- wlug - list.wlug.org.nz

Hackers Are Now Hiding Malware In Windows Event Logs
by Peter Reutemann 10 May '22

10 May '22

'Security researchers have noticed a malicious campaign that used Windows event logs to store malware, a technique that has not been previously documented publicly for attacks in the wild. BleepingComputer reports: The method enabled the threat actor behind the attack to plant fileless malware in the file system in an attack filled with techniques and modules designed to keep the activity as stealthy as possible. [...] The dropper copies the legitimate OS error handling file [...] and then drops an encrypted binary resource to the 'wer.dll' (Windows Error Reporting) in the same location, for DLL search order hijacking to load malicious code. DLL hijacking is a hacking technique that exploits legitimate programs with insufficient checks to load into memory a malicious Dynamic Link Library (DLL) from an arbitrary path. [Denis Legezo, lead security researcher at Kaspersky] says that the dropper's purpose is to loader on the disk for the side-loading process and to look for particular records in the event logs (category 0x4142 - 'AB' in ASCII. If no such record is found, it writes 8KB chunks of encrypted shellcode, which are later combined to form the code for the next stager. "The dropped wer.dll is a loader and wouldn't do any harm without the shellcode hidden in Windows event logs," says Legezo. The new technique analyzed by Kaspersky is likely on its way to becoming more popular as Soumyadeep Basu, currently an intern for Mandiant's red team, has created and published on GitHub source code for injecting payloads into Windows event logs. ' -- source: https://tech.slashdot.org/story/22/05/09/2155240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers are actively exploiting BIG-IP vulnerability with a 9.8 severity rating
by Peter Reutemann 10 May '22

10 May '22

'Researchers are marveling at the scope and magnitude of a vulnerability that hackers are actively exploiting to take full control of network devices that run on some of the world's biggest and most sensitive networks. The vulnerability, which carries a 9.8 severity rating out of a possible 10, affects F5’s BIG-IP, a line of appliances that organizations use as load balancers, firewalls, and for inspection and encryption of data passing into and out of networks. There are more than 16,000 instances of the gear discoverable online, and F5 says it’s used by 48 of the Fortune 50. Given BIG-IP's proximity to network edges and their functions as devices that manage traffic for web servers, they often are in a position to see decrypted contents of HTTPS-protected traffic. Last week, F5 disclosed and patched a BIG-IP vulnerability that hackers can exploit to execute commands that run with root system privileges. The threat stems from a faulty authentication implementation of the iControl REST, a set of web-based programming interfaces for configuring and managing BIG-IP devices. “This issue allows attackers with access to the management interface to basically pretend to be an administrator due to a flaw in how the authentication is implemented,” Aaron Portnoy, the director of research and development at security firm Randori, said in a direct message. “Once you are an admin, you can interact with all the endpoints the application provides, including execute code.”' -- source: https://arstechnica.com/information-technology/2022/05/hackers-are-actively… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GNOME Patent Troll Gets Stripped of Patent Rights
by Peter Reutemann 09 May '22

09 May '22

'An anonymous Slashdot reader writes: Remember that patent lawsuit filed against GNOME's Shotwell in 2019? An enterprising open source lawyer has challenged it within the patent office and gotten the whole thing canceled! OpenSource.org argues that decision by the U.S. patent office "may well give patent trolls cause to steer clear of open source projects — even more than the fierce resistance the community impressively funded and mounted in the GNOME case." Of the many methods developed over the past 20 years to eliminate patent threats against FOSS, none is as powerful as challenging the nefarious patents directly. That's what McCoy Smith, founder of OSI sponsor LexPan Law, did.... Smith pointed out in a re-examination request to the U.S. Patent & Trademark Office that the patent was not for any new invention. They agreed. As a result, all of these "claims" in the Rothschild '086 Patent — the part of a patent describing what the patent rights cover — have consequently been canceled. The Rothschild '086 patent can no longer be used against any victim, including open source projects. Of course, that's little comfort to the 20+ victims attacked after GNOME with the now-proven-worthless Rothschild '086 patent, or the 50+ companies targeted with related patents that haven't yet been re-examined.... Still, it's good to know there are open source champions of all sizes defending the development of open software.' -- source: https://yro.slashdot.org/story/22/05/08/0052226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

(Mostly) Open Source SteamOS Forked into Homegrown ISO For Other Machines
by Peter Reutemann 09 May '22

09 May '22

'"While Valve has yet to actually release a proper ISO for SteamOS 3 used on the Steam Deck, others have been taking it into their own hands to provide," reports GamingOnLinux, "like with the new HoloISO. "This is possible, since 99% of what SteamOS uses is open source (not the Steam client though)..." So people can easily hack away at it to do whatever they want. [HoloISO] is not exactly the same as SteamOS 3 but it's probably the closest I've seen yet, with the main packages coming direct from Valve with "zero possible edits" the developer says. It's described as a "first beta release." Neowin supplies some context: Back in early March, Valve released the Steam Deck recovery image for Deck users who need to get back to a factory state. When it was released, many of us over at the Steam OS subreddit did the first thing any reasonable enthusiast would do and tried installing it on a standard PC. The results of this approach were mixed, and only partial successes were achieved. Then HoloISO happened.... The first release, called 'Ground Zero', was released today and allows users to install Steam OS on any machine. But there are some things you need to know before installing this for yourself.... There's a bunch of caveats, but the article still concludes that "If you're team red and you want to give this a shot, head over to the project's Github page to read more and download."' -- source: https://games.slashdot.org/story/22/05/08/0844220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apple Silicon Exclusively Hit With World-First 'Augury' DMP Vulnerability
by Peter Reutemann 07 May '22

