/wiki/NVM_Express>. * “NVME-oF” (“NVMe over Fabrics”) (mentioned in the above article) is a further spec that allows one node to access storage attached to another node. Sounds like NBD, really <https://en.wikipedia.org/wiki/Network_block_device>, though the term “RDMA” (“Remote Direct Memory Access”) gets tossed around. So, this article <http://www.theregister.co.uk/2018/04/26/nvme_fabric_over_fibre_channel/> says things like NVME-oF “has to be implemented across network or fabric and, so far, Ethernet, with ROCE (RDMA over Converged Ethernet), is the favoured one”, though other lower-layer protocols also work. In particular, the writer is interviewing an industry guru about the prospects for FC-NVMe, which uses Fibre Channel as the transport. A couple of quotes caught my eye: Since the low-level driver isn't a part of the OS, like NVMe-oF, but rather supplied by the HBA vendor (Emulex or QLogic), the deployment for OSes outside the Linux model should be more agile... You must run a recent version of Linux; no other OSes have NVMe-oF drivers available (yet). In other words, NVME-oF is pretty much Linux-only at the moment. But it would be hardware-independent, which should mean you can mix and match storage from different vendors. Unlike FC-NVMe, where the “HBA vendor” needs to supply hardware-specific drivers. In other, other words, NVME-oF works only on Linux, but makes you “hardware-agile”, while FC-NVMe is hardware-specific but should (hopefully) be “OS-agile”. Which kind of “agility” will turn out to be more important, I wonder?

1 0

Drupal Warns of New Remote-Code Bug, the Second in Four Weeks
by Peter Reutemann 26 Apr '18

26 Apr '18

'For the second time in a month, websites that use the Drupal content management system are confronted with a stark choice: install a critical update or risk having your servers infected with ransomware or other nasties. From a report: Maintainers of the open-source CMS built on the PHP programming language released an update patching critical remote-code vulnerability on Wednesday. The bug, formally indexed as CVE-2018-7602, exists within multiple subsystems of Drupal 7.x and 8.x. Drupal maintainers didn't provide details on how the vulnerability can be exploited other than to say attacks work remotely. The maintainers rated the vulnerability "critical" and urged websites to patch it as soon as possible.' -- source: https://developers.slashdot.org/story/18/04/25/1956214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Was Our Census Data Secure?
by Lawrence D'Oliveiro 25 Apr '18

25 Apr '18

According to this article <http://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=12038826>, when we were filling out our census data online last month, it was actually going through the servers of a company called Incapsula, which was scanning the unencrypted data for malware. Since the company is based in the US, this naturally raises concerns about US Government access to the data of NZ residents and citizens. On the one hand, the article says “this is not a data breach”, but on the other hand Adding to the researchers' concerns, Stats NZ's digital key that is required to decrypt the data sent over TLS secured connections is now distributed across Incapsula's global network, Teague and Culnane said. "Our non-exhaustive search found that servers in Australia, the US, as well as New Zealand, all had the Stats NZ key," they added. Digital TLS keys are supposed to be protected and should only be kept on the servers that they relate to, the researchers said. If keys are leaked, attackers could use them to impersonate Stats NZ servers. and further down they use the phrase “clear security flaw”. Stats NZ insists the company is trusted and “Goverment-approved”. Given it’s also protecting the GCSB, I guess that is already very literally true.

1 0

Can Online Elections Ever Be Secure?
by Lawrence D'Oliveiro 25 Apr '18

25 Apr '18

Commentary <https://www.schneier.com/blog/archives/2018/04/securing_electi_1.html> from Bruce Schneier: We can securely bank online, but can't securely vote online. If we could do away with anonymity -- if everyone could check that their vote was counted correctly -- then it would be easy to secure the vote. ... We can't, so we need to accept that our voting systems are insecure. We need an election system that is resilient to the threats. And for many parts of the system, that means paper.

1 0

meeting next week
by Peter Reutemann 25 Apr '18

25 Apr '18

Hi guys We have a WLUG meeting next Monday: "With the Cambridge Analytics scandal around (ab)using data obtained through Facebook, how about we have a look at (self-hosted) alternatives to the social network giant? Details on scandal: https://arstechnica.com/tech-policy/2018/03/facebooks-cambridge-analytica-s… Social media alternatives (eg diaspora, gnu social): https://alternativeto.net/software/facebook/" -- details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/246737141/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 4

What Private Browsing Mode Really Means
by Lawrence D'Oliveiro 25 Apr '18

25 Apr '18

Seems like a lot of people <http://www.theregister.co.uk/2018/04/24/private_web_browsing_study/> have the wrong idea about what is really “private” in private browsing mode. Many of them believe that * Activity while logged into an account (e.g. Google) will not be saved in that account’s history * Bookmarks made in private mode are not visible in standard mode * It prevents websites from tracking their location * It affords better protection against malware * It obscures their IP address. None of which is true. To its credit, when you open a private window in Firefox, it clearly states the things that are hidden and the things that are not.

1 0

Ubuntu 18.04?
by Peter Reutemann 24 Apr '18

24 Apr '18

Hi everyone Since April would be the usual month for an Ubuntu release, I was surprised that I hadn't heard anything so far. The following article mentions a release date of 26/4: https://fossbytes.com/ubuntu-18-04-bionic-beaver-release-date-features/ And according to the Ubuntu wiki, this still seems to be happening: https://wiki.ubuntu.com/BionicBeaver/ReleaseTaskSignup Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Accused of Showing 'Total Contempt' for Android Users' Privacy
by Peter Reutemann 23 Apr '18

23 Apr '18

'On the heels of a terse privacy debate, Google may have found another thing to worry about: its attempt to rethink the traditional texting system. From a report: Joe Westby is Amnesty International's Technology and Human Rights researcher. Recently, in response to Google's launch of a new messaging service called "Chat", Westby argued that Google, "shows total contempt for Android users' privacy." "With its baffling decision to launch a messaging service without end-to-end encryption, Google has shown utter contempt for the privacy of Android users and handed a precious gift to cybercriminals and government spies alike, allowing them easy access to the content of Android users' communications. Following the revelations by CIA whistleblower Edward Snowden, end-to-end encryption has become recognized as an essential safeguard for protecting people's privacy when using messaging apps. With this new Chat service, Google shows a staggering failure to respect the human rights of its customers," Westby contended. Westby continued, saying: "In the wake of the recent Facebook data scandal, Google's decision is not only dangerous but also out of step with current attitudes to data privacy."' -- source: https://tech.slashdot.org/story/18/04/23/1946251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

“Drupalgeddon2” touches off arms race to mass-exploit powerful Web servers
by Peter Reutemann 22 Apr '18

22 Apr '18

'Attackers are mass-exploiting a recently fixed vulnerability in the Drupal content management system that allows them to take complete control of powerful website servers, researchers from multiple security companies are warning. At least three different attack groups are exploiting "Drupalgeddon2," the name given to an extremely critical vulnerability Drupal maintainers patched in late March, researchers with Netlab 360 said Friday. Formally indexed as CVE- 2018-7600, Drupalgeddon2 makes it easy for anyone on the Internet to take complete control of vulnerable servers simply by accessing a URL and injecting publicly available exploit code. Exploits allow attackers to run code of their choice without having to have an account of any type on a vulnerable website. The remote-code vulnerability harkens back to a 2014 Drupal vulnerability that also made it easy to commandeer vulnerable servers. Drupalgeddon2 "is under active attack, and every Drupal site behind our network is being probed constantly from multiple IP addresses," Daniel Cid, CTO and founder of security firm Sucuri, told Ars. "Anyone that has not patched is hacked already at this point. Since the first public exploit was released, we are seeing this arms race between the criminals as they all try to hack as many sites as they can." China-based Netlab 360, meanwhile, said at least three competing attack groups are exploiting the vulnerability. The most active group, Netlab 360 researchers said in a blog post published Friday, is using it to install multiple malicious payloads, including cryptocurrency miners and software for performing distributed denial-of-service attacks on other domains. The group, dubbed Muhstik after a keyword that pops up in its code, relies on 11 separate command-and-control domains and IP addresses, presumably for redundancy in the event one gets taken down.' -- source: https://arstechnica.com/information-technology/2018/04/drupalgeddon2-touche… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Millions of Chrome Users Have Installed Malware Posing as Ad Blockers
by Peter Reutemann 19 Apr '18

19 Apr '18

'Andrey Meshkov, the cofounder of ad-blocker AdGuard, recently got curious about the number of knock-off ad blocking extensions available for Google's popular browser Chrome. These extensions were deliberately styled to look like legitimate, well-known ad blockers, but Meshkov wondered why they existed at all, so he downloaded one and took a look at the code. "Basically I downloaded it and checked what requests the extension was making," Meshkov told me over the phone. "Some strange requests caught my attention." Meshkov discovered that the AdRemover extension for Chrome -- which had over 10 million users -- had code hidden inside an image that was loaded from the remote command server, giving the extension creator the ability to change its functions without updating. This alone is against Google's policy, and after Meshkov wrote about a few examples on AdGuard's blog, many of which had millions of downloads, Chrome removed the extensions from the store. I reached out to Google, and a spokesperson confirmed that these extensions had been removed.' -- source: https://yro.slashdot.org/story/18/04/19/1946250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ask Slashdot: Is There a Good Alternative to Facebook?
by Peter Reutemann 18 Apr '18

18 Apr '18

'Long-time Slashdot reader Lauren Weinstein argues that fixing Facebook may be impossible because "Facebook's entire ecosystem is predicated on encouraging the manipulation of its users by third parties who posses the skills and financial resources to leverage Facebook's model. These are not aberrations at Facebook -- they are exactly how Facebook was designed to operate." Meanwhile one fund manager is already predicting that sooner or later every social media platform "is going to become MySpace," adding that "Nobody young uses Facebook," and that the backlash over Cambridge Analytica "quickens the demise." But Slashdot reader silvergeek asks, "is there a safe, secure, and ethical alternative?" to which tepples suggests "the so-called IndieWeb stack using the h-entry microformat." He also suggests Diaspora, with an anonymous Diaspora user adding that "My family uses a server I put up to trade photos and posts... Ultimately more people need to start hosting family servers to help us get off the cloud craze... NethServer is a pretty decent CentOS based option." Meanwhile Slashdot user Locke2005 shared a Washington Post profile of Mastodon, "a Twitter-like social network that has had a massive spike in sign-ups this week." Mastodon's code is open-source, meaning anybody can inspect its design. It's distributed, meaning that it doesn't run in some data center controlled by corporate executives but instead is run by its own users who set up independent servers. And its development costs are paid for by online donations, rather than through the marketing of users' personal information... Rooted in the idea that it doesn't benefit consumers to depend on centralized commercial platforms sucking up users' personal information, these entrepreneurs believe they can restore a bit of the magic from the Internet's earlier days -- back when everything was open and interoperable, not siloed and commercialized. The article also interviews the founders of Blockstack, a blockchain-based marketplace for apps where all user data remains local and encrypted. "There's no company in the middle that's hosting all the data," they tell the Post. "We're going back to the world where it's like the old-school Microsoft Word -- where your interactions are yours, they're local and nobody's tracking them." On Medium, Mastodon founder Eugene Rochko also acknowledges Scuttlebutt and Hubzilla, ending his post with a message to all social media users: "To make an impact, we must act." Lauren Weinstein believes Google has already created an alternative to Facebook's "sick ecosystem": Google Plus. "There are no ads on Google+. Nobody can buy their way into your feed or pay Google for priority. Google doesn't micromanage what you see. Google doesn't sell your personal information to any third parties..." And most importantly, "There's much less of an emphasis on hanging around with those high school nitwits whom you despised anyway, and much more a focus on meeting new persons from around the world for intelligent discussions... G+ posts more typically are about 'us' -- and tend to be far more interesting as a result." (Even Linus Torvalds is already reviewing gadgets there.) Wired has also compiled their own list of alternatives to every Facebook service. But what are Slashdot's readers doing for their social media fix? Leave your own thoughts and suggestions in the comments. Is there a good alternative to Facebook?' -- source: https://tech.slashdot.org/story/18/03/25/0039218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

Microsoft’s bid to secure the Internet of Things: Custom Linux, custom chips, Azure
by Peter Reutemann 18 Apr '18

18 Apr '18

'The drive to connect everything to the Internet and build the Internet of Things has created a new security nightmare. Millions of devices with little to no active maintenance are now permanently online, enabling the creation of massive botnets as the devices go unpatched and unloved. Microsoft today announced its solution: Azure Sphere.' -- source: https://arstechnica.com/gadgets/2018/04/microsofts-bid-to-secure-the-intern… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

When Two Secure Systems Make An Insecure Combination
by Lawrence D'Oliveiro 13 Apr '18

13 Apr '18

Just goes to show <https://www.schneier.com/blog/archives/2018/04/obscure_e-mail_.html> that two separate systems may be reasonably secure in their own right, but the interaction between them can create unexpected vulnerabilities.

1 0

Cyber-Espionage Groups Are Increasingly Leveraging Routers in Their Attacks
by Peter Reutemann 12 Apr '18

12 Apr '18

'Catalin Cimpanu, reporting for BleepingComputer: Cyber-espionage groups -- also referred to as advanced persistent threats (APTs) -- are using hacked routers more and more during their attacks, according to researchers at Kaspersky Lab. "It's not necessarily something new. Not something that just exploded," said Costin Raiu, director of Global Research and Analysis Team (GReAT) at Kaspersky Lab, in a webinar today. "We've seen a bunch of router attack throughout the years. A very good example is SYNful Knock, a malicious implant for Cisco [routers] that was discovered by FireEye but also threat actors such as Regin and CloudAtlas. Both APTs have been known to have and own proprietary router implants." But the number of APTs leveraging routers for attacks has gone steadily up in the past year, and the tactic has become quite widespread in 2018. For example, the Slingshot APT (believed to be a US Army JSOC operation targeting ISIS militants) has used hacked MikroTik routers to infect victims with malware.' -- source: https://tech.slashdot.org/story/18/04/12/1932248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Some Android Device Makers Are Lying About Security Patch Updates
by Peter Reutemann 12 Apr '18

12 Apr '18

'Security patches for smartphones are extremely important because many people store personal data on their devices. Lots of Android phones out there get regularly security patches, but according to a new report, some of them are lying about the patches that they've actually gotten. According to a study by Security Research Labs, some Android phones are missing patches that they claim to have. Wired explains that SRL tested 1,200 phones from more than a dozen phone makers for every Android security patch released in 2017. The devices tested include ones from Google, Samsung, Motorola, LG, HTC, Xiaomi, OnePlus, Nokia, TCL, and ZTE. The study found that outside of Google and its Pixel phones, well-known phone makers had devices that were missing patches that they claimed to have. "We found several vendors that didn't install a single patch but changed the patch date forward by several months," says SRL founder Karsten Nohl.' -- source: https://tech.slashdot.org/story/18/04/12/1851203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AMD Releases Spectre v2 Microcode Updates for CPUs Going Back To 2011
by Peter Reutemann 11 Apr '18

11 Apr '18

'Catalin Cimpanu, writing for BleepingComputer: AMD has released CPU microcode updates for processors affected by the Spectre variant 2 (CVE-2017-5715) vulnerability. The company has forwarded these microcode updates to PC and motherboard makers to include them in BIOS updates. Updates are available for products released as far as 2011, for the first processors of the Bulldozer line. Microsoft has released KB4093112, an update that also includes special OS-level patches for AMD users in regards to the Spectre v2 vulnerability. Similar OS-level updates have been released for Linux users earlier this year. Yesterday's microcode patches announcement is AMD keeping a promise it made to users in January, after the discovery of the Meltdown and Spectre (v1 and v2) vulnerabilities.' -- source: https://tech.slashdot.org/story/18/04/11/1826222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Biometric and App Logins Will Soon Be Pushed Across the Web
by Peter Reutemann 10 Apr '18

10 Apr '18

'Soon, it will be much easier to log into more websites using a hardware key plugged into your laptop, a dedicated app, or even the fingerprint scanner on your phone. Motherboard: On Tuesday, a spread of organizations and businesses, including top browser vendors such as Microsoft and Google, announced a new standards milestone that will streamline the process for web developers to add extra login methods to their sites, potentially keeping consumers' accounts and data more secure. "For users, this will be a natural transition. People everywhere are already using their fingers and faces to 'unlock' their mobile phones and PCs, so this will be natural to them -- and more convenient," Brett McDowell, executive director at the FIDO Alliance, one of the organizations involved in setting up the standard, told Motherboard in an email. "What they use today to 'unlock' will soon allow them to 'login' to all their favorite websites and a growing number of native apps that already includes Bank of America, PayPal, eBay and Aetna," he added. Passwords continue to be one of the weaker points in online security. A hacker may phish a target's password and log into their account, or take passwords from one data breach and use them to break into accounts on another site. The login standard, called Web Authentication (WebAuthn), will let potentially any website or online service use apps, security keys, or biometrics as a login method instead of a password, or use those alternative approaches as a second method of verification. The key here is making it easy and open for developers to use, and for it to work across all different brands of browsers. The functionality is already available in Mozilla's Firefox, and will be rolled out to Microsoft's Edge and Google Chrome in the new few months. Opera has committed to supporting WebAuthn as well.' -- source: https://yro.slashdot.org/story/18/04/10/1357241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux: Beep Command Can Be Used to Probe for the Presence of Sensitive Files
by Peter Reutemann 10 Apr '18

10 Apr '18

'Catalin Cimpanu, writing for BleepingComputer: A vulnerability in the "beep" package that comes pre-installed with Debian and Ubuntu distros allows an attacker to probe for the presence of files on a computer, even those owned by root users, which are supposed to be secret and inaccessible. The vulnerability, tracked as CVE-2018-0492, has been fixed in recent versions of Debian and Ubuntu (Debian-based OS). At its core, the bug is a race condition in the beep utility that allows the OS to emit a "beep" sound whenever it is deemed necessary. Security researchers have discovered a race condition in the beep package that allows an attacker to elevate his code to root-level access.' -- source: https://linux.slashdot.org/story/18/04/10/142218 Cheers, peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Computer Maker System76 To Move Manufacturing To the US
by Peter Reutemann 10 Apr '18

10 Apr '18

'Linux computer manufacturer System76 made its mark in part because of its commitment to open source principles and doing what it believes is right. Last year it released its homegrown Linux, Pop!_OS. In early March, System76 founder Carl Richell tweeted about the company's plans to locate its computer manufacturing factory in Denver, Colorado. By moving its manufacturing from China to the United States, System76 is offering more proof that it's not afraid to buck prevailing tech norms to do things "the System76 way." Carl Richell, founder and CEO of System76, says in a Twitter exchange that they anticipate shipping products from the factory by the end of the year.' -- source: https://linux.slashdot.org/story/18/04/10/1626202 Here's a link to Pop!_OS: https://system76.com/pop It's based on Ubuntu: https://system76.com/pop/tech Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Follows Chrome and Blocks the Loading of Most FTP Resources
by Peter Reutemann 10 Apr '18

10 Apr '18

'Mozilla says it will follow in the steps of Google Chrome and start blocking the loading of FTP subresources inside HTTP and HTTPS pages. >From a report: By FTP subresources, we refer to files loaded via the FTP protocol inside img, script, or iframe tags that have a src="ftp://". FTP links placed inside normal angle bracket links or typed directly in the browser's address bar will continue to work. The reasoning is that FTP is an insecure protocol that doesn't support modern encryption techniques and will inherently break many other built-in browser security and privacy features, such as HSTS, CSP, XSA, or others. Furthermore, many malware distribution campaigns often rely on compromising FTP servers and redirecting or downloading malware on users' computers via FTP subresources. Mozilla engineers say FTP subresource blocking will ship with Firefox 61, currently scheduled for release on June 26.' -- source: https://tech.slashdot.org/story/18/04/10/188244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Torvalds Opposes Tying UEFI Secure Boot to Kernel Lockdown Mode
by Peter Reutemann 08 Apr '18

08 Apr '18

'The kernel lockdown feature further restricts access to the kernel by user-space with what can be accessed or modified... Pairing that with UEFI SecureBoot unconditionally is meeting some resistance by Linus Torvalds. The goal of kernel lockdown, which Linus Torvalds doesn't have a problem with at all, comes down to "prevent both direct and indirect access to a running kernel image, attempting to protect against unauthorised modification of the kernel image and to prevent access to security and cryptographic data located in kernel memory, whilst still permitting driver modules to be loaded." But what has the Linux kernel creator upset with are developers trying to pair this unconditionally with UEFI SecureBoot. Linus describes Secure Boot as being "pushed in your face by people with an agenda." But his real problem is that Secure Boot would then imply Kernel Lockdown mode... "Tying these things magically together IS A BAD IDEA."' -- source: https://linux.slashdot.org/story/18/04/07/2159245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Programmer Unveils OpenGL Bindings for Bash
by Peter Reutemann 08 Apr '18

08 Apr '18

'Compiled languages have long provided access to the OpenGL API, and even most scripting languages have had OpenGL bindings for a decade or more. But, one significant language missing from the list is our old friend/nemesis Bash. But worry no longer! Now you can create your dazzling 3D visuals right from the comfort of your command line! "You'll need a system with both Bash and OpenGL support to experience it firsthand," explains software engineer Michael Conrad, who created the first version 13 years ago as "the sixth in a series of 'Abuse of Technology' projects," after "having my technical sensibilities offended that someone had written a real-time video game in Perl. "Back then, my primary language was C++, and I was studying OpenGL for video game purposes. I declared to my friends that the only thing worse would be if it had been 3D and written in Bash. Having said the idea out loud, it kept prodding me, and I eventually decided to give it a try to one-up the 'awfulness'..."' -- source: https://developers.slashdot.org/story/18/04/07/0035203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel drops plans to develop Spectre microcode for ancient chips
by Peter Reutemann 04 Apr '18

04 Apr '18

'Intel has scaled back its plans to produce microcode updates for some of its older processors to address the "Spectre variant 2" attack. Core 2 processors are no longer scheduled to receive updates, and, while some first generation Core products have microcode updates available already, others have had their update cancelled.' -- source: https://arstechnica.com/gadgets/2018/04/intel-drops-plans-to-develop-spectr… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fedora 28 Beta Linux Distro is Finally Here
by Peter Reutemann 03 Apr '18

03 Apr '18

'Today, version 28 of the Fedora finally achieves beta status. After a short delay -- it was scheduled to be available a week earlier -- the distro is back on track, and looking better than ever. As is typical now, there are three versions of the operating system -- Atomic Host, Server, and Workstation. While all three have their places, normal desktop computer users will want to focus on Workstation. While there are plenty of new features (and bugs), the most exciting aspect of Fedora 28 Workstation is the inclusion of the GNOME 3.28 desktop environment.' -- source: https://linux.slashdot.org/story/18/04/03/1846233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Kernel To Lose A Few Architectures
by Lawrence D'Oliveiro 03 Apr '18

03 Apr '18

Looking at the source code <https://elixir.bootlin.com/linux/latest/source/> for the latest (4.16) Linux kernel, I see support for 31 different major processor architectures currently <https://elixir.bootlin.com/linux/latest/source/arch>. However, the next, 4.17 kernel is due to drop the ability to run on 8 of them <http://www.theregister.co.uk/2018/04/03/linux_kernel_4_16_released/>, due to the fact that nobody is using them any more--or at least, nobody with an interest in implementing new kernels <http://lkml.iu.edu/hypermail/linux/kernel/1804.0/00306.html>. Interesting to read Arnd Bergmann’s observations on what these dead-end architectures have in common: In the end, it seems that while the eight architectures are extremely different, they all suffered the same fate: There was one company in charge of an SoC line, a CPU microarchitecture and a software ecosystem, which was more costly than licensing newer off-the-shelf CPU cores from a third party (typically ARM, MIPS, or RISC-V). It seems that all the SoC product lines are still around, but have not used the custom CPU architectures for several years at this point. In contrast, CPU instruction sets that remain popular and have actively maintained kernel ports tend to all be used across multiple licensees.

