- wlug - list.wlug.org.nz

Canonical Preps Security Lifeboat, Yells: Ubuntu 12.04 Hold-Outs, Get In
by Peter Reutemann 15 Mar '17

15 Mar '17

'Canonical is extending the deadline for security updates for paying users of its five-year-old Ubuntu 12.04 LTS -- a first. Ubuntu 12.04 LTS will become the first Long Term Support release of Canonical's Linux to get Extended Security Maintenance (ESM). There are six LTS editions. All others have been end-of-lifed -- and given no security reprieve. LTS editions of Ubuntu Linux are released every two years. Desktop support runs for three years and the server edition receives security patches and updates for a period of five years. Security updates for 12.04 were scheduled to run out on April 28, 2017 but that now won't happen for those on Canonical's Ubuntu Advantage programme. They'll now receive important security fixes for the kernel and "most essential" userspace packages on their servers running 12.04. In what's shaping up to be Canonical's Windows XP moment over at Microsoft, the Linux spinner rolled out the lifeline because customers are clinging to 12.04.' -- source: https://linux.slashdot.org/story/17/03/15/1754232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

From DoNotPay To DoNotDeport?
by Lawrence D'Oliveiro 14 Mar '17

14 Mar '17

Last year, a 19-year-old student named Josh Browder released a chatbot that helped people avoid paying illegal parking fines. Now he is adapting the same technology to areas like compensation for flight delays, the rights of those who are HIV-positive, and refugees trying to cope with foreign legal systems <https://www.techdirt.com/articles/20170308/10393436870/chatbot-that-helped-…>.

1 0

Debian Update: Stretch Frozen, Bug-Squashing Parties Planned
by Peter Reutemann 12 Mar '17

12 Mar '17

'"Debian project leader Mehdi Dogguy has written a status update concerning the work going on for the first two months of 2017," reports Phoronix. An anonymous reader quotes their report: So far this year Debian 9.0 Stretch has entered its freeze, bug squashing parties are getting underway for Stretch, the DebConf Committee is now an official team within Debian, a broad Debian Project roadmap is in the early stages of talk, and more. Bug-Squashing Parties have been scheduled this week in Germany and Brazil, with at least two more happening in May in Paris and Zurich, and for current Debian contributors, "Debian is willing to reimburse up to $100 (or equivalent in your local currency) for your travel and accommodation expenses for participating in Bug Squashing Parties..." writes Dogguy, adding "If there are no Bug Squashing Parties next to your city, can you organize one?"' -- source: https://linux.slashdot.org/story/17/03/12/2210215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New 'USG' Firewalls Protect USB Drives From Malicious Attacks
by Peter Reutemann 12 Mar '17

12 Mar '17

'A developer has created the USG, "a small, portable hardware USB firewall...to prevent malicious USB sticks and devices laden with malware from infecting your computer." An anonymous reader quotes ZDNet: The problem is that most computers automatically trust every USB device that's plugged in, which means malicious code can run without warning... Cars, cash registers, and some ATMs also come with USB ports, all of which can be vulnerable to cyberattacks from a single USB stick. That's where the USG firewall comes in...a simple hardware serial link that only accepts a very few select number of safe commands, which prevents the device from executing system commands or intercepting network traffic. That means the data can flow from the USB device, but [it] effectively blocks other USB exploits. The firmware has been open sourced, and the technical specifications have also been released online "to allow anyone to build their own from readily available development boards."' -- source: https://hardware.slashdot.org/story/17/03/11/1658238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Munich's IT Lead: 'No Compelling Reason' To Switch Back To Windows From Linux
by Peter Reutemann 12 Mar '17

12 Mar '17

'"The man who runs Munich's central IT says there is no practical reason for the city to write off millions of euros and years of work to ditch its Linux-based OS for Windows," reports TechRepublic. Long-time Slashdot reader Qbertino summarizes a German-language article: Karl-Heinz Schneider, lead of Munich's local system house company IT(a)M, goes on to claim, "We do not see pressing technical reasons to switch to MS and MS Office... The council [in their recent plans] didn't even follow the analysts' suggestion to stick with using LibreOffice." Furthermore, Schneider stated that "System failures that angered citizens in recent years never were related to the LiMux project, but due to new bureaucratic procedures..." and apparently decisions by unqualified personnel at the administrative level, as Munich's administration itself states.' -- source: https://linux.slashdot.org/story/17/03/11/0142247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Foundation Chief: Businesses 'Will Fail' If They Don't Use Open Source Code
by Peter Reutemann 12 Mar '17

12 Mar '17

'First Vint Cert said there's a "thread of openness" that runs throughout the internet, adding that "the internet, itself, has open characteristics" and thrives on "permissionless innovation." And Eric Brewer, vice president of infrastructure at Google, touched on the same themes, according to Tech Republic. "Linux, Brewer said, won some of the early internet wars because it was open, but also because it was the most innovative of its time. He also said that companies should work with open source for the value of the ecosystem and community, not just the value of the code." Then Linux Foundation executive director Jim Zemlin told the audience that business models were already changing to include open source, and ultimately made the argument that organizations that "don't harvest the shared innovation" of open source "will fail." ' -- source: https://news.slashdot.org/story/17/03/12/0317215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Netflix access using Linux
by Roderick Aldridge 11 Mar '17

11 Mar '17

Does Spark prevent clients using Netflix under Linux? If so is there a work-around? Thanks for any info. Rod

3 5

Sensible Password Rules
by Lawrence D'Oliveiro 11 Mar '17

11 Mar '17

NIST came out last year with some guidelines on how to choose passwords <https://nakedsecurity.sophos.com/2016/08/18/nists-new-password-rules-what-y…>. The “dos” should not be too surprising, but it is worth mentioning the “don’ts”: * No restrictions on what characters are allowed * No password hints * No knowledge-based authentication * No expiration without some good reason Also, they are no longer recommending the use of SMS for two-factor authentication. I wonder what you should use instead?

1 0

Look before you paste from a website to terminal
by Peter Reutemann 11 Mar '17

11 Mar '17

'Most of the time when we see a code snippet online to do something, we often blindly copy paste it to the terminal. Even the tech savy ones just see it on the website before copy pasting. Here is why you shouldn't do this.' -- source: https://lifepluslinux.blogspot.co.nz/2017/01/look-before-you-paste-from-web… Hint: hidden commands thanks to HTML/CSS. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

Microsoft Continues Porting Visual C++ To Linux
by Peter Reutemann 11 Mar '17

11 Mar '17

'Long-time Slashdot reader Billly Gates shared some news from Microsoft's Visual C++ blog: Visual Studio 2017 now lets developers write C++ code for Linux desktops, servers, and other devices without an extension, targeting specific architectures, including ARM: Visual Studio will automatically copy and remotely build your sources and can launch your application with the debugger... Today Visual Studio only supports building remotely on the Linux target machine. It is not limited to specific Linux distros, but we do have dependencies on the presence of some tools. Specifically, we need openssh-server, g++, gdb and gdbserver. ' -- source: https://linux.slashdot.org/story/17/03/11/0431252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

US ISP Verizon Wireless To Stop Giving Out Static IPv4 Addresses
by Lawrence D'Oliveiro 10 Mar '17

10 Mar '17

New business customers with Verizon Wireless will no longer get static IPv4 addresses. Instead, they will get “persistent prefix” IPv6 addresses <https://www.theregister.co.uk/2017/03/10/verizon_running_out_of_ipv4_addres…>. I assume “persistent prefix” means they get a fixed value for the top 48 bits, and they can do what they like with the bottom 80 bits. This /48 subnet allocation seems to be the common thing for IPv6.

1 0

Engineering Around Social Media Border Searches
by Lawrence D'Oliveiro 08 Mar '17

08 Mar '17

In the wake of the plan floated by the US Government to demand passwords to social media accounts from people wanting to enter the country, here <http://freedom-to-tinker.com/2017/02/10/engineering-around-social-media-bor…> is a discussion of some likely countermeasures that should still give the cover of plausible deniability.

1 3

Quote Of The Week
by Lawrence D'Oliveiro 08 Mar '17

08 Mar '17

“One of the reasons society hasn't destroyed itself is that people with intelligence and skills tend to not be criminals for a living. If it ever became a viable career path, we're doomed.” -- Bruce Schneier <https://www.schneier.com/blog/archives/2017/03/building_smarte.html>

1 0

Litebook launches a $249 linux laptop
by Ron Dean 07 Mar '17

07 Mar '17

Presumably this is in $US -- Ron Dean Unit 61 Village Gardens 16 Rototuna Road Hamilton 3210 New Zealand Home 64 7 8493904 Mob 02102259172

1 0

The City of Munich Might Stick With Linux
by Peter Reutemann 06 Mar '17

06 Mar '17

'Munich's "LiMux" project brought FOSS software to their city's IT administration -- until a vote last month on whether to abandon Linux and return to Windows. "Since this decision was reached, the majority of media have reported that a final call was made to halt LiMux and switch back to Microsoft software," reports the Free Software Foundation Europe. "This is, however, not an accurate representation of the outcome of the city council meeting." An anonymous reader quotes their report: The opposing parties were overruled, but the decision was amended such that the strategy document must specify which LiMux-applications will no longer be needed, the extent in which prior investments must be written off, and a rough calculation of the overall costs of the desired unification... [Only then will the city council make their final decision...] We succeeded thus far in forcing the mayor Dieter Reiter to postpone the final decision, and this was possible through the unwavering pressure created by joint efforts between The Document Foundation, KDE, OSBA, and the FSFE together with all the individuals who wrote to city council members and took the issue to the media. Although the mandate is highly suggestive in that it suggests that the existing vendor-neutral approach is to be replaced with a proprietary solution, it leaves the door open... The new mandate buys us some time. And we will keep going. Some politicians said they'd never received this much input from the public before, and the Free Software Foundation Europe says the city's issues were caused "from organizational problems, including lack of clear structures and responsibilities," which should not be attributed to the Linux operating system. "LiMux as such is still one of the best examples of how to create a vendor-neutral administration based on Free Software."' -- source: https://linux.slashdot.org/story/17/03/04/0532214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Litebook Launches A $249 Linux Laptop
by Peter Reutemann 06 Mar '17

06 Mar '17

'It's "like a Chromebook for Linux users on a budget," reports ZDNet. The new 2.9-pound Litebook uses Intel's Celeron N3150 processor and ships with a 14.1-inch display and a 512-gigabyte hard drive with full HD resolution (1,920 x 1,080). For $20 more they'll throw in a 32-gigabyte SSD to speed up your boot time. "Unlike Windows laptops, Litebooks are highly optimized, come without performance hogging bloatware, [are] designed to ensure your privacy, and are entirely free of malware and viruses," writes the company's web site. They also add that their new devices "are affordable, customizable, and are backwards compatible with Windows software."' -- source: https://linux.slashdot.org/story/17/03/06/0050203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Tim Berners-Lee Endorses DRM In HTML5, Offers Depressingly Weak Defense Of His Decision
by Lawrence D'Oliveiro 02 Mar '17

02 Mar '17

Has the godfather of the Web just sold it down the river? <https://www.techdirt.com/articles/20170301/03062936815/tim-berners-lee-endo…>

2 1

Researchers find “severe” flaw in WordPress plugin with 1 million installs
by Peter Reutemann 01 Mar '17

01 Mar '17

'More than 1 million websites running the WordPress content management system may be vulnerable to hacks that allow visitors to snatch password data and secret keys out of databases, at least under certain conditions. The vulnerability stems from a "severe" SQL injection bug in NextGEN Gallery, a WordPress plugin with more than 1 million installations. Until the flaw was recently fixed, NextGEN Gallery allowed input from untrusted visitors to be included in WordPress-prepared SQL queries. Under certain conditions, attackers can exploit the weakness to pipe powerful commands to a Web server's backend database.' -- source: https://arstechnica.com/security/2017/02/severe-vulnerability-in-wordpress-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New $10 Raspberry Pi Zero comes with Wi-Fi and Bluetooth
by Peter Reutemann 01 Mar '17

01 Mar '17

'The newest member of the Raspberry Pi product line costs just $10 plus tax and includes Wi-Fi and Bluetooth capability. The "Raspberry Pi Zero W" is an updated version of the Raspberry Pi Zero. While it lacks some niceties, like Ethernet and full-sized USB-A ports, it's smaller than the flagship Pi and a fraction of the cost. The original Raspberry Pi Zero was released in November 2015 at a price of just $5/£4. The new Pi Zero W is almost identical to the original, but doubles the price to $10 and adds a wireless chip that supports 802.11b/g/n Wi-Fi (2.4GHz-only) and Bluetooth 4.0.' -- source: https://arstechnica.com/information-technology/2017/02/new-10-raspberry-pi-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

CSS font-size parameter
by Ian Stewart 27 Feb '17

27 Feb '17

Hi All, There was discussion at last nights meeting regarding the CSS "font-size" property and which units to use. E.g. px (pixels), % (percentage), pt (point), or em (a unit in the field of typography originally based on the width of an "M"), . Note that there are more than just these four units, see here<https://www.w3.org/Style/Examples/007/units.en.html>. If you buy-off on the statements from w3schools.com, then this<http://%20https://www.w3schools.com/TAgs/ref_pxtoemconversion.asp> web-page provides a pixel to em converter, and to quote from their CSS page<https://www.w3schools.com/css/css_font.asp>... "Note: If you do not specify a font size, the default size for normal text, like paragraphs, is 16px (16px=1em)." "The em size unit is recommended by the W3C. 1em is equal to the current font size. The default text size in browsers is 16px. So, the default size of 1em is 16px. The size can be calculated from pixels to em using this formula: pixels/16=em." Although admitting there is much debate over which is the better approach, Kyle Schaeffer, on his website<http://kyleschaeffer.com/development/css-font-size-em-vs-px-vs-pt-vs/>, adds in an addendum from 2011... "Generally, when I create a new design, I will use percent on the body element (body { font-size: 62.5%; }), and then use the em unit to size it from there." Or, for some quotes from wikipedia...<https://en.wikipedia.org/wiki/Em_(typography)> "One em was traditionally defined as the width of the capital M in the current typeface and point size..." "In Cascading Style Sheets, the em unit is the height of the font in nominal points or inches." ...And finally there is one "rem" to save us all... "To make style rules that depend only on the default font size, another unit was developed: the rem. The rem, or root em, is the font size of the root element of the document. Unlike the em, which may be different for each element, the rem is constant throughout the document." More on rem's here<https://www.w3.org/Style/Examples/007/units.en.html#future> cheers, Ian.

1 0

Running Emacs As A Daemon With systemd
by Lawrence D'Oliveiro 26 Feb '17

26 Feb '17

Some instructions here <http://blog.refu.co/?p=1296> for creating a systemd “.service” file for running Emacs. Initially he did it as a privileged systemwide service, then he figured out how to make it per-user without needing special privileges. (Found in a user comment to this article <http://www.phoronix.com/scan.php?page=news_item&px=systemd-233>.)

1 0

Image-To-Image Translation In TensorFlow
by Lawrence D'Oliveiro 24 Feb '17

24 Feb '17

This page <http://affinelayer.com/pixsrv/index.html> lets you create schematic renditions of various kinds of objects, and then synthesize corresponding photorealistic representations of those objects, based on pieces of images taken from the training databases. You can draw your own outlines, or just click the “Random” buttons to see what it does. Results range from entertaining to disturbing.

1 0

“Smart Contracts” May Not Be So Smart
by Lawrence D'Oliveiro 23 Feb '17

23 Feb '17

To review, “smart contracts” are a feature of some blockchain-based systems, which allow an interaction between multiple parties to be encoded as a set of rules which will be executed automatically by the system, so that neither the parties nor anyone else can prevent those rules from being enforced. ... To give just one example, a legal contract need not try to anticipate absolutely every relevant event that might occur. If some weird thing happens that is not envisioned in a regular legal contract, the parties can work out a modification to the contract that seems reasonable to them, and failing that, a judge might decide the outcome, subject to established legal principles. Similarly, a single error or “bug” in writing a regular contract, causing its literal meaning to differ from what the parties intended, is unlikely to lead to extreme results because the legal system will often resolve such a problem by trying to be reasonable. Contrast this with “smart contracts” where a bug in a “contract’s” code can lead to a perverse result that may allow one party to exploit the bug, extracting much of the value out of the arrangement with no recourse for the other parties. That’s what happened with the DAO in Ethereum, leading to a controversial attempt to unwind a legal-according-to-the-rules set of transactions, and dividing the Ethereum community. <http://freedom-to-tinker.com/2017/02/20/smart-contracts-neither-smart-not-c…>

1 0

Catching Fishing Pirates With Signals Analysis
by Lawrence D'Oliveiro 22 Feb '17

22 Feb '17

Every vessel on the ocean broadcasts its identity and location using the automatic identification system (AIS), which is mostly used to prevent ships from colliding. These days it can also be used to track ship locations, as most AIS data is relayed through satellites. If you want to hide on the sea, the first thing you do is make your vessel "dark" by turning off your AIS broadcasts. What's interesting about pirate fishing vessels, however, is that they need to rendezvous with legitimate reefers if they want to get paid for their catch. To find the pirates, Amos told Ars, he and Bergman needed to look for odd patterns in the behavior of reefers. The group partnered with Global Fishing Watch to work on mapping satellite AIS data, and those patterns began to emerge. "Often with reefers they come to a halt in the middle of the ocean," Amos said. "We don’t see other broadcasting vessels, but we can be confident based on what that ship is doing that they must be rendezvousing with dark vessels." <https://arstechnica.com/tech-policy/2017/02/to-catch-a-thief-with-satellite…> I guess this counts as a “big data” application...

1 0

ESA Adopts CC-BY-SA
by Lawrence D'Oliveiro 21 Feb '17

21 Feb '17

The European Space Agency is releasing its images and videos under a Free Creative Commons licence <https://www.theregister.co.uk/2017/02/21/esa_turns_valve_pours_open_images_…>. This kind of thing is long overdue. Though I can imagine some commercial entities not liking the sharealike proviso...