07 May '22

'Tom's Hardware: A team of researchers with the University of Illinois Urbana-Champaign, Tel Aviv University, and the University of Washington have demonstrated a world-first Data Memory-Dependent Prefetcher (DMP) vulnerability, dubbed "Augury," that's exclusive to Apple Silicon. If exploited, the vulnerability could allow attackers to siphon off "at rest" data, meaning the data doesn't even need to be accessed by the processing cores to be exposed. Augury takes advantage of Apple Silicon's DMP feature. This prefetcher aims to improve system performance by being aware of the entire memory content, which allows it to improve system performance by pre-fetching data before it's needed. Usually, memory access is limited and compartmentalized in order to increase system security, but Apple's DMP prefetch can overshoot the set of memory pointers, allowing it to access and attempt a prefetch of unrelated memory addresses up to its prefetch depth. If you feel your mind grasping at a certain familiarity with this, it's likely because the infamous Spectre/Meltdown vulnerabilities also try and speculate what data will be required by the system before it's even requested (hence the term speculative execution). But while side-channel vulnerabilities such as Spectre and Meltdown are only capable of leaking in-use data, Apple's DMP can potentially leak the entire memory content even if it's not being actively accessed. The nature of Apple's DMP also renders void some of the already-engineered fixes for speculative execution vulnerabilities -- those that rely on controlling what is visible to the processing cores. The researchers said that Apple is fully aware of their discoveries, but there are no plans for whether or not the company will deploy mitigations.' -- source: https://apple.slashdot.org/story/22/05/06/2226251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Celebrates the Release of Firefox 100
by Peter Reutemann 05 May '22

05 May '22

'vm shares the blogpost of Mozilla releasing Firefox 100, and outlines some of thoughts: Out of the ashes of Netscape/AOL, Firebird rose as a promising new browser. A significant name change and a hundred releases later, Firefox 100 is still the underdog that keeps on fighting. With my mounting annoyance at all the Google services underpinning Chrome, I've since discovered and used Ungoogled Chromium, Waterfox, LibreWolf, and a handful of other lesser known spins on Chrome or Firefox. On mobile, Brave really does the best job at ad blocking whether you're on iOS or Android but the Mozilla Foundations is probably still the largest dev group fighting the good fight when it comes to both privacy and security enhancements.That's not to say that the Chromium team isn't security savvy -- I only wish they were just a little less Google. Anyhow, tell us about your favorite browser in the comments and have a look at Mozilla's latest release while you're at it.' -- source: https://news.slashdot.org/story/22/05/03/1720240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome's Latest Update: 30 Security Fixes and Bug Details Kept 'Restricted'
by Peter Reutemann 02 May '22

02 May '22

'Hot Hardware warns that on Tuesday, the Stable Channel for Chrome's desktop edition "had an update on April 26, 2022. That update includes 30 security fixes, some of them so bad that Google is urging all users to update immediately." The release notes for Google's Chrome v101.0.4951.41 for Windows, Mac, and Linux has a long list of bug fixes; you can view it here. However, there's also a key statement in that page. "Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven't yet fixed...." Effectively the the non-developer translation of the quote above is that something so significant was found, the details are being kept hidden.' -- source: https://it.slashdot.org/story/22/05/02/0034206 That sounds pretty bad... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fedora's Lead Speaks on the Popularity of Linux and the Importance of Open Source
by Peter Reutemann 02 May '22