1 0

Adobe Is Helping Some 60 Companies Track People Across Devices
by Peter Reutemann 31 Mar '18

31 Mar '18

'Neowin reports of Adobe's recent announcement of its new Marketing Cloud Device Co-op initiative: The announcement of the new solution for tracking customers across devices was made at the Adobe Summit this week in Las Vegas to a digital marketing conference. According to an Adobe blog post released earlier this month citing Forrester, consumers are increasingly accessing multiple devices before making a purchase decision -- an average of 5.5 connected devices per person. This behavior creates a challenge for retailers, who cannot easily target people in their marketing campaigns, ultimately depending on Facebook or Google to track people instead of devices. Both Facebook and Google are able to do this job because of the massive amount of users logged into their ecosystems regularly, so most retailers have been opting to use those platforms as a way to reach potential customers. But Adobe's approach is to provide a platform agnostic solution acting as a glue between the world's biggest brands' own data management platforms. In order for Device Co-op to work, each company that has joined the initiative will provide Adobe with "cryptographically hashed login IDs" and HTTP header data, which Adobe claims will completely hide the customer's identity. This data will be used to create groups of devices used by the same person or household, which will then be made available to all the members of the initiative so they can target people on different devices, instead of creating one customer profile per device, as can be seen from the example given in the image above. Until now, some 60 companies have joined the Adobe initiative, including brands such as Subway, Sprint, NFL, Lenovo, Intel, Barnes & Noble, and Subaru. Also, preliminary measurements made by Adobe indicate that Device Co-op could link up to 1.2 billion devices worldwide, based on the amount of accesses seen by current members. But it is important to note that the initiative is currently collecting data of U.S. and Canada users only. Adobe is claiming the initiative will not disclose a user's identity to its members, including any personal data, but, given the recent Facebook and Cambridge Analytica scandal, many will be skeptical of those claims. Thankfully, Adobe is allowing users to completely opt out all of their devices from the services via this website.' -- source: https://yro.slashdot.org/story/18/03/31/0059259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Prestigious Free Software Award Goes to Karen Sandler
by Peter Reutemann 31 Mar '18

31 Mar '18

'Each year the Free Software award goes to someone making "a great contribution to the progress and development of free software, through activities that accord with the spirit of free software." This year's winner is a former executive of the GNOME Foundation, Karen Sandler. Jeremy Allison - Sam, Slashdot reader #8,157, brought this announcement. Richard Stallman, President of the FSF, presented Sandler with the award during a ceremony. Stallman highlighted Sandler's dedication to software freedom. Stallman told the crowd that Sandler's "vivid warning about backdoored nonfree software in implanted medical devices has brought the issue home to people who never wrote a line of code. Her efforts, usually not in the public eye, to provide pro bono legal advice to free software organizations and [with Software Freedom Conservancy] to organize infrastructure for free software projects and copyleft defense, have been equally helpful." In her acceptance speech, Sandler spoke about her dedication to free software as a patient, advocate and professional. "Coming to terms with a dangerous heart condition should never have cost me fundamental control over the technology that my life relies on", said Sandler... "This issue is personal not just for me but for anyone who relies on software, and today that means every single person." ' -- source: https://news.slashdot.org/story/18/03/31/0322217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Security Experts See Chromebooks as a Closed Ecosystem That Improves Security
by Peter Reutemann 31 Mar '18

31 Mar '18

'The founder of Rendition Security believes his daughter "is more safe on a Chromebook than a Windows laptop," and he's not the only one. CNET's staff reporter argues that Google's push for simplicity, speed, and security "ended up playing off each other." mspohr shared this article: Heading to my first security conference last year, I expected to see a tricked-out laptop running on a virtual machine with a private network and security USB keys sticking out -- perhaps something out of a scene from "Mr. Robot." That's not what I got. Everywhere I went I'd see small groups of people carrying Chromebooks, and they'd tell me that when heading into unknown territory it was their travel device... "If you want prehardened security, then Chromebooks are it," said Kenneth White, director of the Open Crypto Audit Project. "Not because they're Google, but because Chrome OS was developed for years and it explicitly had web security as a core design principle...." Drewry and Liu focused on four key features for the Chromebook that have been available ever since the first iteration in 2010: sandboxing, verified boots, power washing and quick updates. These provided security features that made it much harder for malware to pass through, while providing a quick fix-it button if it ever did. That's not to say Chrome OS is impervious to malware. Cybercriminals have figured out loopholes through Chrome's extensions, like when 37,000 devices were hit by the fake version of AdBlock Plus. Malicious Android apps have also been able to sneak through the Play Store. But Chrome OS users mostly avoided massive cyberattack campaigns like getting locked up with ransomware or hijacked to become part of a botnet. Major security flaws for Chrome OS, like ones that would give an attacker complete control, are so rare that Google offers rewards up to $200,000 to anyone who can hack the system. The article argues that "Fewer software choices mean limited options for hackers. Those are some of the benefits that have led security researchers to warm up to the laptops... "Chrome OS takes an approach to security that's similar to the one Apple takes with iOS and its closed ecosystem."' -- source: https://tech.slashdot.org/story/18/03/31/0443257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Open Source RISC V Processor Gets Support From Google, Samsung, Qualcomm, and Tesla
by Peter Reutemann 31 Mar '18

31 Mar '18

'Google, Qualcomm, and Samsung "are among 80 tech companies joining forces to develop a new open-source chip design for new technologies like self-driving vehicles," writes Seeking Alpha, citing a (pay-walled) report on The Information. "Western Digital and Nvidia also plan to use the new chip design for some of their products," while Tesla "has joined the RISC-V Foundation and is considering using the tech in its new chip efforts." MIT Technology Review adds that while Arm had hoped to bring their low-power/high performance processors to AI and self-driving cars, "The company that masterminded the processor inside your smartphone may find that a set of free-to-use alternative designs erode some of its future success."' -- source: https://news.slashdot.org/story/18/03/31/0622248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft's Windows 7 Meltdown Fixes From January and February Made PCs More Insecure
by Peter Reutemann 30 Mar '18

30 Mar '18

'Microsoft's January and February security fixes for Intel's Meltdown processor vulnerability opened up an even worse security hole on Windows 7 PCs and Server 2008 R2 boxes. From a report: This is according to researcher Ulf Frisk, who previously found glaring shortcomings in Apple's FileVault disk encryption system. We're told Redmond's early Meltdown fixes for 64-bit Windows 7 and Server 2008 R2 left a crucial kernel memory table readable and writable for normal user processes. This, in turn, means any malware on those vulnerable machines, or any logged-in user, can manipulate the operating system's memory map, gain administrator-level privileges, and extract and modify any information in RAM. The Meltdown chip-level bug allows malicious software, or unscrupulous logged-in users, on a modern Intel-powered machine to read passwords, personal information, and other secrets from protected kernel memory. But the security fixes from Microsoft for the bug, on Windows 7 and Server 2008 R2, issued in January and February, ended up granting normal programs read and write access to all of physical memory' -- source: https://tech.slashdot.org/story/18/03/28/2010240 Time to move to another operating system... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Yet Another Microsoft Windows Reorg
by Lawrence D'Oliveiro 30 Mar '18

30 Mar '18

From <https://arstechnica.com/gadgets/2018/03/windows-leader-terry-myerson-out-as…>: The Windows platform has many masters. It is important for both Microsoft's client and server businesses, of course, but it's also fundamental to the Azure platform. While it has become increasingly unified, responsibility for its development (and financial reporting) has often been split between divisions. Conway’s Law says that any piece of software reflects the organizational structure that produced it. The fact that there is no single mind in charge of the overall product will inevitably manifest itself in discontinuities in the characteristics of that product. Yes, I know: scratch that future tense. It already has.

1 0

An Open Source, Royalty-Free AV1 Codec Has Been Released
by Peter Reutemann 28 Mar '18

28 Mar '18

'After three years in development the Alliance for Open Media is releasing the royalty-free AOMedia Video Codec 1.0 (AV1) specification. The AV1 codec promises an average of 30 percent greater compression over competing codecs according to independent member tests. The release of AV1 includes: * Bitstream specification to enable the next-generation of silicon * Unoptimized, experimental software decoder and encoder to create and consume the bitstream * Reference streams for product validation * Binding specifications to allow content creation and streaming tools for user-generated and commercial vid' -- source: https://news.slashdot.org/story/18/03/28/1610215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Many VPN Providers Leak Customer's IP Address via WebRTC Bug
by Peter Reutemann 28 Mar '18

28 Mar '18

'Around 20% of today's top VPN solutions are leaking the customer's IP address via a WebRTC bug known since January 2015, and which apparently some VPN providers have never heard of. The discovery belongs to Paolo Stagno, a security researcher who goes by the pseudonym of VoidSec, and who recently audited 83 VPN apps on this old WebRTC IP leak. Stagno says he found that 17 VPN clients were leaking the user's IP address while surfing the web via a browser. The researcher published his results in a Google Docs spreadsheet. The audit list is incomplete because Stagno didn't have the financial resources to test all commercial VPN clients.' -- source: https://yro.slashdot.org/story/18/03/28/1813213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fwd: [NZLUG] [Fwd: [Security-news] Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002]
by Peter Reutemann 28 Mar '18

28 Mar '18

Apologies for cross-posting. Cheers, Peter ---------- Forwarded message ---------- From: Mark Foster <...> Date: Thu, Mar 29, 2018 at 9:20 AM Subject: [NZLUG] [Fwd: [Security-news] Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002] To: nzlug(a)lists.nzoss.org.nz I know there's plenty of Drupal out there, and I don't usually forward these around, but in case you havn't heard... The Drupal team took the unusual step of warning that this was coming several days ago, that helps set the tone for the severity of this. I've taken the unusual step of disabling my own Drupal based website until I can attend to its update. Mark. ---------------------------- Original Message ---------------------------- Subject: [Security-news] Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002 From: security-news(a)drupal.org Date: Thu, March 29, 2018 8:21 am To: security-news(a)drupal.org -------------------------------------------------------------------------- View online: https://www.drupal.org/sa-core-2018-002 Project:Â Drupal core [1] Date:Â 2018-March-28 Security risk:Â *Highly critical* 21âˆ•25 AC:None/A:None/CI:All/II:All/E:Theoretical/TD:Default [2] Vulnerability:Â Remote Code Execution Description:Â CVE: CVE-2018-7600 A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being completely compromised. The security team has written an FAQ [3] about this issue. Solution:Â Upgrade to the most recent version of Drupal 7 or 8 core. * *If you are running 7.x, upgrade to Drupal 7.58 [4].* (If you are unable to update immediately, you can attempt to apply this patch [5] to fix the vulnerability until such time as you are able to completely update.) * *If you are running 8.5.x, upgrade to Drupal 8.5.1 [6].* (If you are unable to update immediately, you can attempt to apply this patch [7] to fix the vulnerability until such time as you are able to completely update.) Drupal 8.3.x and 8.4.x are no longer supported and we don't normally provide security releases for unsupported minor releases [8]. However, given the potential severity of this issue, we /are/ providing 8.3.x and 8.4.x releases that includes the fix for sites which have not yet had a chance to update to 8.5.0. Your site's update report page will recommend the 8.5.x release even if you are on 8.3.x or 8.4.x. Please take the time to update to a supported version after installing this security update. * If you are running 8.3.x, upgrade to Drupal 8.3.9 [9] or apply this patch [10]. * If you are running 8.4.x, upgrade to Drupal 8.4.6 [11] or apply this patch [12]. This issue also affects Drupal 8.2.x and earlier, which are no longer supported. If you are running any of these versions of Drupal 8, update to a more recent release and then follow the instructions above. This issue also affects Drupal 6. Drupal 6 is End of Life. For more information on Drupal 6 support please contact a D6LTS vendor [13]. Reported By:Â * Jasper Mattsson [14] Fixed By:Â * Jasper Mattsson [15] * Samuel Mortenson [16] Provisional Drupal Security Team member * David Rothstein [17] of the Drupal Security Team * Jess (xjm) [18] of the Drupal Security Team * Michael Hess [19] of the Drupal Security Team * Lee Rowlands [20] of the Drupal Security Team * Peter Wolanin [21] of the Drupal Security Team * Alex Pott [22] of the Drupal Security Team * David Snopek [23] of the Drupal Security Team * Pere Orga [24] of the Drupal Security Team * Neil Drumm [25] of the Drupal Security Team * Cash Williams [26] of the Drupal Security Team * Daniel Wehner [27] * Tim Plunkett [28] -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached by email at security at drupal.org or via the contact form. Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site. [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://groups.drupal.org/security/faq-2018-002 [4] https://www.drupal.org/project/drupal/releases/7.58 [5] https://cgit.drupalcode.org/drupal/rawdiff/?h=7.x&id=2266d2a83db50e2f97682d… [6] https://www.drupal.org/project/drupal/releases/8.5.1 [7] https://cgit.drupalcode.org/drupal/rawdiff/?h=8.5.x&id=5ac8738fa69df34a0635… [8] https://www.drupal.org/core/release-cycle-overview [9] https://www.drupal.org/project/drupal/releases/8.3.9 [10] https://cgit.drupalcode.org/drupal/rawdiff/?h=8.5.x&id=5ac8738fa69df34a0635… [11] https://www.drupal.org/project/drupal/releases/8.4.6 [12] https://cgit.drupalcode.org/drupal/rawdiff/?h=8.5.x&id=5ac8738fa69df34a0635… [13] https://www.drupal.org/project/d6lts [14] https://www.drupal.org/u/Jasu_M [15] https://www.drupal.org/u/Jasu_M [16] https://www.drupal.org/user/2582268 [17] https://www.drupal.org/user/124982 [18] https://www.drupal.org/user/65776 [19] https://www.drupal.org/user/102818 [20] https://www.drupal.org/u/larowlan [21] https://www.drupal.org/user/49851 [22] https://www.drupal.org/u/alexpott [23] https://www.drupal.org/u/dsnopek [24] https://www.drupal.org/u/pere-orga [25] https://www.drupal.org/u/drumm [26] https://www.drupal.org/u/cashwilliams [27] https://www.drupal.org/u/dawehner [28] https://www.drupal.org/u/tim.plunkett _______________________________________________ Security-news mailing list Security-news(a)drupal.org Unsubscribe at https://lists.drupal.org/mailman/listinfo/security-news _______________________________________________ NZLUG mailing list NZLUG(a)lists.nzoss.org.nz http://lists.nzoss.org.nz/mailman/listinfo/nzlug -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chromebooks In Schools?
by Lawrence D'Oliveiro 28 Mar '18

28 Mar '18

In among this article about Apple’s new push to get IPads used in schools <https://arstechnica.com/gadgets/2018/03/analysis-new-ipads-will-help-apple-…> is the interesting information that Google Chromebooks are heavily used throughout the US school system: Google offers G Suite for Education for free, sans some features. Adding the full suite of enterprise features costs only $4 per user per month, compared to $25 per user per month for other kinds of organizations. Papers are typed in Google Docs. Presentations are done using Google Presentations. Each student has a Google email account assigned through the district. Homework is handed out and done entirely on Chromebooks in many classes. In so many words, Google has spread its tentacles throughout the entire school district at every level ... Are Chromebooks used in schools here? I noticed a couple of units on sale in OfficeMax when I dropped in there a few weeks ago. I don’t recall seeing them anywhere else in town.

1 0

Bring your own Linux to Windows with new open source tool
by Peter Reutemann 27 Mar '18

27 Mar '18

'After starting with Ubuntu, Microsoft has added a number of Linux distributions to its Windows Subsystem for Linux (WSL) Linux runtime environment. A Windows machine can simultaneously offer an Ubuntu, SUSE, Debian, and Kali "personality," providing users with a choice of the different distributions' preferences and package management. But if your distribution isn't yet available or if you want a Linux installation that's customized just the way you like it, there's now an answer: Microsoft has an open source tool for building your own Linux package. The tool is aimed at two groups: distribution owners (so they can produce a bundle to ship through the Microsoft Store) and developers (so they can create custom distributions and sideload them onto their development systems). Microsoft's tool provides the basic glue between Windows and the Linux distribution. It handles telling the system about the distribution and performing initial setup such as user creation, and it can be customized to—for example—print a message of the day when the distribution is started.' -- source: https://arstechnica.com/gadgets/2018/03/microsofts-new-open-source-tool-let… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

As predicted, more speculative execution processor attacks are discovered
by Peter Reutemann 26 Mar '18

26 Mar '18

'Researchers from the College of William and Mary, Carnegie Mellon, the University of California Riverside, and Binghamton University have described a security attack that uses the speculative execution features of modern processors to leak sensitive information and undermine the security boundaries that operating systems and software erect to protect important data. That probably sounds familiar. The Spectre attacks, published earlier this year, take advantage of the speculative execution features of modern processors to leak sensitive information. The new attack, named BranchScope by the researchers, shares some similarity with variant 2 of the Spectre attack, as both BranchScope and Spectre 2 take advantage of the behavior of the processor's branch predictor.' -- source: https://arstechnica.com/gadgets/2018/03/its-not-just-spectre-researchers-re… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google starts blocking “uncertified” Android devices from logging in
by Peter Reutemann 26 Mar '18

26 Mar '18

'Google is apparently stepping up its efforts to crack down on illicit distribution of Google's Android apps. According to XDA Developers, Google logins on unlicensed devices will now fail at setup, and a warning message will pop up stating "Device is not certified by Google." This warning screen has appeared on and off in the past during a test phase, but XDA (and user reports) indicate it is now headed for a wider rollout.' -- source: https://arstechnica.com/gadgets/2018/03/google-starts-blocking-uncertified-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Kritia 4.0 Released, Conversation With The Team
by Lawrence D'Oliveiro 26 Mar '18

26 Mar '18

Another high-quality article from Alexandre Prokoudine <http://libregraphicsworld.org/blog/entry/krita-4-0-interview> about the just-released major revamp of Krita. It now straddles both “paint” and “draw” worlds, with Inkscape-styled SVG-based vector functionality added to the older paint functions. Oh, and it does animations as well. The item links to the “official” release video, but another informative one worth checking out is this <https://www.youtube.com/watch?v=OXvHHJUyBDg>.

2 3

Shodan Search Exposes Thousands of Servers Hosting Passwords and Keys
by Peter Reutemann 25 Mar '18

25 Mar '18

'Thousands of etcd servers "are spitting sensitive passwords and encrypted keys," reports Fossbytes: Security researcher Giovanni Collazo was able to harvest 8781 passwords, 650 AWS access keys, 23 secret keys, and 8 private keys. First, he ran a query on the hacker search engine Shodan that returned around 2300 servers running etcd database. Then, he ran a simple script that gave him the login credentials stored on these servers which can be used to gain access to CMSs, MySQL, and PostgreSQL databases, etc. etcd is a database used by computing clusters to store and exchange passwords and configuration settings between servers and applications over the network. With the default settings, its programming interface can return administrative login credentials without any authentication upfront... All of the data he harvested from around 1500 servers is around 750MB in size... Collazo advises that anyone maintaining etcd servers should enable authentication, set up a firewall, and take other security measures. Another security research independently verified the results, and reported that one MySQL database had the root password "1234".' -- source: https://developers.slashdot.org/story/18/03/24/1943239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Facebook Scraped Call, Text Message Data For Years From Android Phones
by Peter Reutemann 25 Mar '18

25 Mar '18

'This past week, a New Zealand man was looking through the data Facebook had collected from him in an archive he had pulled down from the social networking site. While scanning the information Facebook had stored about his contacts, Dylan McKay discovered something distressing: Facebook also had about two years worth of phone call metadata from his Android phone, including names, phone numbers, and the length of each call made or received. This experience has been shared by a number of other Facebook users who spoke with Ars, as well as independently by us -- my own Facebook data archive, I found, contained call-log data for a certain Android device I used in 2015 and 2016, along with SMS and MMS message metadata. In response to an email inquiry about this data gathering by Ars, a Facebook spokesperson replied, "The most important part of apps and services that help you make connections is to make it easy to find the people you want to connect with. So, the first time you sign in on your phone to a messaging or social app, it's a widely used practice to begin by uploading your phone contacts." The spokesperson pointed out that contact uploading is optional and installation of the application explicitly requests permission to access contacts. And users can delete contact data from their profiles using a tool accessible via Web browser. If you granted permission to read contacts during Facebook's installation on Android a few versions ago -- specifically before Android 4.1 (Jelly Bean) -- that permission also granted Facebook access to call and message logs by default. The permission structure was changed in the Android API in version 16. But Android applications could bypass this change if they were written to earlier versions of the API, so Facebook API could continue to gain access to call and SMS data by specifying an earlier Android SDK version. Google deprecated version 4.0 of the Android API in October 2017 -- the point at which the latest call metadata in Facebook user's data was found. Apple iOS has never allowed silent access to call data. You are able to have Facebook delete the data it collects from you, "but it's not clear if this deletes just contacts or if it also purges call and SMS metadata," reports Ars. Generally speaking, if you're concerned about privacy, you shouldn't share your contacts and call-log data with any mobile application.' -- source: https://yro.slashdot.org/story/18/03/25/056246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi 3 Model B+ Benchmarks Show Significantly Improved Performance
by Peter Reutemann 25 Mar '18

25 Mar '18

'Pi Day was marked this year by the launch of the Raspberry Pi 3 Model B+ as the next evolution to this $35 ARM single-board computer. Phoronix has now put out Raspberry Pi 3 B+ benchmarks showing that the Ethernet performance is indeed much faster now but still doesn't stack up to other high performance boards, the SoC temperature is noticeably lower than the very warm Raspberry Pi 3, and the overall performance is a nice upgrade while retaining the same price point as its predecessors. Follow up tests looking at the Wi-Fi performance also show the new 802.11ac dual-band wireless to be much faster as well.' -- source: https://hardware.slashdot.org/story/18/03/25/0556258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hate-Speech Laws In Europe
by Lawrence D'Oliveiro 24 Mar '18

24 Mar '18

<https://www.techdirt.com/articles/20180321/17581339475/spanish-hate-anti-te…>: People are being arrested and charged with speech having nothing to with promoting hate or terrorism. ... It's gotten so bad Amnesty International -- an entity that usually spends its time decrying the acts of dictators and brutal authoritarians -- has felt compelled to speak up about Spain's terrible speech laws. ... The report also notes several other European countries are also beginning to curtail the rights of their citizens in their quest to target hate speech and international terrorism. Germany's hate speech law roll out has been an unmitigated disaster and other countries like France and Italy seem all too willing to join Spain and Germany in killing satire, parody, and content they just don't agree with. All of this is being done under the heading of "public safety," but in reality, the public is no safer and will develop an unhealthy fear of their own governments.

