- wlug - list.wlug.org.nz

Bruce Schneier On Securing A Raspberry π
by Lawrence D'Oliveiro 12 Sep '17

12 Sep '17

Make magazine has an article about securing it. Reading it, I am struck by how much work it is to secure. I fear that this is beyond the capabilities of most tinkerers, and the result will be even more insecure IoT devices. <https://www.schneier.com/blog/archives/2017/09/securing_a_rasp.html>

1 0

mailing list etiquette
by Peter Reutemann 12 Sep '17

12 Sep '17

Hi everyone In light of recent events, a little refresher on the mailing list etiquette seems to be appropriate. You can find it here: https://list.waikato.ac.nz/mailman/listinfo/wlug Yes, there are topics which can kick off a flame war (vi/emacs, systemd). Some things are like politics or religion and cannot be discussed objectively. But calling other people names and/or posting snide, demeaning or threatening comments (on- or off-list) is below this list. I usually have a very hands-off approach to moderation, considering that we are all (or at least most of us are) adults and should know what is considered acceptable social behavior. However, if inciting behavior should continue, I reserve my right to ban people from this list. Last but not least: if you don't like the actual content being posted here, no one forces you to be a member of this mailing list. Simply unsubscribe. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Re: [wlug] Tesla Remotely Extends The Range Of Some Cars To Help With Hurricane Irma
by Eric Light 12 Sep '17

12 Sep '17

Did.... You actually just threaten me? E -------------------------------------------- Q: Why is this email five sentences or less? A: http://five.sentenc.es On Tue, 12 Sep 2017, at 14:39, gb wrote: > > "snark" ... "being a dick" ... would you like to say that to my face? > > > On Tue, 2017-09-12 at 14:04 +1200, Eric Light wrote: > > Is that snark really necessary, gb? I'm not sure about the rest of us, > > but I'm in this group for interesting news, tips, guidance, etc. > > > > The diversity of information here is one of the reasons that I've been > > on the list for almost a decade. I'm sure a full 30% of Peter's posts > > aren't Linux-specific, for example. That only adds to the benefit that > > we get as a group. > > > > Lawrence's post is fascinating, and could be the starting point for an > > interesting discussion if we could go ahead and not be dicks - either to > > the poster, or about the content. > > > > E > > > > -------------------------------------------- > > Q: Why is this email five sentences or less? > > A: http://five.sentenc.es > > > > On Tue, 12 Sep 2017, at 12:51, gb wrote: > > > Well that's got zero to do with linux, or Waikato ... unless someone > > > owns a Tesla in Waikato? (I doubt it). > > > > > > I've got some cool anecdotes on crappy things banks do with our money > > > supply, shall I share them here too? > > > > > > On Tue, 2017-09-12 at 12:02 +1200, Lawrence D'Oliveiro wrote: > > > > Tesla sometimes sells cars with more hardware battery capacity than > > > > is initially available for use by customers, offering the > > > > additional capacity as a subsequent software update. > > > > > > > > ... > > > > > > > > But last week, Tesla decided to temporarily make this extra > > > > capacity available even to Floridians who hadn't paid for the > > > > upgrade to ensure they had enough range to get out of Florida ahead > > > > of Hurricane Irma. > > > > > > > > ... > > > > > > > > Presumably, their vehicles will get a downgrade once hurricane > > > > season is over. > > > > > > > > <https://arstechnica.com/cars/2017/09/tesla-remotely-extends-the-range-of-so…> > > > > _______________________________________________ > > > > wlug mailing list | wlug(a)list.waikato.ac.nz > > > > Unsubscribe: https://list.waikato.ac.nz/mailman/listinfo/wlug > > > > > > > > > _______________________________________________ > > > wlug mailing list | wlug(a)list.waikato.ac.nz > > > Unsubscribe: https://list.waikato.ac.nz/mailman/listinfo/wlug > > _______________________________________________ > > wlug mailing list | wlug(a)list.waikato.ac.nz > > Unsubscribe: https://list.waikato.ac.nz/mailman/listinfo/wlug > > > > .

1 0

Tesla Remotely Extends The Range Of Some Cars To Help With Hurricane Irma
by Lawrence D'Oliveiro 12 Sep '17

12 Sep '17

Tesla sometimes sells cars with more hardware battery capacity than is initially available for use by customers, offering the additional capacity as a subsequent software update. ... But last week, Tesla decided to temporarily make this extra capacity available even to Floridians who hadn't paid for the upgrade to ensure they had enough range to get out of Florida ahead of Hurricane Irma. ... Presumably, their vehicles will get a downgrade once hurricane season is over. <https://arstechnica.com/cars/2017/09/tesla-remotely-extends-the-range-of-so…>

3 2

Google Chrome Will Soon Detect Man-in-the-Middle Attacks
by Peter Reutemann 10 Sep '17

10 Sep '17

'Google Chrome 63 will include a new security feature that will detect when third-party software is performing a Man-in-the-Middle (MitM) attack that hijacks the user's Internet connection.... Most MitM toolkits fail to correctly rewrite the user's encrypted connections, causing SSL errors that Chrome will detect. The new Chrome 63 feature is in the form of a new warning screen. This new error will appear whenever Chrome detects a large number of SSL connection errors in a short timespan, a sign that someone is trying -- and failing -- to intercept the user's web traffic. This includes both malware and legitimate applications, such as antivirus and firewall applications. The new Chrome error won't show up for all antivirus and firewall software, but only for those that do not rewrite SSL connections in a proper way, resulting in SSL errors. Chrome 63 is set for release on December 5, but users can already test it by enabling it in the Google Chrome dev branch' -- source: https://it.slashdot.org/story/17/09/10/1928232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

OBS Studio – Record and Live Stream Videos from Linux Desktop
by Peter Reutemann 10 Sep '17

10 Sep '17

'OBS Studio is a free and open source cross-platform app with which you can create video records of your desktop screen and also live stream directly. You can use it to conveniently share your gaming, art, entertainment activities with Twitch.tv, YouTube, Hitbox.tv, DailyMotion, Connectcast.tv, CyberGame.tv, CashPlay.tv along with custom streaming servers free of charge! It comes with many in-house features that allow you to produce professional videos e.g. Studio Mode lets you live preview and adjust your scenes and sources before making them available for public viewing; you can choose to set any combo of hotkeys to start/stop streams or recordings, switch between scenes, mute audio sources, e.t.c.' -- source: https://www.fossmint.com/obs-studio-record-and-live-stream-videos-from-linu… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Document Liberation Project Announces Initial QuarkXPress Support
by Lawrence D'Oliveiro 10 Sep '17

10 Sep '17

Libre Graphics World may not update very often, but its articles are usually worth reading. Like this one <http://libregraphicsworld.org/blog/entry/document-liberation-project-announ…>: Initially, Scribus was pretty much modeled after QuarkXPress, and the two projects still share some similarities. Early in the history of Scribus, it made a lot of sense to introduce support for QXP files. Users got mad with Quark's continuous quirks and bad user support, they would jump ship at the very next opportunity. Paul Johnson, former Scribus contributor, actually started working on support for QXP files in 2004. But after he had posted to a public mailing list about his progress, he reportedly received a cease and desist letter from Quark. Scribus was nowhere near its current fame at the time, and even now it would not be able to handle legal expenses (save for a theoretical FSF intervention). Back then Paul just stopped working on that project. The good news is, Quark no longer seems to be in a position to be such a bully.

1 0

Vodafone Ending Its E-Mail Service
by Lawrence D'Oliveiro 08 Sep '17

08 Sep '17

Vodafone will no longer be offering e-mail service to its customers after November <http://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=11919531>. It doesn’t seem to have notified some of its customers; certainly I didn’t receive any notification. Of course, I just have to figure out where to get a new server to handle my existing address. The real headache is for those who have been using the ISP’s domain for their address; that has been a bad idea for the last 20 years.

2 1

How to hurricane-proof a Web server
by Peter Reutemann 08 Sep '17

08 Sep '17

'I had enough to worry about as Hurricane Harvey plowed into the Texas Gulf Coast on the night of August 25 and delivered a category 4 punch to the nearby city of Rockport. But I simultaneously faced a different kind of storm: an unexpected surge of traffic hitting the Space City Weather Web server. This was the first of what would turn into several very long and restless nights.' -- source: https://arstechnica.com/information-technology/2017/09/how-to-hurricane-pro… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

How to use speedtest on a Linux server to check, store and report internet speeds graphically
by Peter Reutemann 08 Sep '17

08 Sep '17

'Following on from a set of problems of poor broadband connectivity I was experiencing I decided that I wanted to monitor the Mbps speed I was getting from my provider on a regular basis. I was seeing especially poor figures when trying to download files in the evening, with much faster speeds achieved very early in the morning. I have a Linux Debian server sitting in a corner, which is my test and development machine for ISPConfig-hosted websites, as well as some Let's Encrypt code I like to play around with, so I looked for some software that would enable bandwidth testing, runnable from a linux command line, which could form the basis of an automated shell script system to produce the raw data I needed. I wanted to store the data in a SQL database to make querying simple (I could then easily gather more data and just extract a smaller subset for time periods I was interested in) and to have a web front-end that could produce a simple chart to visualise the data and help highlight the connectivity issues.' -- source: https://www.howtoforge.com/tutorial/how-to-use-speedtest-on-a-linux-server-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android Oreo Bug Eats Up Mobile Data Even When On Wi-Fi
by Peter Reutemann 07 Sep '17

07 Sep '17

'An apparent bug with Android Oreo has been discovered which means Google's mobile operating system could be munching its way through your data allowance, even if you're connected to a wireless network. A thread on Reddit highlighted the issue, with many people pointing out that it could prove expensive for anyone not using an unlimited data plan. Google is apparently aware of the problem and is working on a patch, but in the meantime Oreo users are being warned to consider disabling mobile data when they are at home or using a wireless connection elsewhere.' -- source: https://it.slashdot.org/story/17/09/06/2240208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Kernel 4.13 Officially Released
by Peter Reutemann 06 Sep '17

06 Sep '17

'As expected, the Linux 4.13 kernel series was made official this past weekend by none other than its creator, Linus Torvalds, which urges all Linux users to start migrating to this version as soon as possible. Work on Linux kernel 4.13 started in mid-July with the first Release Candidate (RC) milestone, which already gave us a glimpse of the new features coming to this major kernel branch. There are, of course, numerous improvements and support for new hardware through updated drivers and core components. Highlights of Linux kernel 4.13 include Intel's Cannon Lake and Coffee Lake CPUs, support for non-blocking buffered I/O operations to improve asynchronous I/O support, support for "lifetime hints" in the block layers and the virtual filesystem, AppArmor enhancements, and better power management. There's also AMD Raven Ridge support implemented in the AMDGPU graphics driver, which received numerous improvements, support for five-level page tables was added in the s390 architecture, and the structure randomization plugin was added as part of the build system.' -- source: https://linux.slashdot.org/story/17/09/05/1637226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Use Aircrack-ng To Test Your WiFi Password
by Peter Reutemann 05 Sep '17

05 Sep '17

'Most people have terrible passwords, and WiFi is no exception. Your WiFi password is your primary line of defense against unwanted access to your network. That access can result in a whole host of other nasty things because an attacker can monitor the traffic on your network and even gain direct access to your computers. The best way to prevent such an intrusion is to use the same tools an attacker would to test the security of your WiFi password. [...] Remember this process should only ever be used to test your own security. Using it on someone else's network is illegal.' -- source: https://linuxconfig.org/use-aircrack-ng-to-test-your-wifi-password Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Geo – A Simple BASH Utility To Get Network And Geolocation Details
by Peter Reutemann 05 Sep '17

05 Sep '17

'A while ago, we wrote a blog post about “Bash-Snippets”, a set of BASH scripts for heavy command-line users. Those scripts consists of many useful utilities such as crypt, geo, cheat, weather, ytview and more. Using bash-Snippets, you can install all utilities or a particular one. In this brief guide, we are going to discuss about only one utility in the Bash-Snippets called “Geo”. It is used to display wan, lan, router, dns, mac address, and geolocation output, with clean stdout for piping.' -- source: https://www.ostechnix.com/geo-simple-bash-utility-get-network-geolocation-d… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Oracle Finally Killed Sun
by Peter Reutemann 05 Sep '17

05 Sep '17

'The news from the ex-Sun community jungle drums is that the January rumours were true and Oracle laid off the core talent of the Solaris and SPARC teams on Friday (perhaps hoping to get the news lost in the Labor Day weekend). With 90% gone according to Bryan Cantrill that surely has to mean either a skeleton-staffed maintenance-only future for the product range, especially with Solaris 12 cancelled, or an attempt to force Solaris workloads onto Oracle’s SPARC Cloud offering. A classic Oracle “silent EOL”, no matter what they claim as they satisfy their contractual commitments to Fujitsu and others. ' -- source: https://meshedinsights.com/2017/09/03/oracle-finally-killed-sun/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Mint 18.3 to Launch with Revamped Backup Tool, Window Progress, and More
by Peter Reutemann 05 Sep '17

05 Sep '17

'Last month, we reported that development of Linux Mint 18.3 kicked off with HybridSleep support for the Cinnamon desktop environment, HiDPI support and GTK3 porting for the Software Sources tool, as well as the revamp of the Software Manager graphical package manager, which was also ported to latest GTK+ 3 technologies. And now, the Linux Mint creator reveals the fact that Linux Mint 18.3 will be shipping with a revamped Backup Tool that won't require root anymore, offers a much easier to use interface that no longer requires you to select the type or source of a backup, and it's capable of backing up your entire Home directory. The tool will restore files in their initial location, with the same permissions and timestamps.' -- source: http://news.softpedia.com/news/linux-mint-18-3-to-launch-with-revamped-back… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

To Linux Mint KDE 18.2… and back
by Peter Reutemann 05 Sep '17

05 Sep '17

'Linux Mint KDE is just one of several flavours of Linux Mint, and obviously not the flagship of this distribution. However, I liked that distribution in my test of the Live version of Linux Mint KDE 18.2. I liked it so much that I decided to give it a go in installed mode. How was that? Let’s check.' -- source: http://linuxblog.darkduck.com/2017/09/to-linux-mint-kde-182-and-back.html Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Vulnerabilities Discovered In Mobile Bootloaders of Major Vendors
by Peter Reutemann 05 Sep '17

05 Sep '17

'Android bootloader components from five major chipset vendors are affected by vulnerabilities that break the CoT (Chain of Trust) during the Android OS boot-up sequence, opening devices to attacks. The vulnerabilities were discovered with a new tool called BootStomp, developed by nine computer scientists from the University of California, Santa Barbara. Researchers analyzed five bootloaders from four vendors (NVIDIA, Qualcomm, MediaTek, and Huawei/HiSilicon). Using BootStomp, researchers identified seven security flaws, six new and one previously known (CVE-2014-9798). Of the six new flaws, bootloader vendors already acknowledged five and are working on a fix. "Some of these vulnerabilities would allow an attacker to execute arbitrary code as part of the bootloader (thus compromising the entire chain of trust), or to perform permanent denial-of-service attacks," the research team said (PDF). "Our tool also identified two bootloader vulnerabilities that can be leveraged by an attacker with root privileges on the OS to unlock the device and break the CoT."' -- source: https://mobile.slashdot.org/story/17/09/05/0257221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android One Is Anything But Dead, Google Reaffirms With Xiaomi Mi A1
by Peter Reutemann 05 Sep '17

05 Sep '17

'Google executives shared the stage with Xiaomi chiefs at a media event in New Delhi on Tuesday as the Chinese phone maker unveiled its "new flagship" Mi A1 smartphone. Google's presence at the event was essential. Xiaomi's Mi A1 is the latest phone to be launched under Google's Android One program, a three-year-old initiative from Google, which in the past year has been presumed dead by many. It's anything but that, Google executives said. The Xiaomi Mi A1 smartphone features a 5.5-inch full-HD (1080x1920 pixels) display. It also offers a duo of 12-megapixel rear cameras, one with telephoto capability and 2X optical zoom feature. On the front, for the selfie enthusiasts is a 5-megapixel shooter. The dual-SIM capable Mi A1 smartphone houses a Snapdragon 625 octa-core SoC, 4GB of RAM, 64GB internal storage, IR blaster, a 3080mAh battery, a fingerprint scanner, modems for 4G LTE bands in its gold- and black-coloured thin, full-metal unibody form factor. It is priced at $235, and will be available in dozens of markets including Mexico, India, Indonesia, Russia, and Singapore.' -- source: https://tech.slashdot.org/story/17/09/05/1014235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

With Android Oreo, Google Is Introducing Linux Kernel Requirements
by Peter Reutemann 05 Sep '17

05 Sep '17

'As is easy to tell by comparing versions of Android from different handset manufacturers, developers are -- broadly speaking -- free to do whatever they want with Android, but with Oreo, one aspect of this is changing. Google is introducing a new requirement that OEMs must meet certain requirements when choosing the Linux kernel they use. Until now, as pointed out by XDA Developers, OEMs have been free to use whatever Linux kernel they wanted to create their own version of Android. Of course, their builds still had to pass Google's other tests, but the kernel number itself was not an issue. Moving forward, Android devices running Oreo must use at least kernel 3.18, but there are more specific requirements to meet as well. Google explains on the Android Source page: "Android O mandates a minimum kernel version and kernel configuration and checks them both in VTS as well as during an OTA. Android device kernels must enable the kernel .config support along with the option to read the kernel configuration at runtime through procfs."' -- source: https://linux.slashdot.org/story/17/09/03/1653227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

78 Open Source Replacements for Expensive Applications
by Peter Reutemann 04 Sep '17

04 Sep '17

'Back when Datamation first started making lists of open source software that could replace expensive proprietary applications, most commercial software came in a box and required a flat fee for purchase. These days, with the advent of cloud computing and software as a service, most applications require a regular monthly or yearly subscription. Those subscriptions make it seem like software has become more affordable. After all, $10 or $20 a month doesn't seem like a lot. But when you add up those repeating fees, users often pay more under the new subscription plans than they did under the old flat-fee arrangements. If you use a lot of different applications, those fees can quickly add up. And it can be particularly hard to justify the expense for a piece of software that you only use once in a while. Open source software offers an alternative to paying those high fees. And in many cases, the open source options are as good as or better than the comparable commercial, proprietary solutions. In fact, in the most recent BlackDuck Future of Open Source Survey, the top reasons why people said they use open source software were because of the features, freedom from vendor lock-in and the quality of the solutions. Price and total cost of ownership weren't even on the list. In other words, people are using open source because the software is so good, and the fact that it is free is just a side benefit. The list below includes a variety of open source software for home users, SMBs and large enterprises. All of these applications can replace commercial products that can carry high prices. Even if buyers choose to purchase support or other services for their open source software, the open source options are generally much more affordable than the comparable proprietary solutions.' -- source: http://www.datamation.com/open-source/78-open-source-replacements-for-expen… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Almost-OT: Linux Comic
by Lawrence D'Oliveiro 02 Sep '17

02 Sep '17

There is this peculiar subgenre of art featuring characters called “OS-tans”. These are personifications of operating systems. I’m not sure how their characters and adventures relate to the OSes for which they are named, but anyway here is one about a character named Linux: <https://bellacielo.deviantart.com/gallery/33067628/Linux-Comic-Complete>.

1 0

The Most Epic Tech-Support Call In History
by Lawrence D'Oliveiro 02 Sep '17

02 Sep '17

Scott Manley tells the story <https://www.youtube.com/watch?v=wSSmNUl9Snw> of how the Apollo 14 mission was saved by a truly remarkable bit of computer hacking. You might be thinking: “Have you tried turning it off and on again?” Apollo 10 did that. And there were the computer crashes (“1202 alarm” and “1201 alarm”) during the Apollo 11 landing. But 14 was being stymied by an intermittently-shorting abort switch: if that triggered at the wrong time, the mission was over. And the software couldn’t be reprogrammed, since it was all woven (literally) into ROM. So a bright young guy named Don Eyles was woken up in the middle of the night, and over the space of a couple of hours he put together a sequence of manual patches to the writable memory to temporarily disable the abort switch at crucial moments, with further patches necessary to deal with the consequences of this elsewhere in the code. The astronauts had to follow the instructions and key in the numbers exactly as given. (Upload? What upload?) This included having to manually crank the descent engine up to full thrust at the right time, because the automatic program for doing so would not be working. Anyway, as history records, they successfully made it down to the lunar surface, and back home again. Mission accomplished.