02 May '22

'Fedora project leader Matthew Miller spoke to TechRepublic's Jack Wallen this week, sharing some thoughts on the future of Linux — and on open source in general: Matthew Miller: I think it's a lost cause to try to "sell" our quirky technology interest to people who don't see it already. We need to take a different approach.... I think our message, at its root, has to be around open source.... [W]ith Linux, when you install an open-source distro, you're not just part of a fan community. You're part of a colossal, global effort that makes software more available to everyone, makes that software better and better, and makes the whole world better through sharing... Just by using it you're sharing in this amazing undertaking, part of a move away from scarcity to an economy based on abundance.... Jack Wallen: What's the biggest difference in Linux today vs. Linux of 10 years ago? Matthew Miller: I think first we have to start with just the amazing ubiquity of it. Ten years ago, it was cute to find a TV that ran Linux. Now, not only is it definitely powering your TV, you've probably got Linux running on your lightbulbs! It's everywhere. And while Linux had pushed proprietary Unix from the server room, ten years ago Windows-based servers were pushing back. The cloud changed that — now, the cloud is Linux, almost completely. (Anything that isn't is a legacy app that it was too much trouble to port!) From tiny devices to the most powerful mainframes and supercomputers: Linux, Linux, Linux.... Jack Wallen: If Linux has an Achilles' heel, what is it? Matthew Miller: Linux and the whole free and open-source software movement grew up with the rise of the internet as an open communication platform. We absolutely need that to continue in order to realize our vision, and I don't think we can take it for granted. That's more general than an Achilles' heel, though, so right now let me highlight one thing that I think is troubling: Chrome becoming the dominant browser to the point where it's often the only way to make sites work. Chromium (the associated upstream project) is open source, but isn't really run as a community project, and, pointedly, very very few people run Chromium itself. I'd love to see that change, but I'd also like to see Firefox regain a meaningful presence. Miller also said Fedora's next release is focused on simplicity. ("When the OS gets in the way, it drops from the conversation I want to have about big ideas to ... well, the boring technical details that people never want to deal with") And he also shared his thoughts on what Linux needs most. "What I'd really like to see more of are more non-technical contributors. I mean, yes, we can always benefit from more packagers and coders and engineers, but I think what we really need desperately are writers, designers, artists, videographers, communicators, organizers and planners. I don't think big companies are likely to provide those things, at least, not for the parts of the Linux world which aren't their products." "We need people who think the whole grand project I've been talking about is important, and who have the skills and interests to help make it real."' -- source: https://linux.slashdot.org/story/22/05/01/014252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

30,000 New Users Signed Up For Mastodon After Elon Musk Bought Twitter
by Peter Reutemann 29 Apr '22

29 Apr '22

'Motherboard: Social media platform Mastodon, often seen as an alternative to Twitter, gained nearly 30,000 new users on the day that Elon Musk bought Twitter. On Tuesday a Mastodon domain became unresponsive. Eugen Rochko, Mastodon's CEO, later told Motherboard in an email that there were performance issues. "I'm sorry I couldn't have responded sooner," he wrote. "I was working all day on fixing performance issues on the Mastodon servers I operate due to the influx of new and returning users following Twitter's acquisition by Elon Musk." Rochko added that Mastodon has seen an increase of 41,287 active users, including both returning users and new users. When breaking that figure down by just new users, 28,391 new people have joined Mastodon in the past day, Rochko said. Mastodon is a piece of open-source software that people can use as a base to create their own social networks. Although its appearance is similar to Twitter, it also differs from Twitter in the sense that Twitter is a single social network people sign up for. When it comes to the social network side of things, Mastodon holds more similarities with Discord, in that users have to find specific Mastodon instances to join. Those looking to create their own Mastodon instance also have to host it themselves, a step that may alienate many non-technical users. Donald Trump's social media site, Truth Social, is based on Mastodon and was recently called out by the company for failing to provide the source code for the site built on top of it. Two weeks later, the social media site quietly acknowledged Mastodon in a dedicated section labeled "open source." In regard to the matter, Mastodon founder Eugen Rochko said: "Compliance with our AGPLv3 license is very important to me as that is the sole basis upon which I and other developers are willing to give away years of work for free." Twitter did confirm some fluctuations in follower counts after Musk's deal was made official, although they said they were organic in nature.' -- source: https://news.slashdot.org/story/22/04/27/2141231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

One of the most powerful DDoSes ever targets cryptocurrency platform
by Peter Reutemann 29 Apr '22

29 Apr '22

'A cryptocurrency platform was recently on the receiving end of one of the biggest distributed denial-of-service attacks ever after threat actors bombarded it with 15.3 million requests, content delivery network Cloudflare said. DDoS attacks can be measured in several ways, including by the volume of data, the number of packets, or the number of requests sent each second. The current records are 3.4 terabits per second for volumetric DDoSes—which attempt to consume all bandwidth available to the target—and 809 million packets per second, and 17.2 million requests per second. The latter two records measure the power of application-layer attacks, which attempt to exhaust the computing resources of a target’s infrastructure. Cloudflare's recent DDoS mitigation peaked at 15.3 million requests per second. While still smaller than the record, its power was more considerable because the attack was delivered through HTTPS requests rather than HTTP requests used in the record. Because HTTPS requests are much more compute-intensive than HTTP requests, the latest attack had the potential to put much more strain on the target.' -- source: https://arstechnica.com/information-technology/2022/04/one-of-the-most-powe… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fwd: New Zealand Cyber Security Challenge 2022
by Peter Reutemann 29 Apr '22