1 0

TLS 1.3 Has Been Approved
by Lawrence D'Oliveiro 24 Mar '18

24 Mar '18

The latest version of TLS (the official name for what used to be called “SSL”, i.e. the protocol that your browser uses for URLs beginning “https://”) is now an official IETF standard <http://www.theregister.co.uk/2018/03/23/tls_1_3_approved_ietf/>. This should not only make the setup of secure connections quicker, but also harder to crack. ... banks and businesses complained that, thanks to the way the new protocol does security, they will be cut off from being able to inspect and analyze TLS 1.3 encrypted traffic flowing through their networks, and so potentially be at greater risk from attack. Unfortunately, that self-same ability to decrypt secure traffic on your own network can also be potentially used by third parties to grab and decrypt communications. An effort to effectively insert a backdoor into the protocol was met with disdain and some anger by internet engineers, many of whom pointed out that it will still be possible to introduce middleware to monitor and analyze internal network traffic. Note the key phrase “forward secrecy”. This means that, even if your private key should become compromised down the track, this will still not help attackers decrypt any records they may have kept of your secure communications prior to that. And yes, you can expect the usual suspects to be unhappy about the introduction of such a feature.

1 0

Firefox In 2018: We'll Tackle Bad Ads, Breach Alerts, Autoplay Video, Says Mozilla
by Peter Reutemann 24 Mar '18

24 Mar '18

'Firefox maker Mozilla has outlined its 2018 roadmap to make the web less intrusive and safer for users. First up, Mozilla says it will proceed and implement last year's experiment with a breach alerts service, which will warn users when their credentials have been leaked or stolen in a data breach. Mozilla aims to roll out the service around October. Breach Alerts is based on security consultant Troy Hunt's data breach site Have I Been Pwned. Firefox will also implement a similar block on autoplay video to the one Chrome 66 will introduce next month, and that Safari already has. However, Dotzler says Firefox's implementation will "provide users with a way to block video auto-play that doesn't break websites". This feature is set to arrive in Firefox 62, which is scheduled for release in May. After Firefox 62 the browser will gain an optional Chrome-like ad filter and several privacy-enhancing features similar to those that Apple's WebKit developers have been working on for Safari's Intelligent Tracking Prevention. By the third quarter of 2018, Firefox should also be blocking ad-retargeting through cross-domain tracking. It's also going to move all key privacy controls into a single location in the browser, and offer more "fine-grained" tracking protection. Dotzler says Mozilla is in the "early stages" of determining what types of ads Firefox should block by default. Also on the roadmap is a feature that arrived in Firefox 59, released earlier this month. A new Global Permissions feature will help users avoid having to deny every site that requests permission for location, camera, microphone and notifications. Beyond security and privacy, Mozilla plans to build on speed-focused Quantum improvements that came in Firefox 57 with smoother page rendering.' -- source: https://news.slashdot.org/story/18/03/23/2110244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Windows Server 2019 Will Feature Linux and Kubernetes Support
by Peter Reutemann 22 Mar '18

22 Mar '18

'Microsoft announced this week that it will launch the next major release of Windows Server later this year with better support for hybrid workloads, Linux workloads, and hyper-converged infrastructure. >From a report: This release will succeed Windows Server 2016, which was made generally available in October 2016. While Microsoft moved to twice-yearly updates for Windows Server starting last year, the company bundles those changes into a long-term servicing channel once every two or three years for administrators who prefer less frequent releases. Those companies that haven't moved over to the semi-annual channel will get their first taste of Windows Server's Linux and Kubernetes support, which are currently in beta.' -- source: https://tech.slashdot.org/story/18/03/22/1647243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

NVidia Titan V GPUs Giving Wrong Answers To Scientific Simulations
by Lawrence D'Oliveiro 21 Mar '18

21 Mar '18

<http://www.theregister.co.uk/2018/03/21/nvidia_titan_v_reproducibility/>: Nvidia’s flagship Titan V graphics cards may have hardware gremlins causing them to spit out different answers to repeated complex calculations under certain conditions, according to computer scientists. ... Gamers and casual users will not notice any errors or issues, however folks running scientific software may encounter the glitches.

2 1

Artificial Intelligence And The Future of Online Content Moderation
by Lawrence D'Oliveiro 21 Mar '18

21 Mar '18

Report on a workshop on the use of artificial intelligence in governing communication online <https://freedom-to-tinker.com/2018/03/21/artificial-intelligence-and-the-fu…>: Over the course of the day, [the writer] learned many things about automated filtering that [he] hadn’t previously thought about. • Regulators and platforms are under tremendous pressure to act, based on the assumption that the technical problems are easy. • Takedown requests are a frequent instrument for censorship. • The larger platforms share content hashes of unwanted content, but the database and process are opaque. • Different countries have very different definitions of unlawful content. • Norms and speech evolve over time, often rapidly. In other words, it seems to me that, whether they are doing it deliberately or not, the regulators are pushing more and more power into the hands of the social-media platforms.

1 0

Mozilla Launches a Petition Asking Facebook To Do More For User Privacy
by Peter Reutemann 21 Mar '18

21 Mar '18

'After it was revealed that the personal data of 50 million Facebook users was shared without consent, Mozilla is calling on the social network to ensure that user privacy is protected by default, particularly when it comes to apps. Ashley Boyd, Mozilla's vice president of advocacy, says that billions of Facebook users are unknowingly at risk of having their data passed on to third parties. He says: "If you play games, read news or take quizzes on Facebook, chances are you are doing those activities through third-party apps and not through Facebook itself. The default permissions that Facebook gives to those third parties currently include data from your education and work, current city and posts on your timeline."' -- source: https://tech.slashdot.org/story/18/03/21/182253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AMD promises firmware fixes for security processor bugs
by Peter Reutemann 20 Mar '18

20 Mar '18

'AMD has responded to the reports last week of a range of security flaws affecting its Platform Security Processor (PSP) and chipset. The company acknowledges the bugs and says that, in coming weeks, it will have new firmware available to resolve the PSP bugs. These firmware fixes will also mitigate the chipset bugs.' -- source: https://arstechnica.com/gadgets/2018/03/amd-promises-firmware-fixes-for-sec… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

IBM Unveils the 'World's Smallest Computer'
by Peter Reutemann 19 Mar '18

19 Mar '18

'On the first day of IBM Think 2018, the company's flagship conference, IBM has unveiled what it claims is the world's smallest computer. It's smaller than a grain of salt and features the computer power of the x86 chip from 1990. Mashable first spotted this gem: The computer will cost less than ten cents to manufacture, and will also pack "several hundred thousand transistors," according to the company. These will allow it to "monitor, analyze, communicate, and even act on data." It works with blockchain. Specifically, this computer will be a data source for blockchain applications. It's intended to help track the shipment of goods and detect theft, fraud, and non-compliance. It can also do basic AI tasks, such as sorting the data it's given. According to IBM, this is only the beginning. "Within the next five years, cryptographic anchors -- such as ink dots or tiny computers smaller than a grain of salt -- will be embedded in everyday objects and devices," says IBM head of research Arvind Krishna. If he's correct, we'll see way more of these tiny systems in objects and devices in the years to come. It's not clear yet when this thing will be released -- IBM researchers are currently testing its first prototype. ' -- source: https://hardware.slashdot.org/story/18/03/19/210245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Mint 19 'Tara' Cinnamon Will Be Faster
by Peter Reutemann 19 Mar '18

19 Mar '18

'Mint developers say they feel the app-launching time on the Linux distro seemed slow when using the Cinnamon desktop environment. So, they are working on fixing it. BetaNews reports: Windows build time was four times slower with Cinnamon compared to Metacity, while recovery time was nearly four times slower too. So yes, app-launching on Cinnamon -- as of today -- is slow comparatively. The big benefit to pinpointing a problem, however, is that it is the first step in solving it. And so, Linux Mint 19 Cinnamon will be faster as a result. "We developed a little script and a method to measure how long it took to flood the desktop environment with the creation of 200 windows. We could then measure the time reported by the script to build these 200 windows, and the time it actually took the desktop environment to recover from it and have these windows placed/mapped correctly and ready to be interacted with. Both measures were significantly higher in Cinnamon than in other desktops," says The Linux Mint Team.' -- source: https://linux.slashdot.org/story/18/03/19/1648259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Joins Group Working To 'Cure' Open-Source Licensing Issues
by Peter Reutemann 19 Mar '18

19 Mar '18

'Microsoft is joining Red Hat, Facebook, Google and IBM in committing to extending right to "cure" open source licensing noncompliance before taking legal measures. From a report: On March 19, officials from Microsoft -- along with CA Technologies, Cisco, HPE, SAP and SUSE -- said they'd work with open together with the already-committed vendors to provide more "predictability" for users of open source software. "The large ecosystems of projects using the GPLv2 and LGPLv2.x licenses will benefit from adoption of this more balanced approach to termination derived from GPLv3," explained Red Hat in a press release announcing the new license-compliance partners. The companies which have agreed to adopt the "Common Cure Rights Commitment" said before they file or continue to prosecute those accused of violating covered licenses, they will allow for users to cure and reinstate their licenses.' -- source: https://news.slashdot.org/story/18/03/19/1720228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

When China Hoards Its Hackers Everyone Loses
by Peter Reutemann 18 Mar '18

18 Mar '18

'For over a decade Pwn2Own -- happening this week -- has brought together security talent from across the globe in a friendly hacking competition that is a cornerstone of research and advancement on par with Black Hat and Def Con. China's hackers routinely win, sweeping the board -- notably, the Tencent and Keen teams. Pwn2Own is good-natured, and all in the name of researchers finding big bugs, nabbing great bounties and drawing attention to security holes and zero-days that need to be fixed. But this year, according to Pwn2Own manager Brian Gorenc, China is no longer allowing its researchers to compete. Prior to the start of Pwn2Own this week, Gorenc told press "There have been regulatory changes in some countries that no longer allow participation in global exploit contests, such as Pwn2Own and Capture the Flag competitions." One thing's for certain: yearly champions Tencent's Keen Labs and Qihoo 360's 360Vulcan team are nowhere to be found and Trend Micro, the conference organizer, has confirmed to Engadget that there are no Chinese competitors in this year's competition. [...] It's a worrying development in the direction of isolationism and away from the benefits of competition in the spirit of improving security for all. It comes at a time when relations between the US and China strain under the weight of Huawei security concerns, which are not at all new, but are certainly coming to a head as American companies sever business ties with the firm.' -- source: https://it.slashdot.org/story/18/03/18/2042207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Master Password System Has Been Poorly Secured for the Past 9 Years, Researcher Says
by Peter Reutemann 18 Mar '18

18 Mar '18

'For at past nine years, Mozilla has been using an insufficiently strong encryption mechanism for the "master password" feature. Both Firefox and Thunderbird allow users to set up a "master password" through their settings panel. This master password plays the role of an encryption key that is used to encrypt each password string the user saves in his browser or email client. Experts have lauded the feature because up until that point browsers would store passwords locally in cleartext, leaving them vulnerable to malware or attackers with physical access to a victim's computer. But Wladimir Palant, the author of the AdBlock Plus extension, says the encryption scheme used by the master password feature is weak and can be easily brute-forced. "I looked into the source code," Palant says, "I eventually found the sftkdb_passwordToKey() function that converts a [website] password into an encryption key by means of applying SHA-1 hashing to a string consisting of a random salt and your actual master password."' -- source: https://it.slashdot.org/story/18/03/18/1930240 cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu Community Considers a Crowd-Sourced Promo Video
by Peter Reutemann 17 Mar '18

17 Mar '18

'Slashdot reader Beacon11 writes that "Alan Pope, a community advocate for Ubuntu, has requested comments and ideas regarding the creation of a crowd-sourced promo video that, in 30 seconds, conveys that Ubuntu is for everyone." Alan Pope writes: So for example you might see a woman on a train typing an article, a guy in an office creating a presentation, a kid on the sofa playing a game with a controller on their TV, someone watching a film, someone developing code, kids playing with robots, a farmer planning animal feeding. You get the idea... So I'd really like to do this as a shared community project, with video clips submitted by Ubuntu users from around the world, perhaps even taking in a landmark or two here and there. I'd expect the video to represent the diversity of users, and variety of activities people are able to do with Ubuntu. Though they're currently just discussing its feasibility, Alan writes that "I think if we work together we could make something amazing."' -- source: https://news.slashdot.org/story/18/03/17/0524228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Journal "Reader's Choice Awards"
by Peter Reutemann 17 Mar '18

17 Mar '18

'The newly-relaunched Linux Journal is conducting its annual "Reader's Choice Awards," and this month announced the winners for Best Text Editor, Best Laptop, and Best Domain Registrar. Vim was chosen as the best editor by 35% of respondents, handily beating GNU Emacs (19%) Sublime Text (10%) and Atom (8%). Readers' Choice winner Vim is an extremely powerful editor with a user interface based on Bill Joy's 40-plus-year-old vi, but with many improved-upon features including extensive customization with key mappings and plugins. Linux Journal reader David Harrison points out another great thing about Vim "is that it's basically everywhere. It's available on every major platform." For best laptop their readers picked Lenovo (32%), followed by Dell (25%) and System76 (11%). The ThinkPad began life at IBM, but in 2005, it was purchased by Lenovo along with the rest of IBM's PC business. Lenovo evolved the line, and today the company is well known as a geek favorite. Lenovo's ThinkPads are quiet, fast and arguably have one of the best keyboards (fighting words!). Linux Journal readers say Lenovo's Linux support is excellent, leaving many to ponder why the company doesn't ship laptops with Linux installed. In February readers also voted on the best web browser, choosing Firefox (57%) over Chrome (17%) and Chromium (7%). And they also voted on the best Linux distribution, ultimately selecting Debian (33%), open SUSE (12%), and Fedora (11%).' -- source: https://linux.slashdot.org/story/18/03/17/0438256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel: Our Next Chips Won’t Have Data Leak Flaws We Told You Totally Not To Worry About
by Lawrence D'Oliveiro 16 Mar '18

16 Mar '18

<http://www.theregister.co.uk/2018/03/15/intel_spectre_mitigation/>: In public statements and private briefings to reporters and analysts, it has shifted from claiming these bugs are overblown and not a problem, to admitting they are a problem but are easy to mitigate, to confessing they are not so easy to mitigate but at least there are no ill effects, to conceding there are some ill effects but it's nothing to worry about, to finally confirming: the issues are so embarrassing, we've redesigned our processors to address the design blunders.

1 0

How A Norwegian Comment Section Turned Chaos Into Order—With A Simple Quiz
by Lawrence D'Oliveiro 16 Mar '18

16 Mar '18

<https://arstechnica.com/gaming/2018/03/how-a-norwegian-comment-section-turn…>: "It was a basic idea," NRKbeta developer Ståle Grut told a South By Southwest crowd on Tuesday. "Readers had to prove they read a story before they were able to comment on it."

1 0

New Raspberry Pi - Model 3B+
by Ian Stewart 14 Mar '18

14 Mar '18

A new model of Raspberry Pi single board computer was appropriately released yesterday (...being the 14th day of the 3rd month of the year, or Pi Day 3.14) Its the latest revision of their third-generation single-board computers. This model 3B+ is an enhanced version of the 3B, which was released two years ago. Some details<https://www.raspberrypi.org/blog/raspberry-pi-3-model-bplus-sale-now-35/>, the technical data sheet<http://www.farnell.com/datasheets/2582162.pdf?_ga=2.61358060.1158065867.152…>, and a 7 minute youtube clip<https://www.youtube.com/watch?v=zQZxdiz2UAs> Raspberry Pi 3 Model B+ is now on sale for US$35, and features: A 1.4GHz 64-bit quad-core ARM Cortex-A53 CPU Dual-band 802.11ac wireless LAN and Bluetooth 4.2 Faster Ethernet (Gigabit Ethernet over USB 2.0) Power-over-Ethernet support (with separate PoE HAT) Improved PXE network and USB mass-storage booting Improved thermal management A Power-over-Ethernet (PoE<https://en.wikipedia.org/wiki/Power_over_Ethernet>) Hat is to be released shortly. The R-Pi will default to attempting to do a PXE boot over Ethernet. Thus the R-Pi may be positioned and operated at quite a long physical distance from what is its supply of power and from where it loads its operating system. The NZ on-line outlet of Element14<http://nz.element14.com/raspberry-pi/2773729/raspberry-pi-3-model-b/dp/2842…> have the R-Pi 3B+ available at NZ $51.52 + $7.73 GST = $59.25 What is a little strange is the R-Pi Zero-W, released over a year ago, is still not available in NZ from Element14. cheers, Ian.

2 2

GNOME 3.28 'Chongqing' Linux Is Here
by Peter Reutemann 14 Mar '18

14 Mar '18

'GNOME 3.28 is the latest version of GNOME 3, and is the result of 6 months' hard work by the GNOME community. It contains several major new features, as well as many smaller improvements and bug fixes. In total, the release incorporates 24105 changes, made by approximately 778 contributors. The Project explains, "GNOME 3.28 comes with more beautiful things! First, and most significantly, GNOME's default interface font (called Cantarell) has undergone a significant update. Character forms and spacing have been evolved, so that text is more readable and attractive. Several new weights have also been added -- light and extra bold -- which are being used to produce interfaces that are both modern and beautiful. Other beautiful things include GNOME's collection of background wallpapers, which has been updated to include a lovely set of photographs, and the selection of profile pictures, which has been completely updated with attractive new images to pick from." Unfortunately, you can't just click on a button and upgrade to GNOME 3.28 today. Actually, for the most part, you will need to wait for it to become available for your operating system. Sadly, this can take a while. Fedora users, for instance, will have to wait for a major OS upgrade for it to become available. ' -- source: https://linux.slashdot.org/story/18/03/14/1624227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apple Seems OK With Overt Cryptocurrency-Mining App
by Lawrence D'Oliveiro 14 Mar '18

14 Mar '18

<https://arstechnica.com/information-technology/2018/03/theres-a-currency-mi…>: In recent days, Calendar 2 developer Qbix endowed it with code that mines the digital coin known as Monero. The xmr-stack miner isn't supposed to run unless users specifically approve it in a dialog that says the mining will be in exchange for turning on a set of premium features. If users approve the arrangement, the miner will then run. Users can bypass this default action by selecting an option to keep the premium features turned off or to pay a fee to turn on the premium features. But there were one or two bugs that kept things from working smoothly. However, in an update to the article, it seems the developer has had second thoughts, and is removing the miner function from the app.

1 0

Let’s Encrypt takes free “wildcard” certificates live
by Peter Reutemann 14 Mar '18

14 Mar '18

'In July of 2017, the nonprofit certificate authority Let's Encrypt promised to deliver something that would put secure websites and Web applications within reach of any Internet user: free "wildcard" certificates to enable secure HTTP connections for entire domains. Today, Let's Encrypt took that promised service live, in addition to a new version of the Automated Certificate Management Environment (ACME) protocol, an interface that can be used by a variety of client software packages to automate verification of certificate requests. ACME version 2 "has gone through the IETF standards process," said Josh Aas, executive director of the Internet Security Research Group (ISRG), the group behind Let's Encrypt, in a blog post on the release. ACME v2 is currently a draft Internet Engineering Task Force standard, so it may not yet be in its final form. But the current version is the result of significant feedback from the industry. And its use is required to obtain wildcard certificates. In addition to the ACME v2 requirement, requests for wildcard certificates require the modification of a Domain Name Service "TXT" record to verify control over the domain—a similar method to that used by Google and other service providers to prove domain ownership. But much of this can be automated by hosting providers that provide DNS services. A single Let's Encrypt account can request up to 300 wildcard certificates over a period of three hours, allowing a hosting provider to handle requests for customers who may not have shell access to their sites.' -- source: https://arstechnica.com/information-technology/2018/03/lets-encrypt-takes-f… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Re: [wlug] Microsoft Helps Get A Computer Recycler Sentenced To 15 Months In Prison For Offering Unapproved Recovery Disks
by Rowan Schischka 13 Mar '18

13 Mar '18

>And yet here we are, watching prosecutorial discretion morph into >putting someone's head on a platter over recovery disks any one of us >could download hundreds of times from Microsoft's website without a >single murmur about "lost sales" from the tech giant. Just because something is available online without a fee does not mean it can be treated as public domain. The punishment may not appear to reasonably fit the crime, but this is what was laid out by lawmakers. I would hope a reasonable fine would be equivalent to what an OEM would profit from selling a disc. I worked in anti-piracy a few years back, I should have given a lecture on licensing while I was in Hamilton. Microsoft is very smart in taking money.