1 0

meeting next Monday
by Peter Reutemann 21 Feb '17

21 Feb '17

Hi everyone We have a meeting coming up next Monday: "With Firefox losing against Chrome and sliding lower and lower in the browser rankings, how about we have a good look at the browsers available for Linux and benchmark them? Michael Cree has been to linux.conf.au recently and will talk a bit about his experience. " More details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/237234743/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

When The Internet Of Things Meets The Second-Hand Market
by Lawrence D'Oliveiro 20 Feb '17

20 Feb '17

The global head of IBM's X-Force Red penetration-testing team, Charles Henderson, created a flurry at RSA last week by relating how a connected car app could still access a car he traded in – two years after he'd sold it. ... Henderson feels that none of that should have been possible years after he disposed of the car. Especially as he says he ran a factory reset, reset his garage door and had traded the old car through a factory dealership ... which ... should have revoked his access to the old car. <https://www.theregister.co.uk/2017/02/20/connected_car_in_the_secondhand_lo…> Seems to me this could happen with other kinds of “smart” devices as well.

1 0

Aboard A Cable Survey Ship
by Lawrence D'Oliveiro 17 Feb '17

17 Feb '17

I mention this <http://www.theregister.co.uk/2017/02/16/iregi_tours_submarine_cable_survey_…> because it is scouting out the route for the “Southern Cross NEXT” cable. And also it was formerly an NZ Navy vessel.

1 0

Linus Torvalds: Talk of Tech Innovation is Bullshit. Shut Up and Get the Work Done
by Peter Reutemann 16 Feb '17

16 Feb '17

'Linus Torvalds believes the technology industry's celebration of innovation is smug, self-congratulatory, and self-serving. From a report on The Register: The term of art he used was more blunt: "The innovation the industry talks about so much is bullshit," he said. "Anybody can innovate. Don't do this big 'think different'... screw that. It's meaningless. Ninety-nine per cent of it is get the work done." In a deferential interview at the Open Source Leadership Summit in California on Wednesday, conducted by Jim Zemlin, executive director of the Linux Foundation, Torvalds discussed how he has managed the development of the Linux kernel and his attitude toward work. "All that hype is not where the real work is," said Torvalds. "The real work is in the details." Torvalds said he subscribes to the view that successful projects are 99 per cent perspiration, and one per cent innovation.' -- source: https://linux.slashdot.org/story/17/02/16/1530223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

An Ordinary User?s Adventures In Linux
by rowan schischka 16 Feb '17

16 Feb '17

Third party ink works but don't fill up 100% and save OEM ink to periodically flush. I did not use a cheap printer for a few weeks and the third party ink blocked up the plumbing.

1 0

Google's Not-so-secret New OS
by Peter Reutemann 16 Feb '17

16 Feb '17

'According to reports late last year, Google is working on a new operating system called Andromeda. Much about it is still unknown, but according to the documentations Google has provided on its website, it's clear that the Fuchsia is the actual name of the operating system, and the kernel is called Magenta. A tech enthusiast dug around the documentations to share the followings: To my naive eyes, rather than saying Chrome OS is being merged into Android, it looks more like Android and Chrome OS are both being merged into Fuchsia. It's worth noting that these operating systems had previously already begun to merge together to an extent, such as when the Android team worked with the Chrome OS team in order to bring Update Engine to Nougat, which introduced A/B updates to the platform. Google is unsurprisingly bringing up Andromeda on a number of platforms, including the humble Intel NUC. ARM, x86, and MIPS bring-up is exactly what you would expect for an Android successor, and it also seems clear that this platform will run on Intel laptops. My best guess is that Android as an API and runtime will live on as a legacy environment within Andromeda. That's not to say that all development of Android would immediately stop, which seems extremely unlikely. But Google can't push two UI APIs as equal app frameworks over the long term: Mojo is clearly the future. Ah, but what is Mojo? Well it's the new API for writing Andromeda apps, and it comes from Chromium. Mojo was originally created to "extract a common platform out of Chrome's renderer and plugin processes that can support multiple types of sandboxed content."' -- source: https://mobile.slashdot.org/story/17/02/15/1023242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

JavaScript Attack Breaks ASLR On 22 CPU Architectures
by Peter Reutemann 16 Feb '17

16 Feb '17

'Five researchers from the Vrije University in the Netherlands have put together an attack that can be carried out via JavaScript code and break ASLR protection on at least 22 microprocessor architectures from vendors such as Intel, AMD, ARM, Allwinner, Nvidia, and others. The attack, christened ASLRCache, or AnC, focuses on the memory management unit (MMU), a lesser known component of many CPU architectures, which is tasked with improving performance for cache management operations. What researchers discovered was that this component shares some of its cache with untrusted applications, including browsers. This meant that researchers could send malicious JavaScript that specifically targeted this shared memory space and attempted to read its content. In layman's terms, this means an AnC attack can break ASLR and allow the attacker to read portions of the computer's memory, which he could then use to launch more complex exploits and escalate access to the entire OS. Researchers have published two papers [1, 2] detailing the AnC attack, along with two videos[1, 2] showing the attack in action.' -- source: https://developers.slashdot.org/story/17/02/15/2149235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

QOTW
by Lawrence D'Oliveiro 15 Feb '17

15 Feb '17

Re the Internet of Things: A doctor friend of mine said to me many years ago, "Good thing they won't let you put 'General Protection Fault' down as a cause of death on the certificate." <https://forums.theregister.co.uk/forum/containing/3104004>

1 0

Bruce Schneier At The Open Source Leadership Summit
by Lawrence D'Oliveiro 15 Feb '17

15 Feb '17

"We all had this special right to code the world as we saw fit," said Schneier. "My guess is we're going to lose that right, because it's too dangerous to give to a bunch of techies." <http://www.theregister.co.uk/2017/02/14/the_government_is_coming_for_your_c…>

1 0

Would A Phone That Makes Calls Fly In 2017?
by Lawrence D'Oliveiro 15 Feb '17

15 Feb '17

A company called HMD Global wants to bring back the legendary Nokia 3310 candy-bar phone <https://arstechnica.com/gadgets/2017/02/report-hmd-to-resurrect-legendary-n…>. You regularly see comments from people lamenting the complexity of modern smartphones, and wishing for a return to the simpler days of mobile phones that were good at making calls, with less of all the extra bells and whistles. As well as having much longer battery life. Now we will see if resurrecting a popular model from the days when phones did exactly that will succeed, given that today making calls is one of the last things that people do with their phones...

3 2

Engineering Around Social Media Border Searches
by rowan schischka 15 Feb '17

15 Feb '17

What happens when the 2-factor authentication text gets sent to my NZ phone number, i cant exactly hand that over. I think ill start a bot that posts cat pictures from a fake account. Give the authorities what they want to see. -- Kind Regards Rowan Schischka

1 0

Now sites can fingerprint you online even when you use multiple browsers
by Peter Reutemann 14 Feb '17

14 Feb '17

'Researchers have recently developed the first reliable technique for websites to track visitors even when they use two or more different browsers. This shatters a key defense against sites that identify visitors based on the digital fingerprint their browsers leave behind.' -- source: https://arstechnica.com/security/2017/02/now-sites-can-fingerprint-you-onli… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Web Copy-Protection As A Censorship Tool
by Lawrence D'Oliveiro 13 Feb '17

13 Feb '17

There has been ongoing work at the W3C for some time to standardize “Encrypted Media Extensions” (EME), with the usual claims that many publishers will refuse to offer their content without this kind of “protection”. The mitigating argument has been made that such a “feature” would be optional--the browser user could always turn it off. Well, it turns out Google has removed the option to disable its implementation of EME from Chrome. A further worry is that many countries’ copyright laws include provisions that prohibit the circumvention of copy-protection mechanisms. So work by security researchers to audit browsers that implement EME could be interpreted as violations of such provisions. Many have requested that the W3C explicitly state that EME conformance cannot be (ab)used in such a way, but so far it has refused. <https://www.techdirt.com/articles/20170201/14285436609/codification-web-drm…>

1 1

The City Of Munich Now Wants To Abandon Linux And Switch Back to Windows
by Peter Reutemann 12 Feb '17

12 Feb '17

'"The prestigious FOSS project replacing the entire city's administration IT with FOSS based systems, is about to be cancelled and decommissioned," writes long-time Slashdot reader Qbertino. TechRepublic reports: Politicians at open-source champion Munich will next week vote on whether to abandon Linux and return to Windows by 2021. The city authority, which made headlines for ditching Windows, will discuss proposals to replace the Linux-based OS used across the council with a Windows 10-based client. If the city leaders back the proposition it would be a notable U-turn by the council, which spent years migrating about 15,000 staff from Windows to LiMux, a custom version of the Ubuntu desktop OS, and only completed the move in 2013... The use of the open-source Thunderbird email client and LibreOffice suite across the council would also be phased out, in favor of using "market standard products" that offer the "highest possible compatibility" with external and internal software... The full council will vote on whether to back the plan next Wednesday. If all SPD and CSU councillors back the proposal put forward by their party officials, then this new proposal will pass, because the two parties hold the majority. The leader of the Munich Green Party says the city will lose "many millions of euros" if the change is implemented. The article also reports that Microsoft moved its German headquarters to Munich last year.' -- source: https://yro.slashdot.org/story/17/02/11/1930217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bored with ho-hum cloud backups? Use Usenet (yes, Usenet!) instead
by Peter Reutemann 11 Feb '17

11 Feb '17

'Cloud backups these days are all the rage—for good reason. Rather than dealing with shuffling physical media offsite, you can simply back up the data offsite, where it can be stored in one of many professionally monitored data centers. Unfortunately, this kind of service isn’t free, and the cost can be a barrier. However, there is a cost-effective way to store your cloud backups: Usenet. With access to a Usenet news server, you can simply upload your backup there, and it will be stored redundantly in news servers all over the world. Best of all, this approach typically costs considerably less than a cloud backup service.' -- source: https://arstechnica.com/information-technology/2017/02/bored-with-ho-hum-cl… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Oracle refuses to accept pro-Google “fair use” verdict in API battle
by Peter Reutemann 11 Feb '17

11 Feb '17

'Google successfully made its case to a jury last year that its use of Java APIs in Android was "fair use." A San Francisco federal jury rejected Oracle's claim that the mobile system infringed Oracle's copyrights. But Oracle isn't backing down. Late Friday, the company appealed the high-profile verdict to a federal appeals court. This is the latest stage of a seemingly never-ending legal battle over intellectual property that began in 2010. The conflict has meandered through two federal trials, in addition to multiple trips to the appellate courts and to the Supreme Court. Oracle opened its brief to the US Court of Appeals for the Federal Circuit right where it left off after losing its case. Among other things, Oracle is refusing to believe that the "fair use" defense to copyright-infringement allegations should have protected Google from having to pay billions of dollars in damages.' -- source: https://arstechnica.com/tech-policy/2017/02/oracle-refuses-to-accept-pro-go… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

When A Safety Check Becomes A Point Of Failure...
by Lawrence D'Oliveiro 10 Feb '17

10 Feb '17

All inbound networking for GCE instances, load balancers and VPN tunnels enter via shared layer 2 load balancers. These load balancers are configured with changes to IP addresses for these resources, then automatically tested in a canary deployment, before changes are globally propagated. The issue was triggered by a large set of updates which were applied to a rarely used load balancing configuration. The application of updates to this configuration exposed an inefficient code path which resulted in the canary timing out. From this point all changes of public addressing were queued behind these changes that could not proceed past the testing phase. In other words, the safety system for validating configuration updates before allowing deployment suffered a failure which blocked all configuration updates thereafter. I guess the answer is to add a watchdog for the canaries ... how many more metaphors can I mix in? <http://www.theregister.co.uk/2017/02/10/google_cloud_outage_explanation/>

1 0

We Finally Have A Computer That Can Survive The Surface Of Venus
by Lawrence D'Oliveiro 10 Feb '17

10 Feb '17

The Venera landers that the USSR sent to Venus in the 1970s and 1980s were able to survive for up to 2 hours by heavy use of refrigeration and pre-cooling. But now researchers are testing electronics based on silicon carbide, which can work without special protection at very high voltages and temperatures: The chip, a simple 3-stage oscillator, kept functioning [in Venus-like conditions] at a steady 1.26MHz for 521 hours (21.7) days before the [test rig] had to be shut down. <https://arstechnica.co.uk/gadgets/2017/02/venus-computer-chip/>.

1 0

Met Goes Public Domain
by Lawrence D'Oliveiro 10 Feb '17

10 Feb '17

New York’s Metropolitan Museum of Art is putting 375,000 digitized images online under a Creative Commons CC0 (effectively Public Domain) licence. As Techdirt notes <https://www.techdirt.com/articles/20170208/13005636669/met-goes-public-doma…>, it shouldn’t have to bother specifying such a licence: we should be able to take for granted that digitizations of public-domain works should themselves be public-domain. Unfortunately, others with control over such works (and sizeable legal budgets) think differently. So all kudos to the Met for making this very clear.

2 1

The Right Not To Be Searchable
by Lawrence D'Oliveiro 09 Feb '17

09 Feb '17

“[A] website in Romania ... obtained and posted Canadian judicial and tribunal decisions. These were all public documents, but they were not previously indexed by Google, which meant their contents were effectively hidden. The Romanian site allowed its copies to be indexed by Google, which made the decisions and the Canadian citizens involved visible for the first time -- something the people affected were not happy about. They complained to the Privacy Commissioner of Canada, who ruled that the Romanian site violated Canadian privacy law.” <https://www.techdirt.com/articles/20170208/02314536660/landmark-court-decis…>

1 0

Microsoft hosts the Windows source in a monstrous 300GB Git repository
by Peter Reutemann 07 Feb '17

07 Feb '17

'Microsoft has been working to enhance Git to improve the way it handles vast repositories. Central to this effort is a new project released (in part) as open source Git Virtual File system (GVFS). The premise of GVFS is straightforward enough: rather than fetching all the data at once, only a bare skeleton of the repository needs to be populated up front. The virtualized file system subsequently retrieves additional data on a demand-driven, as-needed basis. Building one particular Windows component, for example, will cause GVFS to fetch the files that make up that component, along with anything that the component depends on, but it will stop short of fetching all the many hundreds of gigabytes the repository contains.' -- source: https://arstechnica.com/information-technology/2017/02/microsoft-hosts-the-… I remember using SourceSafe way back. It may not have been great, but it was a big improvement over "not having any" version control. :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 4

Intel's Atom C2000 Chips Are Bricking Products – And It's Not Just Cisco Hit
by Lawrence D'Oliveiro 06 Feb '17

06 Feb '17

Certain models of Intel Atom chips are prone to clock-signal failures after about 18 months, rendering them unusable. This seems to be related to a warning put out by Cisco about some of its products, but neither company will confirm there is a link. <http://www.theregister.co.uk/2017/02/06/cisco_intel_decline_to_link_product…>

1 0

Chrome 56 Quietly Added Bluetooth Snitch API
by Peter Reutemann 06 Feb '17

06 Feb '17

'When Google popped out Chrome 56 at the end of January it was keen to remind us it's making the web safer by flagging non-HTTPS sites. But Google made little effort to publicise another feature that's decidedly less friendly to privacy, because it lets websites ask about users' Bluetooth devices and harvest information from them through the browser. That's more a pitch to developers, as is clear in this YouTube video from Pete LePage of the Chrome Developers team. "Until now, the ability to communicate with Bluetooth devices has been possible only for native apps. With Chrome 56, your Web app can communicate with nearby Bluetooth devices in a private and secure manner, using the Web Bluetooth API," Google shares in the video. "The Web Bluetooth API uses the GATT [Generic Attribute Profile - ed] protocol, which enables your app to connect to devices such as light bulbs, toys, heart-rate monitors, LED displays and more, with just a few lines of JavaScript." In other words, the API lets websites ask your browser "what Bluetooth devices can you see," find out what your fridge, and so on, is capable of, and interact with it.' -- source: https://yro.slashdot.org/story/17/02/06/1425208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

25G/50G Ethernet
by Lawrence D'Oliveiro 06 Feb '17

06 Feb '17

Thought there already was a 100-gigabit-per-second Ethernet spec. But it seems that still isn’t quite practical enough (cost? range?) for common use. Nor is the 40-gigabit-per-second fallback. So here we have two more lesser specs: <http://www.theregister.co.uk/2017/01/31/25g_and_50g_ethernet_spec_finalised/>.

1 1

Windows DRM-Protected Files Used To Decloak Tor Browser Users
by rowan schischka 04 Feb '17

04 Feb '17

It will be interesting to see if advertising companies will exploit this. You can see it as an exploit to track users but it should be possible for users to discover who is tracking them -- Rowan Schischka

1 0

Windows DRM-Protected Files Used To Decloak Tor Browser Users
by Peter Reutemann 03 Feb '17

03 Feb '17

'Downloading and trying to open Windows DRM-protected multimedia files can deanonymize Tor Browser users and reveal their real IP addresses, security researchers from Hacker House have warned. On Windows, multimedia files encoded with special Microsoft SDK will automatically open an IE window and access a URL to check the file's license. Since this request is sent outside of the Tor Browser and without user interaction, this can be used to ping law enforcement servers and detect the user's real IP address and other details. For example, law enforcement could host properly signed DRM-protected files on sites pretending to host child pornography. When a user would try to view the file, the DRM multimedia file would use Internet Explorer to ping a server belonging to the law enforcement agency. The same tactic can also be used to target ISIS militants trying to view propaganda videos, illegal drug and weapons buyers trying to view video product demos, political dissidents viewing news videos, and more. A video of the attack is available here.' -- source: https://yro.slashdot.org/story/17/02/02/231229 Not sure whether that applies to Linux/Wine/IE as well. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Judge Stops PS3 Linux Settlement
by Lawrence D'Oliveiro 03 Feb '17

03 Feb '17

<https://arstechnica.com/tech-policy/2017/02/game-over-for-ps3-linux-settlem…>: “The California judge presiding over the litigation is now killing the proposed settlement amid concerns the lawyers representing the class haven't explained why they should get $2.25 million for their legal services, especially considering that the deal has made it burdensome on gamers to get their cash.” Seems par for the course for class-action settlements, that the lawyers rake it in in fees, while the actual plaintiffs end up with peanuts...