29 Apr '22

Considering our cyber security theme from this week, some of you might want to participate in the (free) challenge outlined below. Cheers, Peter ---------- Forwarded message --------- From: Buddhika Subasinghe <buddhika.subasinghe(a)waikato.ac.nz> Date: Fri, Apr 29, 2022 at 10:28 AM Subject: New Zealand Cyber Security Challenge 2022 To: Computing Staff: CS & SE <computing-staff(a)waikato.ac.nz>, Mathematics Staff <maths-staff(a)waikato.ac.nz>, Design staff: NZ <design-nz(a)waikato.ac.nz > Hi all FYI Please see the message below from Harpreet re the NZ Cyber Security Challenge 2022. Please contact Vimal vimal.kumar(a)waikato.ac.nz ro Harpreet harpreet.kaur(a)waikato.ac.nz if you need any further information about this event. Many thanks! Buddhika On Fri, Apr 29, 2022 at 9:26 AM Harpreet Kaur <harpreet.kaur(a)waikato.ac.nz> wrote: > Dear Buddhika, > > This is the email we want to regulate in the cs list. Much appreciated > your help! > > > *Hi All,* > *Cyber Security Researchers of Waikato (CROW) team is organising the NZ > Cyber Security Challenge again this year. Could you please distribute this > email invitation to your students?* > > ------------------------------------------------------------------------------------------ > *New Zealand Cyber Security Challenge 2022* > > The NZ Cyber Security Challenge is back for its 9th edition. Participation > is free and as always there are a number of prizes to be won. > > We invite anyone interested in cybersecurity to join and take part in the > challenge. The challenge will start with an online CTF round (Round 0). We > will then invite the top 150 participants to the University of Waikato > campus for the main competition involving Rounds 1,2, a networking lunch, > cybersecurity talks and a side challenge. > > The schedule of the NZCSC’22 is as follows: > > - > > 04 June - 22 June: > - > > Online Round 0: open for everyone > > > - > > 15 June - 22 June: > - > > Online Waikato x Cardiff Challenge (special round for Waikato and > Cardiff University Students) > - > > 22-23 July : > - > > Round 1 - Incident Response round > - > > Round 2 - Capture the Flag > - > > Side Challenge > - > > Networking lunch and talks from the industry > > Feel free to contact me (vimal.kumar(a)waikato.ac.nz) or Harpreet Kaur ( > harpreet.kaur(a)waikato.ac.nz) if you have any questions. More information > and the Registration of Interest link can be found on the event website. > > https://cybersecuritychallenge.org.nz/ > > > We look forward to hosting you at the event! > > > > -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

PFSense - additional info
by Roger Hardy 27 Apr '22

27 Apr '22

Hi all. These are the manuals for the small boards we use to run remote installs. https://pcengines.ch/pdf/apu4.pdf Better details here https://www.pcengines.ch/apu4c4.htm You can even download the schematics there. Price lists here https://www.pcengines.ch/order.htm As I said, these are cheaper than the netgate ones, that can be seen at https://www.netgate.com/appliances The "manual" for PFSense is here https://docs.netgate.com/pfsense/en/latest/ And just for giggles, I checked their (netgate) support prices. Not too bad for a business. https://www.netgate.com/support And they have a pretty interesting service called "Zero to Ping" where "they will help get your Netgate appliance connected to the Internet and one client on the same network online." Feel free to ask any questions, about either PFSense or the APU devices. Roger

1 0

Concerns Raised Over The 'New' NTFS Linux Driver That Merged Last Year
by Peter Reutemann 27 Apr '22

27 Apr '22

'In 2020, Paragon Software announced they wanted to upstream their previously proprietary NTFS driver into Linux. After a year of review, the NTFS3 driver was added to the Linux 5.15 kernel. While Paragon pledged to maintain their driver, there have been no major updates to the driver despite a growing list of patches that have submitted. Developer Kari Argillander has raised his concerns on the mailing list that the driver is orphaned, and that the Paragon maintainer has not responded to any messages about fixes. An offer to co-maintain the driver has also been met with "radio silence".' -- source: https://linux.slashdot.org/story/22/04/26/1749239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New OpenSSH Version On Debian Unstable
by Lawrence D'Oliveiro 24 Apr '22

24 Apr '22

Did my periodic OS upgrade today, and one change that has had an (easy to fix) impact on my backup system is that OpenSSH 9.0 is phasing out the special protocol that was used to implement the scp command, in favour of using the same one as for sftp. One difference this makes is with file specs that contain shell-special characters (e.g. spaces). Previously, when specifying such to the scp command in the shell, you had to do two levels of escaping, one to get them past the local shell, and another to work with the remote shell. But now, the second level of escaping for the remote end is no longer needed. The release notes describe this second level of quoting as “finicky and brittle”, so all in all things are simpler without it.

1 1

Major cryptography blunder in Java enables “psychic paper” forgeries
by Peter Reutemann 22 Apr '22

22 Apr '22

'Organizations using newer versions of Oracle’s Java framework woke up on Wednesday to a disquieting advisory: A critical vulnerability can make it easy for adversaries to forge TLS certificates and signatures, two-factor authentication messages, and authorization credentials generated by a range of widely used open standards. The vulnerability, which Oracle patched on Tuesday, affects the company’s implementation of the Elliptic Curve Digital Signature Algorithm in Java versions 15 and above. ECDSA is an algorithm that uses the principles of elliptic curve cryptography to authenticate messages digitally. A key advantage of ECDSA is the smaller size of the keys it generates, compared to RSA or other crypto algorithms, making it ideal for use in standards including FIDO-based 2FA, the Security Assertion Markup Language, OpenID, and JSON.' -- source: https://arstechnica.com/information-technology/2022/04/major-crypto-blunder… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Critical bug could have let hackers commandeer millions of Android devices
by Peter Reutemann 22 Apr '22