2 1

Researchers Find Critical Vulnerabilities in AMD's Ryzen and EPYC Processors, But They Gave the Chipmaker Only 24 Hours Before Making the Findings Public
by Peter Reutemann 13 Mar '18

13 Mar '18

'Alfred Ng, reporting for CNET: Researchers have discovered critical security flaws in AMD chips that could allow attackers to access sensitive data from highly guarded processors across millions of devices. Particularly worrisome is the fact that the vulnerabilities lie in the so-called secure part of the processors -- typically where your device stores sensitive data like passwords and encryption keys. It's also where your processor makes sure nothing malicious is running when you start your computer. CTS-Labs, a security company based in Israel, announced Tuesday that its researchers had found 13 critical security vulnerabilities that would let attackers access data stored on AMD's Ryzen and EPYC processors, as well as install malware on them. Ryzen chips power desktop and laptop computers, while EPYC processors are found in servers. The researchers gave AMD less than 24 hours to look at the vulnerabilities and respond before publishing the report. Standard vulnerability disclosure calls for 90 days' notice so that companies have time to address flaws properly. An AMD spokesperson said, "At AMD, security is a top priority and we are continually working to ensure the safety of our users as new risks arise. We are investigating this report, which we just received, to understand the methodology and merit of the findings," an AMD spokesman said. Zack Whittaker, a security reporter at CBS, said: Here's the catch: AMD had less than a day to look at the research. No wonder why its response is so vague.' -- source: https://it.slashdot.org/story/18/03/13/1558221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 59, 'By Far the Biggest Update Since Firefox 1.0', Arrives With Faster Page Loads and Improved Private Browsing
by Peter Reutemann 13 Mar '18

13 Mar '18

'Mozilla today launched Firefox 59 for Windows, Mac, Linux, and Android. The release builds on Firefox Quantum, which the company calls "by far the biggest update since Firefox 1.0 in 2004." Version 59 brings faster page load times, private browsing mode that strips path information, and Android Assist. In related news, Mozilla is giving Amazon Fire TV owners a new design later this week that lets them save their preferred websites by pinning them to the Firefox home screen. Enterprise users also have something to look forward to: On Wednesday, Firefox Quantum for Enterprise is entering the beta phase. Firefox 59 for the desktop is available for download now on Firefox.com, and all existing users should be able to upgrade to it automatically. As always, the Android version is trickling out slowly on Google Play.' -- source: https://tech.slashdot.org/story/18/03/13/1623251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Privacy-Busting Bugs Found in Popular VPN Services Hotspot Shield, Zenmate and PureVPN
by Peter Reutemann 13 Mar '18

13 Mar '18

'A report by VpnMentor, a website which ranks VPN services, reveals several vulnerabilities in Hotspot Shield, Zenmate, and PureVPN -- all of which promise to provide privacy for their users. VpnMentor says it hired a team of three external ethical hackers to find vulnerabilities in three random popular VPNs. While one hacker wants to keep his identity private, the other two are known as File Descriptor and Paulos Yibelo. ZDNet: The research reveals bugs that can leak real-world IP addresses, which in some cases can identify individual users and determine a user's location. In the case of Hotspot Shield, three separate bugs in how the company's Chrome extension handles proxy auto-config scripts -- used to direct traffic to the right places -- leaked both IP and DNS addresses, which undermines the effectiveness of privacy and anonymity services. [...] AnchorFree, which makes Hotspot Shield, fixed the bugs, and noted that its mobile and desktop apps were not affected by the bugs. The researchers also reported similar IP leaking bugs to Zenmate and PureVPN.' -- source: https://yro.slashdot.org/story/18/03/13/1836218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Gets Privacy Boost By Disabling Proximity and Ambient Light Sensor APIs
by Peter Reutemann 12 Mar '18

12 Mar '18

'Stating with Firefox 60 -- expected to be released in May 2018 -- websites won't be able to use Firefox to access data from sensors that provide proximity distances and ambient light information. >From a report: Firefox was allowing websites to access this data via the W3C Proximity and Ambient Light APIs. But at the start of the month, Mozilla engineers decided to disable access to these two APIs by default. The APIs won't be removed, but their status is now controlled by two Firefox flags that will ship disabled by default. This means users will have to manually enable the two flags before any website can use Firefox to extract proximity and ambient light data from the device's underlying sensors. The two flags will be available in Firefox's about:config settings page. The screenshot below shows the latest Firefox Nightly version, where the two flags are now disabled, while other sensor APIs are enabled.' -- source: https://news.slashdot.org/story/18/03/12/1641205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Helps Get A Computer Recycler Sentenced To 15 Months In Prison For Offering Unapproved Recovery Disks
by Lawrence D'Oliveiro 12 Mar '18

12 Mar '18

<https://www.techdirt.com/articles/20180223/17294539295/microsoft-helps-get-…>: Someone dedicates his life to keeping landfills free of harmful material and the government wants to send him to prison. And it's all based on Microsoft's assertion it would have sold as many recovery disks as Lundgren created if only Lundgren hadn't created them. Ignored is the fact they never were distributed. Also ignored is the dubiousness of "lost sales" assertions, which are always 100% conjecture and always presented as a simplistic equation: "1 Piracy = 1 Lost Sale." But in this case, no sales were lost because no sales were replaced with bootleg boot disks. And "sales" must be a legal term of art. Microsoft allows anyone to download a recovery disk for free. But in court, these are suddenly worth money because infringement. To ensure someone gets tossed in jail for breaking the chain of planned obsolescence, Microsoft (and prosecutors) want the court to believe the existence of recovery disks that do nothing unless a person already has a licensed copy of Windows has somehow made the company $700,000 poorer. Given the limitations of burned recovery disks, it's impossible to see where infringement even comes into play. And yet here we are, watching prosecutorial discretion morph into putting someone's head on a platter over recovery disks any one of us could download hundreds of times from Microsoft's website without a single murmur about "lost sales" from the tech giant.

1 0

Command Line Text Processing
by Peter Reutemann 11 Mar '18

11 Mar '18

Useful tutorials: https://github.com/learnbyexample/Command-line-text-processing Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz

1 0

SgxSpectre Attack Can Extract Data From Intel SGX Enclaves
by Peter Reutemann 11 Mar '18

11 Mar '18

'A new variation of the Spectre attack has been revealed this week by six scientists from the Ohio State University. Named SgxSpectre, researchers say this attack can extract information from Intel SGX enclaves. Intel Software Guard eXtensions (SGX) is a feature of modern Intel processors that allow an application to create so-called enclaves. This enclave is a hardware-isolated section of the CPU's processing memory where applications can run operations that deal with extremely sensitive details, such as encryption keys, passwords, user data, and more... Neither Meltdown and Spectre were able to extract data from SGX enclaves. This is where SgxSpectre comes in. According to researchers, SgxSpectre works because of specific code patterns in software libraries that allow developers to implement SGX support into their apps. Vulnerable SGX development kits include the Intel SGX SDK, Rust-SGX, and Graphene-SGX. Academics say an attacker can leverage the repetitive code execution patterns that these SDKs introduce in SGX enclaves and watch for small variations of cache size. This allows for side-channel attacks that allow a threat actor to infer and slowly recover data from secure enclaves. Intel's recent Spectre patches don't necessarily help, as an attacker can work around these fixes. Intel says an update for the Intel SGX SDK that adds SgxSpectre mitigations will be released on March 16. Apps that implement Google's Retpoline anti-Spectre coding techniques are safe, researchers say.' -- source: https://it.slashdot.org/story/18/03/10/0446211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Debian 9.4 Released
by Peter Reutemann 11 Mar '18

11 Mar '18

'The Debian project is pleased to announce the fourth update of its stable distribution Debian 9 (codename "stretch"). This point release mainly adds corrections for security issues, along with a few adjustments for serious problems... Please note that the point release does not constitute a new version of Debian 9 but only updates some of the packages included. There is no need to throw away old "stretch" media. After installation, packages can be upgraded to the current versions using an up-to-date Debian mirror. Phoronix adds that Debian 9.4 "has a new upstream Linux kernel release, various dependency fixes for some packages, an infinite loop fix in Glade, several CVE security fixes, a larger stack size for NTP, a new upstream release of their NVIDIA proprietary driver package, Python 3 dependency fixes, and other security fixes."' -- source: https://linux.slashdot.org/story/18/03/10/2120216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Developer McHardy Drops GPLv2 'Shake Down' Case
by Peter Reutemann 11 Mar '18

11 Mar '18

'Former Linux developer Patrick McHardy dropped his Gnu General Public License version 2 (GPLv2) violation case against Geniatech in a German court this week. ZDNet explains why some consider this a big "win": People who find violations typically turn to organizations such as the Free Software Foundation, Software Freedom Conservancy (SFC), and the Software Freedom Law Center to approach violators. These organizations then try to convince violating companies to mend their ways and honor their GPLv2 legal requirements. Only as a last resort do they take companies to court to force them into compliance with the GPLv2. Patrick McHardy, however, after talking with SFC, dropped out from this diplomatic approach and has gone on his own way. Specifically, McHardy has been accused of seeking his own financial gain by approaching numerous companies in German courts. Geniatech claimed McHardy has sued companies for Linux GPLv2 violations in over 38 cases. In one, he'd requested a contractual penalty of €1.8 million. The company also claimed McHardy had already received over €2 million from his actions... In July 2016, the Netfilter developers suspended him from the core team. They received numerous allegations that he had been shaking down companies. McHardy refused to discuss these issues with them, and he refused to sign off on the Principles of Community-Oriented GPL Enforcement. In October 2017, Greg Kroah-Hartman, Linux kernel maintainer for the stable branch, summed up the Linux kernel developers' position. Kroah-Hartman wrote: "McHardy has sought to enforce his copyright claims in secret and for large sums of money by threatening or engaging in litigation...." Had McHardy continued on his way, companies would have been more reluctant to use Linux code in their products for fear that a single, unprincipled developer could sue them and demand payment for his copyrighted contributions... McHardy now has to bear all legal costs for both sides of the case. In other words, when McHardy was faced with serious and costly opposition for the first time, he waved a white flag rather than face near certain defeat in the courts. ' -- source: https://linux.slashdot.org/story/18/03/10/2323242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Well, It Got Them To The Moon And Back ...
by Lawrence D'Oliveiro 10 Mar '18

10 Mar '18

... and only crashed twice‡. Source code <https://github.com/chrislgarry/Apollo-11/blob/master/Luminary099/LUNAR_LAND…>, and note the comments on lines 179 and 180: # TEMPORARY, I HOPE HOPE HOPE ‡The famous “1202 alarm” and “1201 alarm” incidents during the landing.

1 0

Microsoft Throttles On-Prem Tech Donation Scheme For Nonprofits
by Lawrence D'Oliveiro 09 Mar '18

09 Mar '18

Cloud services will be cheaper, but actually buying premium versions of products will cost more <http://www.theregister.co.uk/2018/03/09/microsoft_charity_donation_shakeup/>. Clearly pushing people towards the rental option. Which means, when the corporate largesse runs out, the charity is left with nothing. Kind of like what has happened at the Enderley Community Centre, with all their Adobe CC products: when the funding ran out, the software stopped being usable.

1 0

Hardcoded Password Found in Cisco Software
by Peter Reutemann 08 Mar '18

08 Mar '18

'Cisco released 22 security advisories yesterday, including two alerts for critical fixes, one of them for a hardcoded password that can give attackers full control over a vulnerable system. From a report: The hardcoded password issue affects Cisco's Prime Collaboration Provisioning (PCP), a software application that can be used for the remote installation and maintenance of other Cisco voice and video products. Cisco PCP is often installed on Linux servers. Cisco says that an attacker could exploit this vulnerability (CVE-2018-0141) by connecting to the affected system via Secure Shell (SSH) using the hardcoded password. The flaw can be exploited only by local attackers, and it also grants access to a low-privileged user account. In spite of this, Cisco has classified the issue as "critical." Although this vulnerability has a Common Vulnerability Scoring System (CVSS) Base score of 5.9, which is normally assigned a Security Impact Rating (SIR) of Medium, there are extenuating circumstances that allow an attacker to elevate privileges to root. For these reasons, the SIR has been set to Critical.' -- source: https://it.slashdot.org/story/18/03/08/145209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Disabling Super-Key App-Menu Shortcut In KDE
by Lawrence D'Oliveiro 07 Mar '18

07 Mar '18

Another new “feature” that KDE has acquired in the last few months is that you just have to press and release the Super (aka “Windows”†) modifier key, and the application menu will appear. This annoys me because I frequently lean on modifier keys while thinking about whether to use them, then release them when I change my mind. And then this damn menu pops up. As is usual with KDE, turning this off is pretty easy, but in this case it’s a little counterintuitive. If you right-click on the app-menu icon in the taskbar, you can choose the “Application Launcher Settings” item in the menu that appears (the name might vary a little bit depending on which particular app menu widget you have installed). In the settings dialog that comes up, you will see two panes to choose from, “Appearance” and “Keyboard shortcuts”. Naturally you go to “Keyboard shortcuts”, only to see an entry showing Alt-F1 as the trigger keystroke. So where do you control the use of the Super key? Never fear. Remove this Alt-F1 setting, and the special behaviour of the Super key disappears as well. †No, it doesn’t have a Windows logo on my Das Keyboard Pro 4. It’s imprinted with some kind of indescribable wing-like symbol.

1 0

Ask Slashdot: Should We Worry Microsoft Will 'Embrace, Extend, and Extinguish' Linux?
by Peter Reutemann 07 Mar '18

07 Mar '18

'While there is no proof that anything nefarious is afoot, it does feel like maybe the Windows-maker is hijacking the Linux movement a bit by serving distros in its store. I hope there is no "embrace, extend, and extinguish" shenanigans going on. Just yesterday, we reported that Kali Linux was in the Microsoft Store for Windows 10. That was big news, but it was not particularly significant in the grand scheme, as Kali is not very well known. Today, there is some undeniably huge news -- Debian is joining SUSE, Ubuntu, and Kali in the Microsoft Store. Should the Linux community be worried? My concern lately is that Microsoft could eventually try to make the concept of running a Linux distro natively a thing of the past. Whether or not that is the company's intention is unknown. The Windows maker gives no reason to suspect evil plans, other than past negative comments about Linux and open source. For instance, former Microsoft CEO Steve Ballmer once called Linux "cancer" -- seriously.' -- source: https://tech.slashdot.org/story/18/03/07/159249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

British Military Spends More On Computers Than Weapons And Ammo
by Lawrence D'Oliveiro 07 Mar '18

07 Mar '18

From <http://www.theregister.co.uk/2018/03/07/mod_spends_more_computers_than_weap…>: Spending on weapons and ammunition for the Armed Forces totalled £1.15bn in fiscal year 2016/17, whereas the MoD spent £1.45bn on computer services in the same period. For the four prior years, spending on computers consistently outpaced that for arms and ammo, with half a billion more being spent on computers than weapons in 2015/16. ... Only shipbuilding and repairing, aircraft and spacecraft, and "technical and financial services" spending outpaced the MoD's expenditure on computers. Even construction, at £1.20bn, lagged behind it.

1 0

Google Launches First Android P Developer Preview
by Peter Reutemann 07 Mar '18

07 Mar '18

'Google today launched the first Android P developer preview, available for download now at developer.android.com. From a report: The preview includes an updated SDK with system images for the Pixel, Pixel XL, Pixel 2, Pixel 2 XL, and the official Android Emulator. Unlike last year, there is no emulator for testing Android Wear on Android P. [...] Today's preview includes the following new APIs and features (but you can expect much more; this is just the first preview, after all): Display cutout support; HDR VP9 Video, HEIF image compression, and Media APIs; HEIF (heic) images encoding has been added to the platform; multi-camera API; ImageDecoder for bitmaps and drawables; Improved messaging notifications; Data cost sensitivity in JobScheduler; indoor positioning with Wi-Fi RTT: Platform support for the IEEE 802.11mc WiFi protocol -- also known as WiFi Round-Trip-Time (RTT) -- lets you take advantage of indoor positioning in your apps.' -- source: https://tech.slashdot.org/story/18/03/07/1811201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Turning Off Software Update Notifications In KDE
by Lawrence D'Oliveiro 06 Mar '18

06 Mar '18

Seems the latest version of KDE includes an automatic notifier when there are system updates available. This is great for, shall we say, “normal” users. But I run Debian Unstable. Which means I will be nagged for more updates within a matter of hours after doing a system upgrade, and things will rapidly go downhill from there. So naturally I would rather turn these off completely. The obvious place to find this setting would be in the “Notifications” panel in the System Settings. Unfortunately, the “Event source:” menu lists about three dozen different sources of notification events, and it isn’t obvious (at least, it wasn’t to me) which one handles software updates. The answer is, it’s the one called “Discover”. You will see only one event in its list: “Updates Are Available”. Simply uncheck all the forms of notification for this event. Hmm, I wonder if this panel couldn’t do with a search box...?

1 0

No Safe Haven For Victims Of Digital Abuse
by Lawrence D'Oliveiro 05 Mar '18

05 Mar '18

Blocking messages from online abusers -- and even changing your identity to get away from them -- may work fine against someone on the other side of the world. But what if the abuser is your close partner? <https://slate.com/technology/2018/03/apps-cant-stop-exes-who-use-technology…>: When you learn that your privacy has been compromised, the common advice is to prevent additional access—delete your insecure account, open a new one, change your password. But in abusive romantic relationships, disconnection can be extremely fraught. For one, it can put the victim at risk of physical harm: If abusers expect digital access and that access is suddenly closed off, it can lead them to become more violent or intrusive in other ways. It may seem cathartic to delete abusive material, like alarming text messages—but if you don’t preserve that kind of evidence, it can make prosecution more difficult. And closing some kinds of accounts, like social networks, to hide from a determined abuser can cut off social support that survivors desperately need. (Found from <https://www.schneier.com/blog/archives/2018/03/intimate_partne.html>)

1 0

Libre Content Creation: 2018 In Perspective
by Lawrence D'Oliveiro 05 Mar '18

05 Mar '18

Nice roundup <http://libregraphicsworld.org/blog/entry/2018-in-perspective> from Alexandre Prokoudine on where a bunch of Free graphics/audio/video projects have gone and where they are likely to go over the coming year. Gimp 2.10 continues to be delayed, but in return the list of goodies promised continues to lengthen: The team initially intended v2.10 to be more or less a GEGL-based upgrade of v2.8 plus high bit depth precision support. Needless to say, the plan hasn't exactly worked: there will be a lot more than that. In fact, even now, when only critical bugs are supposed to be worked on, the team cannot resist making improvements that aren't blocking the release. Another interesting one is an initiative in Germany to come up with a nonproprietary alternative to common colour specifications like Pantone: In December 2017, FreieFarbe e.V. announced that their initiative for „Open Colour Communication“ standard was supported by DIN and will become a DIN SPEC (which is the first step towards DIN Norm). It is claimed that DIN intends to turn this into an international standard via ISO later. The FreieFarbe / FreeColour initiative aims to provide an open alternative to Pantone, HKS, and other proprietary colour systems. They argue that unlike Pantone and some other proprietary manufacturers like RAL, FreiFarbe has an actual color system. On the music-production front, Zyn-Fusion seems to be developing as the successor to the venerable ZynAddSubFX, while VCV Rack is the candidate for the ultimate software modular synth, complete with rat’s nest of (virtual) connecting wires. (I’ve seen a demo or two on YouTube.)

1 0

Re: [wlug] FreeBSD's New Code of Conduct
by William Mckee 27 Feb '18

27 Feb '18

virtual contact! none of that. more sjw bs. cheers, william. On 21/02/2018 7:08 pm, "Lawrence D'Oliveiro" <ldo(a)geek-central.gen.nz> wrote: On Sun, 18 Feb 2018 11:25:31 +1300, Peter Reutemann quoted: > '> Physical contact and simulated physical contact (e.g., textual > descriptions like "hug" or "backrub") without consent or after a > request to stop.' From <http://www.theregister.co.uk/2018/02/21/freebsd_code_of_ conduct_controversy/>: OpenSUSE board member and YouTuber Bryan Lunduke has used his YouTube channel <https://www.youtube.com/watch?v=SxNdQJSlg54> to ask if FreeBSD also wants to regulate virtual high fives or fist bumps. Lunduke's video is a rather more polite expression of comments found in corners of the Internet where gender politics is derided and debate is sometimes infamously uncivil. _______________________________________________ wlug mailing list | wlug(a)list.waikato.ac.nz Unsubscribe: https://list.waikato.ac.nz/mailman/listinfo/wlug

2 1

Mozilla Removes Individual Cookie Management in Firefox 60
by Peter Reutemann 26 Feb '18

26 Feb '18

'The most recent version of Firefox Nightly, currently at version 60, comes with changes to Firefox's cookie management. Mozilla merged cookie settings with site data in the web browser which impacts how you configure and manage cookie options. If you run Firefox 59 or earlier, you can load about:preferences#privacy to manage privacy related settings in Firefox. If you set the history to "use custom settings for history" or "remember history", you get an option manage cookie settings and to remove individual cookies from Firefox. A click on the link or button opens a new browser window in which all set cookies are listed. You can use it to find set cookies, look up information, remove selected or all cookies. Mozilla engineers changed this in recent versions of Firefox 60 (currently on the Nightly channel).' -- source: https://news.slashdot.org/story/18/02/26/1853203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Firefox - turning off processes per tab
by Peter Reutemann 26 Feb '18

26 Feb '18

Hi everyone In case you don't like Firefox's new feature of separating tabs into separate processes (far more resource hungry), change the following setting in "about:config" to "false": browser.tabs.remote.auto Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

OpenBSD Releases Meltdown Patch
by Peter Reutemann 25 Feb '18

25 Feb '18

'OpenBSD's Meltdown patch has landed, in the form of a Version 11 code update that separates user memory pages from the kernel's -- pretty much the same approach as was taken in the Linux kernel. From a report: A few days after the Meltdown/Spectre bugs emerged in January, OpenBSD's Phillip Guenther responded to user concerns with a post saying the operating system's developers were working out what to do. Now he's revealed the approach used to fix the free OS: "When a syscall, trap, or interrupt takes a CPU from userspace to kernel the trampoline code switches page tables, switches stacks to the thread's real kernel stack, then copies over the necessary bits from the trampoline stack. On return to userspace the opposite occurs: recreate the iretq frame on the trampoline stack, switch stack, switch page tables, and return to userspace." That explanation is somewhat obscure to non-developers, but there's a more readable discussion of what the project's developers had in mind from January, here.' -- source: https://it.slashdot.org/story/18/02/23/1519245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Botched npm Update Crashes Linux Systems, Forces Users to Reinstall
by Peter Reutemann 22 Feb '18

22 Feb '18

'A bug in npm (Node Package Manager), the most widely used JavaScript package manager, will change ownership of crucial Linux system folders, such as /etc, /usr, /boot. Changing ownership of these files either crashes the system, various local apps, or prevents the system from booting, according to reports from users who installed npm v5.7.0. -- the buggy npm update. Users who installed this update -- mostly developers and software engineers -- will likely have to reinstall their system from scratch or restore from a previous system image.' -- source: https://it.slashdot.org/story/18/02/22/2034213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ricoh MP C3003 or similar wanted
by Gregory Machin 22 Feb '18

22 Feb '18

Hi, This is very off topic. I'm working on script (currently powershell, my port to python)to manage (backup and restore) the addess book on Ricoh printers. The idea is to be able to manage large number of printers address books. I'm looking for a printer I can use for my dev work. It I don't care if the printer or scanner are faulty just need to brains to be functional. If anyone has such I could have or loan for a couple of months, that would be great. If not all good. Many thanks G

1 0

Google To Cease “Offshoring” Local Revenue
by Lawrence D'Oliveiro 21 Feb '18

21 Feb '18

Wonder of wonders <http://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=11999548>: Government moves to crack down on tax avoidance by multinational firms are already bearing fruit, with Google telling Parliament it will no longer funnel New Zealand revenues via low-tax jurisdictions such as Singapore. ... The practice saw Google's New Zealand subsidiary provide only services as part of the sales process - paying just $356,000 in tax on only $12.2m in revenue. Estimates of Google's sales revenue from New Zealand range in the hundreds of millions of dollars annually.