1 0

711 million email addresses ensnared in "largest" spambot
by Peter Reutemann 30 Aug '17

30 Aug '17

'A huge spambot ensnaring 711 million email accounts has been uncovered. A Paris-based security researcher, who goes by the pseudonymous handle Benkow, discovered an open and accessible web server hosted in the Netherlands, which stores dozens of text files containing a huge batch of email addresses, passwords, and email servers used to send spam. Those credentials are crucial for the spammer's large-scale malware operation to bypass spam filters by sending email through legitimate email servers.' -- source: http://www.zdnet.com/article/onliner-spambot-largest-ever-malware-campaign-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

scrollbars: click to scroll
by Peter Reutemann 29 Aug '17

29 Aug '17

Hi everyone Here's one for us old-fogies that don't like the new fandangled behavior of scrollbars, moving to where you click instead of scrolling (drives me nuts when scrolling through posts). For GTK do the following: - Create ~/.config/gtk-3.0/settings.ini - add the following content [Settings] gtk-primary-button-warps-slider = false --source: https://unix.stackexchange.com/a/306340 For Firefox itself do this: - go to about:config - right-click and select "New" of type "Integer" - use "ui.scrollToClick" as name and enter value "0" -- source: https://unix.stackexchange.com/a/276016 And, if you want your top/bottom buttons on the scrollbar back, have a look here: https://linuxnorth.wordpress.com/2014/06/01/vertical-scroll-bars-in-linux-m… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 4

On Internet Privacy, Be Very Afraid
by Peter Reutemann 29 Aug '17

29 Aug '17

'Cybersecurity expert and Berkman Klein fellow Bruce Schneier talked to the Gazette about what consumers can do to protect themselves from government and corporate surveillance. From the interview: GAZETTE: After whistleblower Edward Snowden's revelations concerning the National Security Agency's (NSA) mass surveillance operation in 2013, how much has the government landscape in this field changed? SCHNEIER: Snowden's revelations made people aware of what was happening, but little changed as a result. The USA Freedom Act resulted in some minor changes in one particular government data-collection program. The NSA's data collection hasn't changed; the laws limiting what the NSA can do haven't changed; the technology that permits them to do it hasn't changed. It's pretty much the same. GAZETTE: Should consumers be alarmed by this? SCHNEIER: People should be alarmed, both as consumers and as citizens. But today, what we care about is very dependent on what is in the news at the moment, and right now surveillance is not in the news. It was not an issue in the 2016 election, and by and large isn't something that legislators are willing to make a stand on. Snowden told his story, Congress passed a new law in response, and people moved on. GAZETTE: What about corporate surveillance? How pervasive is it? SCHNEIER: Surveillance is the business model of the internet. Everyone is under constant surveillance by many companies, ranging from social networks like Facebook to cellphone providers. This data is collected, compiled, analyzed, and used to try to sell us stuff. Personalized advertising is how these companies make money, and is why so much of the internet is free to users. We're the product, not the customer.' -- source: https://yro.slashdot.org/story/17/08/29/1725246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Ryzen Running Stable On Linux, Threadripper Builds Kernel In 36 Seconds
by Peter Reutemann 29 Aug '17

29 Aug '17

'After AMD confirmed the a "performance marginality problem" affecting some Ryzen Linux users, RMAs are being issued and replacement Ryzen processors arriving for affected opensource fans. Phoronix has been able to confirm that the new Ryzen CPUs are running stable without the segmentation fault problem that would occur under very heavy workloads. They have also been able to test now the Ryzen Threadripper 1950X. The Threadripper 1950X on Linux is unaffected by any issues unless you count the lack of a thermal reporting driver. With the 32 threads under Linux they have been able to build the Linux kernel in just about a half minute.' -- source: https://linux.slashdot.org/story/17/08/29/184243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Cryptocurrencies And Autonomous Weapons
by Lawrence D'Oliveiro 29 Aug '17

29 Aug '17

Al Jazeer’s “Counting The Cost” economics program this week <http://www.aljazeera.com/programmes/countingthecost/2017/08/cryptocurrencie…> talks, among other things, a bit about: * Cryptocurrencies (e.g. Bitcoin) -- is it too early to start regulating them? Start worrying about their use for illegal activities? Start investing in them? * Autonomous military weaponry -- should we start banning the creation of weapons that can take their own decision to shoot to kill? Or is more research needed? By the way, mentioned in passing in the latter segment is that Samsung-made autonomous guns are already deployed along South Korea’s border with its northern neighbour.

1 0

Addendum to last night's presentation on RPi projects
by Peter Reutemann 29 Aug '17

29 Aug '17

Hi everyone This was the other sensor project that I came across, using multiple arduino sensors to monitor humidity/temperature, collecting them with a RF receiver (though I wouldn't use xively.com to collect the data): https://computers.tutsplus.com/tutorials/building-a-wireless-sensor-network… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How the NSA Identified Satoshi Nakamoto
by Peter Reutemann 29 Aug '17

29 Aug '17

'The 'creator' of Bitcoin, Satoshi Nakamoto, is the world's most elusive billionaire. Very few people outside of the Department of Homeland Security know Satoshi's real name. In fact, DHS will not publicly confirm that even THEY know the billionaire's identity. Satoshi has taken great care to keep his identity secret employing the latest encryption and obfuscation methods in his communications. Despite these efforts (according to my source at the DHS) Satoshi Nakamoto gave investigators the only tool they needed to find him -- his own words. Using stylometry one is able to compare texts to determine authorship of a particular work. Throughout the years Satoshi wrote thousands of posts and emails and most of which are publicly available. According to my source, the NSA was able to the use the 'writer invariant' method of stylometry to compare Satoshi's 'known' writings with trillions of writing samples from people across the globe. By taking Satoshi's texts and finding the 50 most common words, the NSA was able to break down his text into 5,000 word chunks and analyse each to find the frequency of those 50 words. This would result in a unique 50-number identifier for each chunk. The NSA then placed each of these numbers into a 50-dimensional space and flatten them into a plane using principal components analysis. The result is a 'fingerprint' for anything written by Satoshi that could easily be compared to any other writing. The NSA then took bulk emails and texts collected from their mass surveillance efforts. First through PRISM and then through MUSCULAR, the NSA was able to place trillions of writings from more than a billion people in the same plane as Satoshi's writings to find his true identity. The effort took less than a month and resulted in positive match' -- source: https://tech.slashdot.org/story/17/08/28/1725232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Year After Mirai: DVR Torture Chamber Test Shows Two Minutes Between Exploits
by Peter Reutemann 29 Aug '17

29 Aug '17

'Over two days, the Internet Storm Center connected a default configured DVR to the internet, and rebooted it every 5 minutes in order to allow as many bots as possible to infect it. They detected about one successful attack (using the correct password xc3511) every 2 minutes. Most of the attackers were well known vulnerable devices. A year later, what used to be known as the "Mirai" botnet has branched out into many different variants. But it looks like much hyped "destructive" variants like Brickerbot had little or no impact.' -- source: https://it.slashdot.org/story/17/08/28/1812242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

One of 1st-known Android DDoS malware infects phones in 100 countries
by Peter Reutemann 29 Aug '17

29 Aug '17

'Last year, a series of record-setting attacks hitting sites including KrebsOnSecurity and a French Web host underscored a new threat that had previously gone overlooked: millions of Internet-connected digital video recorders and similar devices that could easily be wrangled into botnets that challenged the resources of even large security services. Now, for one of the first times, researchers are reporting a new platform recently used to wage powerful denial-of-service attacks that were distributed among hundreds of thousands of poorly secured devices: Google's Android operating system for phones and tablets. The botnet was made up of some 300 apps available in the official Google Play market. Once installed, they surreptitiously conscripted devices into a malicious network that sent junk traffic to certain websites with the goal of causing them to go offline or become unresponsive.' -- source: https://arstechnica.com/information-technology/2017/08/first-known-android-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How to Scan Your Linux Computer for Viruses and Rootkits
by rowan schischka 28 Aug '17

28 Aug '17

>Any volunteers? Especially people that have used one of these tools before. Unfortunately I am not in Hamilton atm, but if i was I would demonstrate an automated way to scan and alert the user. The tools are very straight forward to use. The hardest part I had was setting up local mail and sending a report to gmail without gmail marking it as spam.

1 0

Raspberry Pi - Raspbian released based on Debian 9 - Stretch
by Ian Stewart 27 Aug '17

27 Aug '17

Raspbian, the main distro for the Raspberry Pi, has now been released based on Debian 9 (Stretch). While this provides the benefits and enhancements of a more recent Linux release, another benefit is the updated products available in the Debian repository. You can download Raspian from https://www.raspberrypi.org/downloads/raspbian/ Raspbian Stretch with desktop Image with desktop based on Debian Stretch Version: August 2017 Release date: 2017-08-16 Kernel version: 4.9 Release notes: 2017-08-16: * Based on Raspbian Stretch (Debian version 9) * Version 60 of Chromium browser included * Version 3.0.1 of Sonic Pi included * Version 6.1.1 of RealVNC included * Version 0.17.4 of NodeRED included * Bluetooth audio routed via ALSA rather than Pulseaudio * SenseHAT extension added to Scratch 2 * Various desktop applications modified to prompt for sudo password if needed * lxinput control options for mouse speed simplified * lxpanel plugins moved into separate packages * Wireless firmware for Pi 3 and Pi 0W modified to address Broadpwn exploit * Latest kernel and firmware * Various small tweaks, bug fixes and theme modifications cheers, Ian.

2 1

How to Scan Your Linux Computer for Viruses and Rootkits
by Peter Reutemann 27 Aug '17

27 Aug '17

'Are you worried that your Linux computer may be infected with malware? Have you ever checked? While Linux systems tend to be less susceptible to malware than Windows, they can still be infected. Many times they’re less obviously compromised, too. There are a handful of excellent open-source tools to help you check if your Linux system has been the victim of malware. While no software is perfect, these three have a solid reputation and can be trusted to find most known threats.' -- source: https://www.maketecheasier.com/scan-linux-for-viruses-and-rootkits/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 5

A New Non-Money Oriented Crowdsourcing Platform Based On Code Contributions
by Peter Reutemann 27 Aug '17

27 Aug '17

An anonymous reader shares a new crowdfunding site built on open source principles to "remove the money element from project creation" so creators "don't have to take extreme actions such as quitting their jobs or compromising on their ideas because of investor demands. Because of the nature of crowdsourcer.io projects, project creators can remain as ambitious as funded projects and get all the contributors they need to make their idea a reality." >From the site: Crowdsourcer.io is an alternative crowd sourcing platform that allows developers and designers alike to create or join in on software related projects, build up their contribution and earn an income from the final product. Think of Crowdsourcer.io as something between open source software creation and Kickstarter start ups, a new crowd sourcing alternative, in its purest form" The site's creator recently answered questions on Reddit, saying they'd spent years fine-tuning the idea, and writing that "It's really focussed on people who don't want to quit their job to form their own software company, and don't want to become embroiled in debt or other financing." A note at the bottom of the site adds that "Crowdsourcer.io is young. We want your ideas!" -- source: https://developers.slashdot.org/story/17/08/27/0639253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

screen with a scrollbuffer / scroll wheel support
by Peter Reutemann 25 Aug '17

25 Aug '17

Hi everyone Finally figured out (well, by that I mean googled) how to change the scrollbuffer for screen sessions (running + default setting): https://stackoverflow.com/questions/8760346/how-do-i-increase-the-scrollbac… And how to get the mouse scroll wheel working (works on mate-terminal): https://stackoverflow.com/questions/359109/using-the-scrollwheel-in-gnu-scr… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux expr command tutorial for beginners (with examples)
by Peter Reutemann 25 Aug '17

25 Aug '17

'Sometimes, while working on the command line (especially when dealing with a shell script), you may find yourself in a situation where you have to perform actions like searching for a substring in a string, finding its index, as well as other things like performing comparisons and arithmetic operations. For those who aren't in the know, there exists a command line utility - dubbed expr - that lets you do all this. In this tutorial, we will discuss the basics of this command along with some of the features it provides.' -- source: https://www.howtoforge.com/linux-expr-command/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Touch-panel PCs run Raspbian on Raspberry Pi CM3
by Peter Reutemann 25 Aug '17

25 Aug '17

'Comfile has launched two IP65 protected, resistive touch panel PCs with 7- and 10.2-inch 800 x 480 displays, built around the Raspberry Pi Compute Module 3. In February, Saelig Co. announced distribution of Janz Tec’s Raspberry Pi 3-based emPC-A/RPI3 industrial controller. Now, Saelig has launched North American distribution of Korea-based Comfile’s ComfilePi line of touch panel computers built around the Raspberry Pi Compute Module 3 (CM3) computer-on-module version of the Raspberry Pi 3.' -- source: http://linuxgizmos.com/touch-panel-pcs-run-raspbian-on-raspberry-pi-cm3/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

You Can Help Purism Build the Secure Open Source Linux-based Librem 5 Smartphone
by Peter Reutemann 24 Aug '17

24 Aug '17

'Thankfully, consumers are starting to wake up and become more aware of security and privacy, and some companies, such as Purism, are designing products to safeguard users. The company's laptops, for instance, run an open source Linux-based operating system, called "PureOS" with a focus on privacy. These machines even have hardware "kill switches" so you can physically disconnect a webcam or Wi-Fi card. Today, Purism announces that it is taking those same design philosophies and using them to build a new $599 smartphone called Librem 5. The planned phone will use the GNOME desktop environment and PureOS by default, but users can install different distros too. Sound good? Well you can help the company build it through crowdfunding. "Purism, the social purpose corporation which designs and produces popular privacy conscious hardware and software, has revealed its plans to build the world's first encrypted, open platform smartphone that will empower users to protect their digital identity in an increasingly unsafe mobile world. After 18 months of R&D to test hardware specifications and engage with one of the largest phone fabricators, Purism is opening a self-hosted crowdfunding campaign to gauge demand for the initial fabrication order and add the features most important to users," says Puris' -- source: https://linux.slashdot.org/story/17/08/24/147204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft .NET Core 2.0 For Linux Released; Redhat Will Bundle Microsoft's .NET
by Peter Reutemann 24 Aug '17

24 Aug '17

'Microsoft recently released Visual Studio 15.3 for Windows and Visual Studio 7.1 for Mac with .NET core 2.0. In addition to porting Microsoft Code and SQL Server to Linux, they have ported .NET. Redhat will bundle .NET in their software offerings instead of relying on Mono. .NET core is Microsoft's open-source .NET platform which is not based off Mono and available for Linux, Mac, and Windows here.' -- source: https://tech.slashdot.org/story/17/08/23/2046234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Spyware backdoor prompts Google to pull 500 apps with >100m downloads
by Peter Reutemann 23 Aug '17

23 Aug '17

'At least 500 apps collectively downloaded more than 100 million times from Google's official Play Market contained a secret backdoor that allowed developers to install a range of spyware at any time, researchers said Monday. The apps contained a software development kit called Igexin, which makes it easier for apps to connect to ad networks and deliver ads that are targeted to the specific interests of end users. Once an app using a malicious version of Igexin was installed on a phone, the developer kit could update the app to include spyware at any time, with no warning. The most serious spyware installed on phones were packages that stole call histories, including the time a call was made, the number that placed the call, and whether the call went through. Other stolen data included GPS locations, lists of nearby Wi-Fi networks, and lists of installed apps.' -- source: https://arstechnica.com/information-technology/2017/08/500-google-play-apps… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Sky Versus The Newspapers
by Lawrence D'Oliveiro 22 Aug '17

22 Aug '17

Sky TV, in its latest annual report, is blaming its poor performance on “piracy”, specifically “the newspaper industry”. [CEO John] Fellet, in the company's annual report, said media outlets were taking clips from "the best parts" of Sky sport content and placing them on their websites without permission. Fair Dealing provisions in the Copyright Act allow news outlets to use a copyrighted work in the context of reporting current events. <http://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=11908731>

1 0

Moreutils – A Collection Of More Useful Unix Utilities
by Peter Reutemann 22 Aug '17

22 Aug '17

'We all know about GNU core utilities that comes pre-installed with all Unix-like operating systems. These are the basic file, shell and text manipulation utilities of the GNU operating system. The GNU core utilities contains the commands, such as cat, ls, rm, mkdir, rmdir, touch, tail, wc and many more, for doing the day-to-day operations. Since these commands are part of Core Utilities, you don’t have to manually install them. Among these utilities, there are also some other useful collection of Unix utilities which are not included in any Unix-like operating systems. Meet moreutilis, a growing collection of the unix tools. The moreutils can be installed on GNU/Linux, and various Unix flavours such as FreeBSD, openBSD and Mac OS.' -- source: https://www.ostechnix.com/moreutils-collection-useful-unix-utilities/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Solus 3 Released
by Peter Reutemann 21 Aug '17

21 Aug '17

'The Solus Project is proud to announce the availability of Solus 3, the latest release of its Linux-based operating system, which builds on its curated rolling release model. Solus offers users a free and modern alternative to commercial operating systems and provides users a safe and reliable vehicle to guide, guard and enable the user's journey through a shifting tech world to their destination and beyond.' -- source: http://www.linuxandubuntu.com/home/solus-3-released-here-is-whats-new-in-so… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

TheSSS (The Smallest Server Suite) 22.2 Debuts
by Peter Reutemann 21 Aug '17

21 Aug '17

'4MLinux developer Zbigniew Konojacki informs Softpedia on Sunday about the release and general availability of TheSSS (The Smallest Server Suite) 22.2 independently-developed, 4MLinux-based server-oriented GNU/Linux distribution. [...] Those unfamiliar with TheSSS (The Smallest Server Suite) will be glad to learn that the project provides them with a live server suite that lets them run a full-featured Linux server without installing any package on their computer, directly from the bootable medium. TheSSS is a lightweight and fast server solution, and it's free.' -- source: http://news.softpedia.com/news/thesss-the-smallest-server-suite-22-2-debuts… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

fdisk Versus parted
by Lawrence D'Oliveiro 21 Aug '17

21 Aug '17

When the first hard drives appeared that were bigger than the 2TiB limit that the MBR partition format could cope with, it seemed like the only tool available that could manage partitions in the new GPT format was GNU parted. So you had to say goodbye to the old fdisk and sfdisk utilities, and learn a new way of setting things up. Well, it turns out that the old programs have been updated with new features, and they can now cope with setting up and using GPT-partitioned disks just fine. I particularly like the “sfdisk -d” command, which dumps out the partition table in a detailed format that can be backed up and then used for restoration later, if the disk’s partition table should somehow get corrupted. As far as I could see, parted never gave the exact numbers, down to the sector, that were necessary for this. Also, in the past day, two problems with parted have manifested themselves acutely to me: * All partitioning changes are made immediately, unlike fdisk. * Also unlike fdisk, it didn’t seem to notice if you were clobbering existing partitions, and would happily overwrite them. Each of these (mis)features might seem bad enough on its own, but putting them together is a recipe for woe. So in future, I think I am going to abandon parted and go back to fdisk and sfdisk.

2 3

postmarketOS Pursues A Linux-Based, LTS OS For Android Phones
by Peter Reutemann 20 Aug '17

20 Aug '17

'Buy an iPhone and you might get 4-5 years of official software updates. Android phones typically get 1-3 years of updates... if they get any updates at all. But there are ways to breathe new life into some older Android phones. If you can unlock the bootloader, you may be able to install a custom ROM like LineageOS and get unofficial software updates for a few more years. The folks behind postmarketOS want to go even further: they're developing a Linux-based alternative to Android with the goal of providing up to 10 years of support for old smartphones... Right now postmarketOS is a touch-friendly operating system based on Alpine Linux that runs on a handful of devices including the Samsung Galaxy Nexus, Google Nexus 4, 5, and 7 (2012), and several other Samsung, HTC, LG, Motorola, and Sony smartphones. There are also ports for some non-Android phones such as the Nokia N900 and work-in-progress builds for the BlackBerry Bolt Touch 9900 and Jolla Phone. Note that when I say the operating system runs on those devices, I basically mean it boots. Some phones only have network access via a USB cable, for instance. None of the devices can actually be used to make phone calls. But here's the cool thing: the developers are hoping to create a single kernel that works with all supported devices, which means that postmarketOS would work a lot like a desktop operating system, allowing you to install the same OS on any smartphone with the proper hardware. One postmarketOS developer complains that Android's architecture "is based on forking (one might as well say copy-pasting) the entire code-base for each and every device and Android version. And then working on that independent, basically instantly incompatible version. Especially adding device-specific drivers plays an important role... Here is the solution: Bend an existing Linux distribution to run on smartphones. Apply all necessary changes as small patches and upstream them, where it makes sense."' -- source: https://linux.slashdot.org/story/17/08/19/2359258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intro To SELinux
by Lawrence D'Oliveiro 18 Aug '17

18 Aug '17

Came across this video recently <https://www.youtube.com/watch?v=cNoVgDqqJmM> from the Red Hat Summit a couple of years ago, which gives a simplified intro to Security-Enhanced Linux (SELinux), which is a set of high-security “mandatory access control” features added to the Linux kernel. There are still some people who get conniptions when they hear that SELinux was originally created by the US National Security Agency. But the code has been through a lot of independent peer review in the time (close to two decades) since then, so rest assured you can have high confidence in it. But it can be a very complex and intimidating piece of software: particularly if you get something wrong and then some service gets denied access to some file or other for mysterious reasons that you cannot fathom. Luckily, there are tools available to help you diagnose such problems. The video talks only about RHEL, but I think those tools are not distro-specific. For a start, SELinux can be set in one of three operating modes: “enabled” (actively blocking/enabling access according to set policy); “disabled” (not active), and “permissive” (where it logs only the actions it would take, without actually blocking any access). The last one is particularly useful for seeing what you would need to fix before you actually enable SELinux, before anything actually breaks. Related to this, each system log message denying access to something also shows a command that you can use to get more detailed information about why that access was blocked, and various things you might do to enable it if that’s what you want. RHEL itself allows you to set two levels of operation of SELinux: “targeted” mode (where a particular critical set of services is controlled by SELinux, while every thing else operates as though it were not there) and “multi-level/multi-category” mode, which is the one that probably justifies the reputation of SELinux for being complex and intimidating, and which is likely only of interest to certain Government employees who don’t like to talk about their job. And which is not addressed in the talk: it only describes “targeted” operation. The video goes step-by-step through a couple of scenarios with using SELinux to control the behaviour of Apache: granting users the ability to set up their own “public_html” directories, and moving a web page created by a staffer into the server area. It shows the mistakes you might make, how they manifest themselves in the logs, and how you correct them. He makes it seem so simple, you feel tempted to actually try SELinux for yourself. Go watch the video.