22 Apr '22

'Security researchers said they uncovered a vulnerability that could have allowed hackers to commandeer millions of Android devices equipped with mobile chipsets made by Qualcomm and MediaTek. The vulnerability resided in ALAC—short for Apple Lossless Audio Codec and also known as Apple Lossless—which is an audio format introduced by Apple in 2004 to deliver lossless audio over the Internet. While Apple has updated its proprietary version of the decoder to fix security vulnerabilities over the years, an open-source version used by Qualcomm and MediaTek had not been updated since 2011. Together, Qualcomm and MediaTek supply mobile chipsets for an estimated 95 percent of US Android devices.' The buggy ALAC code contained an out-of-bounds vulnerability, meaning it retrieved data from outside the limits of allocated memory. Hackers could exploit this mistake to force the decoder to execute malicious code that otherwise would be off-limits. “The ALAC issues our researchers found could be used by an attacker for remote code execution attack (RCE) on a mobile device through a malformed audio file,” security firm Check Point said on Thursday. “RCE attacks allow an attacker to remotely execute malicious code on a computer. The impact of an RCE vulnerability can range from malware execution to an attacker gaining control over a user’s multimedia data, including streaming from a compromised machine’s camera.” -- source: https://arstechnica.com/information-technology/2022/04/critical-bug-could-h… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Canonical Now Hopes To IPO in 2023
by Peter Reutemann 22 Apr '22

22 Apr '22

'The saga of Ubuntu-maker Canonical's IPO efforts now stretches back quite a few years. I think the first time I talked to the company's founder Mark Shuttleworth about going public was in 2018, though there had already been some chatter about it in previous years. But the timing never quite worked out for Canonical. In a press briefing ahead of today's launch of Ubuntu 22.04 LTS, Shuttleworth noted he now expects it to go public next year. "We are on track to float the business. And now I'm pretty confident that we will do that in 2023," said Shuttleworth, who was calling in from an undisclosed island off the coast of West Africa. "And so we're taking active steps at the board level and in our finance operation -- various other parts of the business -- to be prepared for that. We're now effectively on a very clear program to a flotation of the business next year." He stressed that Canonical is not in a situation where it has to raise outside money and that going public for him is not about fundraising. He noted that Canonical's revenue last year was $175 million and that the company's biggest challenge right now is that demand is bigger that the company's ability to service it, in large part because there isn't enough talent on the market for the company to hire.' -- source: https://news.slashdot.org/story/22/04/21/1333228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Volla Phone 22 Runs Ubuntu Touch Or a Privacy-Focused Android Fork Or Both
by Peter Reutemann 20 Apr '22

20 Apr '22

'The Volla Phone 22, a new smartphone available for preorder via a Kickstarter campaign, is unlike any other smartphone on the market today in that it ships with a choice of the Android-based Volla OS or the Ubuntu Touch mobile Linux distribution. "It also supports multi-boot functionality, allowing you to install more than one operating system and choose which to run at startup," writes Liliputing's Brad Linder. Some of the hardware specs include a 6.3-inch FHD+ display, a MediaTek Helio G85 processor, 4GB of RAM, 128GB storage, 3.5mm audio jack and a microSD card reader. There's also a 48-megapixel main camera sensor and replaceable 4,500mAh battery. From the report: While Volla works with the folks at UBPorts to ensure its phones are compatible with Ubuntu Touch, the company develops the Android-based Volla OS in-house. It's based on Google's Android Open Source Project code, but includes a custom launcher, user interface, and set of apps with an emphasis on privacy. The Google Play Store is not included, as this is a phone aimed at folks who want to minimize tracking from big tech companies. Other Google apps and services like the Chrome web browser, Google Maps, Google Drive, and Gmail are also omitted. The upshot is that no user data is collected or stored by Volla, Google, or other companies unless you decide to install apps that track your data. Of course, that could make using the phone a little less convenient if you've come to rely on those apps, so the Volla Phone might not be the best choice for everyone. Volla OS also has a built-in user-customizable firewall, an App Locker feature for disabling and hiding apps, and optional support for using the Hide.me VPN for anonymous internet usage. The source code for Volla OS is also available for anyone that wants to inspect the code. The operating system also has a custom user interface including a Springboard that allows you to quickly launch frequently-used apps by pressing a red dot for a list, or by starting to type in a search box for automatic suggestions such as placing a phone call, sending a text message, or opening a web page. You can also create notes or calendar events from the Springboard or send an encrypted message with Signal. The phone is expected to ship in June at an early bird price of about $408.' -- source: https://news.slashdot.org/story/22/04/19/2131242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers can infect >100 Lenovo models with unremovable malware. Are you patched?
by Peter Reutemann 20 Apr '22