1 0

uTorrent Client Affected by Some Pretty Severe Security Flaws
by Peter Reutemann 21 Feb '18

21 Feb '18

'A Google security researcher has found multiple security flaws affecting the uTorrent web and desktop client that allow an attacker to infect a victim with malware or collect data on the users' past downloads, reports BleepingComputer. From the report: The vulnerabilities have been discovered by Google Project Zero security researcher Tavis Ormandy, and they impact uTorrent Web, a new web-based version of the uTorrent BitTorrent client, and uTorrent Classic, the old uTorrent client that most people know. Ormandy says that both uTorrent clients are exposing an RPC server -- on port 10000 (uTorrent Classic) and 19575 (uTorrent Web). The expert says that attackers can hide commands inside web pages that interact with this open RPC server. The attacker only needs to trick a user with a vulnerable uTorrent client to access a malicious web page. Furthermore, the uTorrent clients are also vulnerable to DNS rebinding -- a vulnerability that allows the attacker to legitimize his requests to the RPC server.' -- source: https://it.slashdot.org/story/18/02/21/180206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel Has a New Spectre and Meltdown Firmware Patch For You To Try Out
by Peter Reutemann 21 Feb '18

21 Feb '18

'The Spectre/Meltdown debacle continues to rumble on, and now the chip manufacturer has announced the availability of a new 'microcode solution' to the vulnerability. The updated firmware applies to 6th, 7th and 8th Generation Intel Core devices, and the release sees the company crossing its fingers and hoping that everything works out this time. This is Intel's second attempt at patching the vulnerability, and this time around both the company and its customers will be praying that the fix for Skylake, Kaby Lake and Coffee Lake chips actually does the job.' -- source: https://it.slashdot.org/story/18/02/21/186257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FreeBSD's New Code of Conduct
by Peter Reutemann 21 Feb '18

21 Feb '18

'FreeBSD has a new code of conduct, which is making several people angry. From the blog post: This code of conduct applies to all spaces used by the FreeBSD Project, including our mailing lists, IRC channels, and social media, both online and off. Anyone who is found to violate this code of conduct may be sanctioned or expelled from FreeBSD Project controlled spaces at the discretion of the FreeBSD Code of Conduct Committee. Participants are responsible for knowing and abiding by these rules. Harassment includes but is not limited to: Comments that reinforce systemic oppression related to gender, gender identity and expression, sexual orientation, disability, mental illness, neurodiversity, physical appearance, body size, age, race, or religion. Unwelcome comments regarding a person's lifestyle choices and practices, including those related to food, health, parenting, drugs, and employment. Deliberate misgendering. Deliberate use of "dead" or rejected names. Gratuitous or off-topic sexual images or behaviour in spaces where they're not appropriate. Physical contact and simulated physical contact (e.g., textual descriptions like "hug" or "backrub") without consent or after a request to stop. Threats of violence. Incitement of violence towards any individual, including encouraging a person to commit suicide or to engage in self-harm. Deliberate intimidation. Stalking or following. Harassing photography or recording, including logging online activity for harassment purposes. Sustained disruption of discussion. Unwelcome sexual attention. Pattern of inappropriate social contact, such as requesting/assuming inappropriate levels of intimacy with others. Continued one-on-one communication after requests to cease. Deliberate "outing" of any private aspect of a person's identity without their consent except as necessary to protect vulnerable people from intentional abuse. Publication of non-harassing private communication without consent. Publication of non-harassing private communication with consent but in a way that intentionally misrepresents the communication (e.g., removes context that changes the meaning). Knowingly making harmful false claims about a person.' -- source: https://yro.slashdot.org/story/18/02/17/0826206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

How to Get Started Using WSL in Windows 10
by Peter Reutemann 20 Feb '18

20 Feb '18

'In this article, we will walk through the process of getting started with WSL on your Windows 10 machine. You must be running the latest version of Windows 10 with Fall Creator Update installed. Then, check which version of Windows 10 is installed on your system by searching on “About” in the search box of the Start menu. You should be running version 1709 or the latest to use WSL. If an older version is installed, you need to download and install the Windows 10 Fall Creator Update (FCU) from this page. Once FCU is installed, go to Update Settings (just search for “updates” in the search box of the Start menu) and install any available updates.' -- source: https://www.linux.com/blog/learn/2018/2/how-get-started-using-wsl-windows-10 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

meeting next Monday
by Peter Reutemann 20 Feb '18

20 Feb '18

Hi everyone Just to let you know that we have a meeting next Monday: 'Ian Young will be demoing Manjaro (https://manjaro.org/) a Linux distribution that has become very popular recently according to the Linux Journal's poll (https://linux.slashdot.org/story/18/02/14/1850259) General discussion on backup tools and strategies: What tool do you use? What approach is working for you? What should you stay away from at all costs?' Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/246736977/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

cron Is Becoming Obsolete
by Lawrence D'Oliveiro 20 Feb '18

20 Feb '18

I have to get out of the habit of (only) checking various /etc/cron* locations for periodic system tasks. Debian is making more and more use of systemd timer tasks. The nice thing is, you can see them all with a simple command: systemctl status \*.timer Got caught out with this on a client’s machine the other day: when you install the certbot package (for managing certificates issued by Let’s Encrypt) on Debian, it also automatically adds a systemd timer to run certificate renewals twice a day, you don’t need to set up your own cron task to manage this.

1 0

Chrome Extension Brings 'View Image' Button Back
by Peter Reutemann 19 Feb '18

19 Feb '18

'Google recently removed the convenient "view image" button from its search results as a result of a lawsuit with stock-photo agency Getty. Thankfully, one day later, a developer created an extension that brings it back. 9to5Google reports: It's unfortunate to see that button gone, but an easy to use Chrome extension brings it back. Simply install the extension from the Chrome Web Store, and then any time you view an image on Google Image Search, you'll be able to open that source image. You can see the functionality in action in the video below. The only difference we can see with this extension versus the original functionality is that instead of opening the image on the same page, it opens it in a new tab. The extension is free, and it will work with Chrome for Windows, Mac, Chrome OS, or anywhere else the full version of Chrome can be used. 9to5Google has a separate post with step-by-step instructions to get the Google Images "view image" button back.' -- source: https://tech.slashdot.org/story/18/02/19/0334208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Skype Can't Fix a Nasty Security Bug Without a Massive Code Rewrite
by Peter Reutemann 15 Feb '18

15 Feb '18

'ZDNet reports of a security flaw in Skype's updater process that "can allow an attacker to gain system-level privileges to a vulnerable computer." If the bug is exploited, it "can escalate a local unprivileged user to the full 'system' level rights -- granting them access to every corner of the operating system." What's worse is that Microsoft, which owns Skype, won't fix the flaw because it would require the updater to go through "a large code revision." Instead, Microsoft is putting all its resources on building an altogether new client. From the report: Security researcher Stefan Kanthak found that the Skype update installer could be exploited with a DLL hijacking technique, which allows an attacker to trick an application into drawing malicious code instead of the correct library. An attacker can download a malicious DLL into a user-accessible temporary folder and rename it to an existing DLL that can be modified by an unprivileged user, like UXTheme.dll. The bug works because the malicious DLL is found first when the app searches for the DLL it needs. Once installed, Skype uses its own built-in updater to keep the software up to date. When that updater runs, it uses another executable file to run the update, which is vulnerable to the hijacking. The attack reads on the clunky side, but Kanthak told ZDNet in an email that the attack could be easily weaponized. He explained, providing two command line examples, how a script or malware could remotely transfer a malicious DLL into that temporary folder. ' -- source: https://it.slashdot.org/story/18/02/12/2319257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Ubuntu Wants To Collect Data About Your System -- Starting With 18.04 LTS
by Peter Reutemann 15 Feb '18

15 Feb '18

' In an announcement on Ubuntu mailing list, Will Cooke, on behalf of the Ubuntu Desktop team, announced Canonical's plans to collect some data related to the users' system configuration and the packages installed on their machines. From a report: Before you read anything further, it's important to note that users will have the option to opt-out of this data collection. The company plans to add a checkbox to the installer, which would be checked by default. The option could be like: "Send diagnostics information to help improve Ubuntu." As per your convenience, you can opt-out during the installation. An option to do the same will also be made available in the Privacy panel of GNOME Settings. With this data collection, the team wishes to improve the daily experiences of the Ubuntu users. It's worth noting that the collected data will be sent over encrypted connections and no IP addresses will be tracked. To be precise, the collected data will include: flavour and version of Ubuntu, network connectivity or not, CPU family, RAM, disk(s) size, screen(s) resolution, GPU vendor and model, OEM manufacturer, location (based on the location selection made during install), no IP information, time taken for Installation, auto-login enabled or not, disk layout selected, third party software selected or not, download updates during install or not, livePatch enabled or not.' -- source: https://news.slashdot.org/story/18/02/15/1410203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DeepFakes Explained
by Lawrence D'Oliveiro 15 Feb '18

15 Feb '18

Heard about the latest hot new trend on the Internet? Slightly disturbing, even? It’s splicing someone’s face into a video in place of that of an entirely unrelated person, to make it look like they’re the one in the scene. Except that the result doesn’t look fake at all--you’d think it was real. Naturally, Rule 34 applies. But here <https://www.youtube.com/watch?v=7XchCsYtYMQ> is a watchable, and entirely SFW, overview of how it all works. Oh, and the software for doing this is all over GitHub.

2 2

Manjaro at meeting
by Ian Young 15 Feb '18

15 Feb '18

I have been using Manjaro of late so could try to summon up something to say ~ IanY

2 1

Critical Telegram flaw under attack disguised malware as benign images
by Peter Reutemann 14 Feb '18

14 Feb '18

'Makers of the Telegram instant messenger have fixed a critical vulnerability that hackers were actively exploiting to install malware on users' computers, researchers said Tuesday. The flaw, which resided in the Windows version of the messaging app, allowed attackers to disguise the names of attached files, researchers from security firm Kaspersky Lab said in a blog post. By using the text-formatting standard known as Unicode, attackers were able to cause characters in file names to appear from right to left, instead of the left-to-right order that's normal for most Western languages.' -- source: https://arstechnica.com/information-technology/2018/02/telegram-app-purged-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft’s compiler-level Spectre fix shows how hard this problem will be to solve
by Peter Reutemann 14 Feb '18

14 Feb '18

'The Meltdown and Spectre attacks that use processor speculative execution to leak sensitive information have resulted in a wide range of software changes to try to limit the scope for harm. Many of these are operating system-level fixes, some of which depend on processor microcode updates. But Spectre isn't a simple attack to solve; operating system changes help a great deal, but application-level changes are also needed. Apple has talked about some of the updates it has made to the WebKit rendering engine, used in its Safari browser, but this is only a single application. Microsoft is offering a compiler-level change for Spectre. The "Spectre" label actually covers two different attacks. The one that Microsoft's compiler is addressing, known as "variant 1," concerns checking the size of an array: before accessing the Nth element of an array, code should check that the array has at least N elements in it. Programmers using languages like C and C++ often have to write these checks explicitly. Other languages, like JavaScript and Java, perform them automatically. Either way, the test has to be done; attempts to access array members that don't exist are a whole class of bugs all on their own. [...] In fairness, Microsoft does warn that "there is no guarantee that all possible instances of variant 1 will be instrumented," but as Kocher's examination shows, it's not simply that some Spectre-vulnerable code will escape the compiler's fixes. Much—and perhaps even most—Spectre-vulnerable code will escape. And even if it were only a few instances, bad guys would be able to locate the unprotected routines and focus their attacks accordingly.' -- source: https://arstechnica.com/gadgets/2018/02/microsofts-compiler-level-spectre-f… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Would You Let A Site Mine Cryptocurrency In Return For Blocking Ads?
by Rowan Schischka 14 Feb '18

14 Feb '18

> What do you think: is it a fair trade? Not fair trade but fair game. The technology used is coinhive and anybody at any level of computer skill can block it. Firefox's noscript plugin and Pi-hole are both effective.

1 0

Linux Journal: Best Linux Distribution
by Peter Reutemann 14 Feb '18

14 Feb '18

'We started things off with Best Linux Distribution, and nearly 10,000 readers voted. The winner was Debian, with many commenting "As for servers, Debian is still the best" or similar. One to watch that is rising in the polls is Manjaro (7 percent), which is independently based on the Arch Linux. Manjaro is a favorite for Linux newcomers and is known for its user-friendliness and accessibility. And, now for the top three LJ winners: Debian (33 percent), openSUSE (12 percent), and Fedora (11 percent).' -- source: https://linux.slashdot.org/story/18/02/14/1850259 Does anyone want to give Manjaro a spin at the next meeting? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Would You Let A Site Mine Cryptocurrency In Return For Blocking Ads?
by Lawrence D'Oliveiro 14 Feb '18

14 Feb '18

This was inevitable, really. Salon.com <https://arstechnica.com/information-technology/2018/02/salon-to-ad-blockers…> now asks you, when it notices you are running an ad-blocker, if you would like to contribute some CPU to running a cryptocurrency miner for them instead. What do you think: is it a fair trade? Is it a sustainable revenue model, at least better than doing the mining without asking your permission?

2 1

The Most Popular Linux Desktop Programs
by Peter Reutemann 14 Feb '18

14 Feb '18

'The most recent Linux Questions poll results are in. Steven J. Vaughan-Nichols, writing for ZDNet: LinuxQuestions, one of the largest internet Linux groups with 550,000 members, has just posted the results from its latest survey of desktop Linux users. In the always hotly-contested Linux desktop environment survey, the winner was the KDE Plasma Desktop. It was followed by the popular lightweight Xfce, Cinnamon, and GNOME. If you want to buy a computer with pre-installed Linux, the Linux Questions crew's favorite vendor by far was System76. Numerous other computer companies offer Linux on their PCs. These include both big names like Dell and dedicated small Linux shops such as ZaReason, Penguin Computing, and Emperor Linux. Many first choices weren't too surprising. For example, Linux users have long stayed loyal to the Firefox web browser, and they're still big fans. Firefox beat out Google Chrome by a five-to-one margin. And, as always, the VLC media player is far more popular than any other Linux media player. For email clients, Mozilla Thunderbird remains on top. That's a bit surprising given how Thunderbird's development has been stuck in neutral for some time now. When it comes to text editors, I was pleased to see vim -- my personal favorite -- win out over its perpetual rival, Emacs. In fact, nano and Kate both came ahead of Emacs.' -- source: https://linux.slashdot.org/story/18/02/13/1652238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Active Browser Tabs Vs Active Browser Windows
by Lawrence D'Oliveiro 14 Feb '18

14 Feb '18

I have noticed some interesting behaviour with video playback on various websites, at least with Firefox. Videos on the NZ Herald website, for example, don’t start playing until the tab becomes the active one in the window. Also on YouTube, sometimes after an ad, there is a display inviting you to take part in some kind of survey. This displays for a fixed amount of time, but that time only accumulates while the tab is active -- make it inactive, and the time counter stops until it becomes active again. *But* ... the active tab is still considered to be active even if the window is not the frontmost one. This means if you want to do something else while waiting for a YouTube ad to finish playing (with the sound off, of course) and the extra display to disappear, you just have to do it in an entirely separate window.

1 0

Facebook is Pushing Its Data-tracking Onavo VPN Within Its Main Mobile App
by Peter Reutemann 14 Feb '18

14 Feb '18

'Onavo Protect, the VPN client from the data-security app maker acquired by Facebook back in 2013, has now popped up in the Facebook app itself, under the banner "Protect" in the navigation menu. Clicking through on "Protect" will redirect Facebook users to the "Onavo Protect -- VPN Security" app's listing on the App Store. We're currently seeing this option on iOS only, which may indicate it's more of a test than a full rollout here in the U.S. Marketing Onavo within Facebook itself could lead to a boost in users for the VPN app, which promises to warn users of malicious websites and keep information secure as you browse. But Facebook didn't buy Onavo for its security protections. Instead, Onavo's VPN allow Facebook to monitor user activity across apps, giving Facebook a big advantage in terms of spotting new trends across the larger mobile ecosystem. For example, Facebook gets an early heads up about apps that are becoming breakout hits; it can tell which are seeing slowing user growth; it sees which apps' new features appear to be resonating with their users, and much more. Further reading: Do Not, I Repeat, Do Not Download Onavo, Facebook's Vampiric VPN Service (Gizmodo).' -- source: https://tech.slashdot.org/story/18/02/13/2026211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Camera Makers Still Showing Zero Interest In Protecting Users With Built-In Encryption
by Lawrence D'Oliveiro 13 Feb '18

13 Feb '18

From <https://www.techdirt.com/articles/20180204/07404639150/camera-makers-still-…>: The Freedom of the Press Foundation sent a letter to major camera manufacturers in December 2016, letting them know filmmakers and journalists would appreciate a little assistance keeping their data out of governments' hands. ... We've covered many cases where police officers have seized phones/cameras and deleted footage captured by bystanders. ... Unfortunately, it doesn't look like camera manufacturers are considering offering encryption. The issue still doesn't even appear to be on their radar, more than a year after the Freedom of the Press Foundation's letter -- signed by 150 photographers and filmmakers -- indicated plenty of customers wanted better protection for their cameras. ... If a government can search something, it will. Encryption may not thwart all searches, but it will at least impede the most questionable ones.

1 0

meeting next month
by Peter Reutemann 13 Feb '18

13 Feb '18

Hi everyone At the last meeting, Ian suggested to have cryptocurrencies (https://en.wikipedia.org/wiki/Cryptocurrency) as topic for our meeting next month. One aspect is the increasing amount of power that is consumed in order to mine "coins". The other interesting aspect introduced by, but not limit to, cryptocurrencies is the concept of the blockchain (https://en.wikipedia.org/wiki/Blockchain) an open, distributed ledger of transactions. Is there interest? Any volunteers to talk about something regarding this topic (history, current status, etc)? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

That mega-vulnerability Cisco dropped is now under exploit
by Peter Reutemann 12 Feb '18

12 Feb '18

'Hackers are actively trying to exploit a high-severity vulnerability in widely used Cisco networking software that can give complete control over protected networks and access to all traffic passing over them, the company has warned. When Cisco officials disclosed the bug last week in a range of Adaptive Security Appliance products, they said they had no evidence anyone was actively exploiting it. Earlier this week, the officials updated their advisory to indicate that was no longer the case.' -- source: https://arstechnica.com/information-technology/2018/02/that-mega-vulnerabil… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

VideoLAN VLC releases version 3.0 with HDR and 360-degree video
by Peter Reutemann 12 Feb '18

12 Feb '18

'The popular cross-platform, open-source video player VLC has received a significant update in 3.0, the first in what will be called the Vetinari branch. It adds support for HDR, including both 10-bit and 12-bit color and 360-degree video. This release version now also fully supports Chromecast streaming, a feature we first played with back in 2016. While VLC is open source, this part of it isn't; Tom's Hardware reports that VideoLAN explained it "used Google’s official closed-source SDK to build out the feature, which prevents it from releasing the source." [*] Other major added features include 3D audio support, audio passthrough for HD audio codecs, and support for browsing NAS drives. As always, a bunch of new codecs are supported too.' [*] 'Please note that Chromecast support in VLC 3.0 is fully open-source for all platforms! That’s the reason why it took us so long to ship as we completely reverse-engineered the entire thing. The closed-source component by Google can’t be used for legal reasons in VLC, isn’t compatible with Macs, Linux and Windows and supports a very limited set of codecs only. With our code, you can play basically anything VLC can decode on your Chromecast (as we transcode on-the-fly if needed).' -- source: https://arstechnica.com/gadgets/2018/02/videolan-vlc-releases-version-3-0-w… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Razer Doesn't Care About Linux'
by Peter Reutemann 12 Feb '18

12 Feb '18

'Razer is a vendor that makes high-end gaming hardware, including laptops, keyboards and mice. I opened a ticket with Razor a few days ago asking them if they wanted to support the LVFS project by uploading firmware and sharing the firmware update protocol used. I offered to upstream any example code they could share under a free license, or to write the code from scratch given enough specifications to do so. This is something I've done for other vendors, and doesn't take long as most vendor firmware updaters all do the same kind of thing; there are only so many ways to send a few kb of data to USB devices. The fwupd project provides high-level code for accessing USB devices, so yet-another-update-protocol is no big deal. I explained all about the LVFS, and the benefits it provided to a userbase that is normally happy to vote using their wallet to get hardware that's supported on the OS of their choice. I just received this note on the ticket, which was escalated appropriately: "I have discussed your offer with the dedicated team and we are thankful for your enthusiasm and for your good idea. I am afraid I have also to let you know that at this moment in time our support for software is only focused on Windows and Mac." The post, written by Richard -- who has long been a maintainer of GNOME Software, PackageKit, GNOME Packagekit, points out that Razer executive Min-Liang Tan last year invited Linux enthusiasts to suggest ideas to help the company make the best notebook that supports Linux.' -- source: https://linux.slashdot.org/story/18/02/12/0722235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How the First Open Source Software and Hardware Satellite UPSat Was Built
by Peter Reutemann 11 Feb '18

11 Feb '18

'UPSat is the first open source -- both hardware and software -- satellite to have ever been launched in orbit. Pierros Papadeas, the Director of Operations for Libre Space Foundation, which helped build the UPSat, talked about the project at FOSDEM, a non-commercial, volunteer-organized European event focused on free and open-source software development. You can watch the talk here; and read an interview of him with folks at FOSDEM ahead of the talk here. Two excerpts from the interview: Q: What challenges did you encounter while designing, building, testing and eventually launching UPSat in orbit? PP: The challenges where numerous, starting with the financial ones. Lack of appropriate funding led us to invest heavily in the project (through Libre Space Foundation funds) to ensure its successful completion. Countless volunteer participation was also key to the success. On the technical side, with minimal documentation and knowledge sharing around space projects we had to re-invent the wheel and discover many procedures and practices in a really short time-frame (6 months - unheard for a space mission). Lack of tools and equipment made our building process a creative exploration as we had to figure out ways to achieve specific tasks resorting to purpose-built projects in our local lab (hackerspace.gr). Testing and verification facilities where also a challenge mainly as we had to undergo much more extensive tests than other missions, having none of our components already "flight proven". Again creativity and countless hours of negotiations and documentation got us to the final delivery point. Launching UPSat in orbit was secured once the delivery happened, but as any typical space mission it came with long delays and timeline push-backs. Q: What do you hope to accomplish by giving this talk? What do you expect? Through this talk we would like to raise awareness for open source initiatives in space, and inspire open source technologists (engineers, programmers, analysts, makers) to engage in an open source project. We would also love to gather feedback and ideas on next steps and provide contribution opportunities for interested parties.' -- source: https://news.slashdot.org/story/18/02/11/2139203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

EFF Founder John Perry Barlow Has Died At Age 70
by Peter Reutemann 08 Feb '18

08 Feb '18

'The Electronic Frontier Foundation reports that its founder, John Perry Barlow, has passed away quietly in his sleep this morning. He was 70 years old. From the report: It is no exaggeration to say that major parts of the Internet we all know and love today exist and thrive because of Barlow's vision and leadership. He always saw the Internet as a fundamental place of freedom, where voices long silenced can find an audience and people can connect with others regardless of physical distance. Barlow was sometimes held up as a straw man for a kind of naive techno-utopianism that believed that the Internet could solve all of humanity's problems without causing any more. As someone who spent the past 27 years working with him at EFF, I can say that nothing could be further from the truth. Barlow knew that new technology could create and empower evil as much as it could create and empower good. He made a conscious decision to focus on the latter: "I knew it's also true that a good way to invent the future is to predict it. So I predicted Utopia, hoping to give Liberty a running start before the laws of Moore and Metcalfe delivered up what Ed Snowden now correctly calls 'turn-key totalitarianism.'" Barlow's lasting legacy is that he devoted his life to making the Internet into "a world that all may enter without privilege or prejudice accorded by race, economic power, military force, or station of birth... a world where anyone, anywhere may express his or her beliefs, no matter how singular, without fear of being coerced into silence or conformity."' -- source: https://politics.slashdot.org/story/18/02/07/234213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Insurance Companies Recommending Computer Gear?
by Lawrence D'Oliveiro 07 Feb '18

07 Feb '18

A couple of big insurance outfits have made deals with Apple and Cisco to charge lower cybersecurity premiums to customers buying their gear <http://www.theregister.co.uk/2018/02/06/cisco_apple_allianz_aon_cyber_insur…>. I’m in favour (up to a point) of charging according to assessed risk, but basing it on specific brand names leaves them open to accusations of conflict of interest. Better it be done according to adherence to published nonproprietary standards, such as PCI-DSS, for example.