1 0

Intro To systemd
by Lawrence D'Oliveiro 18 Aug '17

18 Aug '17

Came across this YouTube video recently <https://www.youtube.com/watch?v=S9YmaNuvw5U> from the Red Hat Summit a couple of years ago, which gives a good intro to systemd, with Lennart Poettering as co-presenter. The video explains what a “service” is, and compares how much simpler it is to define a service (usually just a few lines of declarative config) versus the hundreds of lines of shell script it typically takes to set things up under the ancient sysvinit system. Not only that, but it is possible to customize the standard service definitions without having to copy and paste the entire existing definition file: you just create a few lines of additional/overriding definition in a “drop-in” file that you place in /etc, that matches the name of the original service definition. There is even a command, “systemd-delta”, which lets you immediately see all the places where your entire systemwide configuration has been so customized. Lennart mentions that speeding up boot was never a specific design goal, it just naturally came out of the parallelization of service startup. Because systemd lets you think in terms of “services” rather than “processes”, it achieves something that was difficult to ensure before, namely reliable shutdown of a service. Consider Apache, which typically spawns a whole lot of processes, and then if you run CGI scripts, they require additional processes. Nevertheless, shutting down httpd.service with systemd will ensure that all those processes are terminated. Another important feature of systemd is the logging. Here again systemd had a goal of achieving something that was difficult before, namely capturing all log messages from the earliest possible stages of the boot process, including the initrd stage. And also because the systemd journal mechanism has access to kernel information about the processes doing the logging, it can include information in the log entries that those processes cannot forge. Me, I like the fact that the log timestamps are stored in UTC, so you can display them in whatever timezone you wish. There is more, of course: “slices” are how systemd is able to strictly limit the resource usage of services (important to the RHEL-using, Java-suffering audience), and “sockets” are how the functionality of inetd/xinetd is carried over to the systemd world, so that services can be started on demand, instead of having to run all the time. Watch the video to learn more.

1 0

Do not rely on journald to continue logging after a stop+start
by Bryan Baldwin 18 Aug '17

18 Aug '17

Whilst investigating a problem where services logging to sterr go silent after journald is stopped and started, but not when "restarted", Evgeny Vereshchagin suggests not relying on journald. In spite of its man page, it seems that "restart" isn't quite the same thing as stop+start to journald. Vereshchagin also confirms that is isn't currently possible to prevent a manual stop without also preventing a "restart", and that these shortcomings in using journald should get added to the documentation. https://github.com/systemd/systemd/issues/6620#issuecomment-322718725

1 0

Mageia 6: is it the rise of Phoenix?
by Peter Reutemann 18 Aug '17

18 Aug '17

'There is no secret that I always preferred distributions with the DEB package format. However, there is an exception. Mageia was the distribution that I ran for quite long time on various laptops. Unfortunately, the issues with outdated packages made me leave this distribution behind some time ago. Just as a reminder, Mageia is an off-spring from the famous Mandriva family that survived when the Mandriva tree crashed. And to fill out the whole forest, OpenMandriva is another off-spring, and my recent test showed that it is far below the mother quality. Coming back to Mageia, it has been a long time since the previous version of this operating system was released. Mageia 5.0 was the “most recent release” for 1.5 years, and 5.1 was merely an update to it. Mageia 6 was released just few weeks ago, in July 2017. It is a good time to check it out now.' -- source: http://linuxblog.darkduck.com/2017/08/mageia-6-is-it-rise-of-phoenix.html Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

How To List The Dependencies Of A Package In Linux
by Peter Reutemann 17 Aug '17

17 Aug '17

'The other day I was trying to figure out if there is any easy way to find or list the dependencies of a package in Linux. I have been using Linux as my primary OS for few years now, yet I couldn’t how to find the dependencies for a certain package. Fortunately, I found a workaround after a few google searches and wanted to share it with our readers. So, here you go.' -- source: https://www.ostechnix.com/list-dependencies-package-linux/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

When The Cookie Meets The Blockchain
by Lawrence D'Oliveiro 17 Aug '17

17 Aug '17

Cryptocurrencies like Bitcoin are supposed to allow for completely anonymous financial transactions. However, if you use them at an online shopping site, such places often have enough tracking information in place to link you to a particular currency transaction anyway. <http://freedom-to-tinker.com/2017/08/17/when-the-cookie-meets-the-blockchai…>

2 2

Learn the basics of the ZSH shell
by Peter Reutemann 17 Aug '17

17 Aug '17

'Bash isn't bad. It gets the job done just fine, but have you ever considered what it'd be like if Bash had some extra features to make it more convenient to work with? That's more-or-less what ZSH is. It includes all of the features that you'd expect from Bash, but it also has some really nice additions to make your life easier. Actually, you'll be amazed at how much easier they make working in the command line. ' -- source: https://linuxconfig.org/learn-the-basics-of-the-zsh-shell Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

How to secure your LAMP server
by Peter Reutemann 17 Aug '17

17 Aug '17

'The LAMP stack which stands for Linux, Apache, MySQL/MariaDB and PHP/Python/Perl is a very popular combination of free and open-source software used to run millions of websites today. Although many opt for the much efficient LEMP stack based on Nginx instead of Apache, there are still a significant number of users that choose LAMP for their projects. In fact, more than 30% of the active websites today run on top of LAMP. The stack is considered as reliable and very suitable for running high-performance high-availability web applications. In this tutorial we are going to show you how to secure the LAMP stack on your Linux VPS.' -- source: https://www.rosehosting.com/blog/how-to-secure-your-lamp-server/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Email Provider ProtonMail Says It Hacked Back, Then Walks Claim Back
by Peter Reutemann 17 Aug '17

17 Aug '17

'On Wednesday, encrypted email provider ProtonMail claimed it had hacked someone who was impersonating its service in phishing emails, and the company then swiftly deleted the tweet. Early Wednesday morning, the security researcher known as x0rz tweeted out a series of screenshots allegedly showing someone sending emails that directed targets to a fake ProtonMail login screen. "You have an overdue invoice," the message read. In response, ProtonMail said it had taken action. "We also hacked the phishing site so the link is down now," ProtonMail tweeted. Depending on the context and what exactly the retaliating organization did, hacking back can be illegal. Hacking could violate the Computer Fraud and Abuse Act, or perhaps even wiretapping legislation. A recently proposed bill would attempt to legalize the practice. ProtonMail swiftly deleted its tweet, but not before x0rz could grab and subsequently tweet a screenshot. x0rz then deleted his own tweet at the request of ProtonMail.' -- source: https://it.slashdot.org/story/17/08/16/2021257/email-provider-protonmail-sa… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Review: System76’s Galago Pro solves “just works” Linux’s Goldilocks problem
by Peter Reutemann 16 Aug '17

16 Aug '17

'In recent years, the PC industry has finally spawned a few manufacturers offering up machines with Linux pre-installed to eliminate this issue. By this point, I've tested most of them around Ars: Dell's XPS and Precision lines both have Linux-friendly offerings, and dedicated Linux manufacturers like System76 have long offered decent hardware with Linux pre-installed. In all this testing, I've yet to encounter a driver problem, which is the real benefit of a machine with Linux pre-installed. (Though to be fair, I could say the same for the Lenovo x240 that serves as my daily driver.) Still, finding the perfect Linux laptop has always been and remains something of a Goldilocks problem: this one is too big, this one is too underpowered, this one has too little RAM, this one lacks a big SSD, and so on. Generally speaking, if you want power and storage you're going to end up with something too big to comfortably throw in a bag and carry all day. The Dell Precision 7520 and the System76 Oryx Pro are good examples of this. [...] What Linux users like myself have long wanted is a laptop with roughly the form factor and weight of a Macbook pro, but with the option to get 32GB of RAM or 3TB of storage. This is the mythical unicorn of pre-built Linux machines, a laptop that is both reasonably lightweight and powerful. And that, my fellow Linux users, is refreshingly what System76 has managed to deliver with its new Galago Pro laptop.' -- source: https://arstechnica.com/gadgets/2017/08/review-system76s-galago-pro-solves-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

OpenSource.com Test-Drives Linux Distros From 1993 To 2003
by Peter Reutemann 14 Aug '17

14 Aug '17

'A unique trait of open source is that it's never truly EOL (End of Life). The disc images mostly remain online, and their licenses don't expire, so going back and installing an old version of Linux in a virtual machine and getting a precise picture of what progress Linux has made over the years is relatively simple... Whether you're new to Linux, or whether you're such an old hand that most of these screenshots have been more biographical than historical, it's good to be able to look back at how one of the largest open source projects in the world has developed. More importantly, it's exciting to think of where Linux is headed and how we can all be a part of that, starting now, and for years to come. The article looks at seven distros -- Slackware 1.01 (1993), Debian 0.91 (1994), Jurix/S.u.S.E. (1996), SUSE 5.1 (1998), Red Hat 6.0 (1999), Mandrake 8.0 (2001), and Fedora 1 (2003). Click through for some of the highlights.' -- source: https://linux.slashdot.org/story/17/08/12/0341251 Cheers, Pete -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Clamping Down On VPNs
by Lawrence D'Oliveiro 12 Aug '17

12 Aug '17

“The Listening Post” on Al Jazeera this week <http://www.aljazeera.com/programmes/listeningpost/2017/08/great-firewall-up…> talks among other things about the attempts by China and other countries to clamp down on their citizens’ access to virtual private networks. While these have many legitimate “non-political” applications (particularly for business), they can also be used to bypass state censorship. China, as you may know, has the most advanced system for restricting access within its borders to sources of content outside them that the state has deemed undesirable. The plan for ensuring that this clampdown on VPNs is done in a way that doesn’t hurt its own business interests is to license VPN providers within the country, and make sure they allow state monitoring, and do not give access to “undesirable” sites. Apple, for one, has acquiesced to China’s demands and removed VPN apps from its Iphone app store within the PRC. However, as one of those interviewed in the piece points out, on the Android side there are 400 different app stores accessible within China, and it would be quite another matter to make sure they all comply with the new law.

1 0

That Reminds Me ...
by Lawrence D'Oliveiro 10 Aug '17

10 Aug '17

... I finally got around to writing up some notes on the tips I presented for accessing the systemd journal at that talk last year <https://github.com/WLUG/meetings/tree/master/2016/2016-06-27>.

6 11

A look at OpenSUSE based Gecko Linux
by Peter Reutemann 10 Aug '17

10 Aug '17

'I was sitting at home writing future articles for Ghacks and I decided on a spur of the moment whim that I wanted to try out a distribution I had never touched before. I’ve tried countless systems over the years, from the typical Ubuntu and Debian based systems, to Arch based systems like Manjaro, even Gentoo based systems like Sabayon. However, I was thinking about it and OpenSUSE used to be one of my favourite distributions to use but I’ve never actually sat down and tried a respin of an OpenSUSE based system; so I started digging around into what some popular ones were...And Gecko Linux caught my eye.' -- source: https://www.ghacks.net/2017/08/06/a-look-at-opensuse-based-gecko-linux/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

exa a modern replacement for ls written in rust for Linux/Unix
by Peter Reutemann 09 Aug '17

09 Aug '17

'ls is a command to show files in Linux and Unix-like operating systems. A ls command first appeared in a version of AT&T UNIX as well as in Multics. BSD and GNU Coreutils package provides the ls command with minor syntax changes. There is now third alternative named exa. It is a modern replacement for ls. The exa uses colors for information by default, helping you distinguish between many types of files, such as whether you are the owner, or in the owning group. It also has extra features not present in the original ls, such as viewing the Git status for a directory or recursing into directories with a tree view. The exa command written in Rust, so it’s small, fast, and portable.' -- source: https://www.cyberciti.biz/open-source/command-line-hacks/exa-a-modern-repla… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Firefox 55 Arrives With WebVR on Windows, Performance Panel, and Click-to-Play Flash
by Peter Reutemann 08 Aug '17

08 Aug '17

'Mozilla today made available a new update to Firefox for Windows to introduce support for WebVR, that the company says, will enable desktop VR users to dive into web-based experiences with ease. Firefox 55 also includes performance panel, faster startup when restoring multiple tabs, a quicker way to search across various search engines, and click-to-play Flash by default. From a report: WebVR is an experimental JavaScript API that provides support for virtual reality devices, such as the HTC Vive, Oculus Rift, and Google Cardboard. As its name implies, the technology is meant for browsers. If you find a web game or app that supports VR, just click the VR goggles icon visible on the web page to experience it using your VR headset. WebVR supports navigating and controlling VR experiences with handset controllers or your movements in physical space. [...] Firefox 55 also allows users to adjust the number of processes and how much resources they want to allocate to any of them. This setting is at the bottom of the General section in Options. In fact, if your computer has more than 8GB of RAM, Mozilla recommends "bumping up the number of content processes that Firefox uses" because it will make Firefox faster, though at the expense of using more memory. In its own tests on Windows 10, the company found that Firefox uses less memory than Chrome, even with eight content processes running.' -- source: https://tech.slashdot.org/story/17/08/08/143246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla’s new file-transfer service isn’t perfect, but it’s drop-dead easy
by Peter Reutemann 07 Aug '17

07 Aug '17

'Mozilla is testing a new service that makes it dead simple and quick for people to semi-securely share files with anyone on the Internet. Send, as the service is called, allows senders to encrypt any 1-gigabyte or less file and upload it to a Mozilla server. The service then creates a link with a long, complex string of letters in it that's required to download and decrypt the file. Mozilla will automatically delete the encrypted file as soon as it's downloaded or within 24 hours of being uploaded, even if no one has downloaded it.' -- source: https://arstechnica.com/information-technology/2017/08/mozillas-new-file-tr… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

OpenSSL Support In Debian Unstable Drops TLS 1.0/1.1 Support
by Peter Reutemann 07 Aug '17

07 Aug '17

'Debian Linux "sid" is deprecating TLS 1.0 Encryption. A new version of OpenSSL has been uploaded to Debian Linux unstable. This version disables the TLS 1.0 and 1.1 protocol. This currently leaves TLS 1.2 as the only supported SSL/TLS protocol version. This will likely break certain things that for whatever reason still don't support TLS 1.2. I strongly suggest that if it's not supported that you add support for it, or get the other side to add support for it. OpenSSL made a release 5 years ago that supported TLS 1.2. The current support of the server side seems to be around 90%. I hope that by the time Buster releases the support for TLS 1.2 will be high enough that I don't need to enable them again. This move caused some concern among Debian users and sysadmins. If you are running Debian Unstable on server tons of stuff is going to broken cryptographically. Not to mention legacy hardware and firmware that still uses TLS 1.0. On the client side (i.e. your users), you need to use the latest version of a browser such as Chrome/Chromium and Firefox. The Older version of Android (e.g. Android v5.x and earlier) do not support TLS 1.2. You need to use minimum iOS 5 for TLS 1.2 support. Same goes with SMTP/mail servers, desktop email clients, FTP clients and more. All of them using old outdated crypto. This move will also affect for Android 4.3 users or stock MS-Windows 7/IE users (which has TLS 1.2 switched off in Internet Options.) Not to mention all the mail servers out there running outdated crypto.' -- source: https://linux.slashdot.org/story/17/08/07/1823244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GNOME's Text Editor gedit 'No Longer Maintained', Needs New Developers
by Peter Reutemann 06 Aug '17

06 Aug '17

'AmiMoJo brings news about gedit, the default text editor for GNOME: In a post to the gedit mailing list, Sébastien Wilmet states that gedit is no longer maintained and asks "any developer interested to take over the maintenance of gedit?" Just in case you were considering it, he warns "BTW while the gedit core is written in C (with a bit of Objective-C for Mac OS X support), some plugins are written in Vala or Python. If you take over gedit maintenance, you'll need to deal with four programming languages (without counting the build system). The Python code is not compiled, so when doing refactorings in gedit core, good luck to port all the plugins (the Python code is also less "greppable" than C). At least with Vala there is a compiler, even if I would not recommend Vala." Sébastien's comments were surrounded by a <rant-on-languages> tag, but they're still crying out for some serious discussion. Any Slashdot readers want to share their own insights on Python, some fond thoughts on gedit, or suggestions for maintaining a great piece of open source software?' -- source: https://tech.slashdot.org/story/17/08/05/025227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Red Hat Acquires Data-Cleaning Company Permabit
by Peter Reutemann 06 Aug '17

06 Aug '17

'Business software company Red Hat said on Monday that it is acquiring the technology assets of Permabit, a small company that specializes in cleaning up corporate data to make storage more efficient and data access faster. Terms of the deal were not disclosed but a Red Hat spokesman said 16 people from Permabit will be joining that company... While the conventional wisdom is that data storage is cheap, it is not free. And with companies turning to more expensive flash storage, it saves money to remove redundant data, said Richard Fichera, vice president and principal analyst at Forrester Research... Red Hat, which sells a version of the Linux operating system used by many Fortune 500 companies, also offers its own storage software. And, it wants to become a more formidable challenger in data storage, a goal that can be furthered by buying Permabit's technology, Fichera said. Slashdot reader See Attached points out that this week Red Hat also released RHEL 7.4, which introduces support for Network Bound Disk Encryption (NBDE) and system protection against intrusive USB devices.' -- source: https://linux.slashdot.org/story/17/08/05/0453223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linux Kernel Hardeners Grsecurity Sue Open Source's Bruce Perens
by Peter Reutemann 06 Aug '17

06 Aug '17

'In late June, noted open-source programmer Bruce Perens [a longtime Slashdot reader] warned that using Grsecurity's Linux kernel security could invite legal trouble. "As a customer, it's my opinion that you would be subject to both contributory infringement and breach of contract by employing this product in conjunction with the Linux kernel under the no-redistribution policy currently employed by Grsecurity," Perens wrote on his blog. The following month, Perens was invited to court. Grsecurity sued the open-source doyen, his web host, and as-yet-unidentified defendants who may have helped him draft that post, for defamation and business interference. Grsecurity offers Linux kernel security patches on a paid-for subscription basis. The software hardens kernel defenses through checks for common errors like memory overflows. Perens, meanwhile, is known for using the Debian Free Software Guidelines to draft the Open Source Definition, with the help of others. Grsecurity used to allow others to redistribute its patches, but the biz ended that practice for stable releases two years ago and for test patches in April this year. It offers its GPLv2 licensed software through a subscription agreement. The agreement says that customers who redistribute the code -- a right under the GPLv2 license -- will no longer be customers and will lose the right to distribute subsequent versions of the software. According to Perens, "GPL version 2 section 6 explicitly prohibits the addition of terms such as this redistribution prohibition." A legal complaint (PDF) filed on behalf of Grsecurity in San Francisco, California, insists the company's software complies with the GPLv2. Grsecurity's agreement, the lawsuit states, only applies to future patches, which have yet to be developed. Perens isn't arguing that the GPLv2 applies to unreleased software. Rather, he asserts the GPLv2, under section 6, specifically forbids the addition of contractual terms.' -- source: https://yro.slashdot.org/story/17/08/04/2233239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Browser Extensions Are Undermining Privacy
by Peter Reutemann 06 Aug '17

06 Aug '17

'pizzutz writes: Chrome's popular Web Developer plugin was briefly hijacked on Wednesday when an attacker gained control of the author's Google account and released a new version (0.49) which injected ads into web pages of more than a million users who downloaded the update. The version was quickly replaced with an uncompromised version (0.5) and all users are urged to update immediately. Lauren Weinstein has a broader warning: While the browser firms work extensively to build top-notch security and privacy controls into the browsers themselves, the unfortunate fact is that these can be undermined by add-ons, some of which are downright crooked, many more of which are sloppily written and poorly maintained. Ironically, some of these add-on extensions and apps claim to be providing more security, while actually undermining the intrinsic security of the browsers themselves. Others (and this is an extremely common scenario) claim to be providing additional search or shopping functionalities, while actually only existing to silently collect and sell user browsing activity data of all sorts. Lauren also warns about sites that "push users very hard to install these privacy-invasive, data sucking extensions" -- and believes requests for permissions aren't a sufficient safeguard for most users. "Expecting them to really understand what these permissions mean is ludicrous. We're the software engineers and computer scientists -- most users aren't either of these. They have busy lives -- they expect our stuff to just work, and not to screw them over."' -- source: https://yro.slashdot.org/story/17/08/05/2122210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Windows console is getting a new, easier to read color scheme
by Lawrence D'Oliveiro 03 Aug '17

03 Aug '17

“Even with this work, the Windows console is still weak compared to its counterparts in macOS and Linux. In Windows, the operating systems-supplied console windows are closely tied to the command-line applications that use them; it's impossible to create a command-line application that isn't attached to a Windows console window. Linux and macOS offer a separation between the software that's displaying the console apps and the console apps themselves. Those operating systems have a built-in default console, but unlike Windows, they don't have to use it; third-party software can fill the same role. “Attractive, modern terminal applications like iTerm on macOS and Unix stalwarts such as screen (which enables multiple command-line shells to share a single console window) take advantage of this extensibility. Neither kind of application can be readily developed for command-line apps on Windows, and while people have tried to work around Windows' limitations (for example, by hiding the Windows built-in console windows off-screen somewhere), the results are imperfect. We're told that there are plans in store to finally address this weakness of Windows, though what the solution will be is at present unknown.” <https://arstechnica.com/gadgets/2017/08/the-windows-console-is-getting-a-ne…>

1 0

Systemd wins top gong for 'lamest vendor' in Pwnie security awards
by Bryan Baldwin 30 Jul '17

30 Jul '17

The lamest vendor response award went to Systemd supremo Lennart Poettering for his controversial, and perhaps questionable, handling of the following bugs in everyone's favorite init replacement. Nomination Submission: Awarded to the vendor who mis-handled a security vulnerability most spectacularly. SystemD bugs 5998, 6225, 6214, 5144, 6237 Credit: Lennart Poettering Where you are dereferencing null pointers, or writing out of bounds, or not supporting fully qualified domain names, or giving root privileges to any user whose name begins with a number, there's no chance that the CVE number will referenced in either the change log or the commit message. But CVEs aren't really our currency any more, and only the lamest of vendors gets a Pwnie! https://pwnies.com/nominations/ https://www.theregister.co.uk/2017/07/28/black_hat_pwnie_awards/

3 2

Trust Me, I’m A Random-Number Generator
by Lawrence D'Oliveiro 30 Jul '17

30 Jul '17

SK Telecom has created a “quantum random number generator” chip <https://www.theregister.co.uk/2017/07/26/sk_telecom_makes_light_of_random_n…>. Seems like slapping the label “quantum” on anything is enough to make people believe you know what you are talking about. Random-number generators are notorious for being easily subverted. And hearing things like “SK Telecom hasn't specified what kind [of quantum noise source they are using]” is not exactly reassuring. You can never be sure your random numbers are truly random. But you try to stack the deck as much in your favour as you can. The Linux kernel mixes in several sources of entropy to feed /dev/random (and from there, /dev/urandom), in the hope that, as long as one of them remains unsubverted (intentionally or otherwise), the output can be trusted. This is also the principle behind the Fortuna PRNG <https://en.wikipedia.org/wiki/Fortuna_(PRNG)>, which well-known computer security guru Bruce Schneier had a hand in.