1 0

How Google fought back against a crippling IoT-powered botnet and won
by Peter Reutemann 02 Feb '17

02 Feb '17

'In September, KrebsOnSecurity—arguably the Internet's most intrepid source of security news—was on the receiving end of some of the biggest distributed denial-of-service attacks ever recorded. The site soon went dark after Akamai said it would no longer provide the site with free protection, and no other DDoS mitigation services came forward to volunteer their services. A Google-operated service called Project Shield ultimately brought KrebsOnSecurity back online and has been protecting the site ever since. At the Enigma security conference on Wednesday, a Google security engineer described some of the behind-the-scenes events that occurred shortly after Krebs asked the service for help, and in the months since, they said yes. While there was never significant hesitancy to bring him in, the engineers did what engineers always do—weighed the risks against the benefits. "What happens if this botnet actually takes down google.com and we lose all of our revenue?" Google Security Reliability Engineer Damian Menscher recalls people asking. "But we considered [that] if the botnet can take us down, we're probably already at risk anyway. There's nothing stopping them from attacking us at any time. So we really had nothing to lose here."' -- source: https://arstechnica.com/security/2017/02/how-google-fought-back-against-a-c… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Gitlab Backups ... What Backups?
by Lawrence D'Oliveiro 02 Feb '17

02 Feb '17

A harried sysadmin accidentally deletes nearly 300GB of data during a troublesome data replication process ... and then they discover that, out of 5 different recovery procedures they thought they had available, none work. <http://www.theregister.co.uk/2017/02/01/gitlab_data_loss/>

2 2

LibreOffice 5.3 Released, Touted As 'One of the Most Feature-Rich Releases' Ever
by Peter Reutemann 02 Feb '17

02 Feb '17

'A new month, and a brand new version of open-source office suite LibreOffice is now available to download. And what a release it is. LibreOffice 5.3 introduces a number of key new features and continues work on improving the look and feel of the app across all major platforms. The Document Foundation describes LibreOffice 5.3 as "one of the most feature-rich releases in the history of the application." One of the headline features is called MUFFIN interface, a new toolbar design similar to the Microsoft Office Ribbon UI.' -- source: https://news.slashdot.org/story/17/02/01/1326204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

System76 GPGPU Server
by Lawrence D'Oliveiro 01 Feb '17

01 Feb '17

System76 announces its new Ibex Pro box <http://www.phoronix.com/scan.php?page=news_item&px=System76-Ibex-Pro-GPU-Se…> which can hold up to nearly 40,000 NVidia CUDA cores <https://system76.com/servers/ibex>. Not sure how many you get for that USD9,575 base price... Seems like there is no really competitive market for GPGPU hardware--it is totally dominated by NVidia, and nobody else gets a serious look-in. So the industry-standard OpenCL API languishes, since the dominant player prefers its own proprietary alternative, and there is little pressure from users to be able to port their code to competing products.

1 0

Google AI on raspberry pi
by rowan schischka 31 Jan '17

31 Jan '17

"Google has developed a huge range of tools for machine learning, IoT, wearables, robotics, and home automation, and it wants Raspberry Pi fans to fill out a survey <https://google.qualtrics.com/jfe/form/SV_3yMNYryaP4WsCwJ?Source=RaspPi> that will help it to understand what tools to provide." http://www.zdnet.com/article/google-is-bringing-ai-to-your-raspberry-pi/ I just took the survey and I don't get any impression of what tools they will bring to the r-pi. It was pretty simple, no email address required to participate. The questions were how old are you, what area are your projects in, and how frequently do you work on your projects. Im sure with the processing power of r-pi we'll see some sort of web API which wouldn't really need to be specific to the r-pi. It will be interesting to watch what they come up with so if you have maker projects, take the survey. -- Rowan Schischka

1 0

Backblaze 2016 Hard Drive Report
by Lawrence D'Oliveiro 31 Jan '17

31 Jan '17

<https://arstechnica.com/information-technology/2017/01/8tb-hgst-disks-show-…>: Traditionally, the company has stuck with consumer-oriented disks. Backblaze argues that the extra cost of "enterprise" disks doesn't make sense for its usage pattern. Other studies have shown no significant difference in reliability between “enterprise” and “consumer” disks anyway.

2 2

USB-C Power Meter
by Lawrence D'Oliveiro 31 Jan '17

31 Jan '17

With all the worries over bad USB-C cables and vendors that play fast and loose with the power spec, here <https://arstechnica.co.uk/gadgets/2017/01/usb-c-power-meter/> is a measurement gadget that can help to some extent. But as the article says: If you really want to test a new charger or cable before plugging it into an expensive device, your best bet is some DIYish electronics involving a breakout board and a multimeter. But there doesn't seem to be a plug-and-play version of that yet.

1 0

The Trump-And-Dump Bot
by Lawrence D'Oliveiro 30 Jan '17

30 Jan '17

This bot <http://www.theregister.co.uk/2017/01/30/trumps_corporate_twitter_trolling_t…> analyzes Trump’s tweets, identifies the company he is badmouthing, and does a quick short-sell to profit from the momentary dip in the company’s stock value. T3's approach involves using a Python Twitter bot and API calls to services like Indico for machine learning (sentiment analysis and entity recognition), Clearbit for company identification, Google Finance for stock pricing, and E‑Trade for executing the trade. They have been donating the profits to charity. Imagine that--an ethical use for short-selling...

1 0

Windows Users: It Might Be Time To Stop Using Antivirus
by Lawrence D'Oliveiro 27 Jan '17

27 Jan '17

The nail in the coffin, according to O'Callahan, is that software vendors rarely speak out about antivirus issues "because they need cooperation from the AV vendors." He then links to a mailing list thread in 2012, where he suggests keeping a list of the AV software that interferes with Firefox. Later in the thread, Mozilla PR swoops in and tells him to knock it off. <https://arstechnica.com/information-technology/2017/01/antivirus-is-bad/>

1 0

Code-Signing Vs Software Developers
by Lawrence D'Oliveiro 26 Jan '17

26 Jan '17

This item <http://www.theregister.co.uk/2017/01/26/windows_code_signing_changes/> is about Microsoft adopting some recommendations from the “Certificate Authority Security Council” that code-signing keys should be embedded in special hardware devices, not simply kept as files on a regular computer. Apparently they are also suggesting some yet-to-be-defined “cloud-based service” as an alternative, which raises some questions. One of the commenters linked this article <http://www.pcworld.com/article/2846653/storage-for-spies-how-the-fips-stand…> which gives a good overview of hardware signing key devices that are certified to the various levels of the FIPS 140-2 standard. The idea is not a new one. But like most security techniques that are worth a darn, it can cause all kinds of irritations in practical use.

1 0

KDE-Branded Laptop
by Lawrence D'Oliveiro 26 Jan '17

26 Jan '17

Announcing ... the KDE Slimbook <http://phoronix.com/scan.php?page=news_item&px=KDE-Slimbook-Laptop>.

2 1

why ifconfig may not work these days
by Ian Young 26 Jan '17

26 Jan '17

>From time to time I find myself wondering where *ifconfig* has gone. This article may provide the answer. https://lwn.net/Articles/710533/ See also: http://baturin.org/docs/iproute2/

2 1

Mossberg: What?s up with Firefox, the browser that time forgot?
by rowan schischka 26 Jan '17

26 Jan '17

Happy new year everybody. Somehow i missed the first meeting. For the next one could we do a live benchmark of web browsers available on linux? Theres a couple of things to consider such as: how quickly new browser versions are available - security updates accuracy of rendering - i have found Midori feels fast but does not display some web pages the same as others Theres also flash and HTML5 we could look into. A few years ago (around 2010/2011) I made a simple HTML5 canvas with some animations that looked like a space invaders game, from memory, on debian i had the following results: IE, can't remember version, got around 20 fps chrome scored 120 something fps firefox received around 12 fps I dont know what benchmarks are available for us to use but it would be interesting, it would also be interesting to look at comparing browsers on fedora and ubuntu -- Kind Regards Rowan Schischka

2 1

Mossberg: What’s up with Firefox, the browser that time forgot?
by Peter Reutemann 25 Jan '17

25 Jan '17

'Until about five years ago, techies and others who wanted a speedier, extensible, more privacy-oriented web browser on their desktops often immediately downloaded Mozilla's Firefox to use instead of Internet Explorer on Windows or Safari on the Mac. But those days seem long ago. Firefox is hardly discussed today, and its usage has cratered from a high of over 30 percent of the desktop browser market in 2010 to about 12 percent today, according to Mozilla, citing stats from NetMarketShare. (Various other analytics firms put the share as low as 10 percent or as high as 15 percent.) And Firefox’s share on mobile devices is even worse, at under 1 percent, according to the same firm. Today, the go-to-browser is Google’s Chrome, which has over a 50 percent share on both desktop and mobile, according to NetMarketShare.' -- source: http://www.theverge.com/2017/1/25/14376710/walt-mossberg-mozilla-firefox-br… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AdNauseam, Google, And The Myth Of The “Acceptable Ad”
by Lawrence D'Oliveiro 24 Jan '17

24 Jan '17

[AdNauseam 3.0] contains some new features we’ve been excited to discuss with users and critics, but the discussion was quickly derailed when we learned that Google had banned AdNauseam from its store, where it had been available for the past year. We also learned that Google has disallowed users from manually installing or updating AdNauseam on Chrome, effectively locking them out of their own saved data, all without prior notice or warning. <http://freedom-to-tinker.com/2017/01/24/adnauseam-google-and-the-myth-of-th…>

1 0

Zorin distro reviewed on Distrowatch
by Ian Young 24 Jan '17

24 Jan '17

For a more detailed appraisal of Zorin than was possible at the last meeting see issue 695 of Distrowatch Weekly. http://distrowatch.com/weekly.php?issue=20170116#zorin See also with reference to Fedora a derivative called Korora bubbling under at 49 on Distrowatch. Tracks Fedora releases without much delay. Korora is a little blue penguin. 'Korora was born out of a desire to make Linux easier for new users, while still being useful for experts. The main goal of Korora is to provide a complete, easy-to-use system for general computing. Originally based on Gentoo Linux in 2005, Korora was re-born in 2010 as a Fedora Remix with tweaks and extras to make the system "just work" out of the box.'

1 0

Asus Tinker Board
by Lawrence D'Oliveiro 23 Jan '17

23 Jan '17

Quad-core ARM-based board with more powerful GPU with 4K video capability, also 24-bit audio, and the site linked to quotes a price of about £46+VAT, so not too far off competing with the Raspberry π. Except it’s 32-bit only. <http://arstechnica.com/gadgets/2017/01/asus-tinker-board-price-specs-releas…>

1 0

Already on probation, Symantec issues more illegit HTTPS certificates
by Peter Reutemann 23 Jan '17

23 Jan '17

'A security researcher has unearthed evidence showing that three browser-trusted certificate authorities (CAs) owned and operated by Symantec improperly issued more than 100 unvalidated transport layer security certificates. In some cases, those certificates made it possible to spoof HTTPS-protected websites.' -- source: http://arstechnica.com/security/2017/01/already-on-probation-symantec-issue… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Learn-To-Code Site Code.org Loses Student Work Due To Index Bug
by Lawrence D'Oliveiro 23 Jan '17

23 Jan '17

For your revision this week: understanding integer overflow. <http://www.theregister.co.uk/2017/01/22/code_dot_org_index_bug_wiped_studen…>

1 0

New Term To Scare You With: “Line Of Death”
by Lawrence D'Oliveiro 20 Jan '17

20 Jan '17

... a.k.a. the demarcation between pixels in a web browser window that the user can trust, and those they can’t. And how every new advance in “user experience” seems calculated to weaken this line. Another lovely new term: “picture-in-picture phishing attack”. <http://www.theregister.co.uk/2017/01/19/browser_line_of_death/>

1 0

SporeStack: Anonymous, Disposable Servers
by Lawrence D'Oliveiro 19 Jan '17

19 Jan '17

Paid for with Bitcoin: <http://www.theregister.co.uk/2017/01/19/disposable_servers_available_anonym…>.

1 0

Microsoft-Owned Minecraft No Longer Supported On Microsoft-Owned Windows Phone/Mobile
by Lawrence D'Oliveiro 19 Jan '17

19 Jan '17

<http://arstechnica.com/gaming/2017/01/microsoft-owned-minecraft-no-longer-s…>: In the meantime, however, the game stands as yet another anomaly in the company's approach to software development. It isn't following the rules it suggests that others should obey, and third-party platforms—including the relatively rarely used Fire OS—are seeing stronger software support than the company's own. This tendency to offer better support for non-Windows systems continues to annoy Windows fans, and the failure to capitalize on the universal-ness of UWP leads developers to wonder, "If Microsoft isn't consistently writing universal apps, why should we?"

2 2

Big Astronomy Destroys Big Data
by Lawrence D'Oliveiro 18 Jan '17

18 Jan '17

<http://www.theregister.co.uk/2017/01/18/murchison_radiotelescope_opens_the_…>: A curious detail in the CSIRO blog post caught Vulture South's eye: ASKAP is producing 5.2 TB per second of data, which the CSIRO reckons is equivalent to about 15 per cent of the current data rate for the whole of the Internet. That's bigger, by a nice fat margin, than two things: the connection from Murchison to the Pawsey supercomputer centre in Perth; the amount of disk available once the data arrives in Perth. Clearly, there's a serious amount of data reduction happening along the way... In short, 5.2TB/s of raw data in, 22MB/s of high-res image data out. The latter is what’s stored for further processing.

1 0

Project Isambard To Test Feasibility Of An ARM-Based Supercomputer
by Lawrence D'Oliveiro 18 Jan '17

18 Jan '17

Four UK universities will build a 10,000+-core ARM super to determine whether such a beast can beat the usual Xeon-based beasties on price/performance. There’s a suggestion of support for other architectures for comparison purposes as well. <http://www.theregister.co.uk/2017/01/18/arm_met_office_hpc/>

1 0

Guilty SPARC: Oracle euthanizes Solaris 12, expunging it from roadmap
by Peter Reutemann 18 Jan '17

18 Jan '17

'Rumors have been circulating since late last year that Oracle was planning to kill development of the Solaris operating system, with major layoffs coming to the operating system's development team. Others speculated that future versions of the Unix platform Oracle acquired with Sun Microsystems would be designed for the cloud and built for the Intel platform only and that the SPARC processor line would meet its demise. The good news, based on a recently released Oracle roadmap for the SPARC platform, is that both Solaris and SPARC appear to have a future. The bad news is that the next major version of Solaris—Solaris 12— has apparently been canceled, as it has disappeared from the roadmap. Instead, it's been replaced with "Solaris 11.next"—and that version is apparently the only update planned for the operating system through 2021.' -- source: http://arstechnica.com/information-technology/2017/01/oracle-sort-of-confir… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting on Monday (incl SGM)
by Peter Reutemann 18 Jan '17

18 Jan '17

Hi everyone We have a meeting coming up next Monday: SGM with the following (preliminary) agenda: - elect Vice president Meeting topics - distro roundup: Fedora, Devuan, Zorin - a bit different: ReactOS, FreeDOS Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/236393751/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Vivaldi is building “Opera as it should’ve been”
by Peter Reutemann 16 Jan '17

16 Jan '17

'Working in tight niches occupied by the behemoths of the Internet world is hard; doing it as a startup without external funding is even harder. The 35-strong team of Vivaldi, the spiritual successor to Opera, is doing exactly that: two years after the first public beta and eight months after the release of version 1.0, the Web browser has about 1 million users—but it still isn't turning a profit. Vivaldi, which was envisioned by the Opera Software co-founder and former CEO Jon Stephenson von Tetzchner, is catering first of all to power users and the tech-savvy lot. The team, however, has high expectations for their product and hopes it will have a broader appeal over time in order to start actually making money.' -- source: http://arstechnica.com/information-technology/2017/01/vivaldi-opera-one-mil… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi upgrades Compute Module with 10 times the CPU performance
by Peter Reutemann 16 Jan '17

16 Jan '17

'The Raspberry Pi Compute Module is getting a big upgrade, with the same processor used in the recently released Raspberry Pi 3. The Compute Module, which is intended for industrial applications, was first released in April 2014 with the same CPU as the first-generation Raspberry Pi. The upgrade announced today has 1GB of RAM and a Broadcom BCM2837 processor that can run at up to 1.2GHz. "This means it provides twice the RAM and roughly ten times the CPU performance of the original Compute Module," the Raspberry Pi Foundation announcement said.' -- source: http://arstechnica.com/information-technology/2017/01/raspberry-pi-upgrades… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Debian 8.7 Released
by Peter Reutemann 15 Jan '17

15 Jan '17

'Debian 8.7 has been released. An anonymous reader quotes Debian.org: This update mainly adds corrections for security problems to the stable release, along with a few adjustments for serious problems. Security advisories were already published separately and are referenced where available. Please note that this update does not constitute a new version of Debian 8 but only updates some of the packages included. There is no need to throw away old "jessie" CDs or DVDs but only to update via an up-to-date Debian mirror after an installation, to cause any out of date packages to be updated. Those who frequently install updates from security.debian.org won't have to update many packages and most updates from security.debian.org are included in this update. 86 packages have been updated -- including some fixes for systemd. ("Rework logic to determine when we decide to add automatic deps for mounts; various ordering fixes for ifupdown; systemctl: Fix argument handling when invoked as shutdown...")' -- source: https://linux.slashdot.org/story/17/01/15/0144253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mint 18.1 review: Forget about Wayland and get comfy with the command line
by Peter Reutemann 12 Jan '17

12 Jan '17

'For better or worse, the Wayland graphics stack is the future of Linux and will undoubtedly be the big story of 2017 (unless the Mir display server actually ships, in which case it might share the spotlight). What's more, once you've used Wayland in my experience, you'll want it everywhere. Sadly, only one of the major distros has Wayland today: Fedora. That doesn't mean Mint 18.1, which happened to arrive the same day that our Fedora review published, isn't a great release. But this new release doesn't have Wayland. Nor will the distro at large have Wayland until Linux Mint's upstream source, Ubuntu, ships Wayland as part of an LTS release. That likely won't happen until at least 2018, when the next Ubuntu LTS release comes out. By that time, theoretically, Ubuntu itself will be using Mir, and Ubuntu GNOME (and possibly other flavors) will move to Wayland. Then and only then will Mint be in a position to move to Wayland. And even then, it may not happen right away. That means there's no Wayland in Mint's near future, and it also means Mint will be a little out of the loop going forward. That's an interesting transition for the project given that it started out with a more aggressive development pace, adopting new features and iterating quickly compared to other Linux distros. All that changed a couple of years ago when Mint opted to stop chasing Ubuntu and built off the LTS cycle. Mint is no longer quite as cutting edge as it once was, which shows up in some important areas like the kernel (which is only at 4.4 even now). Mint is also still plagued by the some of the poorly implemented update and security issues that have dogged it for years. You can keep Mint up-to-date and secure, but Mint actively encourages users (especially inexperienced) users to avoid updates. That more than anything else would prevent me from picking Mint 18.1 over, well, any other distro. Although Mint 18.1 builds on the same set of base packages found in the previous release (Linux Mint 18.0), which are based on Ubuntu 16.04, there's still plenty of new stuff in 18.1 to make Mint fans happy. Most of what's new is not underlying system change; rather, it's higher level stuff (the stuff that makes Mint, well, Mint).' -- source: http://arstechnica.com/gadgets/2017/01/mint-18-1-review-forget-about-waylan… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Lawyer Rewrites Instagram's Privacy Policy So Kids and Parents Can Have a Meaningful Talk About Privacy
by Peter Reutemann 10 Jan '17