1 0

New IoT botnet offers DDoSes of once-unimaginable sizes for $20
by Peter Reutemann 02 Feb '18

02 Feb '18

'Organizers of a new botnet made up of infected home and small office routers are brazenly selling denial-of-service attacks of once unimaginable volumes for just $20 per target. Calling itself Los Calvos de San Calvicie, the group is advertising several services on this site. Among the services are distributed denial-of-service attacks of 290 to 300 gigabits per second for $20 each. While a third the size of some of the biggest recorded attacks, 290Gbps is still enough to bring most sites down unless they seek DDoS mitigation services, which in many cases cost considerable amounts of money. Just five years ago, 300Gbps was considered enough volume to shut down the Internet's core infrastructure. Los Calvos de San Calvicie members have been spotted assembling a botnet in recent days that very possibly has the firepower required to deliver the potent attacks promised. According to Pascal Geenens, a researcher at security firm Radware, the group is building the botnet by exploiting two vulnerabilities: one in RealTek routers running out-of-date firmware and the other in the Huawei HG532 router, where a patch released in December has yet to be installed by many users. Both vulnerabilities are also exploited by a different Internet-of-things botnet known as Satori.' -- source: https://arstechnica.com/information-technology/2018/02/for-sale-ddoses-guar… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Releases Skype As a Snap For Linux
by Peter Reutemann 01 Feb '18

01 Feb '18

'While Microsoft has long been viewed as an enemy of the Linux community -- and it still is by some -- the company has actually transformed into an open source champion. One of Microsoft's biggest Linux contributions, however, is Skype -- the wildly popular communication software. By offering that program to desktop Linux users, Microsoft enables them to easily communicate with friends and family that aren't on Linux, thanks to its cross-platform support. Today, Microsoft further embraces Linux by releasing Skype as a Snap. This comes after two other very popular apps became available in Snap form -- Spotify and Slack. "Skype is used by millions of users globally to make free video and voice calls, send files, video and instant messages and to share both special occasions and everyday moments with the people who matter most. Skype has turned to snaps to ensure its users on Linux, are automatically delivered to its latest versionupon release. And with snaps' roll-back feature, whereby applications can revert back to the previous working version in the event of a bug, Skype's developers can ensure a seamless user experience," says Canonical.' -- source: https://linux.slashdot.org/story/18/02/01/1644250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

LibreOffice 6.0 Released: Features Superior Microsoft Office Interoperability, OpenPGP Support
by Peter Reutemann 31 Jan '18

31 Jan '18

'LibreOffice 6.0 comes two and a half years after the LibreOffice 5.x series, and it's the biggest release of the open-source and cross-platform office suite so far. It introduces a revamped design with new table styles, improved Notebookbars, new gradients, new Elementary icons, menu and toolbar improvements, and updated motif/splash screen. LibreOffice 6.0 offers superior interoperability with Microsoft Office documents and compatibility with the EPUB3 format by allowing users to export ODT files to EPUB3. It also lets you import your AbiWord, Microsoft Publisher, PageMaker, and QuarkXPress documents and templates thanks to the implementation of a set of new open-source libraries contributed by the Document Liberation project. Many great improvements were made to the OOXML and ODF filters, as well as in the EMF+, Adobe Freehand, Microsoft Visio, Adobe Pagemaker, FictionBook, Apple Keynote, Pages, and Numbers, as well as Quattro Pro import functionality, and to the XHTML export. LibreOffice Online received numerous improvements as well in this major release of LibreOffice.' -- source: https://news.slashdot.org/story/18/01/31/1422245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Samsung Surpasses Intel To Become the World's Largest Chipmaker
by Peter Reutemann 31 Jan '18

31 Jan '18

'Samsung Electronics just knocked Intel off its perch as the world's biggest chipmaker by revenue, a spot the U.S. company has held since 1992. From a report: On Tuesday, Samsung reported 2017 chip sales of $69 billion, blowing past Intel's $63 billion from last year. The switch underlines how Samsung has transformed itself from a maker of cheap televisions into a pervasive supplier of key components in smartphones and other modern computing devices. It's also a testament to the growth of memory chips, Samsung's main market. Intel, whose processors are the heart of about 90 percent of the world's computers, didn't have a bad year. Sales grew 6 percent. Success in computers is no longer enough, though. Memory chips, a market Intel only recently got back into, are now crucial parts of smartphones, which easily outsell PCs these days. Memory chips are also finding their way into a range of new devices such as cars. One of the ironies of Samsungâ(TM)s success in memory is that itâ(TM)s a business Intel created in the 1960s.' -- source: https://slashdot.org/story/18/01/31/1516212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Chrome To Feature Built-In Image Lazy Loading
by Peter Reutemann 31 Jan '18

31 Jan '18

'Future versions of Google Chrome will feature built-in support for lazy loading, a mechanism to defer the loading of images and iframes if they are not visible on the user's screen at load time. This system will first ship with Chrome for Android and Google doesn't rule out adding it to desktop versions if tests go as planned. The feature is called Blink LazyLoad, and as the name hints, it will implement the principle of "lazy loading" inside Chrome itself. Google engineers reported page load speed improvements varying from 18% to 35%, depending on the underlying network. Other browser makers have been notified of the Chrome team's plan, but none have provided input if they plan to implement a similar feature. Compared to most JS-based lazy loading scripts that only target images, Google implementation will also target iframes.' -- source: https://tech.slashdot.org/story/18/01/31/180234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

MPEG Founder Says the MPEG Business Model Is Broken
by Peter Reutemann 30 Jan '18

30 Jan '18

'Leonardo Chiariglione, the founder and chairman of MPEG, argues on his blog that the current MPEG business model is broken. He writes, "Thanks to [MPEG's] 'business model' that can be simply described as: produce standards having the best performance as a goal, irrespective of the IPR involved. Because MPEG standards are the best in the market and have an international standard status, manufacturers/service providers get a global market of digital media products, services and applications, and end users can seamless communicate with billions of people and access millions of services. Patent holders who allow use of their patents get hefty royalties with which they can develop new technologies for the next generation of MPEG standards. A virtuous cycle everybody benefits from." But, he argues, the MPEG model is now in crisis because the forthcoming AV1 video format from the Alliance for Open Media means that "everybody realizes that the old MPEG business model is broke, all the investments (collectively hundreds of millions USD) made by the industry for the new video codec [HEVC] will go up in smoke and AOM's royalty free model will spread to other business segments as well." Chiariglione goes on to explain what can be done: "The first action is to introduce what I call 'fractional options.' ISO envisages two forms of licensing: Option 1, i.e. royalty free and Option 2, i.e. FRAND, which is taken to mean 'with undetermined license.' We could introduce fractional options in the sense that a proposer could indicate that the technology be assigned to a specifically identified profile with an 'industry license' (defined outside MPEG) that does not contain monetary values. For instance, one such license could be 'no charge' (i.e. Option 1), another could be targeted to the OTT market etc." "The second action, not meant to be alternative to the first, is to streamline the MPEG standard development process. Within this a first goal is to develop coding tools with 'clear ownership,' unlike today's tools which are often the result of contributions with possibly very different weights. A second goal is not to define profiles in MPEG. A third goal could be to embed in the standard the capability to switch coding tools on and off."' -- source: https://news.slashdot.org/story/18/01/30/0419222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Is This The Hawaii Civil Defence Missile Alert UI?
by Lawrence D'Oliveiro 30 Jan '18

30 Jan '18

Remember the alert about the incoming missile in Hawaii that turned out to be nonsense? This <https://arstechnica.com/information-technology/2018/01/the-interface-to-sen…> is apparently what the user interface looks like for the system that sends out both test and genuine alerts. It looks like a web page with a random assortment of links. Just off the top of my head, not claiming to be a UI expert here, but I would have a big title across the top of the screen saying either “TEST MODE” or “LIVE MODE” (the latter red, and blinking). Then have a single set of options below, appropriate to the active mode. Even go one better, and do what Japanese railway locomotive drivers do as they see signs at the side of the track: say out loud what the signs mean, before taking appropriate action.

2 1

The SCO Vs IBM Zombie Shambles On
by Peter Reutemann 29 Jan '18

29 Jan '18

'At the end of last October, the 10th Circuit issued an opinion overturning the lower court's summary judgement in favor of IBM on one of SCO's claims, sending it back to the lower court for trial. Shortly thereafter, IBM filed for a re-hearing en banc. On January 2nd, the 10th circuit essentially denied IBM's request, issuing a slightly revised opinion with the same conclusions and result. The charge being reheard accuses IBM of "stealing and improperly using [SCO's] source code to strengthen its own operating system, thereby committing the tort of unfair competition by means of misappropriation" -- though that charged is based on an implied duty that SCO says IBM incurred by entering into a development relationship with SCO. "SCO believes that IBM merely pretended to go along with the arrangement in order to gain access to Santa Cruz's coveted source code." The court's 46-page document adds that "We are now almost fifteen years into this litigation."' -- source: https://yro.slashdot.org/story/18/01/29/0213203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Intel Told Chinese Firms of Meltdown Flaws Before the US Government
by Peter Reutemann 29 Jan '18

29 Jan '18

'According to The Wall Street Journal, Intel initially told a handful of customers about the Meltdown and Spectre vulnerabilities, including Chinese tech companies like Alibaba and Lenovo, before the U.S. government. As a result, the Chinese government could have theoretically exploited the holes to intercept data before patches were available. Engadget reports: An Intel spokesman wouldn't detail who the company had informed, but said that the company couldn't notify everyone (including U.S. officials) in time because Meltdown and Spectre had been revealed early. Lenovo said the information was protected by a non-disclosure agreement. Alibaba has suggested that any accusations of sharing info with the Chinese government was "speculative and baseless," but this doesn't rule out officials intercepting details without Alibaba's knowledge. There's no immediate evidence to suggest that China has taken advantage of the flaws, but that's not the point -- it's that the U.S. government could have helped coordinate disclosures to ensure that enough companies had fixes in place. ' -- source: https://it.slashdot.org/story/18/01/29/0520222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Are the BSDs Dying? Some Security Researchers Think So
by Peter Reutemann 26 Jan '18

26 Jan '18

'The BSDs have lost the battle for mindshare to Linux, and that may well bode ill for the future sustainability of the BSDs as viable, secure operating systems, writes CSO's JM Porup. The reason why is a familiar refrain: more eyeballs mean more secure code. Porup cites the work of Ilja von Sprundel, director of penetration testing at IOActive, who, noting the "small number of reported BSD kernel vulnerabilities compared to Linux," dug into BSD source code. His search 'easily' turned up about 115 kernel bugs. Porup looks at the relative security of OpenBSD, FreeBSD and NetBSD, the effect on Mac OS, and why, despite FreeBSD's relative popularity, OpenBSD may be the most likely to survive.' -- source: https://bsd.slashdot.org/story/18/01/26/1636229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Ubuntu 18.04 LTS Will Default To The X.Org Stack, Not Wayland
by Peter Reutemann 26 Jan '18

26 Jan '18

'Five years after their original goal to ship Ubuntu with Wayland, Ubuntu 17.10 transitioned to using the Wayland display system by default as part of their transition to GNOME Shell as the default desktop. But with the upcoming Ubuntu 18.04 LTS release, Canonical has decided to transition back to the X.Org Server. Their reasoning for moving to an X.Org Server by default is better support for screen sharing, remote desktop, and better recovery from crashes. But for those interested the Wayland session will still be available as a log-in option.' -- source: https://news.slashdot.org/story/18/01/26/1437212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Burger King Explains Net Neutrality
by Lawrence D'Oliveiro 26 Jan '18

26 Jan '18

Burger King uses “Whopper Neutrality” to illustrate why service providers shouldn’t play favourites <https://www.theregister.co.uk/2018/01/24/burger_king_net_neutrality/>.

1 0

Senator Asks FBI Director To Justify His 'Ill-Informed' Policy Proposal For Encryption
by Peter Reutemann 26 Jan '18

26 Jan '18

'In a speech earlier this month, FBI Director Christopher Wray said the inability of law enforcement authorities to access data from electronic devices due to powerful encryption is an "urgent public safety issue." He proposed that Silicon Valley companies should add a backdoor to their encryption so that they could both "provide data security and permit lawful access with a court order." One person is not amused by Wray's proposal. Senator Ron Wyden criticized Wray on Thursday for not consulting him before going public with the proposal for encryption. Wyden said today, via Gizmodo: Your stated position parrots the same debunked arguments espoused by your predecessors, all of whom ignored the widespread and vocal consensus of cryptographers. For years, these experts have repeatedly stated that what you are asking for is not, in fact, possible. Building secure software is extremely difficult, and vulnerabilities are often introduced inadvertently in the design process. Eliminating these vulnerabilities is a mammoth task, and experts are unified in their opinion that introducing deliberate vulnerabilities would likely create catastrophic unintended consequences that could debilitate software functionality and security entirely. [...] I would like to learn more about how you arrived at and justify this ill-informed policy proposal. Please provide me with a list of the cryptographers with whom you've personally discussed this topic since our July 2017 meeting and specifically identify those experts who advised you that companies can feasibly design government access features into their products without weakening cybersecurity. Please provide this information by February 23, 2018.' -- source: https://yro.slashdot.org/story/18/01/25/161245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

New Unit Of Time: The “Flick”
by Lawrence D'Oliveiro 26 Jan '18

26 Jan '18

Oculus is proposing a new unit for measuring time for audio/video/VR purposes: it is 1/705,600,000 of a second. This denominator was chosen to have sufficient integer factors to allow it to exactly represent various common frame/sample rates as whole numbers of flicks (which cannot be done with the usual SI divisions). And also, from the looks of it, possible future higher multiples of those rates. <https://arstechnica.com/gaming/2018/01/oculus-creates-a-new-open-source-uni…>

1 0

Chrome 64 Released With Stronger Popup Blocker, Spectre Mitigations
by Peter Reutemann 25 Jan '18

25 Jan '18

'Google on Thursday pushed an update to its marquee Web browser Chrome, now at v64, which offers a handful of new features including an improved ad blocker. From a report: Most of the new features included with Chrome 64 are meant to improve the browser's support for the ever-changing web standards that drive the modern Internet. For example, Chrome 64 is choke full of support for new browser APIs, new CSS properties, new JavaScript (ECMAScript) features, and changes to Chrome's V8 JavaScript engine. [...] Other big changes that shipped with Chrome 64 are on the browser's security side. For starters, Chrome 64 includes mitigations against the web-exploitable Spectre flaw. Further, Chrome 64 also comes with a bolstered popup blocker that can now block tab-under behavior, being much more efficient at blocking malvertising redirects.' -- source: https://tech.slashdot.org/story/18/01/25/1717226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Dell and HP Advise All Their Customers To Not Install Spectre BIOS Updates
by Peter Reutemann 25 Jan '18

25 Jan '18

'The Spectre and Meltdown mess continues with Dell now recommending their customers to not install the BIOS updates that are supposed to resolve the Spectre (Variant 2) vulnerabilities. These updates have been causing numerous problems for users including performance issues, boot issues, reboot issues, and general system stability. Due to this, Dell EMC has updated its knowledgebase article with a statement advising customers to not install the BIOS update and to potentially rollback to the previous BIOS if their computers are exhibiting "unpredictable system behavior". ZDNet reports that HP too has issued a similar advisory. The computer manufacturer pulled its softpaqs BIOS updates with Intel's patches from its website, and said it would be releasing a BIOS update with a previous version of Intel's microcode on Thursday.' -- source: https://tech.slashdot.org/story/18/01/24/1312241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

The Death Of Moore’s Law
by Lawrence D'Oliveiro 24 Jan '18

24 Jan '18

From <http://www.theregister.co.uk/2018/01/24/death_notice_for_moores_law/>: The computer science behind microprocessor design has therefore found itself making a rapid U-turn as it learns that its optimisation techniques can be weaponised. ... Hammered by the finance of physics and the weaponisation of optimisation, Moore’s Law has hit the wall, bounced off - and reversed direction. We’re driving backwards now: all things IT will become slower, harder and more expensive. Actually economics probably had more to do with it than physics, as PC sales have been slowing over the past decade.

2 2

City of Barcelona Dumps Windows For Linux and Open Source Software
by Peter Reutemann 24 Jan '18

24 Jan '18

'The City of Barcelona is migrating its computer systems away from the Windows platform, reports the Spanish newspaper El País. The City's strategy is first to replace all user applications with open-source alternatives, until the underlying Windows operating system is the only proprietary software remaining. In a final step, the operating system will be replaced with Linux... According to Francesca Bria, the Commissioner of Technology and Digital Innovation at the City Council, the transition will be completed before the current administration's mandate ends in spring 2019. For starters, the Outlook mail client and Exchange Server will be replaced with Open-Xchange. In a similar fashion, Internet Explorer and Office will be replaced with Firefox and LibreOffice, respectively. The Linux distribution eventually used will probably be Ubuntu, since the City of Barcelona is already running 1,000 Ubuntu-based desktops as part of a pilot... Barcelona is the first municipality to have joined the European campaign 'Public Money, Public Code'. This campaign is an initiative of the Free Software Foundation Europe (FSFE) and revolves around an open letter advocating that publicly funded software should be free. Currently, this call to public agencies is supported by more than 100 organisations and almost 15,000 individuals. With the new open-source strategy, Barcelona's City Council aims to avoid spending large amounts of money on licence-based software and to reduce its dependence on proprietary suppliers through contracts that in some cases have been closed for decades.' -- source: https://linux.slashdot.org/story/18/01/15/0415219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Firefox 58 Gets Graphics Speed Boost, Web App Abilities
by Peter Reutemann 23 Jan '18

23 Jan '18

'Mozilla released on Tuesday a new version of its Firefox Quantum browser, boosting its graphics speed and improving a couple of new technologies designed to make the web more powerful. From a report: The browser, version 58, is the first major update since Mozilla's recovery plan hit full stride in November with the debut of Firefox Quantum. Speed is of the essence in Mozilla's recovery plan, and Firefox 58 does better than its predecessor in some graphics tasks by splitting work better across the multiple processor cores that computer chips have these days. The result should be scrolling that's smooth, uninterrupted by the stuttering that in computing circles goes by the disparaging term "jank." [...] Firefox 58 helps with two new web technologies. One, called WebAssembly, provides for dramatically faster web apps. Firefox 58 can get WebAssembly software running faster so you don't have to twiddle your thumbs waiting as long after clicking a link. Another is progressive web apps (PWAs), an initiative that came out of Google to help make the web a better match for the apps we all drop on our phones.' -- source: https://tech.slashdot.org/story/18/01/23/150206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Malware Hijacks Cryptocurrency Mining
by Lawrence D'Oliveiro 23 Jan '18

23 Jan '18

One parasite feeding off another, or “Human Technology Recapitulates Biology, Volume 323”. <https://www.schneier.com/blog/archives/2018/01/new_malware_hij.html>

1 0

Fake Ads Redirecting To Malicious Software Installers
by Lawrence D'Oliveiro 23 Jan '18

23 Jan '18

Seems a consortium of fake ad companies has been built up, cultivating relationships with legitimate ad platforms, and then carefully inserting forced redirects in a proportion of the ads they serve, to trick unwitting viewers into installing malware on their machines. Various checks are first applied, to try to ensure that the machines being redirected don’t happen to be run by security researchers, for example. Each member of the consortium is activated for serving this malware in turn; then when it is exposed, it is abandoned and the operators move on to the next one. <https://arstechnica.com/information-technology/2018/01/malvertising-factory…>

1 0

Linux 4.15 Becomes Slowest Release Since 2011
by Peter Reutemann 23 Jan '18

23 Jan '18

'Linus Torvalds has decided that Linux 4.15 needs a ninth release candidate, making it the first kernel release to need that much work since 2011. Torvalds flagged up the possibility of an extra release candidate last week, with the caveat that "it obviously requires this upcoming week to not come with any huge surprises" after "all the Meltdown and Spectre hoopla" made his job rather more complicated in recent weeks. Fast-forward another week and Torvalds has announced "I really really wanted to just release 4.15 today, but things haven't calmed down enough for me to feel comfy about it."' -- source: https://tech.slashdot.org/story/18/01/22/2035228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ex-NSA Hacker Runs Christmas Lights With Raspberry πs And Dodgy NZ-Made Radio Kit
by Lawrence D'Oliveiro 22 Jan '18

22 Jan '18

<http://www.theregister.co.uk/2018/01/22/rob_joyce_hacking/>: Joyce uses a couple of Raspberry Pis to control the light show and a slightly dodgy FM transmitter to broadcast the soundtrack to visiting folks. The transmitter, bought as a kit from New Zealand, has the capability to broadcast illegally on FM frequencies, so is sold without the power supply attached to get around regulations, but Joyce said he keeps it low power and within FCC regulations because "I'm very legal."