2 3

Anti-systemd Trolls
by Lawrence D'Oliveiro 27 Jul '17

27 Jul '17

I keep wondering about these random names who pop up with all the badmouthing every time somebody mentions something about systemd. I don’t recall any faces at WLUG meetings that go with them. Who are you and where do you come from? Do you people have any interest in the Waikato Linux User Group at all, or are you just here to shoot your mouths off?

4 9

Some Low-Cost Android Phones Come at a Price -- Your Privacy
by Peter Reutemann 27 Jul '17

27 Jul '17

'At $60, the BLU R1 HD is the top-selling phone on Amazon. Last November, researchers caught it secretly sending private data to China. Shanghai Adups Technology, the group behind the spying software on the BLU R1 HD, called it a mistake. But analysts at Kryptowire found the software provider is still making the same "mistake" on other phones. At the Black Hat security conference in Las Vegas on Wednesday, researchers from Kryptowire, a security firm, revealed that Adups' software is still sending a device's data to the company's server in Shanghai without alerting people. But now, it's being more secretive about it. "They replaced them with nicer versions," Ryan Johnson, a research engineer and co-founder at Kryptowire, said. "I have captured the network traffic of them using the Command and Control channel when they did it." An Adups spokeswoman said that it had resolved the issues in 2016 and that the issues "are not existing anymore." Kryptowire said it has observed the company sending data without telling users on at least three different phones.' -- source: https://it.slashdot.org/story/17/07/26/187258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Wellcome Trust Wants To Share
by Lawrence D'Oliveiro 26 Jul '17

26 Jul '17

You’ve probably heard of the Wellcome Trust: they’re a UK-based nonprofit that funds scientific research, primarily into health. They’ve long had an open-access policy, meaning that “all original research articles and scholarly monographs resulting from our funding are made freely available”. Contrast this with what more commonly happens with scientific research, where the journal publishers get exclusive copyright over the papers, and charge an arm and a leg to everyone wanting a copy. Now the Wellcome Trust is going even further, and requiring open access in a timely manner to the raw research data (within reasonable limits, such as privacy concerns etc), material such as cell lines, antibodies and reagents, and also any software developed. No actual mention of “open source” or “Free software” licences as such, though; the news article only uses the word “freeware”, which I’m not sure is the word they should be using. <https://www.theregister.co.uk/2017/07/25/wellcome_trust_extends_research_da…> <https://wellcome.ac.uk/news/our-new-policy-sharing-research-data-what-it-me…>

1 0

Intel Abandons Consumer/Hobbyist IoT
by Lawrence D'Oliveiro 26 Jul '17

26 Jul '17

Intel is giving up on its consumer/hobbyist-oriented Internet of Things products <https://www.theregister.co.uk/2017/07/25/intel_arduino_board_curie_canceled/>. However, the “enterprise”-oriented efforts remain for now. Not sure what “enterprise” means in this space: are there companies building IoT-type devices for their own internal use? Or is this referring to companies selling readymade IoT products? In any case, I suspect this is the one area left where “Windows 10 IoT Edition” can be mentioned without raising hails of derisive laughter...

1 0

The systemd House Of Horror
by Lawrence D'Oliveiro 26 Jul '17

26 Jul '17

Came across this link in one of the comments to The Register’s article on Fedora 26, rife with the usual anti-systemd moaning. “Here are some examples of how people commonly use systemd in an egregiously wrong manner ... Don't ask me why, so far, all of these have involved starting Java programs. Maybe it's Oracle in general.” <https://jdebp.eu/FGA/systemd-house-of-horror/>

2 6

'Devil's Ivy' Is Another Wake-Up Call for IoT Security
by Peter Reutemann 26 Jul '17

26 Jul '17

'The vulnerability -- called Devil's Ivy or CVE-2017-9765 -- was made public last week by Senrio, a company that specializes in IoT security. It initially found the bug in the M3004 model security camera marketed by Axis Communications, but further research found that 249 of Axis's 251 surveillance camera models are affected. Although that's of lot of devices, it's only the tip of the iceberg, as the problem isn't with code that's native to Axis products but is in gSOAP, an open source web services library that's used by many developers. Media outlets are reporting that 34 companies use gSOAP -- a list that includes Microsoft, IBM, Xerox and Adobe.' -- source: http://windowsitpro.com/internet-things-iot/devils-ivy-another-wake-call-io… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Using Gnome Disk Utility - "Disks" - to install distro iso to USB stick.
by Ian Stewart 24 Jul '17

24 Jul '17

Hi, I mentioned this at last nights meeting, so here is the link info. You might be used to burning distro iso image files to USB sticks using the dd command line utility, or Ubuntu's Startup Disk Creator gui application. The Fedora 21 Installation Guide<https://docs.fedoraproject.org/en-US/Fedora/21/html/Installation_Guide/inde…> describes another way<https://docs.fedoraproject.org/en-US/Fedora/21/html/Installation_Guide/sect…>. You launch the Gnome Disk Utility by clicking on the Disks application icon, or from the command line as gnome-disks, and follow these instructions... Procedure 3.4. Creating USB media with GNOME Disks 1. On a system with GNOME, or with the gnome-disk-utility package installed, open Disks using the system menu. 2. Click your USB device in the left column. 3. Click the menu icon in the upper right corner of the window, and choose the Restore Disk Image option. 4. Navigate to your image file and click Start Restoring. After a few minutes, it will report the process is complete and your installation media will be ready to use. cheers, Ian.

2 1

How a VC-Funded Company Is Undermining the Open-Source Community
by Peter Reutemann 24 Jul '17

24 Jul '17

'Is a $4 million venture capital-funded startup stealthily taking over popular coding tools and injecting ads and spyware into them? That's what some programmers fear may be happening. It is one of the most troubling scandals to hit the open-source community -- a robust network of programmers who work on shared tools for free -- in recent memory. It started back in April, when a programmer noticed a strange change to an open-source tool called Minimap. Minimap has had more than 3.5 million downloads, but like many open-source tools, it was maintained by a single person who no one knew much about other than their username: @abe33. At some point, @abe33, whose real name is Cedric Nehemie, was hired by Kite. Kite was started by Adam Smith, a successful tech entrepreneur who raised funding from a slew of big names including the CEO of Dropbox and the creator of WordPress. It is unclear what Kite's business model is, but it says it uses machine-learning techniques to make coding tools. Its tools are not open source. After being hired by Kite, @abe33 made an update to Minimap. The update was titled "Implement Kite promotion," and it appeared to look at a user's code and insert links to related pages on Kite's website. Kite called this a useful feature. Programmers said it was not useful and was therefore just an ad for an unrelated service, something many programmers would consider a violation of the open-source spirit. "It's not a feature, it's advertising -- and people don't want it, you want it," wrote user @p-e-w. "The least you can do is own up to that." "I have to wonder if your goal was to upset enough people that you'd generate real attention on various news sites and get Kite a ton of free publicity before your next funding round," @DevOpsJohn wrote. "That's the only sane explanation I can find for suddenly dropping ads into the core of one of the oldest and most useful Atom plugins." [...] Although Kite has no business model yet, it's widely thought in Silicon Valley that having users is the first step toward profitability. Adding users potentially benefits the company in another way, by giving it access to precious data. Kite says it uses machine learning tactics to make the best coding helper tools possible. In order to do that, it needs tons of data to learn from. The more code it can look at, the better its autocomplete suggestions will get, for example.' -- source: https://developers.slashdot.org/story/17/07/24/0118202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DNS Lib Underscore Bug Bites Everyone's Favorite Init Tool, Blanks Netflix
by Peter Reutemann 24 Jul '17

24 Jul '17

'Systemd doing what it does best. From a report on The Register: A few Penguinistas spent a weekend working out why they can't get through to Netflix from their Linux machines, because when they tried, their DNS lookups failed. The issue emerged over the weekend, when Gentoo user Dennis Schridde submitted a bug report to the Systemd project. Essentially, he described a failure within systemd-resolve, a Systemd component that turns human-readable domain names into IP addresses for software, like web browsers, to connect to. The Systemd resolver couldn't look up Netflix's servers for Schridde's web browser, according to the report. In his detailed post, Schridde said he expected this to happen: ipv6_1-cxl0-c088.1.lhr004.ix.nflxvideo.net gets resolved to 37.77.187.142 or 2a00:86c0:5:5::142. When in reality, that wasn't happening, so Netflix couldn't be reached on his box. His speculation that libidn2, which adds internationalised domain names support to the resolver, was at fault turned out to be accurate. Rebuilding Systemd without that library cleared the problem.' -- source: https://linux.slashdot.org/story/17/07/24/1558259 Please, no flame war... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mysterious Mac Malware Has Infected Hundreds of Victims For Years
by Peter Reutemann 24 Jul '17

24 Jul '17

'A mysterious piece of malware has been infecting hundreds of Mac computers for years -- and no one noticed until a few months ago. The malware is called "FruitFly," and one of its variants, "FruitFly 2" has infected at least 400 victims over the years. FruitFly 2 is intriguing and mysterious: its goals, who's behind it, and how it infects victims, are all unknown. Earlier this year, an ex-NSA hacker started looking into a piece of malware he described to me as "unique" and "intriguing." It was a slightly different strain of a malware discovered on four computers earlier this year by security firm Malwarebytes, known as "FruitFly." This first strain had researchers scratching their heads. On the surface, the malware seemed "simplistic." It was programmed mainly to surreptitiously monitor victims through their webcams, capture their screens, and log keystrokes. But, strangely, it went undetected since at least 2015. There was no indication of who could be behind it, and it contained "ancient" functions and "rudimentary" remote control capabilities, Malwarebytes's Thomas Reed wrote at the time.' -- source: https://it.slashdot.org/story/17/07/24/1719255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla's New Open Source Voice-Recognition Project Wants Your Voice
by Peter Reutemann 23 Jul '17

23 Jul '17

'Mozilla is building a massive repository of voice recordings for the voice apps of the future -- and it wants you to add yours to the collection. The organization behind the Firefox browser is launching Common Voice, a project to crowdsource audio samples from the public. The goal is to collect about 10,000 hours of audio in various accents and make it publicly available for everyone... Mozilla hopes to hand over the public dataset to independent developers so they can harness the crowdsourced audio to build the next generation of voice-powered apps and speech-to-text programs... You can also help train the speech-to-text capabilities by validating the recordings already submitted to the project. Just listen to a short clip, and report back if text on the screen matches what you heard... Mozilla says it aims is to expand the tech beyond just a standard voice recognition experience, including multiple accents, demographics and eventually languages for more accessible programs. Past open source voice-recognition projects have included Sphinx 4 and VoxForge, but unfortunately most of today's systems are still "locked up behind proprietary code at various companies, such as Amazon, Apple, and Microsoft."' -- source: https://news.slashdot.org/story/17/07/22/2026208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Debian, Gnome Patched 'Bad Taste' VBScript-Injection Vulnerabilities
by Peter Reutemann 23 Jul '17

23 Jul '17

'A now-patched vulnerability in the "GNOME Files" file manager was recently discovered which allowed hackers to create dodgy MSI files which would run malicious VBScript code on Linux... Once Nils Dagsson Moskopp discovered the bug, he reported it to the Debian Project which fixed it very rapidly. The GNOME Project also patched the gnome-exe-thumbnailer file which is responsible for parsing MSI and EXE files inside the GNOME Files app... If you run a Linux distribution with the GNOME desktop it's advisable to run the update manager and check for updates as soon as possible before you become affected by this critical vulnerability.' -- source: https://tech.slashdot.org/story/17/07/22/1911237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Debian 'Stretch' Updated With 9.1 Release
by Peter Reutemann 23 Jul '17

23 Jul '17

'The Debian project is pleased to announce the first update of its stable distribution Debian 9 (codename "stretch"). This point release mainly adds corrections for security issues, along with a few adjustments for serious problems... Please note that the point release does not constitute a new version of Debian 9 but only updates some of the packages included. There is no need to throw away old "stretch" media... Those who frequently install updates from security.debian.org won't have to update many packages, and most such updates are included in the point release.' -- source: https://linux.slashdot.org/story/17/07/23/1930253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next week?
by Peter Reutemann 22 Jul '17

22 Jul '17

Hi everyone We don't have any topics lined up yet for next Monday's meeting. Any ideas? A new Fedora release (https://getfedora.org/) is out - give it a spin? Maybe an introduction on how to use man pages efficiently? For commands and programming? Introduction to useful basic commands: ls, cat/tac/zcat, less, column, grep, find, sort, sed, ... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

next lug meet -fedora 26
by Ian Young 22 Jul '17

22 Jul '17

I will bring a live version of Fedora 26 if there is time available at the meeting ~ Ian Y

2 1

Sysadmin position
by Stuart Inglis 20 Jul '17

20 Jul '17

We are looking for an experienced Linux Administrator to join our team. Being one of the larger website hosting providers in New Zealand our ideal candidate would come from an ISP or web hosting background. To be successful in this role, you would ideally have: - 3+ Years practical experience in the administration of Linux servers - Great multi-tasking skills - Ability to troubleshoot complex problems, software faults, and operational issues and take appropriate corrective action personally and by interacting with other members of the systems team. - Strong technical knowledge - Experience in setting up high-load, high-availability, multi-data centre environments - Experience in supporting MySQL - Configuring and fine-tuning Apache - Knowledge of web architecture - Disaster recovery management - Experience with KVM or other Virtualisation platforms - Excellent communication skills are essential In return we can offer you the chance to work for a leading organisation, work on some exciting projects and deliver key solutions to a variety of clients. This position is based in our office in Hamilton, no teleworking. Applications must be able to attend interviews in Hamilton, NZ. If this sounds like you please don't hesitate to send in your CV today. kind regards Stuart Inglis, Ph.D. | Chief Technology Officer Director NetValue Limited Level 1, SouthBloc, 19 Knox Street, Hamilton M +64 (0) 21 907 532 E stuart.inglis(a)netvalue.nz | W netvalue.nz

1 0

4 lightweight image viewers for the Linux desktop
by Peter Reutemann 18 Jul '17

18 Jul '17

'Like most people, you probably have more than a few photos and other images on your computer. And, like most people, you probably like to take a peek at those images and photos every so often. Firing up an editor like GIMP or Pinta is overkill for simply viewing images. On the other hand, the basic image viewer included with most Linux desktop environments might not be enough for your needs. If you want something with a few more features, but still want it to be lightweight, then take a closer look at these four image viewers for the Linux desktop, plus a handful of bonus options if they don't meet your needs.' -- source: https://opensource.com/article/17/7/4-lightweight-image-viewers-linux-deskt… I've just switched to Nomacs as my default viewer. Fast and displays the EXIF information in a separate pane, which is rather handy for my work. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bruce Schneier’s Book Review: “Twitter And Tear Gas”
by Lawrence D'Oliveiro 14 Jul '17

14 Jul '17

There are two opposing models of how the Internet has changed protest movements. The first is that the Internet has made protesters mightier than ever. ... The second is that it has made them more ineffectual. Derided as "slacktivism" or "clicktivism," the ease of action without commitment can result in movements like Occupy petering out in the US without any obvious effects. Of course, the reality is more nuanced ... <https://www.schneier.com/blog/archives/2017/07/book_review_twi.html>

1 0

PC Sales Still In Decline
by Lawrence D'Oliveiro 14 Jul '17

14 Jul '17

Looks like world PC shipments are now down to about 240 million a year <https://www.theregister.co.uk/2017/07/13/pc_sales_still_slumping_but_more_s…>. I think the peak, maybe ten years ago, was a million a day.

1 0

Looking for something to celebrate today?
by Ian Stewart 14 Jul '17

14 Jul '17

Hi, If you are looking for something to celebrate today, the 14th July 2017, then there's always the storming of La Bastille<https://en.wikipedia.org/wiki/Storming_of_the_Bastille>. If this doesn't appeal, and you are looking for something a little more global, then there is a minor milestone in Unix epoch time<https://en.wikipedia.org/wiki/Unix_time>. For NZ this will occur today at 14:40. It is when Unix time ticks over the 1.5 billion seconds mark. $ date --date="@1500000000" Fri Jul 14 14:40:00 NZST 2017 If you can't think of anything else to do then you can watch it happen here... https://www.epochconverter.com/ ...or repeatedly enter this on your console... $ echo "How many seconds to go:" $((1500000000 - $(date +%s))) If this event is a little low key, and you'd rather wait for it to tick over the 2 billion mark, then you'll have to hold off with the celebrations for another 16 years... $ date --date="@2000000000" Wed May 18 15:33:20 NZST 2033 Cheers to another 1.5 billion seconds and many more. Ian.

2 1

Tim Berners-Lee Approves Web DRM, But W3C Members Have Two Weeks To Appeal
by Peter Reutemann 12 Jul '17

12 Jul '17

'der Atticus Rex writes: A high controversial Web standard has received a seal of approval from Tim Berners-Lee, the inventor of the Web and its chief technical decision-maker. Opponents like the Free Software Foundation and Electronic Frontier Foundation say that the standard, Encrypted Media Extensions, is a step backwards for freedom, privacy, and a host of other rights on the Web. There's still a two-week window in which members of the W3C can appeal the decision, and the Free Software Foundation is asking people to email and encourage them to do so.' -- source: https://news.slashdot.org/story/17/07/08/0147206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

net neutrality article on BBC
by Ian Young 12 Jul '17

12 Jul '17

Some may not have seen this. I thought it a useful summary of the current state of play around this issue. http://www.bbc.com/news/blogs-trending-40494909

2 1

Fedora 26 Linux Distro Released
by Peter Reutemann 12 Jul '17

12 Jul '17

'Today, Fedora 26 sheds its pre-release status and becomes available for download as a stable release. GNOME fans are in for a big treat, as version 3.24 is default. If you stick to stable Fedora releases, this will be your first time experiencing that version of the desktop environment since it was released in March. Also new is LibreOffice 5.3, which is an indispensable suite for productivity. If you still use mp3 music files I've moved onto streaming), support should be baked in for both encoding and decoding. "The latest version of Fedora's desktop-focused edition provides new tools and features for general users as well as developers. GNOME 3.24 is offered with Fedora 26 Workstation, which includes a host of updated functionality including Night Light, an application that subtly changes screen color based on time of day to reduce effect on sleep patterns, and LibreOffice 5.3, the latest update to the popular open source office productivity suite. For developers, GNOME 3.24 provides matured versions of Builder and Flatpak to make application development for a variety of systems, including Rust and Meson, easier across the board," says the Fedora Project.' -- source: https://linux.slashdot.org/story/17/07/11/1722202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu Is Now Available On the Windows Store
by Peter Reutemann 11 Jul '17

11 Jul '17

'Ubuntu is now available for download on the Windows Store. "Initially spotted by Rafael Rivera and Necrosoft Core on Twitter, Ubuntu on the Windows Store will let you install and run the Ubuntu terminal on Windows next to your other apps," reports Windows Central. From the report: Ubuntu's arrival, and that of SUSE, are part of a recent push by Microsoft to embrace Linux and the open source community more broadly. This began with the arrival of the Windows Subsystem for Linux in 2016, allowing users to use the Bash shell from within Windows. Keep in mind that this is limited to the Fall Creators Update, which isn't set for a public release until later this year. If you're running a PC testing the Fall Creators Update through the Windows Insider Program, however, you should be able to download and try Ubuntu from the Windows Store just fine. ' -- source: https://news.slashdot.org/story/17/07/10/202218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Multics Lives!
by Lawrence D'Oliveiro 10 Jul '17

10 Jul '17

I previously mentioned <https://list.waikato.ac.nz/pipermail/wlug/2015-August/013714.html> the old Multics OS, which was so complex and so delayed in its development that a group of folks at AT&T Bell Labs decided not to wait and created their own, less ambitious OS instead, deciding to call it “UNIX” as a sort of pun on “Multics”. Well, at long last <https://www.theregister.co.uk/2017/07/10/multics_resurrected_in_new_simulat…>, you can now run Multics for yourself. The original mainframe hardware is long gone, but today’s PCs can easily support a suitable software emulation without breaking too much of a sweat--even a Raspberry π 2, it seems, can run the emulation at something close to the speed of the early mainframe units. All it took was some suitably dedicated people to build such an emulator. And now you can download their work and try it out for yourself.

1 0

Let’s Encrypt: Wildcard Certs Coming Soon
by Lawrence D'Oliveiro 07 Jul '17

07 Jul '17

Anybody using Let’s Encrypt? Having recently set it up for a client, I’m really impressed with it. It gives you HTTPS certs for your web servers at no cost, and with very little effort, since the entire process is automated (with authentication via the “ACME” protocol). The certs are only valid for 90 days, to try to minimize potential damage from any compromises, but the renewal process is equally easy to automate. The one service they haven’t offered up to now is certs for wildcard domains (e.g. “*.example.com”). Looks like they will soon have a procedure for this, too <https://arstechnica.com/information-technology/2017/07/lets-encrypt-to-star…>.