10 Jan '17

Not exactly Linux related, but nonetheless interesting to read a privacy policy in "plain English" rather than legal mumbo jumbo: 'Kids, of age between 12 and 15, are increasingly joining Facebook's Instagram service, but according to a research, they likely don't even understand what they are signing up for. Jenny Afia, a privacy law expert at Schillings, a UK-based law firm, rewrote Instagram's terms of service in child-friendly language, so that not only the kids but their parents are able to understand what things are at stake. Highlighted are the changes the lawyer has made: Officially you own any original pictures and videos you post, but we are allowed to use them, and we can let others use them as well, anywhere around the world. Other people might pay us to use them and ** *we will not pay you for that*. [...] We may keep, use and share your personal information with companies connected with Instagram. This information includes your name, email address, school, where you live, pictures, phone number, your likes and dislikes, where you go, who your friends are, how often you use Instagram, and ** *any other personal information we find* such as your birthday or who you are chatting with, ** * including in private messages (DMs)*. [...] We might send you adverts connected to your interests which we are monitoring. ** *You cannot stop us doing this and it will not always be obvious that it is an advert*.' -- source: https://yro.slashdot.org/story/17/01/09/1413215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

You Know The Machines Are Taking Over When ...
by Lawrence D'Oliveiro 07 Jan '17

07 Jan '17

... a San Diego TV station does a story about a young girl who asks her parents’ Amazon Echo to get her a dollhouse, which automatically causes an order to be placed for one; but the fun really begins when the voice of the TV presenter triggers additional Amazon Echo devices in the homes of those watching the news, causing them to try to place orders for dollhouses as well. <http://www.theregister.co.uk/2017/01/07/tv_anchor_says_alexa_buy_me_a_dollh…>

2 1

https://kite.com - Your programming copilot
by Chris O'Halloran 05 Jan '17

05 Jan '17

A utility that may be available to Linux users soon. https://kite.com/

2 2

An SQL Injection Attack Is A Legal Company Name In The UK
by Lawrence D'Oliveiro 04 Jan '17

04 Jan '17

I wonder if any real-world databases will fall over trying to include this name. ;) <https://www.schneier.com/blog/archives/2017/01/an_sql_injectio.html>

1 0

Rutgers U In Financial Trouble From Cloud Failure
by Lawrence D'Oliveiro 04 Jan '17

04 Jan '17

Rutgers University in New Jersey has put its “Cornerstone” admin system on Oracle’s cloud services. Ongoing hiccups in this, going back to September, have caused it serious trouble trying to pay its bills, leading to unpleasant consequences like the electricity supply being cut off to some offices. <http://www.theregister.co.uk/2017/01/03/rutgers_university_oracle_cloud_fou…>

1 0

Cloudflare Leap-Second Panic
by Lawrence D'Oliveiro 03 Jan '17

03 Jan '17

Cloudflare’s DNS proxy software misbehaved on New Year’s Day, because of the extra second that was added to December 31st: <http://arstechnica.co.uk/security/2017/01/cloudflare-leap-second-software-p…>. Because they occur so rarely, it seems very difficult to test software to work correctly with leap seconds. This is one reason why some groups propose getting rid of them altogether.

1 0

Photocopier Security
by Lawrence D'Oliveiro 03 Jan '17

03 Jan '17

<https://www.schneier.com/blog/archives/2017/01/photocopier_sec.html>: A modern photocopier is basically a computer with a scanner and printer attached. This computer has a hard drive, and scans of images are regularly stored on that drive. This means that when a photocopier is thrown away, that hard drive is filled with pages that the machine copied over its lifetime. As you might expect, some of those pages will contain sensitive information. Some of the reader discussion veers into one or two only-semi-related, but interesting areas. For example, did you know that Xerox invented an image-compression technique (JBIG2) for its photocopiers that would actually introduce typos into documents?

1 0

Is The Desktop CPU Dead?
by Lawrence D'Oliveiro 03 Jan '17

03 Jan '17

<http://arstechnica.com/gadgets/2017/01/intel-core-i7-7700k-kaby-lake-review/>: For yet another year, high-end desktop CPU performance remains at a standstill. With low-power laptops and all-in-ones continuing to outsell desktops—and with high-end workloads like video editing, 3D animation, and machine learning increasingly being offloaded to GPUs—perhaps it was inevitable that Intel would stop caring so much about its high-end consumer CPUs. Or maybe Intel's struggles with the 14nm process forced its hand, and the last few years of disappointing performance improvements are down to physics rather than passivity. Those laptop sales are declining, too...

1 0

Listening To Streaming Radio
by Lawrence D'Oliveiro 02 Jan '17

02 Jan '17

Currently listening to Sydney’s TripleJ radio station using the ffplay utility (part of FFmpeg). For anybody else who wants to listen without having to go through a web browser, ABC helpfully provide a list of direct-streaming URLs for their stations at <https://radio.abc.net.au/help/streams>. ffplay reports some interesting additional details about the stream: Metadata: icy-notice1 : <BR>This stream requires <a href="http://www.winamp.com">Winamp</a><BR> icy-notice2 : SHOUTcast DNAS/posix(linux x64) v2.4.7.256<BR> icy-name : Triple J NSW icy-genre : Misc icy-br : 64 icy-url : http://www.abc.net.au/radio icy-pub : 0 In other words, they seem to be streaming from a Linux server, but their recommendation is for a client that doesn’t run on Linux...

2 6

Report on U.S. political party having its e-mail servers hacked
by Ian Stewart 30 Dec '16

30 Dec '16

You may have read in the main-stream media about a U.S. political party having its e-mail servers hacked and then copies of the e-mails were published on a web-site. If you'd like to know more, then a 13 page joint report<https://www.us-cert.gov/sites/default/files/publications/JAR_16-20296A_GRIZ…> has been released on 29 December 2016 by the National Cybersecurity and Communications Integration Center (NCCIC) of The Department of Homeland Security (DHS), and the Federal Bureau of Investigation (FBI). In reading this report please recognise that "The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within." The report commences... "GRIZZLY STEPPE – Russian Malicious Cyber Activity Summary This Joint Analysis Report (JAR) is the result of analytic efforts between the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI). This document provides technical details regarding the tools and infrastructure used by the Russian civilian and military intelligence Services (RIS) to compromise and exploit networks and endpoints associated with the U.S. election, as well as a range of U.S. Government, political, and private sector entities. The U.S. Government is referring to this malicious cyber activity by RIS as GRIZZLY STEPPE." While the report contains many abbreviations, please note that "GRIZZLY STEPPE" is never written as "Grizzly Steppe" nor is it abbreviated to "GS". On Page 2... "Description. The U.S. Government confirms that two different RIS actors participated in the intrusion into a U.S. political party." The report does not provide the name of the "U.S. political party". For these details you'll need to use a search engine to search the Internet. The Description continues... "The first actor group, known as Advanced Persistent Threat (APT) 29, entered into the party’s systems in summer 2015, while the second, known as APT28, entered in spring 2016." Page 4 lists 48 "Alternate Names" of the Russian Military and Civilian Intelligence Services (RIS). They are not all called names like Advanced Persistent Threat (APT) 28, APT29, APT30... etc. For example one of them is called "Powershell backdoor". Page 8 has the, "Detailed Mitigation Strategies" with a section on "Protect Against SQL Injection and Other Attacks on Web Services", which states... "Take steps to harden both Web applications and the servers hosting them to reduce the risk of network intrusion via this vector." The "vector" (or "link") is to this webpage... https://msdn.microsoft.com/en-us/library/ff648653.aspx "Improving Web Application Security: Threats and Countermeasures J.D. Meier, Alex Mackman, Michael Dunner, Srinath Vasireddy, Ray Escamilla and Anandha Murukan Microsoft Corporation Published: June 2003 Last Revised: January 2006 Applies to: Internet Information Services (IIS) 5.0 Microsoft Windows® 2000 operating system" With a last revision date of January 2006 its interesting to be provided with advice on how to take steps on your Microsoft Windows® 2000 operating system for which mainstream support ended on June 30, 2005 and extended support ended on July 13, 2010. UNIX does get one mention in the section "Credentials" on page 10... "Properly secure password files by making hashed passwords more difficult to acquire. Password hashes can be cracked within seconds using freely available tools. Consider restricting access to sensitive password hashes by using a shadow password file or equivalent on UNIX systems." While the report has IT related abbreviations such as HTTP, HTTPS, FTP, SQL, etc., here is a list to aid you with some of the other abbreviations used in the report... JAR - Joint Analysis Report NCCIC - National Cybersecurity and Communications Integration Center DHS - Department of Homeland Security FBI - Federal Bureau of Investigation RIS - Russian civilian and military intelligence Services APT - Advanced Persistent Threat. RATs - Remote Access Tools IOCs - Indicators of Compromise US-CERT - United States Computer Emergency Readiness Team EMET - Microsoft’s Enhanced Mitigation Experience Toolkit For additional reading on this report, use a search engine or go here<https://www.theguardian.com/technology/2016/dec/29/fbi-dhs-russian-hacking-…> or here<http://caucus99percent.com/content/all-there>. cheers, Ian.

1 0

CyanogenMod Becomes LineageOS
by Lawrence D'Oliveiro 27 Dec '16

27 Dec '16

Cyanogen Inc tried to take its CyanogenMod fork of Android commercial, with limited success. Now it has shut down the open-source project altogether. But a group of contributors has launched their own fork, called LineageOS. <http://arstechnica.com/information-technology/2016/12/cyanogen-inc-shuts-do…>

2 1

siduction and Wayland
by Ian Young 24 Dec '16

24 Dec '16

Merry Xmas all Just saw this. Wayland relevant. Not tested here. https://news.siduction.org/2016/12/release-notes-for-siduction-2016-1-patie… The released images are a snapshot of Debian unstable, that also goes by the name of Sid, from 2016-12-23. They are enhanced with some useful packages and scripts, our own installer and a custom patched version of the linux-kernel 4.9, accompanied by X-Server 1.19.0-3 and systemd 232-8. Changes that affect all flavours In the wake of the upcoming Wayland display server, that will replace the old Xorg-Server, the way input devices are handled, has changed. The new way to handle devices like Mice, Touchpads, Wacom Tablets, and the like was developed by Red Hat developer Peter Hutterer and is called libinput If you look into /etc/X11/xorgconf.d/60-libinput.conf, you will see that we implemented a basic config, that supports some touchpad actions, but not all. If you miss anything, look at the above link, that has ways to set up other actions. Another change over all flavours is the use of SDDM as Display- and Login-Manager, which is the new default for Plasma, but suits the other flavours fine as well.

1 0

Google Researchers Recommend Security Keys
by Lawrence D'Oliveiro 23 Dec '16

23 Dec '16

Google has been running a two-year internal trial of “Security Keys”, which are cheap, easy-to-use USB-pluggable devices for generating secure authentication tokens, based on the “Universal Second Factor” open standard. Verdict: they work really well, and are resistant to phishing attacks. The Chrome browser has already added support for them. <http://arstechnica.com/security/2016/12/this-low-cost-device-may-be-the-wor…>

1 0

Signal Implements Domain Fronting
by Lawrence D'Oliveiro 23 Dec '16

23 Dec '16

Signal, the secure communications application created by Moxie Marlinspike, has added another tool to its kit to evade Governments that want to block their subjects from using it: “domain fronting”. The technique requires routing through a content-delivery network, which typically is not available for free. But it does mean the only way to block the use of Signal is to block the user from the entire Internet. At least for now. <http://www.theregister.co.uk/2016/12/23/signal_deploys_domain_deceit_to_den…>

1 0

January meeting
by Ian Young 23 Dec '16

23 Dec '16

I have the most recent Zorin Core Edition. Version 12. This is available at no charge, they also have a offering that requires payment. I can try to find something to say if required. ~ Ian Y

2 1

SGM and meeting in January
by Peter Reutemann 23 Dec '16

23 Dec '16

Hi everyone Just a quick email to announce the SGM in January. The agenda (so far): - Elect Vice president Since that is the only item and won't take very long, we will have a regular meeting as well. At this stage, it will be a Linux distro roundup. More details here: https://www.meetup.com/WaikatoLinuxUsersGroup/events/236393751/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

January meeting - ideas?
by Peter Reutemann 22 Dec '16

22 Dec '16

Hi everyone Apart from a very short SGM, we haven't got anything planned yet for our January meeting. How about roundup of some distros? Some ideas: http://distrowatch.com/table.php?distribution=devuan http://distrowatch.com/table.php?distribution=fedora http://distrowatch.com/table.php?distribution=zorin And something a little different? ;-) http://distrowatch.com/table.php?distribution=reactos Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Takes the Next Step Towards Rolling Out Multi-Process To Everyone
by Peter Reutemann 22 Dec '16

22 Dec '16

'With Firefox 50, Mozilla has rolled out the first major piece of its new multi-process architecture. Edge, Internet Explorer, Chrome, and Safari all have a multiple process design that separates their rendering engine -- the part of the browser that reads and interprets HTML, CSS, and JavaScript -- from the browser frame. They do this for stability reasons (if the rendering process crashes, it doesn't kill the entire browser) and security reasons (the rendering process can be run in a low-privilege sandbox, so exploitable flaws in the rendering engine are harder to take advantage of). Moreover, these browsers can all create multiple rendering engine processes and use different processes for different tabs. This means that the scope of a crash is narrowed even further, typically to a single tab. Internet Explorer and Chrome both implemented this long ago, in 2009. Firefox, however, has not offered a similar design. Although work on a multi-process browser was started in 2009, under the codename Electrolysis, that work was suspended between 2011 and 2013 as priorities within the organization shifted. In response, Mozilla started switching to a new extension system in 2015 that opened the door to a multi-process design. The first stage of Firefox's move to multi-process involves separating the browser shell from a single rendering process that's used by every tab. In Firefox 48, that feature was enabled for a small number of users who used no extensions. Firefox 49 was rolled out to include users running a limited selection of extensions. Now, in Firefox 50, a separate renderer process is used for most users and most extensions. Developers are now able to mark their extensions as explicitly multi-process compatible. Firefox 51 will extend this even further to cover all extensions, except those that are explicitly marked as incompatible. Mozilla says that, even with the limited changes made in Firefox 50, responsiveness of the browser has improved by 400 percent due to the separation between the renderer and the browser shell. During page loads, responsiveness will increase to 700 percent.' -- source: https://news.slashdot.org/story/16/12/22/0120256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

MUFFIN, a new tasty user interface concept for LibreOffice
by Peter Reutemann 21 Dec '16

21 Dec '16

'The Document Foundation announces the MUFFIN, a new tasty user interface concept for LibreOffice, based on the joint efforts of the development and the design teams, supported by the marketing team. MUFFIN is an acronym for My User Friendly & Flexible INterface, and focuses on the three areas suggested by LibreOffice users during the development of the concept: My: LibreOffice users want a “personal” UI, with different options capable of adapting to the user’s personal habits, and not a single UI without options. User Friendly: of course, any UI should be as user friendly as possible, but LibreOffice users have clearly asked for a “modular” UI, where they can set their own level of user friendliness, and not a single UI without options. Flexible: the increasing number of LibreOffice users deploying the software on different hardware platforms (for instance, a desktop and a laptop), each one with different characteristics and screen size and resolution, have asked for a UI that can be tweaked to leverage the screen real estate, and not a single UI without options. INterface: The MUFFIN concept is the combination of different UI elements, which are going to be available starting from LibreOffice 5.3 either as a standard or experimental feature: the Default UI (with toolbars), a Single Toolbar UI, the Sidebar with a Single Toolbar, and the new Notebook Bar (experimental). Each UI layout has been thought to serve a different cluster of LibreOffice users.' -- source: https://blog.documentfoundation.org/blog/2016/12/21/the-document-foundation… It's about choice, that's why I love open-source! :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Home routers under attack in ongoing malvertisement blitz
by Peter Reutemann 19 Dec '16

19 Dec '16

'As you read these words, malicious ads on legitimate websites are targeting visitors with malware. But that malware doesn't infect their computers, researchers said. Instead, it causes unsecured routers to connect to fraudulent domains. Using a technique known as steganography, the ads hide malicious code in image data. The hidden code then redirects targets to webpages hosting DNSChanger, an exploit kit that infects routers running unpatched firmware or are secured with weak administrative passwords. Once a router is compromised, DNSChanger configures it to use an attacker-controlled domain name system server. This causes most computers on the network to visit fraudulent servers, rather than the servers corresponding to their official domain.' -- source: http://arstechnica.com/security/2016/12/home-routers-under-attack-in-ongoin… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Old Masters Reinterpreted
by Lawrence D'Oliveiro 16 Dec '16

16 Dec '16

“We Rolled Our Own Crypto”, by Peter Bruegel the Elder, c. 1562 <http://classicprogrammerpaintings.com/post/148027314949/we-rolled-our-own-c…>

1 1

Razors Edge database
by Roderick Aldridge 16 Dec '16

16 Dec '16

Does anybody know about running Razors Edge database under Linux or anybody who does? I successfully installed Citrix Receiver and logged into the database and ran a Report to get information, but could not save it or export it. Although I used the Linux Debian Citrix Receiver the options to save were all Windows destinations. when I tried to save to the computer option the message says The operation has been cancelled due to restrictions in effect on the computer. Please contact your system administrator. This could be a permissions problem. Any help welcome. Roderick Aldridge.