20 Apr '22

'Lenovo has released security updates for more than 100 laptop models to fix critical vulnerabilities that make it possible for advanced hackers to surreptitiously install malicious firmware that can be next to impossible to remove or, in some cases, to detect. Three vulnerabilities affecting more than 1 million laptops can give hackers the ability to modify a computer’s UEFI. Short for Unified Extensible Firmware Interface, the UEFI is the software that bridges a computer’s device firmware with its operating system. As the first piece of software to run when virtually any modern machine is turned on, it’s the initial link in the security chain. Because the UEFI resides in a flash chip on the motherboard, infections are difficult to detect and even harder to remove. Two of the vulnerabilities—tracked as CVE-2021-3971 and CVE-2021-3972—reside in UEFI firmware drivers intended for use only during the manufacturing process of Lenovo consumer notebooks. Lenovo engineers inadvertently included the drivers in the production BIOS images without being properly deactivated. Hackers can exploit these buggy drivers to disable protections, including UEFI secure boot, BIOS control register bits, and protected range register, which are baked into the serial peripheral interface (SPI) and designed to prevent unauthorized changes to the firmware it runs.' -- source: https://arstechnica.com/information-technology/2022/04/bugs-in-100-lenovo-m… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Tuesday (!)
by Peter Reutemann 20 Apr '22

20 Apr '22

Hi everyone We have a meeting next week on Tuesday, due to ANZAC day on Monday. Since we are back under Orange traffic light, we will attempt a hybrid meeting. Whilst the physical meeting will take place in MS4, everything will be transmitted via BigBlueButton. That way you won't miss out n case you can't or don't want to attend in person. Our topic: With increasing cyber security threats, it is high time that we look at how you can bolster the security of your Linux system and how you connect to the outside world. For this purpose, we will have short show and tells lined up: Roger will demo the pfSense firewall and router system based on FreeBSD, complete with a web-based user interface. A far simpler firewall, ufw (uncomplicated firewall), will be introduced by Peter (command-line and GUI). Angus will demo Wireguard, the VPN solutation that made it into the Linux kernel (starting with 5.6). Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/283776633/ If you want to demo something as well, then please contact me. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Details How China-Linked Crew’s Malware Hides Scheduled Windows Tasks
by Lawrence D'Oliveiro 18 Apr '22

18 Apr '22

Seems every week there is something new to learn about the (in)security of Microsoft Windows. In this description <https://www.theregister.com/2022/04/14/microsoft-tarrask-malware-in-windows/> of a malware attack, the software infection creates a scheduled task to automatically reinstall itself if it has been removed. So far, no big deal: on *nix we have cron, and systemd timers, that do much the same thing. But on Windows, these scheduled tasks have “security descriptors” -- basically, ACLs, as far as I have been able to determine, that control who can manage these tasks or even see them. So if a program creates a task and deletes all its security descriptors, the task effectively becomes invisible to the normal Windows admin tools. Except, it can still be seen and managed through its Registry entries. So, having write access to the Registry lets you bypass the entire security-descriptor mechanism, yet it still does not let you see these tasks in any other way? Like the “security” those higher-level tools think they are enforcing is a complete mirage, and end up making the system, not more, but less, secure.

1 0

Git For Windows Issues Update To Fix Running-Someone-Else's-Code Vulnerability
by Peter Reutemann 14 Apr '22

14 Apr '22

'The Git team has issued an update to fix a bug in Git for Windows that "affects multi-user hardware where untrusted parties have write access to the same hard disk," reports The Register. Specifically, the update is concerned with CVE-2022-24765. From the report: Arguably, if an "untrusted party" has write access to a hard disk, then all bets are off when it comes to the nooks and crannies of a PC anyway. In this case, the miscreants would only need to create the folder c:\.git, "which would be picked up by Git operations run supposedly outside a repository while searching for a Git directory," according to NIST. The result is that Git would use the config in the directory. NIST went on to list potentially vulnerable products, which included Visual Studio. "Users of the Microsoft fork of Git are vulnerable simply by starting a Git Bash." The Git team was little blunter about the vulnerability, and warned that "Merely having a Git-aware prompt that runs 'git status' (or 'git diff') and navigating to a directory which is supposedly not a Git worktree, or opening such a directory in an editor or IDE such as VS Code or Atom, will potentially run commands defined by that other user." [...] To deal with the issue, the Git team recommends an update. Alternatively, a user could create that .git folder themselves and remove read/write access as workaround or "define or extend 'GIT_CEILING_DIRECTORIES' to cover the parent directory of the user profile," according to NIST. ' -- source: https://it.slashdot.org/story/22/04/13/2140258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Tim Cook Invokes Eisenhower
by Lawrence D'Oliveiro 13 Apr '22

13 Apr '22

Apple’s CEO gave a speech at a gathering of the International Association of Privacy Professionals <https://arstechnica.com/gadgets/2022/04/tim-cook-delivers-speech-railing-ag…>, where he claimed that Apple has “a commitment to protecting people from a data industrial complex built on a foundation of surveillance”. He particularly hates regulatory proposals to force Apple and other platform owners to allow sideloading of apps, claiming That means data-hungry companies would be able to avoid our privacy rules, and once again track our users against their will. In other words, we should trust companies like his to keep their word, and not fall back on Big Bad Government Regulation. If it weren’t for Governments, the world would end up run by corporations. Which would you prefer?