2 1

OneDrive Has Stopped Working On Non-NTFS Drives
by Peter Reutemann 07 Jul '17

07 Jul '17

'OneDrive users around the world have been upset to discover that with its latest update, Microsoft's cloud file syncing and storage system no longer works with anything other than disks formatted with the NTFS file system. Both older file systems, such as FAT32 and exFAT, and newer ones, such as ReFS, will now provoke an error message when OneDrive starts up. To continue to use the software, files will have to be stored on an NTFS volume. While FAT disks can be converted, ReFS volumes must be reformatted and wiped. This has left various OneDrive users unhappy. While NTFS is the default file system in Windows, people using SD cards to extend the storage on small laptops and tablets will typically use exFAT. Similarly, people using Storage Spaces to manage large, redundant storage volumes will often use ReFS. The new policy doesn't change anything for most Windows users, but those at the margins will feel hard done by. Microsoft said in a statement that it "discovered a warning message that should have existed was missing when a user attempted to store their OneDrive folder on a non-NTFS filesystem -- which was immediately remedied." According to Ars, Microsoft's position, apparently, is that OneDrive should always have warned about these usage scenarios and that it's only a bug or an oversight that allowed non-NTFS volumes to work.' -- source: https://hardware.slashdot.org/story/17/07/06/2012255 Time to switch to ownCloud! :-) https://owncloud.org/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

WikiLeaks Unveils CIA Implants That Steal SSH Credentials From Windows, Linux PCs
by Peter Reutemann 07 Jul '17

07 Jul '17

'WikiLeaks has today published the 15th batch of its ongoing Vault 7 leak, this time detailing two alleged CIA implants that allowed the agency to intercept and exfiltrate SSH (Secure Shell) credentials from targeted Windows and Linux operating systems using different attack vectors. Secure Shell or SSH is a cryptographic network protocol used for remote login to machines and servers securely over an unsecured network. Dubbed BothanSpy -- implant for Microsoft Windows Xshell client, and Gyrfalcon -- targets the OpenSSH client on various distributions of Linux OS, including CentOS, Debian, RHEL (Red Hat), openSUSE and Ubuntu. Both implants steal user credentials for all active SSH sessions and then sends them to a CIA-controlled server. ' -- source: https://linux.slashdot.org/story/17/07/06/224211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

iPhone Bugs Are Too Valuable To Report To Apple
by Peter Reutemann 07 Jul '17

07 Jul '17

'Last year, Apple launched a long-awaited bug bounty program to reward friendly hackers who report flaws in the iPhone to the company. Despite inviting some of the best hackers in the world to join, it's a bit of a flop so far. The iPhone's security is so tight that it's hard to find any flaws at all, which leads to sky-high prices for bugs on the grey market. Researchers I spoke to are reluctant to report bugs both because they are so valuable and because reporting some bugs may actually prevent them from doing more research. "People can get more cash if they sell their bugs to others," said Nikias Bassen, a security researcher for the company Zimperium, and who joined Apple's program last year. "If you're just doing it for the money, you're not going to give [bugs] to Apple directly." Patrick Wardle, a former NSA hacker who now specializes in MacOS research and was invited to the Apple bug bounty program, agreed. He said that iOS bugs are "too valuable to report to Apple."' -- source: https://apple.slashdot.org/story/17/07/06/1551210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Severe' Systemd Bug Allowed Remote Code Execution For Two Years
by Peter Reutemann 06 Jul '17

06 Jul '17

'A flaw in systemd, the init system used on many Linux systems, can be exploited using a malicious DNS query to either crash a system or to run code remotely. The vulnerability resides in the daemon systemd-resolved and can be triggered using a TCP payload, according to Ubuntu developer Chris Coulson. This component can be tricked into allocating less memory than needed for a look-up. When the reply is bigger it overflows the buffer allowing an attacker to overwrite memory. This would result in the process either crashing or it could allow for code execution remotely. "A malicious DNS server can exploit this by responding with a specially crafted TCP payload to trick systemd-resolved in to allocating a buffer that's too small, and subsequently write arbitrary data beyond the end of it," is how Coulson put it. Affected Linux vendors have pushed out patches -- but the bug has apparently been present in systemd code since June of 2015. And long-time Slashdot reader walterbyrd also reports a recently-discovered bug where systemd unit files that contain illegal usernames get defaulted to root.' -- source: https://it.slashdot.org/story/17/07/03/0343258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 4

Raspberry Pi's Smaller, Cheaper Rival: NanoPi Neo Plus2 Weighs in at $25
by Peter Reutemann 05 Jul '17

05 Jul '17

'FriendlyARM, the maker of compact NanoPi developer boards, has released the NanoPi Neo Plus2 for $25. From a report: This board is an update to the recently released NanoPi Neo 2, a $15 cookie-sized developer board measuring 40mm x 40mm (1.6in) with a 64-bit Allwinner H5 processor, 512MB RAM, and one USB port. The NanoPi Neo Plus2 is slightly larger at 52mm x 40mm (2in x 1.6in) and has two USB ports. It has the same H5 quad-core A53 ARM Cortex processor, but comes with 1GB RAM and 8GB eMMC storage. The NeoPlus2's storage in addition to Gigabit Ethernet puts it ahead of the Raspberry Pi 3 on paper, and at $25 undercuts the better-known board by $10.' -- source: https://hardware.slashdot.org/story/17/07/05/0211212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Parlatype - A Manual Audio Transcription App for Linux
by Peter Reutemann 05 Jul '17

05 Jul '17

'Parlatype is a minimal GNOME audio player for manual speech transcription. It plays audio sources to transcribe them in your favorite text application. It features a simple themeable GUI with a track timeline (with a waveform view) and clearly visible buttons and a playback speed tuner. It doesn't come with that many settings but then again, remember - it is a simple audio transcriber.' -- source: https://www.fossmint.com/parlatype-a-audio-transcription-tool-for-linux/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Lollypop – A New Modern Music Player for Linux
by Peter Reutemann 05 Jul '17

05 Jul '17

'Lollypop is a lightweight modern and material design-inspired music player designed to work excellently on the GNOME desktop environment. It has a focus on an intuitive minimal design which makes it easy to pick it up and begin using right away. It features all the functions you would expect from a music player like browsing and searching through your collection of music files, fetching lyrics and artist biography from the internet, as well as automatically fetching cover arts for music files.' -- source: https://www.fossmint.com/lollypop-a-new-modern-music-player-for-linux/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GnuPG crypto library cracked, look for patches
by Lawrence D'Oliveiro 05 Jul '17

05 Jul '17

What they found is that the libgcrypt library used what's called “sliding windows”, a method for carrying out the mathematics of cryptography – but one that's known to leak data. ... What they found was an unpleasant surprise: a complete break of the library's RSA-1024... <https://www.theregister.co.uk/2017/07/04/gnupg_crypto_library_cracked_look_…> Cue the conspiracy theorists lining up to say “Given the controversy surrounding GnuPG and the way they operate, one just has to wonder "bug or backdoor?"”

2 2

Latte Dock – An Elegant and Intuitive Dock for Your Tasks and Plasmoids
by Peter Reutemann 03 Jul '17

03 Jul '17

'Latte Dock is arguably the best dock app for KDE Plasma especially since the release of its stable version 0.6 in April. It is based on plasma frameworks, that working together to provide users with an elegant and intuitive experience while going about their everyday PC tasks. Latte Dock is unlike some dock apps in the market in the sense that it lets you replace your desktop panels completely. You can use it to run multiple docks on one screen, mimic several panel layouts including that of Unity and Plasma, set animation styles especially using its parabolic zoom effects, and organize Plasmoids.' -- source: https://www.fossmint.com/latte-dock-an-elegant-and-intuitive-dock-for-kde-p… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Kernel 4.12 Officially Released
by Peter Reutemann 03 Jul '17

03 Jul '17

'After seven weeks of announcing release candidate versions, Linus Torvalds today informs the Linux community through a mailing list announcement about the general availability of the Linux 4.12 kernel series. Development on the Linux 4.12 kernel kicked off in mid-May with the first release candidate, and now, seven weeks later we can finally get our hands on the final release... A lot of great improvements, new hardware support, and new security features were added during all this time, which makes it one of the biggest releases, after Linux 4.9... Prominent features of the Linux 4.12 kernel include initial support for AMD Radeon RX Vega graphics cards, intial Nvidia GeForce GTX 1000 "Pascal" accelerated support, implementation of Budget Fair Queueing (BFQ) and storage-I/O schedulers, more MD RAID enhancements, support for Raspberry Pi's Broadcom BCM2835 thermal driver, a lot of F2FS optimizations, as well as ioctl for the GETFSMAP space mapping ioctl for both XFS and EXT4 filesystems. Linus said in announcing the release that "I think only 4.9 ends up having had more commits," also noting that 4.9 was a Long Term Support kernel, whereas "4.12 is just plain big." "There's also nothing particularly odd going on in the tree - it's all just normal development, just more of it than usual."' -- source: https://linux.slashdot.org/story/17/07/03/0410253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

HTTPS Certificate Revocation Doesn’t Work: Some Fixes
by Lawrence D'Oliveiro 03 Jul '17

03 Jul '17

The traditional mechanisms for revoking compromised TLS/SSL certifications--cert revocation lists (CRLs) and Online Certificate Status Protocol (OCSP)--don’t really work. But something can be done about this, in the form of “OCSP Must Staple”. Also the issue of rogue certifications--certs issued for your domain without your knowledge or permission--can be mitigated with Certificate Transparency (CT), where the issuing Certificate Authorities (CAs) publish all the certs they have given out, to allow crosschecks. There is also Certificate Authority Authorization (CAA), where the DNS entry for your domain specifies which CA(s) are allowed to issue certs for it. <https://arstechnica.com/security/2017/07/https-certificate-revocation-is-br…>

1 0

Debian Linux reveals Intel Skylake and Kaby Lake processors have broken hyper-threading
by Peter Reutemann 03 Jul '17

03 Jul '17

'Do you have an Intel Skylake and Kaby Lake processor under your computer's hood? Have you experienced unexplained application and system hiccups, data corruption, or data loss? It could be because your chipset has hyper-threading enabled and the chips are malfunctioning. Henrique de Moraes Holschuh, a Debian Linux developer, revealed the Intel chip problem on the Debian developer list. Officially, Intel hasn't acknowledged the problem, but engineers at Dell and Intel have told me that the problem, and its fix, exists. This processor/microcode defect has been found on Intel Skylake and Intel Kaby Lake processors with hyper-threading enabled. Besides these 6th and 7th generation Intel Core processors, its also found on its related server processors, such as Xeon v5 and Xeon v6, and some select Intel Pentium processor models. While the Debian community revealed the problem, it's not Linux-specific. Any operating system -- Windows, macOS,FreeBSD, you name it -- can run into the problem. According to Intel chip errata, "Under complex micro-architectural conditions, short loops of less than 64 instructions that use AH, BH, CH or DH registers as well as their corresponding wider register (e.g. RAX, EAX or AX for AH) may cause unpredictable system behavior. This can only happen when both logical processors on the same physical processor are active." This will lead to the computer experiencing "unpredictable system behavior." What programs will cause a computer to act up? That's a good question, and we don't have a good answer. As Holschuh wrote, "We do not have enough information at this time to know how much software out there will trigger this specific defect."' -- source: http://www.zdnet.com/article/debian-linux-reveals-intel-skylake-kaby-lake-p… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

23 Years Of The Open Source 'FreeDOS' Project
by Peter Reutemann 03 Jul '17

03 Jul '17

Not quite Linux, but a good example of an open-source project: 'Jim Hall is celebrating the 23rd birthday of the FreeDOS Project, calling it "a major milestone for any free software or open-source software project," and remembering how it all started. An anonymous reader quotes Linux Journal: If you remember Windows 3.1 at the time, it was a pretty rough environment. I didn't like that you could interact with Windows only via a mouse; there was no command line. I preferred working at the command line. So I was understandably distressed in 1994 when I read via various tech magazines that Microsoft planned to eliminate MS-DOS with the next version of Windows. I decided that if the next evolution of Windows was going to be anything like Windows 3.1, I wanted nothing to do with it... I decided to create my own version of DOS. And on June 29, 1994, I posted an announcement to a discussion group... Our "PD-DOS" project (for "Public Domain DOS") quickly grew into FreeDOS. And 23 years later, FreeDOS is still going strong! Today, many people around the world install FreeDOS to play classic DOS games, run legacy business software or develop embedded systems... FreeDOS has become a modern DOS, due to the large number of developers that continue to work on it. You can download the FreeDOS 1.2 distribution and immediately start coding in C, Assembly, Pascal, BASIC or a number of other software development languages. The standard FreeDOS editor is quite nice, or you can select from more than 15 different editors, all included in the distribution. You can browse websites with the Dillo graphical web browser, or do it "old school" via the Lynx text-mode web browser. And for those who just want to play some great DOS games, you can try adventure games like Nethack or Beyond the Titanic, arcade games like Wing and Paku Paku, flight simulators, card games and a bunch of other genres of DOS games. On his "Open Source Software and Usability" blog, Jim says he's been involved with open source software "since before anyone coined the term 'open source'," and first installed Linux on his home PC in 1993. Over on the project's blog, he's also sharing appreciative stories from FreeDOS users and from people involved with maintaining it (including memories of early 1980s computers like the Sinclair ZX80, the Atari 800XL and the Coleco Adam). Any Slashdot readers have their own fond memories to share?' -- source: https://news.slashdot.org/story/17/07/02/1710200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu Disputes 'Ads In MOTD' Claims
by Peter Reutemann 03 Jul '17

03 Jul '17

'Thursday Lproven (Slashdot reader #6030) wrote: It appears that Ubuntu is using a feature it has added -- intended to insert headlines of breaking tech news (security alerts and so on) into the Message of the Day displayed at login to the console -- to display advertising and promotional messages. The message in question linked to a Hacker Noon article titled "How HBO's Silicon Valley built 'Not Hotdog' with mobile TensorFlow, Keras & React Native." Later that day Dustin Kirkland, a Ubuntu Product Manager for the feature's design (and the Core Developer for its implementation) suggested the message had been mistaken for an ad, describing it on Hacker News as a "fun fact... an interesting tidbit of potpourri from the world of Ubuntu," and later saying it was intended like Google's doodles. "Last week's message actually announced an Ubuntu conference in Latin America. The week before, we linked to an article asking for feedback on Kubuntu. Before that, we announced the availability of Extended Security Maintenance updates for 12.04. And so on." He later confirmed Canonical received no money for the message, and also pointed out that the messages all come from an open source repository, and "You're welcome to propose your own messages for merging, if you have a well formatted, informative message for Ubuntu users." Click through for a condensed version of the complete response by Dustin Kirkland, Ubuntu Product and Strategy at Canonical.' -- source: https://news.slashdot.org/story/17/07/01/0550251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

15 Devices (Including 6 Laptops) Awarded FSF's 'Respects Your Freedom' Certification
by Peter Reutemann 03 Jul '17

03 Jul '17

'This week the Free Software Foundation awarded its coveted 'Respects Your Freedom' certification to 15 products -- more than doubling the number of certified products (from 12 to 27) since the program began in 2012. An anonymous reader writes: The non-profit FSF certified six different laptops, two docking stations, three WiFi USB adapters and two internal WiFi devices, a mainboard, and their first-ever certified Bluetooth device, the TET-BT4 USB adapter. The products are all from Technoethical (formerly Tehnoetic), a Romania-based company who previously had just one mini wireless USB adapter on their list of FSF-certified products. "In 2014 we started selling hardware compatible with fully free systems in order to fund the free software activism work that we've been doing with our foundation," said Technoethical founder, Tiberiu C. Turbureanu. "Since then, we worked hard to build a hardware catalog that allows free software users to choose what best fits their computing needs, while also helping with the funding of different free software projects." "We are excited that Technoethical has brought out such an impressive collection of hardware whose associated software respects user freedom," said the FSF's executive director, John Sullivan. "RYF certification continues to gain speed and momentum, thanks to companies like them."' -- source: https://hardware.slashdot.org/story/17/07/02/205201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Mint 18.2 (Sonya) released
by Peter Reutemann 02 Jul '17

02 Jul '17

Hi everyone Linux Mint 18.2, nicknamed Sonya, has been released. Here are the blog entries for the various flavors: - KDE http://blog.linuxmint.com/?p=3292 - XFCE http://blog.linuxmint.com/?p=3291 - MATE http://blog.linuxmint.com/?p=3290 - Cinnamon http://blog.linuxmint.com/?p=3289 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Govhack hamilton
by William Mckee 01 Jul '17

01 Jul '17

Hi, Govhack is happening end of July. Tickets are free. https://www.eventbrite.co.nz/e/govhack-nz-hamilton-tickets-35833922226 I'm planning on a project involving Waikato bus data. a static website that displays bus stops and when the next buses leave. Hope to see you there! Cheers, William

2 1

Open-Source Healthcare
by Lawrence D'Oliveiro 01 Jul '17

01 Jul '17

Report on a long-standing project called “NHSbuntu” to put together an open-source OS fit for use at the NHS in the UK <https://www.theregister.co.uk/2017/06/30/nhsbuntu_nhs_revolution/>. Also mentions Code4health, a “home for the growing number of open source projects in the health service”.

1 0

Tuesday’s massive ransomware outbreak was, in fact, something much worse
by Peter Reutemann 29 Jun '17

29 Jun '17

'Tuesday's massive outbreak of malware that shut down computers around the world has been almost universally blamed on ransomware, which by definition seeks to make money by unlocking data held hostage only if victims pay a hefty fee. Now, some researchers are drawing an even bleaker assessment—that the malware was a wiper with the objective of permanently destroying hard drives.' -- source: https://arstechnica.com/security/2017/06/petya-outbreak-was-a-chaos-sowing-… Welcome to cyber warfare... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Vulnerability Discovered In Latest Ubuntu Distributions, Users Advised To Update
by Peter Reutemann 29 Jun '17

29 Jun '17

'There is a vulnerability in the latest ubuntu distributions due to the DNS resolver included in systemd. The inclusion of the dns resolver was lamented by many on the mailing list, not without cause. All are advised to update their distribution.' -- source: https://news.slashdot.org/story/17/06/28/1659216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Testing For Windows Vulnerabilities On Linux
by Lawrence D'Oliveiro 27 Jun '17

27 Jun '17

What’s notable about this report <https://arstechnica.com/security/2017/06/latest-high-severity-flaw-in-windo…> on a vulnerability in Windows Defender is that the testing that uncovered the problem was done, not on Windows, but on Linux. The researcher, Tavis Ormandy, developed a framework <https://github.com/taviso/loadlibrary> for loading Windows DLLs (Dynamically-Loadable Libraries) under Linux so that he could take advantage of the superior tools available there.

1 0

Intel Quietly Discontinues Galileo, Joule, and Edison Development Boards
by Peter Reutemann 20 Jun '17

20 Jun '17

'Intel is discontinuing its Galileo, Joule, and Edison lineups of development boards. The chip-maker quietly made the announcement last week. From company's announcement: Intel Corporation will discontinue manufacturing and selling all skus of the Intel Galileo development board. Shipment of all Intel Galileo product skus ordered before the last order date will continue to be available from Intel until December 16, 2017. [...] Intel will discontinue manufacturing and selling all skus of the Intel Joule Compute Modules and Developer Kits (known as Intel 500 Series compute modules in People's Republic of China). Shipment of all Intel Joule products skus ordered before the last order date will continue to be available from Intel until December 16, 2017. Last time orders (LTO) for any Intel Joule products must be placed with Intel by September 16, 2017. [...] Intel will discontinue manufacturing and selling all skus of the Intel Edison compute modules and developer kits. Shipment of all Intel Edison product skus ordered before the last order date will continue to be available from Intel until December 16, 2017. Last time orders (LTO) for any Intel Edison products must be placed with Intel by September 16, 2017. All orders placed with Intel for Intel Edison products are non-cancelable and non-returnable after September 16, 2017. The company hasn't shared any explanation for why it is discontinuing the aforementioned development boards. Intel launched the Galileo, an Arduino-compatible mini computer in 2013, the Edison in 2014, and the Joule last year. The company touted the Joule as its "most powerful dev kit." You can find the announcement posts here.' -- source: https://hardware.slashdot.org/story/17/06/19/1720201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting on the 26th
by Peter Reutemann 18 Jun '17

18 Jun '17

Hi everyone Unfortunately, I haven't had any inspirations as to topics for the upcoming meeting on June 26th. Any ideas or suggestions? Any cool software or distro that you'd like to demo? Personally, I've never seen an installation and day-to-day usage of Arch Linux (adding/removing applications, configuring services, etc)... Thanks. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Debian 9 "Stretch" released
by William Mckee 18 Jun '17

18 Jun '17

Hi, Debian 9 "Stretch" has been released... After 26 months of development the Debian project is proud to present its new stable version 9 (code name Stretch), which will be supported for the next 5 years thanks to the combined work of the Debian Security team and of the Debian Long Term Support team. Debian 9 is dedicated to the project's founder Ian Murdock, who passed away on 28 December 2015. https://www.debian.org/News/2017/20170617 Cheers, William.