1 0

0-days hitting Fedora and Ubuntu open desktops to a world of hurt
by Peter Reutemann 16 Dec '16

16 Dec '16

'If you run a mainstream distribution of Linux on a desktop computer, there's a good chance security researcher Chris Evans can hijack it when you do nothing more than open or even browse a specially crafted music file. And in the event you're running Chrome on the just-released Fedora 25, his code-execution attack works as a classic drive-by.' -- source: http://arstechnica.com/security/2016/12/fedora-and-ubuntu-0days-show-that-h… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Yahoo admits it’s been hacked again, and 1 billion accounts were exposed
by Peter Reutemann 15 Dec '16

15 Dec '16

'On December 14, Yahoo announced that after an investigation into data provided by law enforcement officials in November, the company and outside forensics experts have determined that there was in fact a previously undetected breach of data from more than 1 billion user accounts. The breach took place in August 2013 and is apparently distinct from the previous mega-breach revealed this fall—one Yahoo claims was conducted by a "state-sponsored actor." The information accessed from potentially exposed accounts "may have included names, email addresses, telephone numbers, dates of birth, hashed passwords (using MD5) and, in some cases, encrypted or unencrypted security questions and answers," Yahoo's chief information security officer, Bob Lord, reported in the statement issued by the company. "The investigation indicates that the stolen information did not include passwords in clear text, payment card data, or bank account information. Payment card data and bank account information are not stored in the system the company believes was affected."' -- source: http://arstechnica.com/security/2016/12/yahoo-reveals-1-billion-more-accoun… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

OpenStreetView
by Lawrence D'Oliveiro 14 Dec '16

14 Dec '16

You’ve heard of OpenStreetMap, the (very popular) project to compile mapping information for the whole world under a freely shareable, open licence; now there is OpenStreetView, which attempts to do the same for street-level photos <http://www.theregister.co.uk/2016/12/14/open_source_insider_openstreetview_…>.

1 0

First Version of Sandboxed Tor Browser Available
by Peter Reutemann 12 Dec '16

12 Dec '16

'To protect Tor users from FBI hacking tools that include all sorts of Firefox zero-days, the Tor Project started working on a sandboxed version of the Tor Browser in September. Over the weekend, the Tor Project released the first alpha version of the sandboxed Tor Browser. "Currently, this version is in an early alpha stage, and only available for Linux," reports BleepingComputer. "There are also no binaries available, and users must compile it themselves from the source code, which they can grab from here." The report notes: "Sandboxing is a security mechanism employed to separate running processes. In computer security, sandboxing an application means separating its process from the OS, so vulnerabilities in that app can't be leveraged to extend access to the underlying operating system. This is because the sandboxed application works with its own separate portion of disk and memory that isn't linked with the OS."' -- source: https://yro.slashdot.org/story/16/12/12/2042225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Mint 18.1 'Serena' BETA Ubuntu-based Operating System Now Available For Download
by Peter Reutemann 05 Dec '16

05 Dec '16

'Feeling fatigued by Windows 10 and its constant updates and privacy concerns? Can't afford one of those beautiful new MacBook Pro laptops? Don't forget, Linux-based desktop operating systems are just a free download away, folks! If you do decide to jump on the open source bandwagon, a good place to start is Linux Mint. Both the Mate and Cinnamon desktop environments should prove familiar to Windows converts, and since it is based on Ubuntu, there is a ton of compatible packages. Today, the first beta of Linux Mint 18.1 'Serena' becomes available for download.' -- source: https://linux.slashdot.org/story/16/12/04/236236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Canonical Sues Cloud Provider Over 'Unofficial' Ubuntu Images
by Peter Reutemann 05 Dec '16

05 Dec '16

'Canonical posted Thursday that they've been in a dispute with "a European cloud provider" over the use of their own homespun version of Ubuntu on their cloud servers. Their implementation disables even the most basic of security features and Canonical is worried something bad could happen and it'd reflect badly back on them... They said they've spent months trying to get the unnamed provider to use the standard Ubuntu as delivered to other commercial operations to no avail. Canonical feels they have no choice but to "take legal steps to remove these images." They're sure Red Hat and Microsoft wouldn't be treated like this. Mark Shuttleworth, the founder of Ubuntu, wrote in his blog post that Ubuntu is "the leading cloud OS, running most workloads in public clouds today," whereas these homegrown images "are likely to behave unpredictably on update in weirdly creative and mysterious ways... We hear about these issues all the time, because users assume there is a problem with Ubuntu on that cloud; users expect that 'all things that claim to be Ubuntu are genuine', and they have a right to expect that... "To count some of the ways we have seen home-grown images create operational and security nightmares for users: clouds have baked private keys into their public images, so that any user could SSH into any machine; clouds have made changes that then blocked security updates for over a week... When things like this happen, users are left feeling let down. As the company behind Ubuntu, it falls to Canonical to take action."' -- source: https://news.slashdot.org/story/16/12/04/2235251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ask Slashdot: What's the Best Linux Laptop?
by Peter Reutemann 04 Dec '16

04 Dec '16

'Long-Time Slashdot reader sconeu is finally replacing his 10-year-old Toshiba Satellite laptop, and needs suggestions on the best current laptops for running Linux. I'm looking to run some flavor of Linux (probably KDE-based UI, but not mandatory) while using a virtual machine to run Windows 7 (for stuff needed for work). For me personally, battery life and weight are more important than raw power. I'm not going to be running games on this. I've been considering an XPS 13 Developer Edition, or something from System76, ZaReason or Emperor Linux. What laptop do you use? Do you have any suggestions? It's your chance to share useful information, recommendations, and your own experiences with various brands of laptop. So leave your best answers in the comments. What's the best Linux laptop? ' -- source: https://linux.slashdot.org/story/16/12/03/0727258 Personally, I've been very happy with my Dell Latitude 6430u at work in conjunction with Linux Mint 17. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Devuan's Systemd-Free Linux Hits Beta 2
by Peter Reutemann 04 Dec '16

04 Dec '16

'Long-time Slashdot reader Billly Gates writes, "For all the systemd haters who want a modern distro feel free to rejoice. The Debian fork called Devuan is almost done, completing a daunting task of stripping systemd dependencies from Debian." From The Register: Devuan came about after some users felt [Debian] had become too desktop-friendly. The change the greybeards objected to most was the decision to replace sysvinit init with systemd, a move felt to betray core Unix principles of user choice and keeping bloat to a bare minimum. Supporters of init freedom also dispute assertions that systemd is in all ways superior to sysvinit init, arguing that Debian ignored viable alternatives like sinit, openrc, runit, s6 and shepherd. All are therefore included in Devuan. Devuan.org now features an "init freedom" logo with the tagline, "watching your first step. Their home page now links to the download site for Devuan Jessie 1.0 Beta2, promising an OS that "avoids entanglement".' -- source: https://linux.slashdot.org/story/16/12/04/0142242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Easing Into That Leap-Second...
by Lawrence D'Oliveiro 02 Dec '16

02 Dec '16

Google is offering time servers that will help you get over the upcoming leap-second hump. Instead of having a day with 61 seconds in it, their clock will run 0.0014% slower across a twenty-hour interval with the moment of the leap second in the middle. At the end of that interval, your clock will be correctly in sync with UTC again. <http://www.theregister.co.uk/2016/12/02/google_public_ntp_servers/>

1 0

Firefox: libavcodec may be vulnerable or is not supported, and should be updated to play video
by Peter Reutemann 01 Dec '16

01 Dec '16

Hi everyone Being on Linux Mint 17, I've noticed that Chromium stopped playing certain animated gifs a few weeks (probably after an upgrade of the browser). Switching to Firefox, I had the same problem, but I got at least a message: libavcodec may be vulnerable or is not supported, and should be updated to play video Following the instructions here solved my problem: http://superuser.com/a/1137409 However, Chromium still doesn't work. Maybe it's not linking to the libavcodec libraries, but including them in their build, using the outdated Mint 17 libraries. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android’s Market Share Grows Because It Can Fit Any Niche, Big Or Small
by Lawrence D'Oliveiro 01 Dec '16

01 Dec '16

<http://arstechnica.com/gadgets/2016/12/androids-market-share-grows-because-…> How Android began: Android started out as an advanced platform for digital cameras with network connections. When Android, Inc. founders Andy Rubin and Matias Duarte realized that the camera market was too small to carry a whole new business structure, the company ported its software over to the more promising smartphone sector. Not so convinced about this: These days, you can modify and build almost all of Android from freely available code, but the remaining Google-specific bits are almost compulsory in order to provide a high-quality user experience. considering that there are hundreds of millions of Android users in China who have probably never heard of Google. And for those hankering after more, shall we say, venerable form factors: Pining for a physical keyboard? There are still Android models with that feature. ... Looking for a flip-phone with smartphone features? Lesser-known device makers like Freetel can hook you up. Samsung took that idea one step further with the W2016 flip-phone, which comes with separate screens on the inside and the outside of the fold, along with a physical T9 keypad. etc etc.

1 0

Oracle Abandoning Solaris?
by Lawrence D'Oliveiro 01 Dec '16

01 Dec '16

Seems like every OS that gets to call itself “Unix” is either dead or dying... <http://phoronix.com/scan.php?page=news_item&px=Oracle-Solaris-Demise-Rumors>

2 2

feature update (formerly known as upgrade)
by Ian Young 01 Dec '16

01 Dec '16

The detailed content is a bit beyond my pay grade but I did like the bit about upgrade being displaced by feature update. http://www.theregister.co.uk/2016/12/01/upgrade_shift_f10_pops_win10_system…

2 1

Firefox Zero-Day Can Be Used To Unmask Tor Browser Users
by Peter Reutemann 01 Dec '16

01 Dec '16

'A Firefox zero-day being used in the wild to target Tor users is using code that is nearly identical to what the FBI used in 2013 to unmask Tor-users. A Tor browser user notified the Tor mailing list of the newly discovered exploit, posting the exploit code to the mailing list via a Sigaint darknet email address. A short time later, Roger Dingledine, co-founder of the Tor Project Team, confirmed that the Firefox team had been notified, had "found the bug" and were "working on a patch." On Monday, Mozilla released a security update to close off a different critical vulnerability in Firefox. Dan Guido, CEO of TrailofBits, noted on Twitter, that "it's a garden variety use-after-free, not a heap overflow" and it's "not an advanced exploit." He added that the vulnerability is also present on the Mac OS, "but the exploit does not include support for targeting any operating system but Windows." Security researcher Joshua Yabut told Ars Technica that the exploit code is "100% effective for remote code execution on Windows systems." "The shellcode used is almost exactly the shellcode of the 2013 one," tweeted a security researcher going by TheWack0lian. He added, "When I first noticed the old shellcode was so similar, I had to double-check the dates to make sure I wasn't looking at a 3-year-old post." He's referring to the 2013 payload used by the FBI to deanonymize Tor-users visiting a child porn site. The attack allowed the FBI to tag Tor browser users who believed they were anonymous while visiting a "hidden" child porn site on Freedom Hosting; the exploit code forced the browser to send information such as MAC address, hostname and IP address to a third-party server with a public IP address; the feds could use that data to obtain users' identities via their ISPs.' -- source: https://yro.slashdot.org/story/16/11/30/2156218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

More Than 1 Million Android Devices Rooted By Gooligan Malware
by Peter Reutemann 30 Nov '16

30 Nov '16

'A new version of an existing piece of malware has emerged in some third-party Android app stores and researchers say it has infected more than a million devices around the world, giving the attackers full access to victims' Google accounts in the process. The malware campaign, known as Gooligan, is a variant of older malware called Ghost Push that has been found in many malicious apps. Researchers at Check Point recently discovered several dozen apps, mainly in third-party app stores, that contain the malware, which is designed to download and install other apps and generate income for the attackers through click fraud. The malware uses phantom clicks on ads to generate revenue for the attackers through pay-per-install schemes, but that's not the main concern for victims. The Gooligan malware also employs exploits that take advantage of several known vulnerabilities in older versions of Android, including Kit Kat and Lollipop to install a rootlet that is capable of stealing users' Google credentials.Although the malware has full remote access to infected devices, it doesn't appear to be stealing user data, but rather is content to go the click-fraud route. Most users are being infected through the installation of apps that appear to be legitimate but contain the Gooligan code, a familiar infection routine for mobile devices.' -- source: https://tech.slashdot.org/story/16/11/30/1720202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

expanding Europe's Linux Presentation Day to New Zealand
by Hauke Laging 30 Nov '16

30 Nov '16

Hello, in May 2015 Berlin's Linux user group (BeLUG) has started a new type of event which has spread quickly all over Europe: the Linux Presentation Day (LPD) 2015.1: Berlin only 2015.2: 72 cities in three countries 2016.1: 110 cities in 10 countries 2016.2: 150+ cities in 14 countries (on October, 22nd) I contact you because we intend to expand the LPD beyond Europe next year. The aim of the LPD towards the general public is to provide biannual and comprehensive information events about Linux for private users who would like to get a first impression of Linux. The aim towards the media is to make the event so big (both nationally and internationally) that the nationwide non-IT media cover it regularly. The aim towards the Linux community is that an LPD event can be so small and easy to organize (even without costs) that really everyone can try to organize an event with good chances of success. The local organizers decide on their own what their event shall be like; we just make suggestions and offer support. You can find a longer description of the concept here: http://www.linux-presentation-day.org/idea/ Are you as an organization interested in participating in the LPD? If not: Are any of your members interested in helping us bring the LPD to New Zealand? This event is very useful for finding new LUG members. Best regards, (Mr.) Hauke Laging -- http://www.linux-presentation-day.org/ International phone contact for the Linux Presentation Day: tel:+49-30-55579620 (13:00–23:00, German and English) XMPP (Chat with OTR): linux-presentation-day(a)jabber.ccc.de OTR: 91626899 1C06F2BD 75EC2441 35C696CE 38F75997

1 0

Westpac one and online banking
by Ron Dean 30 Nov '16

30 Nov '16

Apparently I was in error that Westpac would be closing its browser based online banking. Its still available through a browser just not the original Online banking. Thanks for all your comments -- Ron Dean

2 1

Jolla's Sailfish OS Now Certified as Russian Government's First 'Android Alternative'
by Peter Reutemann 29 Nov '16

29 Nov '16

'The future for one of the few remaining alternative mobile OS platforms, Jolla's Sailfish OS, looks to be taking clearer shape. Today the Finnish company which develops and maintains the core code, with the aim of licensing it to others, announced Sailfish has achieved domestic certification in Russia for government and corporate use. TechCrunch adds: In recent years the Russian government has made moves to encourage the development of alternatives to the duopoly of US-dominated smartphone platforms, Android and Apple's iOS -- flagging Sailfish as one possibility, along with Tizen. Although Sailfish looks to have won out as the preferred Android alternative for Russia at this point. The government has said it wants to radically reduce its reliance on foreign mobile OSes -- to 50 per cent by 2025 vs the 95 per cent of the market garnered by Android and iOS in 2015. Sailfish's local certification in Russia also follows an announcement earlier this year that a new Russian company, Open Mobile Platform (OMP), had licensed the OS with the intention of developing a custom version of the platform for use in the domestic market. So, in other words, a Russian, strategic 'Android alternative' is currently being built on Sailfish.' -- source: https://yro.slashdot.org/story/16/11/29/208245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Westpac insisting that Banking be done with Android or IOS
by Ron Dean 29 Nov '16

29 Nov '16

I always do my banking with a Linux Desktop and keep the system up to Date and do it through a web browser. It seems less secure with my android devices as they don't provide frequent updates as Ubuntu does. Should I change Banks? -- Ron Dean

6 6

Open Review Toolkit
by Lawrence D'Oliveiro 28 Nov '16

28 Nov '16

The Open Review Toolkit is software that turns a book manuscript into a website where users can read and annotate your text, and “you can collect valuable data to help launch your book”. <http://freedom-to-tinker.com/2016/11/27/announcing-the-open-review-toolkit/>

1 0

Ex-Debian systemd Haters Celebrate Second Birthday
by Lawrence D'Oliveiro 28 Nov '16

28 Nov '16

Two years going, this Linux OS that aims for "Init Freedom" isn't the most vibrant distribution out there. When's the last time you've heard of Devuan or even used it yourself? This year much of the systemd "hate" seems to have calmed down compared to prior years, although new features continue to be tacked onto systemd. <http://phoronix.com/scan.php?page=news_item&px=Devuan-Systemd-Debian-Turns-…>

1 0

resistance futile goto WIN 10 now
by Ian Young 28 Nov '16

28 Nov '16

While messing about with a laptop that has a video defect causing the screen to remain blank initially, I tried a distro called Zorin. Amazingly it lit up the screen early in the process of starting Linux. So impressed was I that I looked up Zorin on the Guggle and found this article. In the comments was this gem. Looks like I won't be needing Linux any more. But the price will be using Windows 10. Nah, maybe I'll just stay in the backwoods. http://hothardware.com/news/zorin-os-12-linux-distro-could-be-a-windows-10-… "I guess I just don't see much point anymore now that Windows 10 can natively run Ubuntu. Bash, SSH, Telnet, full desktop, X11 etc. The Linux subsystem runs fine alongside Win 10. You have both running simultaneously. https://www.youtube.com/watch?v=R0hCB8_HFzg Have a look all you Linux fans, after all, it no longer has to be one or the other. If you have the anniversary update, you already have ubuntu waiting to be activated. It's a fairly long video but should cover everything you might want to know." PS Caveat. Had to transcribe the YouTube link so may be subject to error, and I haven't watched it.