1 0

Has the Decades-Old Floating Point Error Problem Been Solved?
by Peter Reutemann 22 Jan '18

22 Jan '18

'Wednesday a company called Bounded Floating Point announced a "breakthrough patent in processor design, which allows representation of real numbers accurate to the last digit for the first time in computer history. This bounded floating point system is a game changer for the computing industry, particularly for computationally intensive functions such as weather prediction, GPS, and autonomous vehicles," said the inventor, Alan Jorgensen, PhD. "By using this system, it is possible to guarantee that the display of floating point values is accurate to plus or minus one in the last digit..." The innovative bounded floating point system computes two limits (or bounds) that contain the represented real number. These bounds are carried through successive calculations. When the calculated result is no longer sufficiently accurate the result is so marked, as are all further calculations made using that value. It is fail-safe and performs in real time. Jorgensen is described as a cyber bounty hunter and part time instructor at the University of Nevada, Las Vegas teaching computer science to non-computer science students. In November he received US Patent number 9,817,662 -- "Apparatus for calculating and retaining a bound on error during floating point operations and methods thereof." But in a followup, HPCwire reports: After this article was published, a number of readers raised concerns about the originality of Jorgensen's techniques, noting the existence of prior art going back years. Specifically, there is precedent in John Gustafson's work on unums and interval arithmetic both at Sun and in his 2015 book, The End of Error, which was published 19 months before Jorgensen's patent application was filed. We regret the omission of this information from the original article.' -- source: https://science.slashdot.org/story/18/01/21/0157230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Google’s Fuchsia OS on the Pixelbook: It works! It actually works!
by Peter Reutemann 21 Jan '18

21 Jan '18

'Google currently has two OSes on the market: Android and Chrome OS. The company is never one to leave a successful product alone in the marketplace, though, so it's also developing a third operating system called "Fuchsia." When we last checked in on the experimental OS in May 2017, calling it an "OS" was a bit of a stretch. We only got the system UI up and running on top of Android, where it then functioned like an app. The UI offered a neat multi-window system, but mostly it was just a bunch of placeholder graphics. Nothing worked. It has been hard to check in on Fuchsia since. The Fuchsia system UI, which was written with a cross-platform SDK called "Flutter," quickly shut down the Android (and iOS) compatible builds. Fuchsia has a Vulkan-based graphics stack, and no emulator supports the new-ish graphics API. The only way to get Fuchsia up and running again was with actual hardware, and the only supported devices were Intel NUC PCs from 2015 and the Acer Switch Alpha 12 laptop. So after the recent news that the Fuchsia team picked the Chrome OS-powered Google Pixelbook as a supported device, we jumped at the chance to get it up and running. And after a little elbow grease, it actually booted. Now, we're not just running the system UI on top of Android like last time, we're running Fuchsia directly on a piece of hardware! This means it's finally time for a deep dive on what Fuchsia looks like in early 2018. Our usual in-development OS testing caveats apply: Fuchsia only started development in 2016 and probably has several years of development time ahead of it. Everything can—and probably will—change between now and release (if a release ever even happens). Google won't even officially acknowledge the OS exists—Fuchsia is a bunch of code sitting on fuchsia.googlesource.com.' -- source: https://arstechnica.com/gadgets/2018/01/googles-fuchsia-os-on-the-pixelbook… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

“Kernel Memory Leaking” Intel Processor Design Flaw Forces Linux, Windows Redesign
by Lawrence D'Oliveiro 20 Jan '18

20 Jan '18

A pretty serious-sounding security hole has been found in recent Intel CPUs, which will require performance-sapping workarounds in both Linux and Windows to fix <http://www.theregister.co.uk/2018/01/02/intel_cpu_design_flaw/>. The details are not public yet, but AMD, in its announcement that its products are not affected, would seem to have divulged some important clues.

4 13

Trying To Fix Windows Security Problems Breaks Security Software
by Lawrence D'Oliveiro 20 Jan '18

20 Jan '18

Microsoft is having a tough time coming out with good patches for the Spectre and Meltdown vulnerabilities. The main trouble is, these patches cause third-party anti-malware software to malfunction, and so the vendors of those products have to rush out their own patches to work with the fixes <http://www.theregister.co.uk/2018/01/08/meltdown_fix_security_problems/>.

2 3

Introducing The Cryptocurrency-Mining Operating System
by Lawrence D'Oliveiro 19 Jan '18

19 Jan '18

Mentioned in passing in this article <https://arstechnica.com/tech-policy/2018/01/cryptocurrency-boom-creates-ins…> explaining why high-end graphics cards are currently in short supply (they’re being snapped up by cryptocurrency miners) is the existence of a “mining-centric operating system called PIMP OS”. Presumably they’re Linux-based, I thought. And checking the T&Cs <https://getpimp.org/terms/> reveals yes, it’s built on Debian, with a bunch of other pieces, some closed-source, some open.

1 0

Wine 3.0 Released
by Peter Reutemann 18 Jan '18

18 Jan '18

'The Wine (Wine Is Not an Emulator) project has been updated today to version 3.0, a major release that ends 2017 in style for the open-source compatibility layer capable of running Windows apps and games on Linux-based and UNIX-like operating systems. Almost a year in the works, Wine 3.0 comes with amazing new features like an Android driver that lets users run Windows apps and games on Android-powered machines, Direct3D 11 support enabled by default for AMD Radeon and Intel GPUs, AES encryption support on macOS, Progman DDE support, and a task scheduler. In addition, Wine 3.0 introduces the ability to export registry entries with the reg.exe tool, adds various enhancements to the relay debugging and OLE data cache, as well as an extra layer of event support in MSHTML, Microsoft's proprietary HTML layout engine for the Windows version of the Internet Explorer web browser. You can read the full list of features and download Wine 3.0 from WineHQ's website.' -- source: https://tech.slashdot.org/story/18/01/18/2054205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

NHoS/NHSBuntu Gives Up After NHS Trademark Bullying
by Lawrence D'Oliveiro 18 Jan '18

18 Jan '18

The small team of volunteers behind the NHoS project (formerly NHSBuntu) are giving up. They wanted to offer an alternative to the current NHS smartcard implementation system, currently running on Windows, using open-source software. First they rebranded from “NHSBuntu” to “NHoS” (along with “overhauling the previous tooling and branding”), which they thought would address trademark concents from the NHS. But now it seems even this name is considered unacceptable. One of the developers, Marcus Baw, ... said openhealthhub had numerous conversations that had led to "several cancelled-at-the-last minute meetings" with NHS England (NHSE) CIO Will Smart and Paul Rice, head of technology strategy in the Digital Health team. Baw alleged the pair "(unbeknown to us) were also duplicitously negotiating with Microsoft about a new NHS Enterprise Wide Agreement". He added: "In fact I now strongly suspect that the reason we were getting any engagement at all at these levels was in order to strength NHSE negotiating position with Microsoft, by being able to say to M$ 'There is a competitor, we are meeting with them next week'." <http://www.theregister.co.uk/2018/01/18/nhs_thanks_for_all_the_free_work_li…>

1 0

Apple Rejects Net-Neutrality-Testing App
by Lawrence D'Oliveiro 18 Jan '18

18 Jan '18

A researcher who has published papers on “traffic differentiation” by ISPs tried to submit an app to perform tests to detect this happening on behalf of Iphone users, only to have Apple turn it down on the grounds that it “has no direct benefits to the user”. That is, until word got around about the rejection. Now it seems they are reconsidering. <https://arstechnica.com/information-technology/2018/01/apple-rejects-app-th…>

1 0

meeting ideas?
by Peter Reutemann 18 Jan '18

18 Jan '18

Hi everyone I hope everyone had a good break and enjoyed the lovely muggy weather in the Waikato... ;-) Unfortunately, I didn't get around to looking into home automation over the break, so currently drawing a blank in terms of topics for next week's meeting. Did you work on a little Linux or open-source related project and feel like sharing? Then please let me know! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

5 7

Hackers can’t dig into latest Xiaomi phone due to GPL violations
by Peter Reutemann 17 Jan '18

17 Jan '18

'Yet another Android OEM is dragging its feet with its GPL compliance. This time, it's Xiaomi with the Mi A1 Android One device, which still hasn't seen a kernel source code release. Android vendors are required to release their kernel sources thanks to the Linux kernel's GPLv2 licensing. The Mi A1 has been out for about three months now, and there's still no source code release on Xiaomi's official github account. Unfortunately, GPL non-compliance is par for the course in the world of Android. Budget SoC company MediaTek once tried charging users for access to GPL'd code. Motorola under Lenovo has been regularly accused of violating the GPL and releasing incomplete sources or sources that differ from the kernel shipping on devices. Unsurprisingly, the majority of these alleged GPL violators are from China, which often plays fast and loose with IP law. Android developers use the source code to create custom kernels that tweak the way a device works, allowing for overclocking, better battery life, or control over the CPU governor. One of the largest custom kernel developers, Francisco Franco, has started a public Twitter campaign to encourage Xiaomi to comply with the GPL.' -- source: https://arstechnica.com/gadgets/2018/01/xiaomi-is-dragging-its-feet-on-the-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Found: New Android malware with never-before-seen spying capabilities
by Peter Reutemann 17 Jan '18

17 Jan '18

'Last year, researchers found what at the time was quite possibly the world's most sophisticated espionage app ever written for the Android mobile operating system. Now, in a discovery that underscores the growing arms race among competing malware developers, researchers have uncovered a new Android spying platform that includes location-based audio recording and other features that have never been seen in the wild before. According to a report published Tuesday by antivirus provider Kaspersky Lab, "Skygofree" is most likely an offensive security product sold by an Italy-based IT company that markets various surveillance wares. With 48 different commands in its latest version, the malware has undergone continuous development since its creation in late 2014. It relies on five separate exploits to gain privileged root access that allows it to bypass key Android security measures. Skygofree is capable of taking pictures, capturing video, and seizing call records, text messages, geolocation data, calendar events, and business-related information stored in device memory. Skygofree also includes the ability to automatically record conversations and noise when an infected device enters a location specified by the person operating the malware. Another never-before-seen feature is the ability to steal WhatsApp messages by abusing the Android Accessibility Service that's designed to help users who have disabilities or who may temporarily be unable to fully interact with a device. A third new feature: the ability to connect infected devices to Wi-Fi networks controlled by attackers. Skygofree also includes other advanced features, including a reverse shell that gives malware operators better remote control of infected devices. The malware also comes with a variety of Windows components that provide among other things a reverse shell, a keylogger, and a mechanism for recording Skype conversations' -- source: https://arstechnica.com/information-technology/2018/01/found-new-android-ma… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Phrase Of The Week: “Foveated Rendering”
by Lawrence D'Oliveiro 16 Jan '18

16 Jan '18

<http://www.theregister.co.uk/2018/01/16/human_limits_of_vr_and_ar/>: By some estimates, given a field of view of 180 degrees, around 74 gigabytes of visual data are available to us each second, but only around 125 megabytes are ultimately processed ... Much of the rest is chucked away before it even gets to the optic nerve. But trying to minimize the rendering workload by concentrating on the fovea (the most detail-sensitive part of the eye, the little spot where the image falls when you “look at” something) is not so simple, given the quirks of how our visual perception actually works. Computer graphics doyen Alvy Ray Smith is reputed to have said “reality is 80 million polygons per second”. I think we can achieve that now, but the pixel rate considered acceptable on a conventional monitor is peanuts compared to that required for VR.

1 0

Fighting Ransomware
by Lawrence D'Oliveiro 15 Jan '18

15 Jan '18

No More Ransom <https://www.schneier.com/blog/archives/2018/01/fighting_ransom.html> is a joint project between Europol, the Dutch police, Kaspersky and McAfee to offer a central repository of bypasses for ransomware. Mainly good against older strains, but it should still help prevent lightening a few pocketbooks ...

1 0

20 Years Later, Has Open Source Changed the World?
by Peter Reutemann 15 Jan '18

15 Jan '18

'"Most code remains closed and proprietary, even though open source now dominates enterprise platforms," notes Matt Asay, former COO at Canonical (and an emeritus board member of the Open Source Initiative). "How can that be?" he asks, in an essay noting it's been almost 20 years since the launch of the Open Source Initiative, arguing that so far open source "hasn't changed the world as promised." [T]he reason most software remains locked up within the four walls of enterprise firewalls is that it's too costly with too small of an ROI to justify open-sourcing it. At least, that's the perception. Such a perception is impossible to break without walking the open source path, which companies are unwilling to walk without upfront proof. See the problem? This chicken-and-egg conundrum is starting to resolve itself, thanks to the forward-looking efforts of Google, Facebook, Amazon, and other web giants that are demonstrating the value of open-sourcing code. Although it's unlikely that a State Farm or Chevron will ever participate in the same way as a Microsoft, we are starting to see companies like Bloomberg and Capital One get involved in open source in ways they never would have considered back when the term "open source" was coined in 1997, much less in 2007. It's a start. Let's also not forget that although we have seen companies use more open source code over the past 20 years, the biggest win for open source since its inception is how it has changed the narrative of how innovation happens in software. We're starting to believe, and for good reason, that the best, most innovative software is open source. The article strikes a hopeful note. "We're now comfortable with the idea that software can, and maybe should, be open source without the world ending. The actual opening of that source, however, is something to tackle in the next 20 years.' -- source: https://news.slashdot.org/story/18/01/14/1627207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Meltdown and Spectre Patches Bricking Ubuntu 16.04 Computers
by Peter Reutemann 10 Jan '18

10 Jan '18

'Ubuntu Xenial 16.04 users who updated to receive the Meltdown and Spectre patches are reporting they are unable to boot their systems and have been forced to roll back to an earlier Linux kernel image. The issues were reported by a large number of users on the Ubuntu forums and Ubuntu's Launchpad bug tracker. Only Ubuntu users running the Xenial 16.04 series appear to be affected. All users who reported issues said they were unable to boot after upgrading to Ubuntu 16.04 with kernel image 4.4.0-108. Canonical, the company behind Ubuntu OS, deployed Linux kernel image 4.4.0-108 as part of a security update for Ubuntu Xenial 16.04 users, yesterday, on January 9. According to Ubuntu Security Notice USN-3522-1 and an Ubuntu Wiki page, this was the update that delivered the Meltdown and Spectre patches.' -- source: https://news.slashdot.org/story/18/01/10/1634215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Germany Ban On Online Hate Speech Triggers Debate
by Lawrence D'Oliveiro 10 Jan '18

10 Jan '18

A new law has come into effect in Germany whereby companies like Facebook and Twitter face multi-million-euro fines if they don’t block their users from expressing “hate speech” <http://www.aljazeera.com/news/2018/01/germany-ban-online-hate-speech-trigge…>. Trouble is, this law seems to be a bit of a blunt axe: on the one hand it led to the temporary suspension of the Twitter account of the deputy leader of the far-right AfD party, Beatrix von Storch. But also caught up in the net was the account of the satirical “Titanic” magazine, after it parodied a phrase used by von Storch. Then again, if you are seen to clamp down too hard on particular points of view, that gives political ammunition to those who claim they are being censored...

1 0

Re-Assembling Shredded Stasi Records
by Lawrence D'Oliveiro 09 Jan '18

09 Jan '18

During the last days of the German Democratic Republic (a.k.a. East Germany), the Stasi secret police tried to destroy the more incriminating records they had been keeping on their own citizens. They were only partially successful. And even then, there has been an ongoing project to reassemble those torn-up pieces of paper, by scanning them and doing pattern-recognition to match up the image pieces. Seems the easiest ones are fairly manageable, but now they are getting to smaller fragments, which are proving more of a challenge. <https://www.techdirt.com/articles/20180105/07120838936/stasis-tiny-torn-up-…>

1 0

Another Fork Takes Over The Original Project
by Lawrence D'Oliveiro 08 Jan '18

08 Jan '18

Open-source software projects can fork for various reasons. Sometimes a bunch of developers want to go in a different direction. Other times the original project appears to be languishing, but those in charge are reluctant to give up control. Sometimes the forks peter out, other times they coexist happily (or unhappily) with the original project, occasionally they even absorb the original project. This <http://www.theregister.co.uk/2018/01/08/lede_and_openwrt_merge/> seems to be one of the latter cases: the LEDE fork of OpenWRT is merging back in, but the merger will be “governed under the rules of the LEDE project”.

1 0

Can You Install Linux On a 1993 PC?
by Peter Reutemann 07 Jan '18

07 Jan '18

'The oldest x86 CPU that the Linux kernel supports today is theoretically the 486. However is this theory actually true in practice? I decided to put this theory to the test in my project. His site describes installing Gentoo Linux on an "ancient" IBM PS/1 Consultant 2133 19C (released in 1993), with 64MB SIMM-72 RAM. (Though to speed things up, he compiled that minimal version of Gentoo on a modern Thinkpad T430 released in 2012.) "Due to the age of the PC, the BIOS only supports booting from the floppy drive or internal HDD," so there was also some disk partitioning and kernel configuration. ("Must disable 64-bit kernel for obvious reasons!") A half-hour video shows that it takes almost 11 minutes just to boot up -- and five and a half minutes to shut down. "Despite the many roadblocks I faced, I was impressed by the level of support Linux has for ancient hardware like this." And there's one more added bonus. "Given the age of the 486 (1989 technology), it does not support branch prediction... Ironically this makes it safe from the Meltdown and Spectre attacks."' -- source: https://linux.slashdot.org/story/18/01/07/228222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Can We Replace Intel x86 With an Open Source Chip?
by Peter Reutemann 07 Jan '18

07 Jan '18

'Perhaps the Meltdown and Spectre bugs are the impetus for making long-overdue changes to the core DNA of the semiconductor industry and how chip architectures are designed... Linux (and other related FOSS tech that forms the overall stack) is now a mainstream operating system that forms the basis of public cloud infrastructure and the foundational software technology in mobile and Internet of Things (IoT)... We need to develop a modern equivalent of an OpenSPARC that any processor foundry can build upon without licensing of IP, in order to drive down the costs of building microprocessors at immense scale for the cloud, for mobile and the IoT. It makes the $200 smartphone as well as hyperscale datacenter lifecycle management that much more viable and cost-effective. Just as Linux and open source transformed how we view operating systems and application software, we need the equivalent for microprocessors in order to move out of the private datacenter rife with these legacy issues and into the green field of the cloud... The fact that we have these software technologies that now enable us to easily abstract from the chip hardware enables us to correct and improve the chips through community efforts as needs arise... We need to stop thinking about microprocessor systems' architectures as these licensed things that are developed in secrecy by mega-companies like Intel or AMD or even ARM... The reality is that we now need to create something new, free from any legacy entities and baggage that has been driving the industry and dragging it down the past 40 years. Just as was done with Linux. The bigger question is which chip should take its place. "I don't see ARM donating its IP to this effort, and I think OpenSPARC may not be it either. Perhaps IBM OpenPOWER? It would certainly be a nice gesture of Big Blue to open their specification up further without any additional licensing, and it would help to maintain and establish the company's relevancy in the cloud going forward. "RISC-V, which is being developed by UC Berkeley, is completely Open Source."' -- source: https://news.slashdot.org/story/18/01/06/0424200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

After Intel ME, Researchers Find Security Bug In AMD's SPS Secret Chip-on-Chip
by Peter Reutemann 07 Jan '18

07 Jan '18

'AMD has fixed, but not yet released BIOS/UEFI/firmware updates for the general public for a security flaw affecting the AMD Secure Processor. This component, formerly known as AMD PSP (Platform Security Processor), is a chip-on-chip security system, similar to Intel's much-hated Management Engine (ME). Just like Intel ME, the AMD Secure Processor is an integrated coprocessor that sits next to the real AMD64 x86 CPU cores and runs a separate operating system tasked with handling various security-related operations. The security bug is a buffer overflow that allows code execution inside the AMD SPS TPM, the component that stores critical system data such as passwords, certificates, and encryption keys, in a secure environment and outside of the more easily accessible AMD cores. Intel fixed a similar flaw last year in the Intel ME.' -- source: https://hardware.slashdot.org/story/18/01/07/2015226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Data Centres: No Cheaper NVidia Gaming Graphics Cards For You
by Lawrence D'Oliveiro 05 Jan '18

05 Jan '18

Another entry in the “If I Buy It, Do I Own It?” files: NVidia’s EULA for the proprietary drivers for its GeForce and Titan gaming graphics cards has been amended to forbid their use in data centres: <http://www.theregister.co.uk/2018/01/03/nvidia_server_gpus/>. Such users will have to shell out for more expensive cards. For their own good, of course...

3 2

Munich Council: To Hell With Linux, We're Going Full Windows in 2020
by Peter Reutemann 04 Jan '18

04 Jan '18

'The German city of Munich, which received much popularity back in the day when it first ditched Microsoft's services in favor of open-source software, has now agreed to stop using Linux and switch back to Windows. If the decision is ratified by the full council in two weeks, Windows 10 will start rolling out across the city in 2020. From a report: A coalition of Social Democrats and Conservatives on the committee voted for the Windows migration last week, Social Democrat councillor Anne Hubner told The Register. Munich rose to fame in the open-source world for deciding to use Linux and LibreOffice to make the city independent from the claws of Microsoft. But the plan was never fully realised -- mail servers, for instance, eventually wound up migrating to Microsoft Exchange -- and in February the city council formally voted to end Linux migration and go back to Microsoft. Hubner said the city has struggled with LiMux adoption. "Users were unhappy and software essential for the public sector is mostly only available for Windows," she said. She estimated about half of the 800 or so total programs needed don't run on Linux and "many others need a lot of effort and workarounds." Hubner added, "in the past 15 years, much of our efforts were put into becoming independent from Microsoft," including spending "a lot of money looking for workarounds" but "those efforts eventually failed." A full council vote on Windows 10 2020 migration is set for November 23, Hubner said. However, the Social Democrats and Conservatives have a majority in the council, and the outcome is expected to be the same as in committee.' -- source: https://news.slashdot.org/story/17/11/13/1714220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

4 3

Today I Learned ...
by Lawrence D'Oliveiro 22 Dec '17

22 Dec '17

... what a “Layer 8 issue” is. You know how the ISO/OSI networking model has 7 layers, from the physical hardware up to the actual application that the user is using?

1 0

Roll On The Feudal Internet
by Lawrence D'Oliveiro 22 Dec '17

22 Dec '17

Quoted in <https://www.schneier.com/blog/archives/2017/12/amazons_door_lo.html>: The Key-compatible locks are made by Yale and Kwikset, yet don't work with those brands' own apps. They also can't connect with a home-security system or smart-home gadgets that work with Apple and Google software. And, of course, the lock can't be accessed by businesses other than Amazon. No Walmart, no UPS, no local dog-walking company. And so Amazon becomes a gatekeeper (literally) for access to your very home.

1 0

Does Apple Deliberately Slow Down Older IPhones?
by Lawrence D'Oliveiro 20 Dec '17

20 Dec '17

<https://arstechnica.com/gadgets/2017/12/iphones-slow-over-time-to-preserve-…>: ... the iPhone may throttle performance to preserve battery life or avoid unexpected shutdowns as the battery degrades. What an amazingly complicated solution to the problem. Let me offer a simpler one: why not just make it easier for Iphone users to replace their batteries?

1 0

All 500 of the World's Top 500 Supercomputers Are Running Linux
by Peter Reutemann 19 Dec '17

19 Dec '17

'Linux rules supercomputing. This day has been coming since 1998, when Linux first appeared on the TOP500 Supercomputer list. Today, it finally happened: All 500 of the world's fastest supercomputers are running Linux. The last two non-Linux systems, a pair of Chinese IBM POWER computers running AIX, dropped off the November 2017 TOP500 Supercomputer list. When the first TOP500 supercomputer list was compiled in June 1993, Linux was barely more than a toy. It hadn't even adopted Tux as its mascot yet. It didn't take long for Linux to start its march on supercomputing. >From when it first appeared on the TOP500 in 1998, Linux was on its way to the top. Before Linux took the lead, Unix was supercomputing's top operating system. Since 2003, the TOP500 was on its way to Linux domination. By 2004, Linux had taken the lead for good. This happened for two reasons: First, since most of the world's top supercomputers are research machines built for specialized tasks, each machine is a standalone project with unique characteristics and optimization requirements. To save costs, no one wants to develop a custom operating system for each of these systems. With Linux, however, research teams can easily modify and optimize Linux's open-source code to their one-off designs. The semiannual TOP500 Supercomputer List was released yesterday. It also shows that China now claims 202 systems within the TOP500, while the United States claims 143 systems.' -- source: https://linux.slashdot.org/story/17/11/14/2223227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Fear And Loathing In Open-Source Clothing Design
by Lawrence D'Oliveiro 18 Dec '17

18 Dec '17

Seems the Valentina project, to create an open-source clothing design package, has split in two over the usual reason--disagreements among the project members <http://libregraphicsworld.org/blog/entry/valentina-seamly2d>. In that article, Alexandre Prokoudine tries to give an even-handed account of the saga, which can sometimes be quite difficult. The proprietary software in this field is extremely expensive--to the point where it becomes hard for clothing makers/designers to hire people who are familiar with using it. An alternative project, called SodaCAD <http://www.sodacad.org/>, takes a very different view: more direct control over the design (as I understand it), rather than trying to automatically fit a predefined design to given measurements, as Valentina does. It hasn’t seen much activity in over three years, though.