1 0

Why do printers add secret tracking dots?
by Ian Stewart 17 Jun '17

17 Jun '17

Hi, This is new news to me, however it looks like its been known about for years. cheers, Ian. According to this<http://www.bbc.com/future/story/20170607-why-printers-add-secret-tracking-d…> BBC technology article, colour laser printers add yellow dots to each page printed that identify the date and time it was printed and the printers serial number. "At that point, experts began taking a closer look at the document, now publicly available on the web. They discovered something else of interest: yellow dots in a roughly rectangular pattern repeated throughout the page. They were barely visible to the naked eye, but formed a coded design. After some quick analysis, they seemed to reveal the exact date and time that the pages in question were printed: 06:20 on 9 May, 2017 – at least, this is likely to be the time on the printer’s internal clock at that moment. The dots also encode a serial number for the printer." The Electronic Frontier Foundation (EFF) maintained a List of Printers Which Do or Do Not Display Tracking Dots<https://www.eff.org/pages/list-printers-which-do-or-do-not-display-tracking…> ...but "This list is no longer being updated." "(Added 2015) Some of the documents that we previously received through FOIA suggested that all major manufacturers of color laser printers entered a secret agreement with governments to ensure that the output of those printers is forensically traceable. Although we still don't know if this is correct, or how subsequent generations of forensic tracking technologies might work, it is probably safest to assume that all modern color laser printers do include some form of tracking information that associates documents with the printer's serial number. (If any manufacturer wishes to go on record with a statement to the contrary, we'll be happy to publish that here.) (Added 2017) REMINDER: IT APPEARS LIKELY THAT ALL RECENT COMMERCIAL COLOR LASER PRINTERS PRINT SOME KIND OF FORENSIC TRACKING CODES, NOT NECESSARILY USING YELLOW DOTS. THIS IS TRUE WHETHER OR NOT THOSE CODES ARE VISIBLE TO THE EYE AND WHETHER OR NOT THE PRINTER MODELS ARE LISTED HERE. THIS ALSO INCLUDES THE PRINTERS THAT ARE LISTED HERE AS NOT PRODUCING YELLOW DOTS."

1 0

Wi-Fi Alliance Offers Guidance For Builders
by Lawrence D'Oliveiro 16 Jun '17

16 Jun '17

The Wi-Fi Alliance has issued its “Home Design Standard”, a set of recommendations that it hopes will see new homes outfitted properly for wireless networking from the beginning <https://www.theregister.co.uk/2017/06/15/wifi_certified_home_designs/>. Some of the reader comments suggest that UK builders at least, seem to have no clue. But surely even builders’ families must appreciate the value of wi-fi in their own homes nowadays...

1 0

Programmers Who Indent With Spaces Earn More Than Those Using Tabs
by Lawrence D'Oliveiro 16 Jun '17

16 Jun '17

According to this report <https://arstechnica.com/information-technology/2017/06/according-to-statist…>, the latest Stack Overflow developer survey shows a wide gap between the earnings of those who use spaces to indent their code, versus those who use tabs. Speaking as someone who moved from tabs to spaces about a decade ago, I don’t understand why the author seems so cut up about this. It makes about as much sense as vi/vim users complaining about Emacs users. (The guy also seems to put Perl and PHP on the same intellectual level, which I think tells you all you need to know about the state of his mental health...) And he forgot to link to the actual survey results, which are here <https://insights.stackoverflow.com/survey/2017>. I can’t see where he got the information about the correlation between tabs/spaces and income--all I can see is that among professional developers, spaces are more popular, whereas among all developers, tabs are more popular.

1 1

Green Party Leaders Don't Want Windows In Munich
by Peter Reutemann 15 Jun '17

15 Jun '17

'Munich spent a lot of time (9 years) and a lot of money in shifting some 15,000 staff to a Linux-based OS. The plan now is to move to Windows 10 by 2021. Munich's Green Party is citing the WannaCry virus as a valid reason not to switch to Windows. "As with many of the biggest attacks, the computers that were mainly hit were running the Windows operating system," the Green Party said in a statement.' -- source: https://linux.slashdot.org/story/17/06/15/1530224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Vivaldi 1.10 Released
by Peter Reutemann 15 Jun '17

15 Jun '17

'Vivaldi, the successor to Opera 12.16 (Presto) in spirit, admittedly has a long way to go but continues to steadily mature with the release of version 1.10: Releasing Vivaldi 1.10, we give you the power for making the Start Page more personal than ever before. You're the one who gets to decide how your Start Page looks, feels and performs. We've also added the much-requested ability to dock the Developer Tools. Other new features and improvements include: -Sorting of Downloads in the Side Panel by name, size, date added and date finished, as well as manually. -Toggle image visibility from the View menu or via configurable keyboard shortcut. -Quick Commands improvements for users that like to control everything in their browser from their keyboard. The Quick Commands menu lets users navigate to tabs, find search terms, filter lists of available commands and much more. -Address Bar dropdown list can now exclude bookmarks and typed history. -Controlling new tabs via third-party extensions with additional functionality, such as productivity tools or reminders. ' -- source: https://tech.slashdot.org/story/17/06/15/1511257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Re: [wlug] meeting on the 26th
by William Mckee 15 Jun '17

15 Jun '17

On Jun 15, 2017 9:44 PM, "Peter Reutemann" <fracpete(a)waikato.ac.nz> wrote: Hi everyone Unfortunately, I haven't had any inspirations as to topics for the upcoming meeting on June 26th. Any ideas or suggestions? Any cool software or distro that you'd like to demo? Personally, I've never seen an installation and day-to-day usage of Arch Linux (adding/removing applications, configuring services, etc)... I installed arch linux once on the pi. didnt get further than the login prompt though. its certainly helpful distro, i will be forever grateful for the wiki. i will be away for this meetup up though, mid semester break gives an excuse to get away. Hope you find a topic. cheers, william.

1 0

Firefox 54 Arrives With Multi-Process Support For All Users
by Peter Reutemann 14 Jun '17

14 Jun '17

'Mozilla today launched Firefox 54 for Windows, Mac, Linux, and Android. The new version includes the next major phase of multi-process support, which streamlines memory use, improving responsiveness and speed. The Electrolysis project, which is the largest change to Firefox code ever, is live. Firefox now uses up to four processes to run webpage content across all open tabs. This means that complex webpages in one tab have a much lower impact on responsiveness and speed in other tabs, and Firefox finally makes better use of your computer's hardware.' -- source: https://tech.slashdot.org/story/17/06/13/1720250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Malware Infects Raspberry Pi Devices And Makes Them Mine Cryptocurrency
by Peter Reutemann 12 Jun '17

12 Jun '17

'If you're a Raspberry Pi user who's never changed the default password of the "pi" user, then heed this warning: change it. A brand new piece of malware has hit the web, called "Linux.MulDrop.14", and it preys on those who haven't secured their devices properly... After scanning for RPis with an open (and default) SSH port, the "pi" user is logged into (if the password is left default), and the password is subsequently changed. After that, the malware installs ZMap and sshpass software, and then it configures itself. The ultimate goal of Linux.MulDrop.14 is to make digital money for someone else, namely the author of the malware, using your Raspberry Pi. ' -- source: https://linux.slashdot.org/story/17/06/11/0552231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Malware Uses Obscure Intel CPU Feature To Steal Data and Avoid Firewalls
by Peter Reutemann 09 Jun '17

09 Jun '17

'Microsoft's security team has come across a malware family that uses Intel's Active Management Technology (AMT) Serial-over-LAN (SOL) interface as a file transfer tool. The problem with Intel AMT SOL is that it's part of Intel's ME, a separate chip inside Intel CPUs that runs its own OS and stays on even when the main CPU is off. Inside Intel's ME, AMT SOL opens a virtual network interface which works even when the PC is turned off. Furthermore, because this virtual network interface runs inside ME, firewalls and security products installed on the main OS won't detected malware using AMT SOL to exfiltrate data. The malware was created and used by a nation-state cyber-espionage unit codenamed PLATINUM, active since 2009, and which has targeted countries around the South China Sea. PLATINUM is by far one of the most sophisticated hacking groups ever discovered. Last year [PDF], the OS maker said the group was installing malware by abusing hotpatching — a mechanism that allows Microsoft to issue updates that tap into active processes and upgrade applications or the operating system without having to reboot the computer. Details about PLATINUM's recent targets and attacks are available in a report [PDF] Microsoft released yesterday.' -- source: https://it.slashdot.org/story/17/06/08/1754244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Is Intel Threatening To Sue Microsoft Over x86-on-ARM?
by Lawrence D'Oliveiro 09 Jun '17

09 Jun '17

Intel has put out a press release warning anybody working on x86-emulation technology to beware of infringing its patents <https://arstechnica.com/information-technology/2017/06/intel-fires-warning-…>. The article suggests that the timing of this announcement is a warning specifically to Microsoft, and possibly also Qualcomm, over their upcoming release of Windows-10-on-ARM machines. Even if this is so, I’m not sure I agree that “This compatibility makes these ARM-based machines a threat to Intel in a way that Windows RT never was”. The simple fact is that the performance of emulated x86 code on ARM is going to be most politely described as “anaemic”. ARM chips are not the most powerful (they are the most power-efficient), and x86 code is extremely complicated to emulate. Thus, the overheads of the translation layer are going to sap any hope of reasonable speed.

1 0

Internet cameras have hard-coded password that can’t be changed
by Peter Reutemann 08 Jun '17

08 Jun '17

'Security cameras manufactured by China-based Foscam are vulnerable to remote take-over hacks that allow attackers to view video feeds, download stored files, and possibly compromise other devices connected to a local network. That's according to a 12-page report released Wednesday by security firm F-Secure. Researchers at F-Secure documented 18 vulnerabilities that the manufacturer has yet to fix despite being alerted to them several months ago. All of the flaws were confirmed in a camera marketed under the Opticam i5 HD brand. A smaller number of the vulnerabilities were also found in the Foscam C2. The report said the weaknesses are likely to exist in many other camera models Foscam manufactures and sells under other brand names.' -- source: https://arstechnica.com/security/2017/06/internet-cameras-expose-private-vi… Not sure whether these cameras are sold here in NZ... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu Works With GNOME To Improve HiDPI Support On Linux Desktop
by Peter Reutemann 07 Jun '17

07 Jun '17

'Canonical is playing host to a 'fractional scaling hackfest' in its Taipei offices this week. Both GNOME developers and Ubuntu developers are in attendance, ready to wrestle with the aim: improve GNOME HiDPI support. Ubuntu's Unity desktop (I'm told, anyhow) plays fairly nice with high DPI monitors because the shell supports fractional scaling (though most apps, I believe, do not). Furthermore, users can tweak some high DPI settings to better suit their display(s). GNOME Shell also supports HiDPI monitors, but has, until now, been a little less flexible about it. "Currently, we only allow to scale windows by integral factors (typically 2). This proves somewhat limiting as there are many systems that are just in between the dpi ranges that are good for scale factor 2, or unscaled," the hackfest page explains.' -- source: https://linux.slashdot.org/story/17/06/06/2048243 Other links regarding HiDPI: http://www.makeuseof.com/tag/linux-hidpi-support-for-gnome-kde-xfce-cinnamo… https://www.maketecheasier.com/best-linux-desktop-environments-for-hidpi-di… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

SGI Desktop Clone Gets A New Version On Fedora
by Peter Reutemann 06 Jun '17

06 Jun '17

'Silicon Graphics workstations used the IRIX Interactive Desktop (formerly called Indigo Magic Desktop) for its IRIX operating system (based on UNIX System V with BSD extensions). "Anyone who remembers working on a SGI machine probably has fond memories of the Magic Desktop for IRIX," remembered one Slashdot reader in 2002. At the time a project called 5Dwm was working on a clone, and its work is still being continued by MaXX Interactive. Today Slashdot reader Daniel Mark shared the news that after "several years and many long nights," the company is announcing a new release for Fedora 25, adding that "more Linux Distributions support will be added over the coming days/weeks." They're calling it "something new and fresh in the Linux Desktop space." The MaXX Desktop is available in two versions, the free Community Edition (CE) which provides basic SGI Desktop experience and the commercially available Professional Edition (PE) that comes with support, CPU and GPU specific optimizations and a full SGI Desktop experience... So there is no surprise here, the MaXX Desktop is a highly tuned Workstation Environment for the Linux x86_64 and ia64 platforms. Multi-core processing, NVidia GPU specific optimizations are among the things that makes the MaXX Desktop so fast, light-weight and stable. ' -- source: https://slashdot.org/story/17/06/04/1535251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Network Time Protocol Hardened To Protect Users From Spying, Increase Privacy
by Peter Reutemann 05 Jun '17

05 Jun '17

'The Internet Engineering Task Force has taken another small step in protecting everybody's privacy... As the draft proposal explains, the RFCs that define NTP have what amounts to a convenience feature: packets going from client to server have the same set of fields as packets sent from servers to clients... "Populating these fields with accurate information is harmful to privacy of clients because it allows a passive observer to fingerprint clients and track them as they move across networks". The header fields in question are Stratum, Root Delay, Root Dispersion, Reference ID, Reference Timestamp, Origin Timestamp, and Receive Timestamp. The Origin Timestamp and Receive Timestamp offer a handy example or a "particularly severe information leak". Under NTP's spec (RFC 5905), clients copy the server's most recent timestamp into their next request to a server – and that's a boon to a snoop-level watcher. The proposal "proposes backward-compatible updates to the Network Time Protocol to strip unnecessary identifying information from client requests and to improve resilience against blind spoofing of unauthenticated server responses." Specifically, client developers should set those fields to zero.' -- source: https://tech.slashdot.org/story/17/06/03/0422246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu Touch Mobile OS Now Maintained By UBports
by Peter Reutemann 05 Jun '17

05 Jun '17

'UBports continues to be the leading community project for trying to let Ubuntu Touch live on and evolve under their direction... Among their recent achievements were acquiring more sponsors, all devices that were sold with Ubuntu Touch can now run with UBports' builds, they are working on their own version of Mozilla's AGPS Location Service to replace Canonical's GPS system, the Halium OS platform continues evolving, the Dekko email client is back under development, installation improvements are being worked on, they are still striving for Wayland support, and more. The UBports Patreon page has even raised enough to allow UBports founder Marius Gripsgard to work full-time on what they're calling "a beautiful, free and open-source mobile OS." Their recent community update announced that "we are seeing more activity on Ubuntu Touch than for a very long time, and that is really encouraging."' -- source: https://news.slashdot.org/story/17/06/04/0316204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

US Supreme Court Victory for the Right to Tinker in Printer Cartridge Case
by Ian Stewart 01 Jun '17

01 Jun '17

"The [US] Supreme Court struck a blow today for your right to own the things you buy, reversing a lower court decision that had given patent owners the power to sue customers who paid in full for a patented item but then used it in a way the patent owner didn't care for. Together with Public Knowledge and R Street, EFF filed an amicus brief at the Supreme Court. We explained that the ability of patent owners to sell products into the stream of commerce while also writing a wishlist of anti-competitive restrictions, would be a disastrous expansion of patent law, hindering competition, innovation, and your freedom to tinker with and repair your own stuff. The Supreme Court agreed, explaining that when a patent owner "chooses to sell an item, that product is no longer within the limits of the monopoly and instead becomes the private individual property of the purchaser, with the rights and benefits that come along with ownership." The Court emphasized that, by default, people have every right to make, sell, and use things. The limited monopoly that the government bestows upon a patent owner is a deviation from the norm of free market competition and ownership of personal property, and is subject to important limits in order to protect the public interest. The Court explained that people who buy things are allowed to use and resell them without being sued under patent and copyright law, and explained that this freedom is necessary for commerce to function. The next logical step will be for courts to recognize that people who buy digital goods are owners of those goods, not mere licensees, and can resell and tinker with their digital goods to the same extent as purchasers of tangible property." See the Electronic Frontier Foundation (EFF) article for more details... https://www.eff.org/deeplinks/2017/05/supreme-court-victory-right-tinker-pr… [https://www.eff.org/files/issues/patents-2.png]<https://www.eff.org/deeplinks/2017/05/supreme-court-victory-right-tinker-pr…> Supreme Court Victory for the Right to Tinker in Printer Cartridge Case<https://www.eff.org/deeplinks/2017/05/supreme-court-victory-right-tinker-pr…> www.eff.org The Supreme Court struck a blow today [PDF] for yo Maybe the 11 remaining TPP countries will ensure that their agreement endorses this ruling ? cheers, Ian

2 1

Car Emissions Cheating: How It’s Done
by Lawrence D'Oliveiro 29 May '17

29 May '17

Researchers have been digging through car firmware from Volkswagen and Audi to get to the bottom of the emissions-testing scandal that broke a couple of years ago. Turns out the code was written by Bosch, and important information in the form of “function sheets” (documentation for what the firmware does) was not (officially) forthcoming from that company. But unofficial sources can be found on online forums frequented by vehicle-modding enthusiasts. <https://arstechnica.com/cars/2017/05/volkswagen-bosch-fiat-diesel-emissions…>

1 0

Creative Commons Staff Members Release New Free eBook
by Peter Reutemann 28 May '17

28 May '17

'Creative Commons staff-members Sarah Hinchliff Pearson and Paul Stacey have now published Made With Creative Commons, the awaited book they successfully funded on Kickstarter in 2015. "Made With Creative Commons is a book about sharing," explains the book's description. "It is about sharing textbooks, music, data, art, and more. People, organizations, and businesses all over the world are sharing their work using Creative Commons licenses because they want to encourage the public to reuse their works, to copy them, to modify them... But if they are giving their work away to the public for free, how do they make money? "This is the question this book sets out to answer. There are 24 in-depth examples of different ways to sustain what you do when you share your work. And there are lessons, about how to make money but also about what sharing really looks like -- why we do it and what it can bring to the economy and the world. Full of practical advice and inspiring stories, Made with Creative Commons is a book that will show you what it really means to share." There's free versions in PDF, ePub, and MOBI formats for downloading from the Creative Commons site, and there's also an edit-able version on Google Docs. A small Danish non-profit publisher named Ctrl+Alt+Delete Books is also publishing print copies of the book under a Creative Commons license "to ensure easy sharing," and is making the book available on Amazon or through the publisher's own web site.' -- source: https://news.slashdot.org/story/17/05/28/0130259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Timers In systemd
by Lawrence D'Oliveiro 27 May '17

27 May '17

Was referred to this page <https://wiki.gentoo.org/wiki/Systemd> about enabling systemd as the init system in Gentoo. The section on “Timer services” I found particularly useful, as applicable to other distros running systemd: instead of a conventional crontab, you create .timer entries, and corresponding .service descriptions for them to invoke, in your ~/.local/share/systemd/user area. One advantage of this I can see is one less set of user files kept in /var. In fact, do this in conjunction with maildir format for user mail, and you no longer need to have any user files in /var. (That I can think of, anyway...)

1 0

Popularity Contests
by Lawrence D'Oliveiro 26 May '17

26 May '17

In the middle of another Phoronix flame war, someone posted links to a couple of interesting pages. What’s your favourite desktop environment? According to this <https://opensource.com/life/15/7/poll-preferred-desktop-environment>, GNOME is number one, with KDE not far behind. One-third of respondents use something else. Arch Linux offers some stats <https://www.archlinux.de/?page=FunStatistics> on popularity of desktop environments and other software among its users. Here GNOME and KDE add up to only about 50%. By the way, it’s clear from the numbers for browsers and text editors in the latter that lots of people use more than one.

1 0

UK Government May Push Anti-Encryption Laws After Election
by Lawrence D'Oliveiro 25 May '17

25 May '17

Not too surprising to discover that some parties in the UK might be using the Manchester attack as a pretext to push through laws to ban secure encryption <https://www.theregister.co.uk/2017/05/25/uk_to_push_antiencryption_laws_aft…>. As if such a ban would have helped uncover a perpetrator who, by all accounts, had already been reported to the authorities multiple times...