1 0

Trend says hackers have weaponized SpringShell to install Mirai malware
by Peter Reutemann 12 Apr '22

12 Apr '22

'Researchers on Friday said that hackers are exploiting the recently discovered SpringShell vulnerability to successfully infect vulnerable Internet of Things devices with Mirai, an open source piece of malware that wrangles routers and other network-connected devices into sprawling botnets. The Internet’s biggest players are all affected by critical Log4Shell 0-day When SpringShell (also known as Spring4Shell) came to light last Sunday, some reports compared it to Log4Shell, the critical zero-day vulnerability in the popular logging utility Log4J that affected a sizable portion of apps on the Internet. That comparison proved to be exaggerated because the configurations required for SpringShell to work were by no means common. To date, there are no real-world apps known to be vulnerable. Researchers at Trend Micro now say that hackers have developed a weaponized exploit that successfully installs Mirai. A blog post they published didn’t identify the type of device or the CPU used in the infected devices. The post did, however, say a malware file server they found stored multiple variants of the malware for different CPU architectures.' -- source: https://arstechnica.com/information-technology/2022/04/trend-says-hackers-h… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox downloads PDF files to home directory when viewing
by Peter Reutemann 12 Apr '22

12 Apr '22

Hi everyone One annoying new feature that showed up in Firefox recently is that it downloads PDF files to my home directory rather then /tmp when I'm only viewing them. The following thread discusses this: https://support.mozilla.org/en-US/questions/1370409 All you have to do is go to the configuration ("about:config" in URL bar) and change the following option to "false: browser.download.improvements_to_download_panel Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The End Of Byte Magazine
by Lawrence D'Oliveiro 12 Apr '22

12 Apr '22

I’ve been browsing through a few more of those old issues of Byte magazine, up to its shutdown in 1998. In the final, July, issue, among the items promised as “coming up in August”, was a “software lab report” on “free Unixes”: “We test Linux and FreeBSD to see how they measure up against their commercial cousins as servers and development platforms”. Presumably as per the typical magazine publishing pipeline, that report had already been done and written up by that point; I wonder if it ever got published anywhere ... Linux had been getting a few small mentions in the prior issues, along with other free software such as Perl for website development. Though the writers kept referring to these as “freeware” ... Also in that issue was a mention of an unusual new PC design, called the “Rock City”, from a company called the Panda Project. It was the shape of a cube, balanced on one corner (where the stand was attached). Hunting around, I found a short item, with one small, intriguing-looking picture, here <https://www.fatsofa.com/rockcity.html>. The actual company website is of course long gone; I tried looking for copies at archive.org, but while the text of the website back to 1998 is there, the pictures are not.

2 1

Raspberry Pi OS Ditches Longtime User Account For Security Reasons
by Peter Reutemann 09 Apr '22

09 Apr '22

'Ars Technica: Since its launch, the Raspberry Pi OS (and most operating systems based on it) has shipped with a default "pi" user account, making it simpler to boot up a Pi and start working without needing to hook up the device to a monitor or go through a multi-step setup process. But as of today, that's changing -- new installs of the Raspberry Pi OS are shedding that default user account for both security and regulatory reasons. Raspberry Pi Foundation software engineer Simon Long explains the thinking in this blog post. "[The "pi" user account] could potentially make a brute-force attack slightly easier, and in response to this, some countries are now introducing legislation to forbid any Internet-connected device from having default login credentials," he writes. This move will improve the Pi operating system's security. Before, even if you assigned a good password to the "pi" account, attackers could still assume with a reasonable degree of certainty that most Raspberry Pi boards were using the "pi" username. Many Pi OS-based operating systems also ship with the default "pi" user account enabled and are completely passwordless, requiring extra steps to assign the account a password in the first place. The flip side is that the change could break some software and scripts, particularly those that are hard-coded to use the "pi" user account and home folder. "[T]he Raspberry Pi OS now boots into a dedicated setup mode the first time you start it up instead of running the setup wizard as an app in the normal desktop environment," adds Ars. "And that setup wizard now prompts you to create a username and password rather than simply assigning a password to the default 'pi' user account. To aid with setup, the wizard can now pair Bluetooth keyboards and mice without requiring you to plug in a USB accessory first." The new version of the Pi OS also includes experimental support for the Wayland display server protocol, but Long says most people should ignore it for now since it's explicitly labeled as "experimental."' -- source: https://hardware.slashdot.org/story/22/04/08/2032252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fedora Plans To Drop Support For Legacy BIOS Systems
by Peter Reutemann 08 Apr '22

08 Apr '22

'The Fedora 37 development team is considering dropping support for non-UEFI BIOS. Linuxiac reports: The Unified Extensible Firmware Interface, or UEFI, is a modern method of handling the boot process. UEFI is similar to Legacy; however, the boot data is stored in a .efi file rather than the firmware. In the case of Fedora, while the change may take some time, the new Fedora x86_64 installations will no longer work on non-UEFI platforms. On x86_64 architectures, Fedora 37 will mark legacy BIOS installation as deprecated in favor of UEFI. While systems already using Legacy BIOS to boot will continue to be supported, new Legacy BIOS installations on these architectures will be impossible. ' -- source: https://linux.slashdot.org/story/22/04/07/2049257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chinese Hackers Abuse VLC Media Player To Launch Malware Loader
by Peter Reutemann 08 Apr '22