1 0

Undoing Data Anonymization Is Trivial
by Lawrence D'Oliveiro 18 Dec '17

18 Dec '17

Yet another demonstration <http://www.theregister.co.uk/2017/12/18/no_hack_needed_anonymisation_beaten…> of the seeming impossibility of publishing “anonymized” sets of personal data that cannot be traced back to specific individuals. The response of the Australian Government to a previous demonstration of such “de-anonymization” techniques was to seek laws to ban them.

1 0

Why Linux HDCP Isn't the End of the World
by Peter Reutemann 17 Dec '17

17 Dec '17

'"There is no reason for the open-source community to worry..." writes Daniel Stone, who heads the graphics team at open-source consultancy Collabora. mfilion quotes Collabora.com: Recently, Sean Paul from Google's ChromeOS team, submitted a patch series to enable HDCP support for the Intel display driver. HDCP is used to encrypt content over HDMI and DisplayPort links, which can only be decoded by trusted devices... However, if you already run your own code on a free device, HDCP is an irrelevance and does not reduce freedom in any way.... HDCP support is implemented almost entirely in the hardware. Rather than adding a mandatory encryption layer for content, the HDCP kernel support is dormant unless userspace explicitly requests an encrypted link. It then attempts to enable encryption in the hardware and informs userspace of the result. So there's the first out: if you don't want to use HDCP, then don't enable it! The kernel doesn't force anything on an unwilling userspace.... HDCP is only downstream facing: it allows your computer to trust that the device it has been plugged into is trusted by the HDCP certification authority, and nothing more. It does not reduce user freedom, or impose any additional limitations on device usage.' -- source: https://linux.slashdot.org/story/17/12/16/0320227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Net Neutrality Repeal --- What It Means For NZ
by Rowan Schischka 17 Dec '17

17 Dec '17

<https://list.waikato.ac.nz/pipermail/wlug/2017-December/015504.html> So you are agreeing with me that USA has a problem of poor competition? In NZ if my provider gives me crap access to certain services, I have options, but in many places in the US they do not. Net Neutrality rules did not increase competition in USA, and I do not see how dropping regulations in US will affect NZ's access. Just like Internet censorship from the department of internal affairs is optional, so will any media business arrangement with our ISPs. I can choose one that does it and I can choose one that does not.

1 0

Should Google Be Paying News Sites For Linking To Them?
by Lawrence D'Oliveiro 16 Dec '17

16 Dec '17

News agencies in Europe, particularly, have been claiming for a long while that Google has been unfairly profiting from linking to their articles (and quoting snippets from them). So they want Governments to force Google to pay a “link tax” <https://www.techdirt.com/articles/20171214/16352638814/european-new-agencie…>. The reality of such things is that, regardless of laws to the contrary, the money tends to flow from the ones benefiting to the ones providing the value (cf the “Payola” scandals in the US). Which explains what happened in Spain after it brought in its link-tax law <https://www.techdirt.com/articles/20150725/14510131761/study-spains-google-…>. Maybe the news agencies’ real complaint is that Google is such a massively profitable advertising company.

1 0

Net Neutrality Repeal --- What It Means For NZ
by Rowan Schischka 16 Dec '17

16 Dec '17

>Doesn?t mean we shouldn?t have network neutrality here, though. It just >means the abuses have not been quite as flagrant to date. The article is about ghost problems. In America, with or without net neutrality, providers abuse their market position. Every argument to keep the net neutrality rules comes back to poor competition in telco providers, which previous regulations did not address. The article correctly states that we will not see problems here because of Chrous' position but they incorrectly state we do not have links between media and ISP; Vodafone currently offers package deals https:// www.vodafone.co.nz/pass/ The internet is still working and there is no barrier to stop you or me to start a competing business. If a company like Duco or the rugby union did a deal with an ISP, I would want a deal that gives me uninterrupted live sports streaming, but it wont happen if the government thinks they need to regulate this.

2 1

Net Neutrality Repeal --- What It Means For NZ
by Lawrence D'Oliveiro 15 Dec '17

15 Dec '17

<http://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=11960493>: "Since so many of the services we use online have been developed in America, what is bad for the internet there is bad for us all." But fortunately, Carter added, New Zealand didn't have the market problems that made network neutrality such a pressing issue in the US. Doesn’t mean we shouldn’t have network neutrality here, though. It just means the abuses have not been quite as flagrant to date.

1 0

Avast Launches Open-Source Decompiler For Machine Code
by Peter Reutemann 14 Dec '17

14 Dec '17

'To help with the reverse engineering of malware, Avast has released an open-source version of its machine-code decompiler, RetDec, that has been under development for over seven years. RetDec supports a variety of architectures aside from those used on traditional desktops including ARM, PIC32, PowerPC and MIPS. As Internet of Things devices proliferate throughout our homes and inside private businesses, being able to effectively analyze the code running on all of these new devices becomes a necessity to ensure security. In addition to the open-source version found on GitHub, RetDec is also being provided as a web service. Simply upload a supported executable or machine code and get a reasonably rebuilt version of the source code. It is not possible to retrieve the exact original code of any executable compiled to machine code but obtaining a working or almost working copy of equivalent code can greatly expedite the reverse engineering of software. For any curious developers out there, a REST API is also provided to allow third-party applications to use the decompilation service. A plugin for IDA disassembler is also available for those experienced with decompiling software.' -- source: https://news.slashdot.org/story/17/12/14/006237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

AT&T Versus Carterfone Revisited
by Lawrence D'Oliveiro 14 Dec '17

14 Dec '17

Or, it takes a certain amount of Government regulation to maintain a free market <https://arstechnica.com/tech-policy/2017/12/carterfone-40-years/>. I like the closing remarks: We do not begrudge the CEOs of these great corporations their legal positions. But they are, as Andrew Carnegie would put it, stewards of the system, not its owners. They are not there to tell us to Go Away. They are there to keep the system running while we discover it, use it, develop it, innovate it, game it, finesse it, and reinvent it to our heart's content. The great enterprise of telecommunications is no better than our right to participate in it as individuals.

1 0

AMD Is Open-Sourcing Their Official Vulkan Linux Driver
by Peter Reutemann 13 Dec '17

13 Dec '17

'While many of you have likely heard of the "RADV" open-source Vulkan driver, it's been a community-written driver up to this point in the absence of AMD's official, cross-platform Vulkan driver being open-source. That's now changed with AMD now open-sourcing their official Vulkan driver. The code drop is imminent and they are encouraging the use of it for quick support of new AMD hardware, access to the Radeon GPU Profiler, easy integration of AMD Vulkan extensions, and enabling third-party extensions. For now at least it does provide better Vulkan performance than RADV but the RADV developers have indicated they plan to continue development of their Mesa-based Vulkan driver.' -- source: https://news.slashdot.org/story/17/12/13/016211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

1998 attack that messes with sites’ secret crypto keys is back in a big way
by Peter Reutemann 12 Dec '17

12 Dec '17

'A surprisingly big number of top-name websites—Facebook and PayPal among them—recently tested positive for a critical, 19-year-old vulnerability that allowed attackers to decrypt encrypted data and sign communications using the sites' secret encryption key. The vulnerability in the transport layer security protocol for Web encryption was disclosed in 1998 when researcher Daniel Bleichenbacher found it in the TLS predecessor known as secure sockets layer. A flaw in the algorithm that handles RSA encryption keys responded to certain types of errors in a way that divulged potentially sensitive information. With enough specially formed queries, attackers could exploit the weakness in a way that allowed them to decrypt ciphertext even when they didn't have the secret decryption key. SSL architects responded by designing workarounds that suppressed the error messages rather than removing or rewriting the faulty RSA algorithm. Researchers call the class of crypto vulnerability an Oracle because it provides only "yes" or "no" answers that, over time, can reveal detailed information about the contents of encrypted data. The information allows hackers to carry out what's known as an "adaptive chosen-ciphertext attack."' -- source: https://arstechnica.com/information-technology/2017/12/a-worrying-number-of… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Should Service Providers Be Liable For Content?
by Lawrence D'Oliveiro 11 Dec '17

11 Dec '17

It is commonly accepted that ISPs should not generally be held liable for things done by their customers--or indeed, anybody else’s customers over their pipes. This is currently the case in Australia, for example. But should protections be extended to what we might describe as “secondary” service providers--such as social media sites like Facebook, and of course Google? Seems like Australia agrees the answer should be mostly “yes”, but not for those specific companies. Not sure how they are going to decide who is eligible for such legal protections and who is not. <https://www.techdirt.com/articles/20171207/09383538762/mpaa-wins-australia-…>

1 0

Intel's ME May Be Massively Infringing on Minix3's Free Software License
by Peter Reutemann 10 Dec '17

10 Dec '17

'Almost all Free Software licenses (BSD, MIT, GPL...) require some sort of legal notice (legal attribution) given to the recipient of the software, both when the software is distributed in source and in binary forms. The legal notice usually contains the copyright holder's name and the license text. This means that it's not possible to hide and keep secret the existence of Free Software that you have stuck into your product that you distribute. If you do so, then you are not complying with the Free Software license and you are committing a copyright infringement! This is exactly what Intel seems to have done with the Intel ME. The Minix3 operating system license requires a legal notice, but so far it seems like Intel has not given the necessary legal notices. (Probably because they want to keep the inside of the ME secret.) Thus not only is Minix3 the most installed OS on our recent x86 CPUs -- but it might also the most pirated OS on our recent x86 CPUs!' -- source: https://slashdot.org/story/17/12/09/0610203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

The FCC Still Doesn’t Know How the Internet
by Peter Reutemann 10 Dec '17

10 Dec '17

'The EFF describes the FCC's official plan to kill net neutrality as "riddled with technical errors and factual inaccuracies," including, for example, a false distinction between "Internet access service" and "a distinct transmission service" which the EFF calls "utterly ridiculous and completely ungrounded from reality." "Besides not understanding how Internet access works, the FCC also has a troublingly limited knowledge of how the Domain Name System (DNS) works -- even though hundreds of engineers tried to explain it to them this past summer... As the FCC would have it, an Internet user actively expects their ISP to provide DNS to them." And in addition, "Like DNS, it treats caching as if it were some specialized service rather than an implementation detail and general-purpose computing technique." "There are at least two possible explanations for all of these misunderstandings and technical errors. One is that, as we've suggested, the FCC doesn't understand how the Internet works. The second is that it doesn't care, because its real goal is simply to cobble together some technical justification for its plan to kill net neutrality. A linchpin of that plan is to reclassify broadband as an 'information service,' (rather than a 'telecommunications service,' or common carrier) and the FCC needs to offer some basis for it. So, we fear, it's making one up, and hoping no one will notice." "We noticed," their editorial ends, urging Americans "to tell your lawmakers: Don't let the FCC sell the Internet out."' -- source: https://yro.slashdot.org/story/17/12/09/0545230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Updated Debian Linux 9.3 and 8.10 Released
by Peter Reutemann 10 Dec '17

10 Dec '17

'The Debian project is pleased to announce the third update of its stable distribution Debian 9 (codename stretch). This point release mainly adds corrections for security issues, along with a few adjustments for serious problems. Security advisories have already been published separately and are referenced where available. The Debian project also announces the tenth update of its oldstable distribution Debian 8 (codename jessie). Please note that the point release does not constitute a new version of Debian 9 or 8 but only updates some of the packages included. There is no need to throw away old jessie or stretch DVD/CD media. After installation, packages can be upgraded to the current versions using an up-to-date Debian mirror. This stable update adds a few important corrections to packages. New installation images will be available soon at the mirrors. Those who frequently install updates from security.debian.org won't have to update many packages, and most such updates are included in the point release. One can use the apt command or apt-get command to apply updates. A step-by-step update guide is posted here.' -- source: https://linux.slashdot.org/story/17/12/09/1958254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Canadian ISPs And Hollywood Agree On Plan To Make Themselves Judge, Jury and Website Executioner
by Lawrence D'Oliveiro 08 Dec '17

08 Dec '17

Think it could happen here <https://www.techdirt.com/articles/20171205/03452738742/canadian-isps-hollyw…>? A bunch of Canadian ISPs, together with various entertainment groups, is submitting a plan to the Canadian Radio-television and Communications Commission (CRTC), which is the regulatory body for broadcasting and telecoms, to maintain a list of sites which will be blocked by the ISPs at the request of the entertainment groups. Is there any recourse, any review process, any independent oversight? Nope. Any prospect for, shall we say, “mission creep”? Oh boy, is there... The CRTC seems less than enthused. I like this comment from their spokesperson: “Our government supports an open internet where Canadians have the ability to access the content of their choice in accordance to Canadian laws,” Sasseville says. “While other parts of the world are focused on building walls, we’re focused on opening doors‎.”

1 0

Google Vs Amazon Smackdown
by Rowan Schischka 06 Dec '17

06 Dec '17

> There is a tussle going on at the moment between a couple of large > corporations--but then, isn?t there always? There is a saying in some > parts of Africa that ?when elephants fight, the grass gets trampled?. > The ?grass?, in this case, being ordinary consumers like you and me. > > * Once Amazon started offering its own video-streaming hardware, it > banned competing products offered by Apple and Google from its store. > (Can you say ?conflict of interest??) > * Google/YouTube retaliated by blocking YouTube from Amazon?s Echo Show. > * Amazon upped the ante by denying sales of Google?s Nest devices as > well. > > And so it goes... so each store does not list their competitors spyware? no loss to me.

1 0

Google Vs Amazon Smackdown
by Lawrence D'Oliveiro 06 Dec '17

06 Dec '17

There is a tussle going on at the moment between a couple of large corporations--but then, isn’t there always? There is a saying in some parts of Africa that “when elephants fight, the grass gets trampled”. The “grass”, in this case, being ordinary consumers like you and me. * Once Amazon started offering its own video-streaming hardware, it banned competing products offered by Apple and Google from its store. (Can you say “conflict of interest”?) * Google/YouTube retaliated by blocking YouTube from Amazon’s Echo Show. * Amazon upped the ante by denying sales of Google’s Nest devices as well. And so it goes... <https://www.techdirt.com/articles/20171206/10385638755/google-amazon-are-ha…>

3 2

Windows RT Strike 2
by Lawrence D'Oliveiro 06 Dec '17

06 Dec '17

The first Windows-10-on-ARM machines are due to ship from HP and Asus in the autumn <https://arstechnica.com/gadgets/2017/12/hp-asus-announce-first-windows-10-a…>. It will include some kind of x86 emulator to run 32-bit regular-Windows apps. Of which I didn’t realize that there were still many around. Of course you can have either the ARM native performance and the long battery life, or you can have the Windows compatibility, but you are not going to get both at once. Prognosis: whenever either member of the Wintel symbiote has tried to step out on their own, the results have been uniformly disastrous. I expect this foray to be no different.

2 1

MacOS High Sierra Bug Allows Login As Root With No Password
by Peter Reutemann 04 Dec '17

04 Dec '17

'A trivial-to-exploit flaw in macOS High Sierra, aka macOS 10.13, allows users to gain admin rights, or log in as root, without a password. The security bug is triggered via the authentication dialog box in Apple's operating system, which prompts you for an administrator's username and password when you need to do stuff like configure privacy and network settings. If you type in "root" as the username, leave the password box blank, hit "enter" and then click on unlock a few times, the prompt disappears and, congrats, you now have admin rights. You can do this from the user login screen. The vulnerability effectively allows someone with physical access to the machine to log in, cause extra mischief, install malware, and so on. You should not leave your vulnerable Mac unattended until you can fix the problem. And while obviously this situation is not the end of the world -- it's certainly far from a remote hole or a disk decryption technique -- it's just really, really sad to see megabucks Apple drop the ball like this. Developer Lemi Orhan Ergan was the first to alert the world to the flaw. The Register notes: "If you have a root account enabled and a password for it set, the black password trick will not work. So, keep the account enabled and set a root password right now..."' -- source: https://it.slashdot.org/story/17/11/28/2135236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 5

Researchers Run Unsigned Code on Intel ME By Exploiting USB Ports
by Peter Reutemann 04 Dec '17

04 Dec '17

'A pair of security researchers in Russia are claiming to have compromised the Intel Management Engine just using one of the computer's USB ports. The researchers gained access to a fully functional JTAG connection to Intel CSME via USB DCI. The claim is different from previous USB DCI JTAG examples from earlier this year. Full JTAG access to the ME would allow making permanent hidden changes to the machine. "Getting into and hijacking the Management Engine means you can take full control of a box," reports the Register, "underneath and out of sight of whatever OS, hypervisor or antivirus is installed." They add that "This powerful God-mode technology is barely documented," while The Next Web points out that USB ports are "a common attack vector."' -- source: https://it.slashdot.org/story/17/11/11/237236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

Is Open Source Innovation Now All About Vendor On-Ramps?
by Peter Reutemann 03 Dec '17

03 Dec '17

'InfoWorld published an interesting essay from Matt Asay, former COO at Canonical (and an emeritus board member of the Open Source Initiative), about innovation from the big public cloud vendors, which "even when open-sourced, doesn't really help the community at large... All this innovation is available to buy; none of it is available to build. Not for mere mortals, anyway." Google in particular has figured out how to both open-source code in a useful way and make it pay. As Server Density CEO David Mytton has underlined, Google hopes to "standardize machine learning on a single framework and API," namely TensorFlow, then supplement it "with a service that can [manage] it all for you more efficiently and with less operational overhead," namely Google Cloud. By open-sourcing TensorFlow and backing it with machine-learning-heavy Google Cloud, Google has open-sourced a great on-ramp to future revenue. My question: why not do this with the rest of its code? The simple answer is "Because it's a lot of work." That is, Google could open-source everything tomorrow without any damage to its revenue, but the code itself would provide other providers and enterprises only limited ability to increase their revenue unless Google did all the necessary prep work to make it useful to mere mortals not running superhuman Google infrastructure. This is the trick that AWS, Microsoft, and Google are all racing to figure out today. Not open source, per se, because that's the easy table stakes. No, the AWS/Microsoft Azure/Google Cloud trio are figuring out how to turn their innovations into open source on-ramps to their proprietary services. Companies used to lock up their code to sell it. Today, it's the opposite: They need to open it up to make their ability to operate the code at scale more valuable. For them.' -- source: https://news.slashdot.org/story/17/12/02/0833217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Understanding the New Red Hat-IBM-Google-Facebook GPL Enforcement Announcement
by Peter Reutemann 03 Dec '17

03 Dec '17

'Bruce Perens co-founded the Open Source Initiative with Eric Raymond -- and he's also Slashdot reader #3872. Bruce Perens writes: Red Hat, IBM, Google, and Facebook announced that they would give infringers of their GPL software up to a 30-day hold-off period during which an accused infringer could cure a GPL violation after one was brought to their attention by the copyright holder, and a 60 day "statute of limitations" on an already-cured infringement when the copyright holder has never notified the infringer of the violation. In both cases, there would be no penalty: no damages, no fees, probably no lawsuit; for the infringer who promptly cures their infringement. Perens sees the move as "obviously inspired" by the kernel team's earlier announcement, and believes it's directed against one man who made 50 copyright infringement claims involving the Linux kernel "with intent to collect income rather than simply obtain compliance with the GPL license." Unfortunately, "as far as I can tell, it's Patrick McHardy's legal right to bring such claims regarding the copyrights which he owns, even if it doesn't fit Community Principles which nobody is actually compelled to follow."' -- source: https://linux.slashdot.org/story/17/12/02/2024240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

'24 Pull Requests' Suggests Contributing Code For Christmas
by Peter Reutemann 03 Dec '17

03 Dec '17

'"On December 1st, 24 Pull Requests will be opening its virtual doors once again, asking you to give the gift of a pull request to an open source project in need," writes UK-based software developer Andrew Nesbitt -- noting that last year the site registered more than 16,000 pull requests. "And they're not all by programmers. Often the contribution with the most impact might be an improvement to technical documentation, some tests, or even better -- guidance for other contributors." This year they're even touting "24 Pull Requests hack events," happening around the world from Lexington, Kentucky to Torino, Italy. (Last year 80 people showed up for an event in London.) "You don't have to hack alone this Christmas!" suggests the site, also inviting local communities and geek meetups (as well as open source-loving companies) to host their own events. Contributing to open source projects can also beef up your CV (for when you're applying for your next job), the site points out, and "Even small contributions can be really valuable to a project." "You've been benefiting from the use of open source projects all year. Now is the time to say thanks to the maintainers of those projects, and a little birdy tells me that they love receiving pull requests!"' -- source: https://developers.slashdot.org/story/17/12/03/2018213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Net Un-Neutrality ... For Real
by Lawrence D'Oliveiro 01 Dec '17

01 Dec '17

Some of those who have been following the net neutrality debate may remember a spoof poster that showed what might happen if ISPs were allowed to charge you differently, based on which sites you were allowed to visit. Well, in Spain, which has no laws against this sort of thing, a similar situation has actually happened: one ISP is selling you addons to a basic broadband cap based, not on the amount of extra data you want, but on what you want to use it for. Their “Vodafone Pass” product offers tiers like €3/month extra for a “Social Pass”, or €5/month for a “Music Pass”. <https://pplware.sapo.pt/informacao/vodafone-portugal-pacotes-smartnet/>, referenced from <https://www.techdirt.com/articles/20171030/12364538513/portugal-shows-inter…>

3 10

30 Years Of HyperCard
by Lawrence D'Oliveiro 30 Nov '17

30 Nov '17

Just came across this item <https://blog.archive.org/2017/08/11/hypercard-on-the-archive-celebrating-30…> at archive.org about an online emulator that runs HyperCard stacks. HyperCard, in case you didn’t know, was an application created by Apple Macintosh engineer Bill Atkinson for that platform in 1987, and it was always hard to describe exactly what it was for. But it allowed users to create their own applications, aka “stacks”, around a card-based paradigm. One of the commenters points out that the basic idea is still alive and well, in the form of LiveCode, which is available as a paid online service <https://livecode.com/> and also in the form of Free Software <https://github.com/livecode/>.

1 0