3 5

A wormable code-execution bug has lurked in Samba for 7 years. Patch now!
by Peter Reutemann 25 May '17

25 May '17

'Maintainers of the Samba networking utility just patched a critical code-execution vulnerability that could pose a severe threat to users until the fix is widely installed. The seven-year-old flaw, indexed as CVE-2017-7494, can be reliably exploited with just one line of code to execute malicious code, as long as a few conditions are met. Those requirements include vulnerable computers that (a) make file- and printer-sharing port 445 reachable on the Internet, (b) configure shared files to have write privileges, and (c) use known or guessable server paths for those files. When those conditions are satisfied, remote attackers can upload any code of their choosing and cause the server to execute it, possibly with unfettered root privileges depending on the vulnerable platform. "All versions of Samba from 3.5.0 onwards are vulnerable to a remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it," Samba maintainers wrote in an advisory published Wednesday. They urged anyone using a vulnerable version to install a patch as soon as possible.' -- source: https://arstechnica.com/security/2017/05/a-wormable-code-execution-bug-has-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Windows switch to Git almost complete: 8, 500 commits and 1, 760 builds each day
by Peter Reutemann 25 May '17

25 May '17

'Back in February, Microsoft made the surprising announcement that the Windows development team was going to move to using the open source Git version control system for Windows development. A little over three months after that first revelation, and about 90 percent of the Windows engineering team has made the switch.' -- source: https://arstechnica.com/information-technology/2017/05/90-of-windows-devs-n… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Malicious Subtitles Threaten VLC, Kodi and Popcorn Time Users, Researchers Warn
by Peter Reutemann 24 May '17

24 May '17

'Millions of people risk having their devices and systems compromised by malicious subtitles, according to a new research published by security firm Check Point. The threat comes from a previously undocumented vulnerability which affects users of popular streaming software, including Kodi, Popcorn-Time, and VLC. Developers of the applications have already applied fixes and in some cases, working on it. From a report: While most subtitle makers do no harm, it appears that those with malicious intent can exploit these popular streaming applications to penetrate the devices and systems of these users. Researchers from Check Point, who uncovered the problem, describe the subtitle 'attack vector' as the most widespread, easily accessed and zero-resistance vulnerability that has been reported in recent years. "By conducting attacks through subtitles, hackers can take complete control over any device running them. From this point on, the attacker can do whatever he wants with the victim's machine, whether it is a PC, a smart TV, or a mobile device," they write.' -- source: https://it.slashdot.org/story/17/05/24/1329211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Testing Windows Software For Vulns Too Slow? Do It On Linux!
by Lawrence D'Oliveiro 24 May '17

24 May '17

“Distributed, scalable fuzzing on Windows can be challenging and inefficient. This is especially true for endpoint security products, which use complex interconnected components that span across kernel and user space. This often requires spinning up an entire virtualized Windows environment to fuzz them or collect coverage data.” Porting stuff like Windows antivirus tools to Linux lets Ormandy “run the code I’m testing in minimal containers with very little overhead, and easily scale up testing”. Oh, and “I also think Linux has better tools”. <https://www.theregister.co.uk/2017/05/24/whats_got_a_vast_attack_service_an…>

1 0

WannaCry Makes an Easy Case For Linux
by Peter Reutemann 23 May '17

23 May '17

'The thing is, WannaCry isn't the first of its kind. In fact, ransomware has been exploiting Windows vulnerabilities for a while. The first known ransomware attack was called "AIDS Trojan" that infected Windows machines back in 1989. This particular ransomware attack switched the autoexec.bat file. This new file counted the amount of times a machine had been booted; when the machine reached a count of 90, all of the filenames on the C drive were encrypted. Windows, of course, isn't the only platform to have been hit by ransomware. In fact, back in 2015, the LinuxEncoder ransomware was discovered. That bit of malicious code, however, only affected servers running the Magento ecommerce solution. The important question here is this: Have their been any ransomware attacks on the Linux desktop? The answer is no. With that in mind, it's pretty easy to draw the conclusion that now would be a great time to start deploying Linux on the desktop. I can already hear the tired arguments. The primary issue: software. I will counter that argument by saying this: Most software has migrated to either Software as a Service (SaaS) or the cloud. The majority of work people do is via a web browser. Chrome, Firefox, Edge, Safari; with few exceptions, SaaS doesn't care. With that in mind, why would you want your employees and staff using a vulnerable system? [...] Imagine, if you will, you have deployed Linux as a desktop OS for your company and those machines work like champs from the day you set them up to the day the hardware finally fails. Doesn't that sound like a win your company could use? If your employees work primarily with SaaS (through web browsers), then there is zero reason keeping you from making the switch to a more reliable, secure platform.' -- source: https://linux.slashdot.org/story/17/05/18/1757205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Check-In Delays At Auckland Airport, Australia And Elsewhere
by Lawrence D'Oliveiro 22 May '17

22 May '17

You may have come across this report <http://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=11860878> about problems with check-in processing at Auckland and Wellington “as a result of a global issue”. This item from The Register <https://www.theregister.co.uk/2017/05/22/sita_failure_australia/> gives a few more details, mentioning an international hookup called “SITA” which was hit by problems in the UK.

1 0

Disabling Microsoft Telemetry Is Not So Easy
by Lawrence D'Oliveiro 22 May '17

22 May '17

Came across a link to this series of tweets <https://twitter.com/m8urnett/status/866353982217699328> detailing a sysadmin’s attempts to block his Windows 10 Enterprise installation from making gratuitous Internet accesses. Seems like the obvious answer--blocking things at your border router--can cause major Windows malfunctions...

1 0

upcoming meeting
by Peter Reutemann 18 May '17

18 May '17

Hi everyone We don't have anything scheduled yet for the upcoming meeting next week. Any ideas? [and apologies if I should have missed your suggestion - I've got too many things going on at the moment...] Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

Google Takes Another Shot At Making Android Great On Low-Budget Smartphones
by Peter Reutemann 17 May '17

17 May '17

'At its developer conference, Google unveiled Android Go, a project wherein Google will offer a version of Android that runs swiftly on budget, low-specced smartphones. With the new strategy, Google hopes to further improve the low-budget smartphone ecosystem in developing markets. Android Go will be focused around building a version of Android for phones with less memory, with the System UI and kernel able to run with as little as 512MB of memory. Apps will be optimized for low bandwidth and memory, with a version of Play Store designed for those markets that will highlight these apps. From a report: Another feature of Android Go will be data management. Android Go will let you easily see your data usage, and thanks to carrier integration, it'll also let you top-up with more data right on your device.' -- source: https://hardware.slashdot.org/story/17/05/17/202209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu 17.04 review: Don’t call it abandonware, per se
by Peter Reutemann 12 May '17

12 May '17

'Last month, it finally happened. Six years after its tumultuous switch from GNOME 2 to the homegrown Unity desktop, Canonical announced it was abandoning work on Unity. Going forward, the company will switch the default Ubuntu desktop back to GNOME beginning with next year's 18.04 LTS release. This means Canonical is also abandoning the development of the Mir display server and its unified interface of Ubuntu for phones and tablets. The company's vision of "convergence," as Canonical founder Mark Shuttleworth termed it, has officially died.' -- source: https://arstechnica.com/gadgets/2017/05/ubuntu-17-04-review-this-is-unitys-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu Arrives in the Windows Store, Suse and Fedora Are Coming To the Windows Subsystem For Linux
by Peter Reutemann 11 May '17

11 May '17

'At its Build developer conference today, Microsoft announced that Ubuntu has arrived in the Windows Store. From a report: The company also revealed that it is working with Fedora and Suse to bring their distributions to the Windows Subsystem for Linux (WSL) in Windows 10. At the conference last year, Microsoft announced plans to bring the Bash shell to Windows. The fruits of that labor was WSL, a compatibility layer for running Linux binary executables (in ELF format) natively on Windows, which arrived with the Windows 10 Anniversary Update released in August 2016. Microsoft also partnered with Canonical to allow Ubuntu tools and utilities to run natively on top of the WSL. By bringing Ubuntu to the Windows Store, the company is now making it even easier for developers to install the tools and run Windows and Linux apps side by side. Working with other Linux firms shows that Microsoft's deal with Canonical was not a one-time affair, but rather part of a long-term investment in the Linux world.' -- source: https://news.slashdot.org/story/17/05/11/1535214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Canonical Founder Says Recent Changes In Ubuntu Were Necessary To Prepare the Company For an IPO
by Peter Reutemann 10 May '17

10 May '17

'Canonical was doing well with Ubuntu and cloud and container-related technologies, such as Juju, LXD, and Metal-as-a-Service (MaaS). In addition, its OpenStack and Kubernetes software stacks, according to Shuttleworth, are growing by leaps and bounds on both the public and private cloud. Canonical founder Mark Shuttleworth said "in the last year, Ubuntu cloud growth had been 70 percent on the private cloud and 90 percent on the public cloud." In particular, "Ubuntu has been gaining more customers on the big five public clouds." What hadn't succeeded was Canonical's attempt to make Unity the universal interface for desktops, tablets, and smartphones. Shuttleworth was personally invested in this project, but at day's end, it wasn't getting enough adoption to make it profitable. So, Shuttleworth said with regret, Unity had to be dropped. This move also means Canonical will devote more of its time to "putting the company on the path to a IPO. We must figure out what steps we need to take moving forward." That means focusing on Canonical's most profitable lines. Specifically, "Ubuntu will never die. Ubuntu is the default platform on cloud computing. Juju, MaaS, and OpenStack are nearly unstoppable. We need to work out more of our IoT path. At the same time, we had to cut out those parts that couldn't meet an investors' needs. The immediate work is get all parts of the company profitable."' -- source: https://linux.slashdot.org/story/17/05/09/1553255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Re: [wlug] How Psychology Today Sees Richard Stallman
by rowan schischka 09 May '17

09 May '17

>He is a control freak, and a prophet. He has been right more than once >(the dangers of software patents, pitfalls of online services). But >some of his policy decisions (e.g. the reluctance to allow a plugin >architecture into GCC for fear it would lead to evasion of the GPL) >have, I think, been counterproductive. >But isn?t it grand that Free Software is all about having a choice? >That we can use what he and everybody else working for the FSF has been >responsible for, without necessarily having to subscribe to every tenet >of his philosophy? You can't expect anyone to be 100% correct on everything.

2 1

Re: [wlug] The hijacking flaw that lurked in Intel chips is worse than anyone thought
by rowan schischka 09 May '17

09 May '17

I went through Intel's press release and document on how to detect the exploit. https://downloadmirror.intel.com/26754/eng/Intel-SA-00075%20Mitigation%20Gu… Intel says this to detect: netstat -na | findstr "\<16993\> \<16992\> \<16994\> \<16995\> \<623\> \<664\>" Is that all we can do? just scan for port numbers and throw them into our firewalls?

1 0

Google’s “Fuchsia” smartphone OS dumps Linux, has a wild new UI
by Peter Reutemann 09 May '17

09 May '17

'Google, never one to compete in a market with a single product, is apparently hard at work on a third operating system after Android and Chrome OS. This one is an open source, real-time OS called "Fuchsia." The OS first popped up in August last year, but back then it was just a command line. Now the mysterious project has a crazy new UI we can look at, so let's dive in. Unlike Android and Chrome OS, Fuchsia is not based on Linux—it uses a new, Google-developed microkernel called "Magenta." With Fuchsia, Google would not only be dumping the Linux kernel, but also the GPL: the OS is licensed under a mix of BSD 3 clause, MIT, and Apache 2.0. Dumping Linux might come as a bit of a shock, but the Android ecosystem seems to have no desire to keep up with upstream Linux releases. Even the Google Pixel is still stuck on Linux Kernel 3.18, which was first released at the end of 2014.' -- source: https://arstechnica.com/gadgets/2017/05/googles-fuchsia-smartphone-os-dumps… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How Psychology Today Sees Richard Stallman
by Peter Reutemann 08 May '17

08 May '17

'After our article about Richard Stallman's new video interview, Slashdot reader silverjacket shared this recent profile from Psychology Today that describes Richard Stallman's quest "to save us from a web of spyware -- and from ourselves." By using proprietary software, Stallman believes, we are forfeiting control of our computers, and thus of our digital lives. In his denunciation of all nonfree software as inherently abusive and unethical, he has alienated many possible allies and followers. But he is not here to make friends. He is here to save us from a software industry he considers predatory in ways we've yet to recognize... for Stallman, moralism is the whole point. If you write or use free software only for practical reasons, you'll stop when it's inconvenient, and freedom will disappear. Stallman collaborator Eben Moglen -- a law professor at Columbia, as well as the FSF's general counsel -- assesses Stallman's legacy by saying "the idea of copyleft and the proposition that social and political freedom can't happen in a society without technological freedom -- those are his long-term meanings. And humanity will be aware of those meanings for centuries, whatever it does about them." The article also includes quotes from Linus Torvalds and Eric S. Raymond -- along with some great artwork. In addition to insisting the reporter refer to Linux as "GNU/Linux," Stallman also required that the article describe free software without using the term open source, a phrase he sees as "a way that people who disagree with me try to cause the ethical issues to be forgotten." And he ultimately got Psychology Today to tell its readers that "Nearly all the software on our phones and computers, as well as on other machines, is nonfree or 'proprietary' software and is riddled with spyware and back doors installed by Apple, Google, Microsoft, and the like."' -- source: https://news.slashdot.org/story/17/05/06/0258204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

The hijacking flaw that lurked in Intel chips is worse than anyone thought
by Peter Reutemann 08 May '17

08 May '17

'A remote hijacking flaw that lurked in Intel chips for seven years was more severe than many people imagined, because it allowed hackers to remotely gain administrative control over huge fleets of computers without entering a password. This is according to technical analyses published Friday. As Ars reported Monday, the authentication bypass vulnerability resides in a feature known as Active Management Technology. AMT, as it's usually called, allows system administrators to perform a variety of powerful tasks over a remote connection. Among the capabilities: changing the code that boots up computers, accessing the computer's mouse, keyboard, and monitor, loading and executing programs, and remotely powering on computers that are turned off. In short, AMT makes it possible to log into a computer and exercise the same control enjoyed by administrators with physical access. AMT, which is available with many vPro processors, was set up to require a password before it could be remotely accessed over a Web browser interface. But, remarkably, that authentication mechanism can be bypassed by entering any text string—or no text at all. According to a blog post published Friday by Tenable Network Security, the cryptographic hash that the interface's digest access authentication requires to verify someone is authorized to log in can be anything at all, including no string at all.' -- source: https://arstechnica.com/security/2017/05/the-hijacking-flaw-that-lurked-in-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Debian 8.8 Released
by Peter Reutemann 07 May '17

07 May '17

'The Debian Project announced today Debian GNU/Linux 8.8, the most advanced stable version of the Jessie series, which brings corrections for numerous packages and various security flaws discovered and patched since the release of the Debian GNU/Linux 8.7 maintenance update back in mid-January 2017... "This update mainly adds corrections for security problems to the stable release, along with a few adjustments for serious problems. Security advisories were already published separately and are referenced where available," reads today's announcement. "Please note that this update does not constitute a new version of Debian 8 but only updates some of the packages included. There is no need to throw away old 'jessie' CDs or DVDs but only to update via an up-to-date Debian mirror after an installation, to cause any out of date packages to be updated." Debian 8.8 contains more than 150 bug fixes and security updates.' -- source: https://linux.slashdot.org/story/17/05/06/2243254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Docs phishing problem
by Ian Young 05 May '17

05 May '17

As seen in an ITP weekly update. Spear phishing This one will definitely leave a mark and I suspect we'll be seeing waves from it for years to come. Google Docs have become a default mechanism for sharing and collaborating on single documents. For those of you not in the realm of writing stuff for a living, you possibly don't know about the special circle of hell reserved for those who don't track changes or for the group email that results in 50 different versions of the same document that need to be subsumed into one. Google Docs has meant everyone can work on the one piece at the same time and when they've exhausted their pedantic nit-picking about fonts, Oxford commas or whether Kiwi needs to be upper or lower case (upper case for New Zealanders, lower case for the bird or the dollar) then you can simply print it off and be done. Now some bugger has gone and ruined it for all by releasing a nasty phishing attack which sends out a spam inviting you to edit a Google Doc, then raiding your contacts and spamming all of them with the same message. By now it will have more email addresses than there are grains of sand on Whangapoua beach. Google has rushed out the big guns to take on the phish and says it has managed to shut it down (I haven't seen it at all, so I'm pleased about that) but already the damage will be done. These kinds of attacks simply undermine what makes the internet so useful - the openness of it all. One day soon the whole thing will be locked down (I see the newest version of Windows only allows apps to be installed from Microsoft's own app store) and the value and character that makes the internet what it is will be gone. The Verge - Google Docs users hit with sophisticated phishing attack Wired - Don't Open That Google Doc Unless You're Positive It's Legit CNN - Major phishing attack targets Google Docs users

1 0

Google Releases DIY Open Source Raspberry Pi Voice Kit Hardware
by Peter Reutemann 05 May '17

05 May '17

'Google has decided to take artificial intelligence to the maker community with a new initiative called AIY. This initiative will introduce open source AI projects to the public that makers can leverage in a simple way. Today, Google announces the first-ever AIY project. Called "Voice Kit," it is designed to work with a Raspberry Pi 3 Model B to create a voice-based virtual assistant. Billy Rutledge, Director of AIY Projects for Google, explains, "The first open source reference project is the Voice Kit: instructions to build a Voice User Interface (VUI) that can use cloud services (like the new Google Assistant SDK or Cloud Speech API) or run completely on-device. This project extends the functionality of the most popular single board computer used for digital making -- the Raspberry Pi. The included Voice Hardware Accessory on Top (HAT) contains hardware for audio capture and playback: easy-to-use connectors for the dual mic daughter board and speaker, GPIO pins to connect low-voltage components like micro-servos and sensors, and an optional barrel connector for dedicated power supply. It was designed and tested with the Raspberry Pi 3 Model B."' -- source: https://hardware.slashdot.org/story/17/05/04/208240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

No More FTP At Debian
by Peter Reutemann 04 May '17

04 May '17

'It looks like anonymous FTP is officially on its way out. While many public repositories have deprecated it in favor of HTTP, I was rather surprised to see Debian completely drop it on their public site. In a blog post, the team cited the FTP's lack of support for caching or acceleration, and declining usage as some of the reasons for their decision.' -- source: https://tech.slashdot.org/story/17/05/04/1731227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Distro Count
by Lawrence D'Oliveiro 03 May '17

03 May '17

I can remember reports from several years ago that distrowatch.com was tracking about 350 different Linux distros. Curious to know what the situation is like now, I went to their home page a few minutes ago, and counted the number of “<option ...>” entries in the “Select Distribution” popup menu at the top, and got 290. This figure also includes a few non-Linux OSes. But even so, I think it’s fair to say the sheer variety of Linux distros has scarcely abated over the last decade.

1 0

Linux Kernel 4.11 Officially Released
by Peter Reutemann 02 May '17

02 May '17

'Linux kernel 4.11 has been in development for the past two months, since very early March, when the first Release Candidate arrived for public testing. Eight RCs later, we're now able to download and compile the final release of Linux 4.11 on our favorite GNU/Linux distributions and enjoy its new features. Prominent ones include scalable swapping for SSDs, a brand new perf ftrace tool, support for OPAL drives, support for the SMC-R (Shared Memory Communications-RDMA) protocol, journalling support for MD RAID5, all new statx() system call to replace stat(2), and persistent scrollback buffers for VGA consoles... The Linux 4.11 kernel also introduces initial support for Intel Gemini Lake chips, which is an Atom-based, low-cost computer processor family developed using Intel's 14-nanometer technology, and better power management for AMD Radeon GPUs when the AMDGPU open-source graphics driver is used.' -- source: https://linux.slashdot.org/story/17/05/01/0534253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

UEFI Secure Boot Booted From Debian 9 'Stretch'
by Peter Reutemann 02 May '17

02 May '17

'In a release update from last week, release team member Jonathan Wiltshire wrote that "At a recent team meeting, we decided that support for Secure Boot in the forthcoming Debian 9 'stretch' would no longer be a blocker to release. The likely, although not certain outcome is that stretch will not have Secure Boot support." "We appreciate that this will be a disappointment to many users and developers," he continued, "However, we need to balance that with the limited time available for the volunteer teams working on this feature, and the risk of bugs being introduced through rushed development." The decision not to offer Secure Boot support at release leaves Debian behind Red Hat and Suse, making it the only one of Linux's three main branches not to support the heir-to-BIOS and the many security enhancements it offers.' -- source: https://linux.slashdot.org/story/17/05/01/1452209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel Patches Remote Execution Hole That's Been Hidden In Its Chips Since 2008
by Peter Reutemann 02 May '17

02 May '17

'Intel processor chipsets have, for roughly the past nine years, harbored a security flaw that can be exploited to remotely control and infect vulnerable systems with virtually undetectable spyware and other malicious code. Specifically, the bug is in Intel's Active Management Technology (AMT), Standard Manageability (ISM) and Small Business Technology (SBT) firmware versions 6 to 11.6. According to Chipzilla, the security hole allows "an unprivileged attacker to gain control of the manageability features provided by these products." That means hackers exploiting the flaw can silently snoop on a vulnerable machine's users, make changes to files and read them, install rootkits and other malware, and so on. This is possible across the network, or with local access. These management features have been available in various Intel chipsets for years, starting with the Nehalem Core i7 in 2008, all the way up to Kaby Lake Core parts in 2017. According to Intel today, this critical security vulnerability, labeled CVE-2017-5689, was found and reported in March by Maksim Malyutin at Embedi. To get the patch to close the hole, you'll have to pester your machine's manufacturer for a firmware update, or try the mitigations here. These updates are hoped to arrive within the next few weeks.' -- source: https://hardware.slashdot.org/story/17/05/01/228211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Richard Stallman Interviewed By Bryan Lunduke
by Peter Reutemann 26 Apr '17

26 Apr '17

'Many Slashdot readers know Bryan Lunduke as the creator of the humorous "Linux Sucks" presentations at the annual Southern California Linux Exposition. He's now also a member of the OpenSUSE project board and an all-around open source guy. (In September, he released every one of his books, videos and comics under a Creative Commons license, while his Patreon page offers a tip jar and premiums for monthly patrons). But now he's also got a new "daily computing/nerd show" on YouTube, and last week -- using nothing but free software -- he interviewed the 64-year-old founder of the Free Software Foundation, Richard Stallman. "We talk about everything from the W3C's stance on DRM to opinions on the movie Galaxy Quest," Lunduke explains in the show's notes.' -- source: https://news.slashdot.org/story/17/04/24/0738250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

Systemd-Free Devuan Announces Its First Stable Release Candidate 'Jessie' 1.0.0
by Peter Reutemann 26 Apr '17

26 Apr '17

' Devuan 1.0.0-RC is announced, following its beta 2 release last year. The Debian fork that spawned over systemd controversy is reaching stability and plans long-term support. Devuan deploys an innovative continuous integration setup: with fallback on Debian packages, it overlays its own modifications and then uses the merged source repository to ship images for 11 ARM targets, a desktop and minimal live, vagrant and qemu virtual machines and the classic installer isos. The release announcement contains several links to projects that have already adopted this distribution as a base OS. "Dear Init Freedom Lovers," begins the announcement, "Once again the Veteran Unix Admins salute you!" It points out that Devuan "can be adopted as a flawless upgrade path from both Debian Wheezy and Jessie. This is a main goal for the Devuan Jessie stable release and has proven to be a very stable operation every time it has been performed. "' -- source: https://linux.slashdot.org/story/17/04/22/1822216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Anbox Can Run Android Apps Natively On Linux (In A Container)
by Peter Reutemann 26 Apr '17