2 1

Debian Putting Everything On The /usr
by Lawrence D'Oliveiro 25 Nov '16

25 Nov '16

In the old days, back when disks were smaller, Unix and Linux systems tended to have the “/” (root) and “/usr” directories on different volumes. In fact, I can remember that the DEC/Compaq Tru64 UNIX installer insisted on arranging things this way, even though the disks were quite big enough by then to put the whole OS on one volume. (I just moved /usr into the root volume afterwards and removed the redundant mount point.) One consequence of this was that you had to be careful where you put core parts of the system: things had to be designed so that you would still have some useable functionality if you only had / mounted and not /usr (for recovery purposes). Thus, binaries in /bin and /sbin could depend on shareable libraries in /lib, but not /usr/lib, while of course binaries in /usr/bin and /usr/sbin could freely depend on both. These days, nobody cares about such a possibility any more. Other distros (notably Red Hat) abandoned the root-usr distinction a long time ago, and merged things so /bin was just a symlink to /usr/bin, and /lib to /usr/lib, anyway. You can still put /usr on a separate volume, but your system will no longer work if it cannot be mounted. Now Debian is following suit. <http://www.theregister.co.uk/2016/11/24/debian_testing_merged_codeusrcode/>

1 0

System76 Oryx Pro Ubuntu Laptop Review
by Lawrence D'Oliveiro 24 Nov '16

24 Nov '16

Comes preinstalled with your choice of Ubuntu LTS 16.04.1 or 16.10 (officially), unofficially it seems they are tolerant of those who prefer other distros. A high-spec machine, solidly-built, which certainly cannot be described as “anorexic”. And with a price tag to match. And unfashionably expandable, too: In total, this laptop offers an Ethernet port, an SD card slot, 2 Mini DisplayPorts, an HDMI port, 2 USB 3.1 Type-C ports, 3 USB 3.0 Type-A ports, and both headphone and mic jacks. The GTX 1070 models even include a headphone amplifier. <http://arstechnica.com/gadgets/2016/11/system76-oryx-pro-review-linux-in-a-…>

1 0

Tor phone is antidote to Google “hostility” over Android, says developer
by Peter Reutemann 23 Nov '16

23 Nov '16

'The Tor Project recently announced the release of its prototype for a Tor-enabled smartphone—an Android phone beefed up with privacy and security in mind, and intended as equal parts opsec kung fu and a gauntlet to Google. The new phone, designed by Tor developer Mike Perry, is based on Copperhead OS, the hardened Android distribution profiled first by Ars earlier this year.' -- source: http://arstechnica.com/security/2016/11/tor-phone-prototype-google-hostilit… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fedora 25 Now Available -- Makes It Easier To Switch From Windows 10 Or Mac
by Peter Reutemann 22 Nov '16

22 Nov '16

'After the release of both alpha and beta versions, Fedora 25 is officially here and ready for production machines. If you aren't familiar with the popular Linux-based operating system, please know that it is the distribution of choice for the founder of the Linux kernel, Linus Torvalds. One of the most endearing qualities of Fedora is its focus on only offering truly free open source software. Also, you can always count on a very modern version of the Linux kernel being available. Despite having very up-to-date packages, it is always very stable too. My favorite aspect, however, is the commitment to the GNOME desktop environment; other DEs are available, though. The team says, "Fedora 25 Workstation now makes it easier to for Windows and OS X users to get started, with Fedora Media Writer serving as the default download for those operating systems. This tool helps users find and download the current Fedora release and write it to removable media, like a USB stick, allowing potential Fedora users to 'test drive' the operating system from that media environment. Fedora can then be installed to their systems with the same process".' -- source: https://apple.slashdot.org/story/16/11/22/154248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Introducing ... The Tor Phone
by Lawrence D'Oliveiro 22 Nov '16

22 Nov '16

"The iOS App Store is at a significant disadvantage there even compared to Google Play," [Tor developer Mike Perry] told us. "Each iOS app is re-encrypted specifically for the user with Apple's DRM, making it technically impossible to verify that the package you installed matches the official one." ... In order to solve the Android security mess, Google is taking steps that hurt user freedom, and make Android vulnerable to compelled backdoors, Perry argued. ... "Copperhead is also the only Android ROM that supports verified boot, which prevents exploits from modifying the boot, system, recovery, and vendor device partitions," ... "This makes Copperhead an excellent choice for our base system." <http://arstechnica.com/security/2016/11/tor-phone-prototype-google-hostilit…>

1 0

AGM next Monday
by Peter Reutemann 21 Nov '16

21 Nov '16

Hi everyone The Annual General Meeting (AGM) of the Waikato Linux Users Group Society is coming up next Monday. The agenda - at this stage - is as follows: - President's Report - Treasurer's Report - Election of 2017 Committee - General business (eg future of WLUG library, wording in the charter with regard to advertising of jobs using the wlug mailing list, etc) - Consumption of pizza Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/233952391/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Antivirus Firm Kaspersky Launches Its Own Hackproof OS, Based On Microkernel
by Peter Reutemann 18 Nov '16

18 Nov '16

'Kaspersky Lab, a Russian cybersecurity and antivirus company, has announced their new operating system which was in development for the last 14 years. Dubbed as Kaspersky OS, it has made its debut on a Kraftway Layer 3 Switch. Not many details have been revealed by the CEO Eugene Kaspersky in his blog post. The GUI-less OS -- as it appears in the image -- has been designed from scratch and Eugene said it doesn't have "even the slightest smell of Linux." He actually tagged "Kaspersky OS being non-Linux" as one of the three main distinctive features he mentioned. The other two features he briefly described are rather fascinating. The first feature is that the Kaspersky OS is based on microkernel architecture, which basically means using the minimum amount of ingredients to bake your own operating system. The OS can be custom-designed as per requirements by using different modification blocks. The second distinctive feature is the inbuilt security system which can control application behavior and OS modules. It touts Kaspersky OS as practically unhackable, unless a cyber-baddie has a quantum computer -- which will be required to crack the digital signature of the platform -- at his disposal.' -- source: https://news.slashdot.org/story/16/11/18/2039245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

This $5 Device Can Hack Your Locked Computer In One Minute
by Peter Reutemann 18 Nov '16

18 Nov '16

'Next time you go out for lunch and leave your computer unattended at the office, be careful. A new tool makes it almost trivial for criminals to log onto websites as if they were you, and get access to your network router, allowing them to launch other types of attacks. Hackers and security researchers have long found ways to hack into computers left alone. But the new $5 tool called PoisonTap, created by the well-known hacker and developer Samy Kamkar, can even break into password-protected computers, as long as there’s a browser open in the background.' -- source: http://motherboard.vice.com/en_ca/read/this-5-device-can-hack-your-locked-c… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Alternatives To MATLAB
by Lawrence D'Oliveiro 17 Nov '16

17 Nov '16

In this announcement about the latest release of GNU Octave, which “remains largely compatible with the widely-used MATLAB” <http://phoronix.com/scan.php?page=news_item&px=GNU-Octave-4.2>, one commenter bemoaned the lack of a serious alternative to MATLAB’s Simulink Toolbox. To which another suggested looking at OpenModelica <https://openmodelica.org/>.

1 0

Debian Is Moving To MariaDB
by Lawrence D'Oliveiro 17 Nov '16

17 Nov '16

I upgraded my main machine, running Debian Unstable, a few days ago, and my time and billing system stopped working. Further investigation revealed that the mysql-server package had somehow disappeared. I am installing it again now, and it looks like it is putting in MariaDB instead of Oracle MySQL. The executables etc still keep the “mysql” name, so it looks like nothing in my code need change...

1 0

Are Antivirus Tools A Useless Box-Ticking Exercise?
by Lawrence D'Oliveiro 17 Nov '16

17 Nov '16

... many existing tools [are] ineffective "magic" that engineers are forced to install for the sake of compliance but at the expense of real security. <http://www.theregister.co.uk/2016/11/17/google_hacker_pleads_try_whitelists…>

1 0

Word For The Day: “Serverless”
by Lawrence D'Oliveiro 16 Nov '16

16 Nov '16

When I first came across this term, I assumed it meant something like “distributed peer-to-peer” rather than having dedicated servers. Turns out it means something quite different: instead of paying for the server as a whole, you pay per service request. <http://www.theregister.co.uk/2016/11/16/forget_razors_and_blades_apis_are_t…>

1 0

The End Of GCJ?
by Lawrence D'Oliveiro 16 Nov '16

16 Nov '16

GCJ, the GNU Compiler for Java, has been languishing for some time, and may be about to be put out of its misery. Unlike the Sun/Oracle compiler, GCJ can compile to native machine code (thanks to the common GCC infrastructure), it is not restricted to some intermediate byte code. It originated before Sun open-sourced Java, and I guess a lot of the need for it went away when OpenJDK appeared. <http://phoronix.com/scan.php?page=news_item&px=GCC-Patch-To-Drop-GCJ>

2 2

Disk-Reliability Data From Backblaze
by Lawrence D'Oliveiro 16 Nov '16

16 Nov '16

Backup service company Backblaze has been migrating en mass from 2TB drives to 8TB ones. The Seagate ones, at least show no difference in failure rate--1.6% per year. They must be getting a special deal on the price, because last time I looked at cost, 4TB was still the sweet spot, same as it was 2 years ago. <http://arstechnica.com/information-technology/2016/11/8tb-disks-still-looki…>.

1 0

How Toy Story 2 Got Deleted Twice, Once On Accident, Again On Purpose
by Lawrence D'Oliveiro 16 Nov '16

16 Nov '16

How a wayward “rm -rf *” almost destroyed Pixar’s “Toy Story 2”, and how it was recovered from a copy that a staffer just happened to have on her home machine <http://thenextweb.com/media/2012/05/21/how-pixars-toy-story-2-was-deleted-t…>.

1 0

Ubuntu Budgie Is Now An Official Ubuntu Flavor
by rowan schischka 10 Nov '16

10 Nov '16

Cheers for that Peter, budgie looks like an interesting interface. Im going to have to review it. Why is there so much effort going into remixes when you can install the desktop on stock ubuntu? -- Kind Regards Rowan Schischka

1 0

Open Source Pioneer Munich Debates Report That Suggests Abandoning Linux for Windows 10
by Peter Reutemann 10 Nov '16

10 Nov '16

'As an open-source software pioneer, Munich spent years moving away from Windows, but now politicians are debating a report that suggests the city could eventually abandon Linux. A report on TechRepublic adds: If the authority ruling Germany's third largest city backs proposals to make Windows 10 and Microsoft Office available across the council, it would be a significant step away from open-source software for an organization once seen as its champion. Over a nine-year period starting in 2004, the council moved about 15,000 staff from using Windows and Office to LiMux -- a custom version of the Ubuntu desktop OS -- and other open source software. At the time, Munich was one of the largest organizations to reject Windows, and Microsoft took the city's leaving so seriously that then CEO Steve Ballmer flew to Munich to meet the mayor. Now a report commissioned by current mayor Dieter Reiter to help determine the future of IT at the council has outlined a project to make Windows 10 and Microsoft Office available to all departments, and give staff the choice about whether to use Windows or LiMux.' -- source: https://tech.slashdot.org/story/16/11/09/212246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 4

Ubuntu Budgie Is Now An Official Ubuntu Flavor
by Peter Reutemann 09 Nov '16

09 Nov '16

'After two successful major releases, budgie-remix has finally been accepted as an official Ubuntu flavor, earlier today during a meeting where four Canonical technicians voted positive. As such, we're extremely happy to inform our readers that the new Ubuntu flavor is called Ubuntu Budgie. In April this year, when budgie-remix hit the road towards its first major release, versioned 16.04, we reported that David Mohammed was kind enough to inform Softpedia about the fact that he got in touch with Ubuntu MATE leader Martin Wimpress, who urged the developer to target Ubuntu 16.10 for an official status. budgie-remix 16.10 arrived as well this fall shortly after the release of Ubuntu 16.10 (Yakkety Yak), and the dream of becoming an official Ubuntu flavor is now a reality. Re-branding of the official website and the entire distribution is ongoing. "We now move full steam ahead and look forward to working with the Ubuntu Develop Membership Board to examine and work through the technical aspects [...] 17.04 will be our first official release under the new name," said David Mohammed in the announcement.' -- source: https://news.slashdot.org/story/16/11/08/2211257 Cheers, Petr -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Signal Looks Secure
by Lawrence D'Oliveiro 08 Nov '16

08 Nov '16

Signal is an application and secure messaging protocol created by a group led by Moxie Marlinspike. It has also been adopted by some other applications, notably Facebook Messenger and WhatsApp. Now, an independent security audit by a multinational team <http://www.theregister.co.uk/2016/11/08/trust_it_results_of_signals_first_f…> has come to the conclusion that there are no obvious flaws in the protocol (accidental or otherwise)--that it really can deliver on the promise of preserving privacy in communication over an insecure network.

2 1

Web of Trust, Downloaded 140M Times, Pulled From Extension Stores After Revelations That It Sells Users' Data
by Peter Reutemann 08 Nov '16

08 Nov '16

'According to multiple reports, Web of Trust, one of the top privacy and security extensions for web browsers with over 140 million downloads, collects and sells some of the data of its users -- and it does without properly anonymizing it. Upon learning about this, Mozilla, Google and Opera quickly pulled the extension off their respective extension stores. From a report on The Register: A browser extension which was found to be harvesting users' browsing histories and selling them to third parties has had its availability pulled from a number of web browsers' add-on repositories. Last week, an investigative report by journalists at the Hamburg-based German television broadcaster, Norddeutscher Rundfunk (NDR), revealed that Web of Trust Services (WoT) had been harvesting netizens' web browsing histories through its browser add-on and then selling them to third parties. While WoT claimed it anonymised the data that it sold, the journalists were able to identify more than 50 users from the sample data it acquired from an intermediary. NDR quoted the data protection commissioner of Hamburg, Johannes Caspar, criticising WoT for not adequately establishing whether users consented to the tracking and selling of their browsing data. Those consent issues have resulted in the browser add-on being pulled from the add-on repositories of both Mozilla Firefox and Google Chrome, although those who have already installed the extension in their browsers will need to manually uninstall it to stop their browsing being tracked.' -- source: https://yro.slashdot.org/story/16/11/08/1551236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Two Critical MySQL Bugs Discovered
by Peter Reutemann 05 Nov '16

05 Nov '16

'Two critical privilege escalation vulnerabilities in MySQL, MariaDB, and PerconaDB can help take control of the whole server, which is very bad for shared environments... Administrators need to check their database versions, as attackers can chain two critical vulnerabilities and completely take over the server hosting the database... The first vulnerability, a privilege escalation/race condition flaw, gives elevated privileges to a local system user with access to a database and allows them to execute arbitrary code as the database system user. This gives an attacker access to all of the databases on the affected server... The privilege escalation/race condition flaw can be chained with another critical vulnerability, a root privilege escalation vulnerability, to further elevate the system level user to gain root on the server.' -- source: https://developers.slashdot.org/story/16/11/05/056227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

US Government Launches Open-Source Repository
by Lawrence D'Oliveiro 04 Nov '16

04 Nov '16

The US Federal Government has just opened code.gov, a “platform designed to improve access to the federal government’s custom-developed software” <http://www.theregister.co.uk/2016/11/04/code_gov_goes_live/>. You can browse projects by department/agency.

2 1

Google Says Bye-Bye To Eclipse
by Lawrence D'Oliveiro 04 Nov '16

04 Nov '16

Google has officially abandoned its Android development plugin for Eclipse, in favour of its Android Studio IDE <http://www.theregister.co.uk/2016/11/03/google_knifes_eclipse_android_devel…>. For me, the nice thing about the Android SDK is that it gives you a choice: you can still build things from the command line, which makes it easy to set up custom build procedures. For example, the largest Android project I have dabbled with so far <https://github.com/ldo/ti5x_android> has 11,000 lines of Java code and 3,000 lines of Python, all created with Emacs. I’m not sure any IDE could gracefully build it at all.

2 1

E-Voting Around The World
by Lawrence D'Oliveiro 03 Nov '16

03 Nov '16

Roundup of how various places implement electronic- and online-based voting systems <http://arstechnica.com/features/2016/11/internet-based-and-open-source-how-…>. Brazil: One major flaw [Prof Aranha] found was that the digital votes are randomly shuffled, as a way to provide extra security while in storage. However, the algorithm to provide that randomness is given a non-random seed: the timestamp. Australia, specifically the Australian Capital Territory: Still, despite the success of the open-source e-voting setup, [Electoral Commissioner] Green says its days may be numbered. Even though he has his doubts about the security and openness of Internet-based setups, he believes that it, not open-source e-voting, will "be the way of the future." Estonia: "If you sign something digitally with your Estonian ID card, it universally replaces a paper written signature and this can be applied anywhere—terminating contracts, creating contracts—everywhere. Everywhere you'd need a paper signature you can replace it with an electronic signature" ... And now, that applies to Internet-based voting as well.

1 0

Spark Wants To Abandon Copper?
by Lawrence D'Oliveiro 03 Nov '16

03 Nov '16

“Spark ... [is] not happy with the quality of the copper provided by the wholesale spin-out, Chorus.” Oh, and “The lucky 400 first houses in the trial are in the suburbs of the North Island city of Hamilton.” <http://www.theregister.co.uk/2016/11/03/cu_later_copper_spark_is_going_to_g…>

4 5

trustworthy computing -- what this?
by Ian Young 03 Nov '16

03 Nov '16

Sorry if this strays off topic, though discussion is fairly eclectic imho ..... I was interested to learn that Microsoft has a senior director of trustworthy computing in this article. http://www.theregister.co.uk/2016/11/01/microsoft_google_bug_disclosure_spa… Perhaps comforting news, I usually assume that computing is minimally trustworthy these days. Not so much in terms of the performance of software (eg Linux) but in the extent of spying and covert mass data gathering. Just as well we have these large corporates to take care of us.

1 0

death of copper, 4G coverage fubar
by rowan schischka 03 Nov '16

03 Nov '16

>As to 4G bwahahaha. When the Skinny mini offshoot offered a 4G deal >earlier this year I had a look. Coverage at that point was confined to >an area round the uni, and for some reason Chartwell. Perhaps it now >covers the entire metropolis of Hamilton? Let me know if I have missed >something there. And the greedies wanted $200 for a 4G modem. Nice one >Spinny. I brought my 4g skinny modem with me from auckland. I had to use it up there because the lease holder of my flat was refusing to upgrade her modem. She reckoned Spark confirmed there was nothing wrong with her modem but after a year I finally got to have a look at it and the arial was broken and there was a large crack through the case; she still refused to accept her modem was damaged and kept dropping connection so I got the 4g. It works very well and now comes in a 100GB plan that is faster than ADSL. Im using the 4g in Rototuna and I haven't been tempted to get fibre because of the lack of ethernet through the house, and my inability to persuade the property manager to allow me to install network ports in the walls. -- Kind Regards Rowan Schischka

1 0

death of copper, 4G coverage fubar
by Ian Young 03 Nov '16

03 Nov '16

Apologies to thread lovers. Yes well. of course our telecom overlords want to get shot of copper. So last century. One annoying aspect of that cable network was that it needed some maintenance. Your modern day utility company doesn't like maintenance costs. And once it is shut down maybe the copper can be pulled out of the ground at some stage. On the shopping block with all those annoying exchange buildings. As to 4G bwahahaha. When the Skinny mini offshoot offered a 4G deal earlier this year I had a look. Coverage at that point was confined to an area round the uni, and for some reason Chartwell. Perhaps it now covers the entire metropolis of Hamilton? Let me know if I have missed something there. And the greedies wanted $200 for a 4G modem. Nice one Spinny. By the way, isn't this article wrong or misguiding in just about every respect? Much of the Register is wryly amusing and even informative on occasion, but this is surely a low point?