26 Apr '17

'Canonical engineer Simon Fels has publicly released an Alpha version of Anbox. Similar to the method employed for Android apps on ChromeOS, Anbox runs an entire Android system (7.1.1 at present) in an LXC container. Developed over the last year and a half, the software promises to seamlessly bring performant Android apps to the Linux desktop. After installing Anbox (based on Android 7.1.1) and starting Anbox Application Manager, ten apps are available: Calculator, Calendar, Clock, Contacts, Email, Files, Gallery, Music, Settings, and WebView. Apps run in separate resizeable windows. Additional apps (ARM-native binaries are excluded) can be installed via adb. Installation currently is only supported on a few Linux distributions able to install snaps. Contributions are welcome on Github. In a blog post Simon describes it as "a side project" that he's worked on for over a year and a half. "There were quite a few problems to solve on the way to a really working implementation but it is now in a state that it makes sense to share it with a wider audience."' -- source: https://news.slashdot.org/story/17/04/22/207253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux PC Maker System76 Plans To Design And Manufacture Its Own Hardware
by Peter Reutemann 26 Apr '17

26 Apr '17

'System76 is one of only a handful of PC vendors that exclusively sells computers with Linux-based software. Up until now, that's meant the company has chosen hardware that it could guarantee would work well with custom firmware and the Ubuntu Linux operating system... Starting in 2018 though, you may be able to buy a System76 computer that was designed and built in-house... CAD files for System76 computers will be open source, allowing anyone with the appropriate skills and equipment to build or modify their own cases based on the company's designs. "We're prototyping with acrylic and moving to metal soon," the company says in a blog post, adding "Our first in-house designed and manufactured desktops will ship next year. Laptops are more complex and will follow much later."' -- source: https://hardware.slashdot.org/story/17/04/23/0325234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Linux Foundation Launches IoT-focused Open Source EdgeX Foundry
by Peter Reutemann 26 Apr '17

26 Apr '17

'The Linux Foundation launches the open source EdgeX Foundry -- an attempt to unify and simplify the Internet of Things. The Linux Foundation says, "EdgeX Foundry is unifying the marketplace around a common open framework and building an ecosystem of companies offering interoperable plug-and-play components. Designed to run on any hardware or operating system and with any combination of application environments, EdgeX can quickly and easily deliver interoperability between connected devices, applications, and services, across a wide range of use cases. Interoperability between community-developed software will be maintained through a certification program."' -- source: https://linux.slashdot.org/story/17/04/24/1511239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 4.11 Delayed For a Week
by Peter Reutemann 26 Apr '17

26 Apr '17

'Linux kernel creator Linus Torvalds said over the weekend that v4.11 version of Linux has hit a speed bump in the form of "NVMe power management that apparently causes problems on some machines." The Register adds: "It's not entirely clear what caused the [NVMe] issue (it wasn't just limited to some NVMe hardware, but also particular platforms), but let's test it." Which sounds like a good idea, given that flash memory on the PCIe bus is increasingly mainstream. That problem and "a couple of really annoying" bugs mean that Torvalds has decided to do an eighth release candidate for Linux 4.11. "I did get fixes for the issues that popped up, so I could have released 4.11 as-is," Torvalds wrote, "but it just doesn't feel right."' -- source: https://linux.slashdot.org/story/17/04/24/1633209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Canadian Regulator Puts Foot Down On Net Neutrality
by Lawrence D'Oliveiro 23 Apr '17

23 Apr '17

While the Trump administration has rolled back consumer protections on net neutrality in the USA, the Canadian CRTC has come out firmly in favour of it <https://www.theregister.co.uk/2017/04/21/canada_net_neutrality/>. It has said that “zero rating”--the practice of ISPs favouring certain online services by not counting them towards data caps, is bad because differential pricing practices, generally speaking, result in (a) a preference toward certain subscribers over others, (b) a preference toward certain content providers over others, (c) a disadvantage to subscribers who are not eligible for, or interested in, a differential pricing practice offering, and (d) a disadvantage to content providers that are not eligible for, or included in, an offering. In other words, they are anticompetitive, no matter what some may try to argue.

1 1

File System Improvements To the Windows Subsystem for Linux
by Peter Reutemann 21 Apr '17

21 Apr '17

'In the latest Windows Insider build, the Windows Subsystem for Linux (WSL) now allows you to manually mount Windows drives using the DrvFs file system. Previously, WSL would automatically mount all fixed NTFS drives when you launch Bash, but there was no support for mounting additional storage like removable drives or network locations. Now, not only can you manually mount any drives on your system, we've also added support for other file systems such as FAT, as well as mounting network locations. This enables you to access any drive, including removable USB sticks or CDs, and any network location you can reach in Windows all from within WSL.' -- source: https://tech.slashdot.org/story/17/04/20/1422256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Unicode In Domain Names Opens Up Homograph Attacks
by Lawrence D'Oliveiro 19 Apr '17

19 Apr '17

The problem is not new: it was identified over a decade ago. But no fix has been forthcoming. <https://www.theregister.co.uk/2017/04/18/homograph_attack_again/>

1 1

meeting next Monday
by Peter Reutemann 18 Apr '17

18 Apr '17

Hi everyone We have a meeting coming up on Monday next week: "With Canonical killing off its desktop environment Unity in favor of GNOME, let's have a look at some of the available desktop environments: - Ian Stewart: Ubuntu 17.04 with Unity - William Mckee: LXDE - Peter Reutemann: MATE (vanilla and mint-flavored) Also, Ian Young: Getting a DVB-T card for laptops going - a live experiment." Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/237234793/ If you want to demo another desktop environment, like KDE or XFCE, then please let me know. Always looking for volunteers! :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

demo at meeting on Monday
by Ian Young 17 Apr '17

17 Apr '17

Afraid I won't be talking about Unity as Ian S has suggested - I have only ever used it briefly and never really quite got what it was all about. However if there is any spare time I could bring a DVB-T card for use with laptops I got recently. It seems to be a live one, lights up and is seen by a laptop and various Linux software applications for viewing TV. Alas, not scanning any channels. Perhaps someone knows all about this, or at any rate more than I do. The device in question is badged as an HP EC300 and has a DIBcom chipset. ~ Ian Y

4 3

suggestion for upcoming meeting
by Peter Reutemann 15 Apr '17

15 Apr '17

Hi everyone With Canonical pulling out of Unity development, how about we showcase the various desktops that have been available for a long time and are *still* available at the next meeting (April 24th)? If you want to present one, then please reply to this list naming the desktop of your choice. Thanks. Cheers, Peter PS And stay safe with Cyclone Cook! The next 24 hours will be interesting... -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Dozens Of Canonical Employees Resign As Ubuntu Switches To GNOME, Shuttleworth Returns As CEO
by Peter Reutemann 12 Apr '17

12 Apr '17

'More than 80 Canonical workers are facing the axe as founder Mark Shuttleworth has taken back the role of chief executive officer. The number, revealed today by The Reg, comes as Shuttleworth assumed the position from CEO of eight years Jane Silber, previously chief operating officer. The Reg has learned 31 or more staffers have already left the Ubuntu Linux maker ahead of Shuttleworth's rise, with at least 26 others now on formal notice and uncertainty surrounding the remainder. One individual has resigned while others, particularly in parts of the world with more stringent labour laws (such as the UK), are being left in the dark. The details come after The Reg revealed plans for the cuts as a commercial get-fit programme instituted by Shuttleworth. The Canonical founder is cutting numbers after an external assessment of his company by potential new financial backers found overstaffing and that projects lacked focus.' -- source: https://news.slashdot.org/story/17/04/12/1844230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Kodi Development Team Wants To Be Legitimate and Bring DRM To the Platform
by Peter Reutemann 11 Apr '17

11 Apr '17

'The XBMC/ Kodi development team has taken a lot of heat over the years, mostly due to third-party developers introducing piracy plugins to the platform. In many cases, cheap Android computers are often sold with these plugins pre-installed with the Kodi or XBMC name attached to them -- something that caused Amazon to ban sales of such devices. The Kodi team is not happy about this, and has taken the fight to the sellers. The Kodi team is now trying to work with rights holders to introduce DRM and legitimate plugins to the platform. Is this the first step towards creating a true one-stop do it yourself Linux entertainment system?' -- source: https://yro.slashdot.org/story/17/04/11/1911215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Canonical Founder Criticizes Free Software Developers Who 'Hate On Whatever's Mainstream'
by Peter Reutemann 10 Apr '17

10 Apr '17

'Canonical Founder Mark Shuttleworth said Saturday that "I came to be disgusted with the hate" on Canonical's display server Mir, saying it "changed my opinion of the free software community." After announcing his company was abandoning Unity for GNOME, Shuttleworth posted a gracious thank-you note to the Unity community Friday on Google Plus. But on Saturday, he added a sharper comment: "I used to think that it was a privilege to serve people who also loved the idea of service, but now I think many members of the free software community are just deeply anti-social types who love to hate on whatever is mainstream. When Windows was mainstream they hated on it. Rationally, Windows does many things well and deserves respect for those. And when Canonical went mainstream, it became the focus of irrational hatred too. The very same muppets would write about how terrible it was that IOS/Android had no competition and then how terrible it was that Canonical was investing in (free software!) compositing and convergence. Fuck that shit." The comment begins by saying "The whole Mir hate-fest boggled my mind - it's free software that does something invisible really well. It became a political topic as irrational as climate change or gun control, where being on one side or the other was a sign of tribal allegiance. We have a problem in the community when people choose to hate free software instead of loving that someone cares enough to take their life's work and make it freely available."' -- source: https://news.slashdot.org/story/17/04/09/1829209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Smart TV hack embeds attack code into broadcast signal—no access required
by Chris O'Halloran 06 Apr '17

06 Apr '17

https://arstechnica.co.uk/security/2017/04/smart-tv-hack-embeds-attack-code… A new attack that uses terrestrial radio signals to hack a wide range of Smart TVs raises an unsettling prospect—the ability of hackers to take complete control of a large number of sets at once without having physical access to any of them.

1 0

Android devices can be fatally hacked by malicious Wi-Fi networks
by Peter Reutemann 06 Apr '17

06 Apr '17

'A broad array of Android phones is vulnerable to attacks that use booby-trapped Wi-Fi signals to achieve full device takeover, a researcher has demonstrated. The vulnerability resides in a widely used Wi-Fi chipset manufactured by Broadcom and used in both iOS and Android devices. Apple patched the vulnerability with Monday's release of iOS 10.3.1. "An attacker within range may be able to execute arbitrary code on the Wi-Fi chip," Apple's accompanying advisory warned. In a highly detailed blog post published Tuesday, the Google Project Zero researcher who discovered the flaw said it allowed the execution of malicious code on a fully updated 6P "by Wi-Fi proximity alone, requiring no user interaction." Google is in the process of releasing an update in its April security bulletin. The fix is available only to a select number of device models, and even then it can take two weeks or more to be available as an over-the-air update to those who are eligible. Company representatives didn't respond to an e-mail seeking comment for this post.' -- source: https://arstechnica.com/security/2017/04/wide-range-of-android-phones-vulne… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Canonical Killing Unity For Ubuntu Linux, Will Switch To the Superior GNOME
by Peter Reutemann 05 Apr '17

05 Apr '17

'Today, the company admits that it is throwing in the towel on Unity, as well as its vision for convergence with devices like phones and tablets. Starting with Ubuntu 18.04, the wonderful GNOME will once again become the default desktop environment! "We are wrapping up an excellent quarter and an excellent year for the company, with performance in many teams and products that we can be proud of. As we head into the new fiscal year, it's appropriate to reassess each of our initiatives. I'm writing to let you know that we will end our investment in Unity8, the phone and convergence shell. We will shift our default Ubuntu desktop back to GNOME for Ubuntu 18.04 LTS," says Mark Shuttleworth, Founder of Ubuntu and Canonical.' -- source: https://linux.slashdot.org/story/17/04/05/1812232 <rant> Well, looks like some consolidation is happening, not that I consider Gnome3 "superior". IMHO MATE is still far better (and making me more efficient) than Gnome3. Introducing dynamic workspaces was the worst decision ever... </rant> Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Samsung’s Tizen is riddled with security flaws, amateurishly written
by Peter Reutemann 05 Apr '17

05 Apr '17

'Tizen, the open source operating system that Samsung uses on a range of Internet-of-Things devices and positions as a sometime competitor to Android, is chock full of egregious security flaws, according to Israeli researcher Amihai Neiderman. Samsung has been developing the operating system for many years. The project started as an Intel and Nokia project, and Samsung merged its Bada operating system into the code in 2013. Like Android, it's built on a Linux kernel, with a large chunk of open source software running on top. App development on Tizen uses C++ and HTML5.' -- source: https://arstechnica.com/gadgets/2017/04/samsungs-tizen-is-riddled-with-secu… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fuchsia: Google's new operating system
by Bryan Baldwin 04 Apr '17

04 Apr '17

Fuchsia is a new operating system <https://lwn.net/SubscriberLink/718267/206c8a5fbf0ee2ea/> being built more or less from scratch at Google. The news of the development of Fuchsia made a splash on technology news sites in August 2016, although many details about it are still a mystery. It is an open-source project; development and documentation work is still very much ongoing. Despite the open-source nature of the project, its actual purpose has not yet been revealed by Google. From piecing together information from the online documentation and source code, we can surmise that Fuchsia is a complete operating system for PCs, tablets, and high-end phones. The source to Fuchsia and all of its components is available to download at its source repository <https://fuchsia.googlesource.com/>. If you enjoy poking around experimental operating systems, exploring the innards of this one will be fun. Fuchsia consists of a kernel plus user-space components on top that provide libraries and utilities. There are a number of subprojects under the Fuchsia umbrella in the source repository, mainly libraries and toolkits to help create applications. Fuchsia is mostly licensed under a 3-clause BSD license, but the kernel is based on another project called LK (Little Kernel) <https://github.com/littlekernel/lk> that is MIT-licensed, so the licensing for the kernel is a mix. Third-party software included in Fuchsia is licensed according to its respective open-source license. https://www.osnews.com/story/29747/Fuchsia_Google_s_new_operating_system

1 0

The r/place Experiment
by Lawrence D'Oliveiro 04 Apr '17

04 Apr '17

Over the April Fool’s weekend, Reddit, the (in)famous social-media and troll-hangout site, tried something very unusual: they created a blank 1000-by-1000-pixel canvas, and turned their users loose on it to draw whatever they liked. The only restriction was a limit on how quickly any one user could update the image: just 1 pixel every 5 minutes. The resulting time-lapse animation is quite breathtaking to watch <https://arstechnica.com/gaming/2017/04/in-memoriam-reddits-72-hour-live-gra…>. Look at the number of logos and national flags: a battle between the French and German flags gets resolved with the French one running its bars vertically, the German one horizontally, and an EU flag placed at the intersection; another brief skirmish between the Greek and Turkish flags gets resolved with them being placed side by side, joined by a heart. Yes, there are the occasional rude words. But it’s surprising how little of that kind of thing appears--or perhaps it was removed too quickly by competing groups with other fish to fry. Watch the animations a few times; you’ll see something new each time.

2 1

If-I-Buy-It-Do-I-Own-It Chapter 339: Tractors
by Lawrence D'Oliveiro 31 Mar '17

31 Mar '17

Owners of John Deere tractors are resorting to pirated firmware in order to gain the ability to repair their own property: <https://www.techdirt.com/articles/20170322/04582036973/tractor-owners-using…> Are farmers in NZ impacted by any of this? I see that John Deere tractors are indeed sold here.

2 1

Phrase Of The Week: “Necessary Hashtags”
by Lawrence D'Oliveiro 28 Mar '17

28 Mar '17

UK Home Secretary Amber Rudd’s immortal quotation has spawned a T-shirt: <https://www.techdirt.com/articles/20170327/20224837016/limited-edition-gear…>. Do you have the necessary hashtags? Do they come in a nice series of tubes?

1 0

After 20 Years, OpenSSL Will Change To Apache License 2.0, Seeks Pasts Contributors
by Peter Reutemann 26 Mar '17

26 Mar '17

'After nearly 20 years and 31,000 commits, OpenSSL wants to change to Apache License v2.0. They're now tracking down all 400 contributors to sign new license agreements, a process expected to take several months. Slashdot reader rich_salz shares links to OpenSSL's official announcement (and their agreement-collecting web site). "This re-licensing activity will make OpenSSL, already the world's most widely-used FOSS encryption software, more convenient to incorporate in the widest possible range of free and open source software," said Mishi Choudhary, Legal Director of Software Freedom Law Center and counsel to OpenSSL. "OpenSSL's team has carefully prepared for this re-licensing, and their process will be an outstanding example of 'how to do it right.'" Click through for some comments on the significance of this move from the Linux Foundation, Intel, and Oracle.' -- source: https://news.slashdot.org/story/17/03/26/2258218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu Linux 17.04 'Zesty Zapus' Final Beta Now Available For Download
by Peter Reutemann 26 Mar '17

26 Mar '17

'The final beta of Ubuntu 17.04 'Zesty Zapus' became available for download Thursday. While it is never a good idea to run pre-release software on production machines, Canonical is claiming that it should be largely bug free at this point. In other words, if you understand the risks, it should be a fairly safe. Home users aside, this is a good opportunity for administrators to conduct testing prior to the official release next month. "The Ubuntu team is pleased to announce the final beta release of the Ubuntu 17.04 Desktop, Server, and Cloud products. Codenamed 'Zesty Zapus', 17.04 continues Ubuntu's proud tradition of integrating the latest and greatest open source technologies into a high-quality, easy-to-use Linux distribution," says Adam Conrad, Canonical. "The team has been hard at work through this cycle, introducing new features and fixing bugs."' -- source: https://news.slashdot.org/story/17/03/25/2127238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

meeting next Monday
by Peter Reutemann 23 Mar '17

23 Mar '17

Hi everyone We have a WLUG meeting coming up next Monday: "William Mckee has been to nz.js.con recently and will talk about the A/V setup used for recording the presentations: hdmi2usb" https://www.meetup.com/WaikatoLinuxUsersGroup/events/237234774/ BTW It's not too late if you still want to present something! Just email me. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GNOME 3.24 Released
by Peter Reutemann 22 Mar '17

22 Mar '17

'GNOME 3.24 just finished its six-month development cycle, and it's now the most advanced stable version of the modern and popular desktop environment used by default in numerous GNU/Linux distributions. It was developed since October 2016 under the GNOME 3.23.x umbrella, during which it received numerous improvements. Prominent new features of the GNOME 3.24 desktop environment include a Night Light functionality that promises to automatically shift the colors of your display to the warmer end of the spectrum after sunset, and a brand-new GNOME Control Center with redesigned Users, Keyboard and Mouse, Online Accounts, Bluetooth, and Printer panels. As for the GNOME apps, we can mention that the Nautilus file manager now lets users browse files as root (system administrator), GNOME Photos imitates Darktable's exposure and blacks adjustment tool, GNOME Music comes with ownCloud integration and lets you edit tags, and GNOME Calendar finally brings the Week view. New apps like GNOME Recipes are also part of this release. The full release notes can be viewed here. Softpedia notes in conclusion: "As mentioned before, it will take at least a couple of weeks for the new GNOME 3.24 packages to land on the stable repositories of your favorite distro, which means that you'll most probably be able to upgrade from GNOME 3.22 when the first point release, GNOME 3.24.1, is out on April 12, 2017."' -- source: https://tech.slashdot.org/story/17/03/22/205210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox for Linux is Now Netflix Compatible
by Peter Reutemann 22 Mar '17

22 Mar '17

'For a while, Netflix was not available for traditional Linux-based operating systems, meaning users were unable to enjoy the popular streaming service without booting into Windows. This was due to the company's reliance on Microsoft Silverlight. Since then, Netflix adopted HTML5, and it made Google Chrome and Chromium for Linux capable of playing the videos. Unfortunately, Firefox -- the open source browser choice for many Linux users -- was not compatible. Today this changes, however, as Mozilla's offering is now compatible with Netflix!' -- source: https://news.slashdot.org/story/17/03/22/1510220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

suggestions for upcoming meeting?
by Peter Reutemann 19 Mar '17

19 Mar '17

Hi everyone Any suggestions for the upcoming meeting? https://www.meetup.com/WaikatoLinuxUsersGroup/events/237234774/ Thanks. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

4 6

Big Surprise: HTTPS Interception Middleboxes Weaken Your Security
by Lawrence D'Oliveiro 17 Mar '17

17 Mar '17

Some companies run boxes that intercept outgoing TLS/SSL connections, by using their own certificates that employees’ machines are configured to accept, in order to enforce policies on access to outside sites. Trouble is, many of these boxes introduce their own vulnerabilities into the system, by allowing new kinds of attacks from outside. <https://www.theregister.co.uk/2017/03/17/are_you_undermining_your_web_secur…>

1 0

Microsoft Locks Ryzen, Kaby Lake Users Out of Updates On Windows 7, 8.1
by Peter Reutemann 17 Mar '17

17 Mar '17

'In a move that will shock a lot of people, someone at Microsoft decided to deny Windows 7/8.1 updates to the users of the following CPU architectures: Intel seventh (7th)-generation processors (Kaby Lake); AMD "Bristol Ridge" (Zen/Ryzen); Qualcomm "8996." It's impossible to find any justification for this decision to halt support for the x86 architectures listed above because you can perfectly run MS-DOS on them. Perhaps, Microsoft has decided that the process of foisting Windows 10 isn't running at full steam, so the company created this purely artificial limitation. I expect it to be cancelled soon after a wide backlash from corporate customers. KitGuru notes that users may encounter the following error message when they attempt to update their OS: "Your PC uses a processor that isn't supported on this version of Windows." The only resolution is to upgrade to Windows 10.' -- source: https://tech.slashdot.org/story/17/03/16/2047215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0