1 0

Arch Linux Review
by Lawrence D'Oliveiro 03 Nov '16

03 Nov '16

<http://www.theregister.co.uk/2016/11/02/arch_linux_taster/>: Arch gets very little coverage for a several reasons, not the least of which is that it's somewhat difficult to install and requires you feel comfortable with the command line to get it working. Worse, from the point of view of anyone trying to appeal to mainstream users, that difficulty is by design - nothing keeps the noobs out like a daunting install process. I never knew that about Arch. But my real excuse for mentioning this review is the picture. That looks like a Renault 4. Or rather, 3 of them, cut and joined together in a truly unholy Franken-mess. If you pointed it facing north, it would probably summon Cthulhu...

2 4

When Is JSON Not JSON?
by Lawrence D'Oliveiro 01 Nov '16

01 Nov '16

I thought JSON was a nice, simple, straightforward spec. Turns out different implementations interpret some things just that little bit differently enough to lead to headaches. That means security headaches <http://www.theregister.co.uk/2016/11/01/json_parsers_tested/> ...

2 1

Fwd: Domain Name Commission introduces provisional address masking option
by Simon Green 01 Nov '16

01 Nov '16

Not strictly Linux / Open Source related, but thought I'd share this in relation to making your .nz whois address information private if you are an individual. Most interesting is "Any mail sent to the masked address displayed on the WHOIS will be forwarded to the address on the Register, by DNCL.". This means you could give anyone or a company your masked address if you don't want to give out your real postal address. -- Simon -------- Forwarded Message -------- Subject: Domain Name Commission introduces provisional address masking option Date: Tue, 1 Nov 2016 10:36:51 +1300 Media release – 1 November 2016 The Domain Name Commission (DNCL) has today introduced a free provisional address masking option where any individual (natural person) .nz domain name holder can ask that their contact address be masked from public display in the WHOIS (domain search tool). Just what information should be displayed when a WHOIS search is done on a .nz domain name is the subject of a major review. Throughout the review, DNCL has become aware that some individual registrants are concerned for privacy and personal safety reasons about having their contact address publicly displayed. The provisional address masking option has been introduced to help alleviate these concerns while DNCL carries on with its WHOIS review. Those wanting to take advantage of the option will have his or her contact address masked with a unique reference code and DNCL’s P.O. Box address. Domain Name Commissioner Debbie Monahan says DNCL is currently running a public consultation – asking for the community’s feedback on two policy options for withholding some information in the WHOIS, including contact address information. “In the meantime,” she says, “the address masking option announced today is intended to allay any personal safety concerns around public display of address information while we finish up our review and implement any permanent policy changes – expected to be later in 2017.” With the provisional address masking option, any individual registrant can ask that their contact address is masked from display in the .nz WHOIS. This doesn’t change their contact address information recorded on the .nz Register; it just means that information can’t be seen when someone does a WHOIS search on their domain name. Any mail sent to the masked address displayed on the WHOIS will be forwarded to the address on the Register, by DNCL. Importantly, says Monahan, the masking option is open to any individual registrant who is concerned for whatever reason about having their contact address publicly visible. She encourages all individual registrants to make use of it if they feel the need. The address masking is a straightforward process, but can only be effected by DNCL. It works by having individual registrants email DNCL from their email address on record. The DNCL office will then run some basic verification checks before applying the masking. The option is not available to businesses or organisations. Visit dnc.org.nz/pamo <https://www.dnc.org.nz/pamo> to find out more about DNCL’s provisional address masking option. Information about DNCL’s WHOIS review can be found at https://dnc.org.nz/whois-review. ------------------------------------------------------------------------

1 0

UDOO
by rowan schischka 01 Nov '16

01 Nov '16

"It is based on Quad Core 64-bit new-generation x86 processors made by Intel®, designed for the PC domain. Prodigious processors concentrated in 14 nm, with an amount of energy consumption of 5 or 6 Watt." http://www.udoo.org/udoo-x86/ If you're thinking of getting a raspberry pi this month, have a look at UDOO. x86 with a bunch of impressive specs shipping in december. For those of us conscious of using linux in low energy computing its still not as cheap as the m-ITX Asus N3050I-C. -- Kind Regards Rowan Schischka +64226719711

1 0

Is Lenovo Blocking Linux Installs?
by Lawrence D'Oliveiro 28 Oct '16

28 Oct '16

You may have heard that the BIOS on Lenovo’s Yoga 900 laptops has not been allowing the installation of non-Windows OSes (like Linux). After being on the receiving end of much opprobrium, Lenovo has finally released a BIOS update to fix this <http://www.theregister.co.uk/2016/10/28/lenovo_downward_dogs_with_yoga_bios…>. As usual, there are the suggestions that this was a deliberate deal done with Microsoft to shut out competitors to Windows. But then again, Hanlon’s Razor usually applies: “never ascribe to malice that which can be adequately explained by stupidity”. (See the reader comments on the above article for more examples of such stupidity.) Matthew Garrett has some more analysis <http://mjg59.dreamwidth.org/44694.html> on the specific issue that was stopping Linux installs: the hard drive controller is locked in “RAID” mode rather than “AHCI” mode. “AHCI” allows normal Linux drivers to work, while “RAID” mode requires special hardware-specific drivers. These special drivers don’t actually have to offer any RAID functionality; think of the “RAID” setting as just a way to block the generic drivers from taking control of the hardware. Garrett’s article has some discussion of why this might even be necessary: in this case, it may have to do with implementing proper power management.

1 0

Quirky 8.1 from Barry Kauler of Puppy who likes R Pi it seems
by Ian Young 26 Oct '16

26 Oct '16

Go Bazza!!! somewhere on the net Quirky Xerus 8.1 All Quirkies prior to 8.1 have been built for x86 and x86_64 PCs. Version 8.1 is the first to be built for the ARM platform, specifically the Raspberry Pi2 and Pi3. Note that Quirky will not work on a Pi1. It is expected a build for the Odroid XU4 is coming soon. The functionality is much as you have come to expect with a Puppy-derivative -- you get "the kitchen sink" in a very small package. That is, an application for just about everything and utilities to setup and configure just about anything. A difference though, with the Raspberry Pi build, is that it includes LibreOffice and Inkscape, whereas Puppy-derivatives usually have light-weight choices, such as Gnumeric, Abiword and InkscapeLite. This decision was made so as to provide the same functionality out-of-the-box as Raspbian, and in fact a whole lot more. This has resulted in a somewhat larger build than usual, a download file of 360MB. However, compare that with Raspbian at 1.3GB, and Quirky is still relatively small. As this is the very first release of Quirky for the Pi, it may have some issues, though we have been testing at the Puppy Forum and have fixed, hopefully, most of them. Some outstanding issues are:

1 0

Another Raspberry ? Contender
by rowan schischka 25 Oct '16

25 Oct '16

on indiegogo i like the picture half way down of the VoCore2 inside an ethernet wall socket. seems like a perfect disposable spy tool. It wont hurt raspberry pi sales as it does not have video, its just a really small networking toy https://www.indiegogo.com/projects/vocore2-4-coin-sized-linux-computer-with… -- Kind Regards Rowan Schischka

1 0

Another Raspberry π Contender
by Lawrence D'Oliveiro 25 Oct '16

25 Oct '16

Came across this mention <https://www.techdirt.com/articles/20161024/09194835873/daily-deal-vocore2-m…> of the “VoCore2 Mini Linux Computer”. Usually, rivals to the Raspberry π fall down either in price (e.g. anything Intel-based) or in features (e.g. the BBC Micro:Bit). But this seems, at first sight, to hold its own in both areas. And it goes one better than the π in terms of size. Thoughts?

2 2

nexdock
by rowan schischka 25 Oct '16

25 Oct '16

>NiceGear does sell an uninterruptilble power supply hat for the Pi. The problem with that UPS is its $50, 300mah, and supplies 15minutes of power. I want to run a pi on solar power 24/7. Iv run the pi3, idle, on my 20.000mAh for about two days; which means ill probably need a 10,000mAh battery. I say about two days because i did not run the battery flat, just down to one bar. I can't use the pack I have without re-wiring it because i need to press a physical button to switch it on and it won't supply power while its charging. Do you think a realtime clock would be necessary considering i can get time off a server? I'm also considering repurposing my old phone because it already has a battery, but it doesn't have much ram and is also running a very old unsupported android. -- Kind Regards Rowan Schischka +64226719711

1 0

pi-top raspberry pi laptop
by rowan schischka 24 Oct '16

24 Oct '16

here the RS link for the raspberry pi laptop http://nz.rs-online.com/web/generalDisplay.html?id=i/pi-top -- Kind Regards Rowan Schischka

1 0

AGM
by Peter Reutemann 24 Oct '16

24 Oct '16

Hi everyone The WLUG AGM will be held November 28th. The agenda, as it stands at this stage, is as follows: - President's Report - Treasurer's Report - Election of 2017 Committee - General business (eg future of WLUG library, wording in the charter with regard to advertising of jobs using the wlug mailing list, etc) - Consumption of pizza Details can be found here: http://www.meetup.com/WaikatoLinuxUsersGroup/events/233952391/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

nexdock
by rowan schischka 24 Oct '16

24 Oct '16

heres the laptop without a CPU that I mentioned last night. the crowd funding is over and you can't buy them anymore. Its not too different to a dock that motorola shipped about five years ago as a phone accessory. I hope more of these to hit the market, they should be good for the raspberry pi and ubuntu phones. RS electronics does sell a lap dock for the reaspberry pi but its expensive. http://nexdock.com http://www.phonearena.com/news/Motorola-Lapdock-100-hands-on_id24191 If anyone knows of a battery bank with passthrough id appreciate if you could pass on the model, it will be really useful for a solar project I want to do over summer. Cheers -- Kind Regards Rowan Schischka

2 1

android on raspberry pi
by rowan schischka 23 Oct '16

23 Oct '16

So iv been trying for two days to download the raspberry pi android image without success. the best i can achieve is 20/500mb. Can someone else please try? https://github.com/Android-RPi3/android_releases_rpi3/releases -- Kind Regards Rowan Schischka

2 2

www wobbles
by Ian Young 23 Oct '16

23 Oct '16

Recall the web as once we knew it before the financiers and crims took over? http://www.theregister.co.uk/2016/10/21/dyn_dns_ddos_explained/ http://www.theregister.co.uk/2016/10/21/dns_devastation_as_dyn_dies_under_d… David Gibson, VP of strategy at Varonis, noted: "Like many of our aging technologies, DNS wasn’t built with security in mind… DNS is one of the aging technologies the industry is struggling to update, along with one-factor authentication and unencrypted web connections – the list is very long, and the stakes have never been higher." Craig Young, a security researcher at Tripwire, added to the general concern: "As with most software designs from the 1980s, security was generally not considered when creating DNS. Because the web is so dependent on this system, it becomes a very visible point of failure as is the case today with service provider Dyn."

2 2

meeting monday
by rowan schischka 22 Oct '16

22 Oct '16

Regarding the android pi installation I'm currently downloading android 6 from here https://github.com/Android-RPi3/android_releases_rpi3/releases I noticed that theres also an android 7 build but I don't have enough SD cards. if someone else wants to have a go at getting android 7 running on raspberry pi it needs to be built from source: https://github.com/peyo-hd/device_brcm_rpi3/tree/nougat -- Kind Regards Rowan Schischka

1 0

Fwd: [NZOSS OpenChat] expanding Europe's Linux Presentation Day to New Zealand
by Peter Reutemann 21 Oct '16

21 Oct '16

Apologies for cross-posting. Cheers, Peter ---------- Forwarded message ---------- From: Hauke Laging <hauke.laging(a)linux-presentation-day.org> Date: Fri, Oct 21, 2016 at 3:01 PM Subject: [NZOSS OpenChat] expanding Europe's Linux Presentation Day to New Zealand To: openchat(a)groups.nzoss.org.nz ― 1 file link ― Hello, in May 2015 Berlin's Linux user group (BeLUG) has started a new type of event which has spread quickly first in Germany and then all over Europe; despite our rather tiny organizational and finacial resources: the Linux Presentation Day (LPD) 2015.1: Berlin only 2015.2: 72 cities in three countries 2016.1: 110 cities in 10 countries 2016.2: 150+ cities in 14 countries (on October, 22nd) I contact you because we intend to expand the LPD beyond Europe next year. The main aim of the LPD is to provide biannual and comprehensive information events about Linux for private users who would like to get a first impression of Linux, i.e. for people who do not plan to install Linux yet because they know too little about it to be concretely interested in giving it a try on their own system. The LPD is not headed at happy Windows users. The other important aim is to make the event so big that the non-IT media cover it regularly so that over time the public becomes more familiar with the idea of Linux being an OS for normal computer users, too. The approach is to have many small and rather simple events which can be easily organized and even without costs. The local organizers decide on their own what their event shall be like; we just make suggestions and offer support. Making hosting an event easy broadens the spectrum of potential hosting organizations and leads to more locations. In Germany most events are hosted by associations (Linux user groups and hackspaces) and adult education centers. But companies, universities, and schools are involved, too. The aim is to have 1,000 locations in Germany in a few years. You can find a longer description of the concept here: http://www.linux-presentation-day.org/idea/ Even more information is on the German web site in case anyone understands German or is willing to try a translation service: http://www.linux-presentation-day.de/ueber/ Currently there are well working national organizers only in Germany (me) and Switzerland. We have contacted nearly all the hosting organizations abroad from Germany. Obviously the effectivity of this approach is limited and it probably would not get better if we tried this with countries on the other side of the world. Thus in your case I first try to get in touch with organizations which might help in setting up the national organizing so that in the best case we do not have to search for event hosts from here. A few questions: 1) Do you already have a similar event? 2) Are you as an organization interested in supporting the LPD? In the best case that would mean that you are willing to do the national organizing. But it could also mean that you are willing to just host an LPD event or that you support other hosting organizations as a sponsor. 3) If not: I assume that you are in contact with many people who might be interested in participating. Would you be willing to ask them whether they want to participate (as local event hosts or on the national level)? 4) Can you point me at other organizations which are well networked within the Linux community and might be helpful for getting the LPD started? CU Hauke -- http://www.linux-presentation-day.org/ International phone contact for the Linux Presentation Day: tel:+49-30-55579620 (13:00–23:00, German and English) XMPP (Chat with OTR): linux-presentation-day(a)jabber.ccc.de OTR: 91626899 1C06F2BD 75EC2441 35C696CE 38F75997 ― 1 file ― 📎 (585b) http://groups.nzoss.org.nz/r/file/xwrEUCtYgg2XWjNlQFN2CqROqlU-9r-2BdOyWU/ ―― View topic http://groups.nzoss.org.nz/r/topic/HpjKQN2I1NhTGxRrASG2L Leave group mailto:openchat(a)groups.nzoss.org.nz?subject=Unsubscribe Start groups https://OnlineGroups.net -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

“Most serious” Linux privilege-escalation bug ever is under active exploit
by Peter Reutemann 20 Oct '16

20 Oct '16

'A serious vulnerability that has been present for nine years in virtually all versions of the Linux operating system is under active exploit, according to researchers who are advising users to install a patch as soon as possible. While CVE-2016-5195, as the bug is cataloged, amounts to a mere privilege-escalation vulnerability rather than a more serious code-execution vulnerability, there are several reasons many researchers are taking it extremely seriously. For one thing, it's not hard to develop exploits that work reliably. For another, the flaw is located in a section of the Linux kernel that's a part of virtually every distribution of the open-source OS released for almost a decade. What's more, researchers have discovered attack code that indicates the vulnerability is being actively and maliciously exploited in the wild.' -- source: http://arstechnica.com/security/2016/10/most-serious-linux-privilege-escala… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday
by Peter Reutemann 19 Oct '16

19 Oct '16

Hi everyone We have a meeting coming up next Monday: "Rowan Schischka will present his Ubuntu M10 tablet and also demonstrate installing/running Android on the Raspberry Pi. The new Raspbian desktop environment PIXEL will be taken for a test drive as well." -- details: http://www.meetup.com/WaikatoLinuxUsersGroup/events/233762057/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

KDE’s 20th Birthday Celebrated By Re-Releasing KDE 1
by Lawrence D'Oliveiro 17 Oct '16

17 Oct '16

The KDE Restoration Project has managed to (re)build KDE 1.1.2 to run on a more current Linux system. <http://phoronix.com/scan.php?page=news_item&px=KDE-20-KDE1-Re-Release>

1 0

MTP protocol - why needed?
by Ian Young 16 Oct '16

16 Oct '16

Alas, more thread breaking in subject line. After a bit more reading on MTP it seems there is a rationale for its existence. That said, it appears that the protocol has not won universal acclaim.Some people are very scathing about it. In part my post was a bit overwrought as I had never heard of MTP, but then I have never used an Android phone until very recently. ~ Ian Y

3 2

why i need this in my life?
by Ian Young 15 Oct '16

15 Oct '16

Apologies for extra posting bur after reading this article, what the botheration? Any phoneware suppliers out there not utterly fith? Good grief, Utterly random selection from something they say is the internet. http://www.howtogeek.com/192732/android-usb-connections-explained-mtp-ptp-a…

2 1

raspberry PIXEL
by rowan schischka 15 Oct '16

15 Oct '16

Rasbian now has its own desktop environment called PIXEL https://www.raspberrypi.org/magpi/introducing-pixel/ Considering I'm already demonstrating android on raspberry pi, we may as well have a look at this new interface if we have time. Can I ask people to bring their old, unused micro SD cards; Iv got one but its already been written to with dd a few times, and I don't know how much life is left in it. -- Kind Regards Rowan Schischka

2 1

elementary?
by Ian Young 15 Oct '16

15 Oct '16

Not a good review from dedoimedo. " Elementary OS 0.4 has some nice goodies, but they all completely over-shadowed by a slew of big bugs, heating issues, inconsistent behavior, poor multimedia support, weak smartphone support, non-existent Samba support, a less-than-ideal responsiveness of its desktop and apps, weird graphic artefacts and glitches, poor contrast, and a few others. This is just too much for an ordinary user to commit to. I'm particularly sad because Freya had started showing promise, but it's all gone now. Then again, Xerus really killed the Ubuntu line, so it comes as no surprise." http://www.dedoimedo.com/computers/elementary-0-4-loki.html Anyone know what is this MTP protocol by the way? It sounds a bit surplus to requirements. Perhaps my phone is not smart enough?

1 0

Ian S Was Right About DECnet Phase IV
by Lawrence D'Oliveiro 14 Oct '16

14 Oct '16

Remember I said DECnet Phase IV couldn’t have been in existence in 1983? In fact, these documents <http://bitsavers.trailing-edge.com/pdf/dec/decnet/phase_IV/> make it clear it was introduced in 1982.

1 0

Security Economics Of The Internet Of Things
by Lawrence D'Oliveiro 10 Oct '16

10 Oct '16

Basically, neither the buyers nor the sellers of these devices care about fixing the security problems, since the victims are usually somebody else. So the only way to solve them is via Government intervention. But this has to be done with international cooperation--no single country can do it. <https://www.schneier.com/blog/archives/2016/10/security_econom_1.html>

1 0

Why Linus Torvalds Prefers x86 Over ARM
by Peter Reutemann 09 Oct '16

09 Oct '16

'Linus Torvalds answered a question about his favorite chip architecture at the Linaro Connect conference. An anonymous Slashdot reader quotes PCWorld: People are too fixated with the instruction set and the CPU core, Torvalds said. But ultimately "what matters is all the infrastructure around the instruction set, and x86 has all that infrastructure... at a lot of different levels. It's open in a way that no other architecture is... Being compatible just wasn't as big of a deal for the ARM ecosystem as it has been traditionally for the x86 ecosystem... I've been personally pretty disappointed with ARM as a hardware platform, not as an instruction set, though I've had my issues there, too. As a hardware platform, it is still not very pleasant to deal with." You can watch the whole half-hour conversation on YouTube. My favorite part is where Linus candidly acknowledges that "sometimes my grumpiness makes more news than my being nice... 99% of the time I'm a very happy manager, and I mentally pat people on the head all the time. That maybe then highlights the times when things don't work so well a bit more."' -- source: https://linux.slashdot.org/story/16/10/09/0755231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Persistent Memory At LinuxCon 2016
by Lawrence D'Oliveiro 09 Oct '16

09 Oct '16

Seems like there is a lot of interest currently in “persistent memory” architectures (e.g. flash storage that doesn’t sit on the other side of a slow SATA interface). Quite a few different programming models and libraries are being developed to try to find the best approach to making efficient use of this resource <http://phoronix.com/scan.php?page=news_item&px=Persistent-Memory-Linux-2016>. I suppose this is like the early days of disks (and drums, and tapes), when the first primitive filesystems were being developed. Anybody remember core memories? But they were never used this way...

2 1

Looks Like Fedora 25 Will Default To Wayland
by Lawrence D'Oliveiro 08 Oct '16

08 Oct '16

Wayland, the complete reworking of the antiquated X11 graphics/windowing architecture along more modern lines, has been many years in the development. Looks like it is finally ready for prime time <http://phoronix.com/scan.php?page=news_item&px=Fedora-25-Wayland-Continues>.

1 0

ISP GMX attempts the nigh impossible: PGP for the masses
by Lawrence D'Oliveiro 07 Oct '16

07 Oct '16

Will this <http://www.theregister.co.uk/2016/10/06/pgp_email_service_gmx/> finally take secure e-mail mainstream?

3 2

Linux is a new frontier for young developer
by Peter Reutemann 07 Oct '16

07 Oct '16

'When I was 17 years old, I started using Linux because I wanted a desktop that resembled my brother-in-law's Gentoo laptop, which used the KDE environment. Instead, I got the now-nostalgic brown and orange GNOME 2 environment because I'd installed Ubuntu. (Ubuntu has since changed its color palette.) At the time, I couldn't go back to Windows Vista and I didn't ask my in-law for help. So I hunkered down and started learning. But I was scared of other Linux distributions and felt lucky that I could even get Ubuntu on my computer. I started to learn how to make my newly installed system look and feel how I wanted it to. For a year or so, I executed shell scripts with reckless abandon, as root, which downloaded icons and possibly zero-day exploits. GNOME-Look was a staple source for me. I had fun learning about all the free software that one could get through Ubuntu's software center and Synaptic. To be frank, I only cared that it was gratis. I was a kid and could not afford much of anything. But, the fact that a lot of software was free as in beer got me thinking and made me wonder why.' -- source: https://opensource.com/life/16/10/a-linux-journey Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

could it finally be
by Ian Young 07 Oct '16

07 Oct '16

Year of Linux on the Windows desktop? Sorry, just couldn't refrain :/

3 4

Unity 8 Desktop Session Arrives in Ubuntu 16.10
by Peter Reutemann 06 Oct '16

06 Oct '16

'Added to the Ubuntu meta package, the new Unity 8 desktop session will be available to try on all new installs and upgrades of Ubuntu 16.10, but only as an alternate login session to Unity 7. Unity 8 is not -- repeat: not -- going to be the default session in this release. Shipping it as a preview session is a great idea. It means to try Unity 8 on Ubuntu 16.10 you won't need to install a set of packages, or faff around with special set-up, or add a PPA. When at the Unity Greeter (aka the login screen) just click the session selector button, followed by 'Unity 8,' and then proceed to login as normal.' -- source: https://linux.slashdot.org/story/16/10/06/1650200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Offers Landsat & Sentinel-2 Data On Its Cloud
by Lawrence D'Oliveiro 06 Oct '16

06 Oct '16

Google is now offering another way to get hold of satellite imagery from NASA’s Landsat and the ESA’s Sentinel-2 program, using its cloud service <http://www.theregister.co.uk/2016/10/06/google_landsat_and_sentinel2_imager…>. This should mitigate the bandwidth bottlenecks, but maybe it doesn’t make navigating the files to find what you want any easier...

1 0

BadKernel Vulnerability Affects One In 16 Android Smartphones
by Peter Reutemann 05 Oct '16

05 Oct '16

'A security bug in Google's V8 JavaScript engine is indirectly affecting around one in 16 Android devices, impacting smartphone models from all major vendors, such as LG, Samsung, Motorola, and Huawei. Despite this bug being public for more than a year, only in August 2016 have Chinese security researchers discovered that the V8 issue also affected a whole range of Android-related products where the older V8 engine versions had been deployed. Affected products included Google Chrome Mobile, Opera Mobile, apps that use the WebView component (Gmail, Facebook, Twitter, WeChat, etc.) and apps that deploy the Tencent X5.SDK (a bunch of Chinese apps). It is estimated that around one in 16 Android devices is vulnerable to this issue, nicknamed BadKernel. The flaw leads to a RCE on Android devices, allowing attackers to take full control over one's smartphone. Despite BadKernel being discovered in August 2016, because all research was only published in Chinese, most E.U. and U.S. users have no clue they might be affected. One of the best ways to protect yourself, as noted in the report, is to keep your apps and operating system updated. You can view this list via Trustlook's website to see if your device is affected. There's also a dedicated BadKernel security scanner you can download from the Play Store to check for the vulnerability.' -- source: https://news.slashdot.org/story/16/10/05/033233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

New Project Lets You Install Arch Linux In the Windows Subsystem For Linux
by Peter Reutemann 05 Oct '16

05 Oct '16

'Softpedia reports that there's a new project on GitHub, called alwsl, which promises to let you install the Arch Linux operating system on Windows 10's new WSL (Windows Subsystem for Linux) feature, which allows users to run native Linux command-line tools directly on the Windows operating system alongside their modern desktop and apps. For example, Canonical and Microsoft brought Bash on Ubuntu on Windows using the new WSL functionality. For now, the alwsl project, which is developed by a group of German developers that call themselves "Turbo Developers," offers a .bat file that you can use to install Arch Linux on a WSL (Windows Subsystem for Linux) host, but the software is in developer preview stage. The first stable release, alwsl 1.0 will be able not only to install Arch Linux on the Windows Subsystem for Linux host in Windows 10 editions that support it, but also to create and manage users and snapshots. Also, it looks like it will get rolling upgrades just like a normal Arch Linux installation gets. The final release is expected to launch on December 2016, and you can monitor its development progress on GitHub.' -- source: https://linux.slashdot.org/story/16/10/05/1510203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Encryption App Signal Wins Fight Against FBI Subpoena and Gag Order
by Peter Reutemann 05 Oct '16

05 Oct '16

'Signal, widely considered the gold standard of encrypted messaging apps, was put to the test earlier this year when a FBI subpoena and gag order that demanded a wide range of information on two users resulted in a federal grand jury investigation in Virginia. The makers of Signal, Open Whisper Systems, profoundly disappointed law enforcement. The app collects as little data as possible and therefore was unable to hand anything useful over to agents. "That's not because Signal chose not to provide logs of information," ACLU lawyer Brett Kaufman told the Associated Press. "It's just that it couldn't." "The Signal service was designed to minimize the data we retain," Moxie Marlinspike, the founder of Open Whisper Systems, told the New York Times. The subpoena came with a yearlong gag order that was successfully challenged by the American Civil Liberties Union. Signal's creators challenged the gag order as unconstitutional, "because it is not narrowly tailored to a compelling government interest." The challenge was successful. In addition to being popularly considered the best consumer encrypted messaging app available, Signal's technology is used by Facebook for Secret Conversations, WhatsApp for encrypted messages, and Google's Allo. Confronted with the subpoena, Marlinspike went to the ACLU for legal counsel. The ACLU responded with a letter saying that even though Signal did not have data the FBI sought, it still strenuously objected (PDF) to the fact the FBI wanted so much information.' -- source: https://tech.slashdot.org/story/16/10/04/2144202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apple, Google, Microsoft: We Have No Government Email Scanning Program Like Yahoo's
by Peter Reutemann 05 Oct '16

05 Oct '16

'Apple, Google and Microsoft -- three of the largest technology companies in the U.S. -- have each said they don't scan all incoming messages for the U.S. government, which is exactly what Yahoo does. According to Reuters, Yahoo secretly built a custom software program last year to search all of its customers' incoming emails for specific information provided by U.S. intelligence officials. The company complied with a classified U.S. government directive, scanning hundreds of millions of Yahoo Mail accounts at the behest of the National Security Agency or FBI. Vocativ reports: In a statement, a Microsoft spokesperson told Vocativ that "We have never engaged in the secret scanning of email traffic like what has been reported today about Yahoo." While Apple declined to give a statement on the record, a representative for the company did, in response to Vocativ's question, refer to CEO Tim Cook's official letter on consumer privacy, which reads in part: "I want to be absolutely clear that we have never worked with any government agency from any country to create a backdoor in any of our products or services. We have also never allowed access to our servers. And we never will." The fact that both the companies declined further statement means it's not yet known if the NSA or FBI approached them to request they build a program like Yahoo's. Meanwhile, a spokesperson from Alphabet's Google issued a statement to CNBC: "We've never received such a request, but if we did, our response would be simple: 'no way.'" [The spokesperson later clarified that the company has not received a "directive" or "order" to that effect, either, according to The Intercept.] But the question is whether or not you believe them. With Yahoo's case, only a handful of employees knew about the program. The same could be true with Apple, Google, Microsoft or any other large tech company. Edward Snowden tweeted not too long after Reuters' report surfaced: "Heads up: Any major email service not clearly, categorically denying this tomorrow -- without careful phrasing -- is as guilty as Yahoo."' -- source: https://yro.slashdot.org/story/16/10/04/2252242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

KDE Plasma 5.8 LTS Desktop Officially Released
by Peter Reutemann 05 Oct '16

05 Oct '16

'KDE will celebrate 20 years of activity on October 14, 2016, and they've just released the first LTS (Long Term Support) version of the KDE Plasma desktop environment. Prominent new features of KDE Plasma 5.8 LTS include support for desktop widgets, a new system-wide search functionality that promises to let users easily search their KDE desktops for everything they want, including apps, music, videos, files, folders, etc., a new tool to get hot new stuff for your KDE Plasma desktop, such as wallpapers, widgets, desktop effects, or window styles, and infinite customization possibilities. Moreover, KDE Plasma 5.8 LTS comes with a unified look for the default Breeze theme so that, no matter what type of application you're using (Qt4, GTK2, GTK3, or Qt5), it will look the same, mobile phone notifications, along with the ability to use your smartphone as a PC remote, transfer files or mute music during calls, all with the new KDE Connect plasmoid. There's also Right-to-Left (RTL) language support, simplified global shortcuts, improvements to many applets, and much better Wayland support. KDE Plasma 5.8 LTS will receive nine point releases until 2018. "Today KDE releases its first Long Term Support edition of its flagship desktop software, Plasma," reads the announcement. "This marks the point where the developers and designers are happy to recommend Plasma for the widest possible audience be they enterprise or non-techy home users. If you tried a KDE desktop previously and have moved away, now is the time to re-assess, Plasma is simple by default, powerful when needed."' -- source: https://linux.slashdot.org/story/16/10/04/1941237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu 16.04 Available in Latest Insider Update To Windows 10
by Peter Reutemann 04 Oct '16

04 Oct '16

'The latest Windows 10 Insider preview -- build 14936 -- features Ubuntu 16.04 LTS. When a user enables the 'Bash on Ubuntu on Windows' feature for the first time, OMGUbuntu reports, Windows 10 now installs an Ubuntu 16.04 (Xenial Xerus) image instead of Ubuntu 14.04 (Trusty Tahr). From the report: The updated version of Ubuntu in the WSL only affects new instances, i.e., those created by running lxrun.exe /install or on the very first run of the bash.exe setup. It is possible to upgrade WSL instances from Ubuntu 14.04 to Ubuntu 16.04 manually by running the do-release-upgrade command. Other changes in the WSL in Build 14936 include support for chroot system call, epoll support for /dev/null and the ability for bash -c to redirect to a file.' -- source: https://linux.slashdot.org/story/16/10/03/198222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Security Design: Stop Trying To Fix The User
by Lawrence D'Oliveiro 03 Oct '16

03 Oct '16

<https://www.schneier.com/blog/archives/2016/10/security_design.html>: The problem isn't the users: it's that we've designed our computer systems' security so badly that we demand the user do all of these counterintuitive things. Why can't users choose easy-to-remember passwords? Why can't they click on links in emails with wild abandon? Why can't they plug a USB stick into a computer without facing a myriad of viruses? Why are we trying to fix the user instead of solving the underlying security problem?

2 1

Linux Should Soon Start Receiving "Make WiFi Fast" Improvements
by Lawrence D'Oliveiro 03 Oct '16

03 Oct '16

Some improvements coming for Linux Wi-Fi code <http://phoronix.com/scan.php?page=news_item&px=Linux-Getting-Make-WiFi-Fast>. Not sure what the connection is to the Bufferbloat project: that is an attempt to reduce overall network latency by cutting down on excessively-large buffers inside various network components.

1 0

Linux Mint Unveils New 'Mintbox Mini Pro' Desktop
by rowan schischka 02 Oct '16

02 Oct '16

Does anyone have a mintbox? I'm quite interested in these small silent devices. Iv seen some bad reviews of devices from aliexpress, there are significant reviews that complain the gigabit ethernet ports cant achieve advertised speeds. If you do have one, specifically a high power (i5/i7) one; can you please share some benchmarking results. Id like to see how CPU thermal throttling under load affects performance. Im thinking theres going to be a limit in CPU frequency, i.e. you wouldn't pay for for the high frequency, high power CPU if it throttles down to a cheaper CPU's performance -- Kind Regards Rowan Schischka

1 0

Multiple Linux Distributions Affected By Crippling Bug In Systemd
by Peter Reutemann 02 Oct '16

02 Oct '16

'System administrator Andrew Ayer has discovered a potentially critical bug in systemd which can bring a vulnerable Linux server to its knees with one command. "After running this command, PID 1 is hung in the pause system call. You can no longer start and stop daemons. inetd-style services no longer accept connections. You cannot cleanly reboot the system." According to the bug report, Debian, Ubuntu, and CentOS are among the distros susceptible to various levels of resource exhaustion. The bug, which has existed for more than two years, does not require root access to exploit.' -- source: https://linux.slashdot.org/story/16/10/01/2155209 Cheers, peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

Linux Mint Unveils New 'Mintbox Mini Pro' Desktop
by Peter Reutemann 01 Oct '16

01 Oct '16

'It's been 18 months since the original Mintbox Mini launched, and this week saw the release of the new Mintbox Mini Pro (which costs just $100 more). BrianFagioli quotes BetaNews: That extra money gets you a faster processor, more powerful graphics, double the storage, twice the RAM, improved Wi-Fi, Bluetooth, and an additional Ethernet port... This diminutive desktop is the same size as the previously-released Mintbox... Thankfully, it retains the same cute appearance and Linux Mint branding. Their article calls it a "beautiful little computer that comes pre-loaded with Linux Mint 18 Cinnamon (64-bit)," and the Linux Mint blog promises this fanless device offers "better passive cooling thanks to an all-metal black housing" -- and comes with six different USB ports.' -- source: https://linux.slashdot.org/story/16/10/01/0236245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Arduino Split is Over, New Non-Profit Formed
by Peter Reutemann 01 Oct '16

01 Oct '16

'"Today is one of the best days in Arduino history," announced Massimo Banzi, Co-Founder of Arduino LLC, calling it "a new beginning" for Ardunio. Slashdot reader ruhri reports: Massimo Banzi and Federico Musto, co-founders of the Arduino Project, announced they have settled their differences that had resulted in the creation of Arduino LLC and Arduino SRL. A new, unified Arduino Holding and Arduino Foundation will be created. "Massimo Banzi and Federico Musto took the stage today at the New York Maker Faire to announce the good news," reports a blog post at Arudino.cc. "At the end of 2016, the newly created 'Arduino Holding' will become the single point of contact for the wholesale distribution of all current and future products... In addition, Arduino will form a not-for-profit 'Arduino Foundation' responsible for maintaining the open source Arduino desktop IDE, and continuing to foster the open source movement by providing support for a variety of scholarships, community and developer initiatives."' -- source: https://news.slashdot.org/story/16/10/01/1926242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Asian Penguins turn program into a Linux success
by Peter Reutemann 30 Sep '16

30 Sep '16

"The Community School of Excellence (CSE) Asian Penguins are the world's first and only Linux user group based in a Hmong charter school. A failed Windows laptop program at the school was turned by the Asian Penguins into a Linux success." -- source: https://opensource.com/education/16/9/asian-penguins-convert-minnesota-scho… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0