08 Apr '22

'Security researchers have uncovered a long-running malicious campaign from hackers associated with the Chinese government who are using VLC Media Player to launch a custom malware loader. BleepingComputer reports: The campaign appears to serve espionage purposes and has targeted various entities involved in government, legal, and religious activities, as well as non-governmental organizations (NGOs) on at least three continents. This activity has been attributed to a threat actor tracked as Cicada (a.k.a. menuPass, Stone Panda, Potassium, APT10, Red Apollo) that has been active for more than 15 years, since at least 2006. Brigid O Gorman of Symantec Threat Hunter Team told BleepingComputer that the attacker uses a clean version of VLC with a malicious DLL file in the same path as the media player's export functions. The technique is known as DLL side-loading and it is widely used by threat actors to load malware into legitimate processes to hide the malicious activity. Apart from the custom loader, which O Gorman said Symantec does not have a name but has been seen in previous attacks attributed to Cicada/APT10, the adversary also deployed a WinVNC server to gain remote control over victim systems. The attacker also executed the Sodamaster backdoor on compromised networks, a tool believed to be used exclusively by the Cicada threat group since at least 2020. Sodamaster runs in the system memory (fileless) and is equipped to evade detection by looking in the registry for clues of a sandbox environment or by delaying its execution. The malware can also collect details about the system, search for running processes, and download and execute various payloads from the command and control server. [...] The attackers' dwell time on the networks of some of the discovered victims lasted for as long as nine months, the researchers note in a report today. ' -- source: https://it.slashdot.org/story/22/04/06/2144218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

disable "Pocket" in Firefox
by Peter Reutemann 08 Apr '22

08 Apr '22

Hi everyone If you find that "Pocket" in Firefox is getting in your way or you simply don't want to use it, just do the following to disable it: - in the URL bar, type about:config (and click on "show all") - and toggle "extensions.pocket.enabled" to "false" >From here: https://support.mozilla.org/en-US/kb/disable-or-re-enable-pocket-for-firefox Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Zyxel patches critical vulnerability that can allow Firewall and VPN hijacks
by Peter Reutemann 05 Apr '22

05 Apr '22

'Hardware manufacturer Zyxel has issued patches for a highly critical security flaw that gives malicious hackers the ability to take control of a wide range of firewalls and VPN products the company sells to businesses. The flaw is an authentication bypass vulnerability that stems from a lack of a proper access-control mechanism in the CGI (common gateway interface) of affected devices, the company said. Access control refers to a set of policies that rely on passwords and other forms of authentication to ensure resources or data are available only to authorized people. The vulnerability is tracked as CVE-2022-0342. “The flaw could allow an attacker to bypass the authentication and obtain administrative access of the device,” Zyxel said in an advisory. The severity rating is 9.8 out of a possible 10.' -- source: https://arstechnica.com/information-technology/2022/04/zyxel-patches-critic… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Infinite Mac' Project Lets You Boot Up Mac OS In Your Browser
by Peter Reutemann 03 Apr '22

03 Apr '22

'Ars Technica: What makes the ["Infinite Mac"] project unique isn't necessarily the fact that it's browser-based; it has been possible to run old DOS, Windows, and Mac OS versions in browser windows for quite a while now. Instead, it's the creative solutions that developer Mihai Parparita has come up with to enable persistent storage, fast download speeds, reduced processor usage, and file transfers between the classic Mac and whatever host system you're running it on. Parparita details some of his work in this blog post. Beginning with a late 2017 browser-based port of the Basilisk II emulator, Parparita wanted to install old apps to more faithfully re-create the experience of using an old Mac, but he wanted to do it without requiring huge downloads or running as a separate program as the Macintosh.js project does. To solve the download problem, Parparita compressed the disk image and broke it up into 256K chunks that are downloaded on demand rather than up front. "Along with some old fashioned web optimizations, this makes the emulator show the Mac's boot screen in a second and be fully booted in 3 seconds, even with a cold HTTP cache," Parparita wrote. CPU usage was another issue. Old operating systems and processors didn't really distinguish between active and idle processor states -- your computer was either on or off. So when you emulate these old systems, they'll ramp one of your CPU cores to 100% whether you're actually using the emulator or not. Parparita used existing Basilisk II features to reduce CPU usage, only requiring full performance when "there was user input or a screen refresh was required." Infinite Mac won't run later releases of classic Mac OS (including 8.5, 8.6, and 9) because those releases ran exclusively on PowerPC Macs, dropping support for the old Motorola 68000-based processors. Emulators like QEMU are capable of emulating PowerPC Macs, but (at least as far as I am aware) there are no easy browser-based implementations that exist. Not yet, anyway.' -- source: https://apple.slashdot.org/story/22/04/01/2032251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

StarFive VisionFive RISC-V Single Board Computer
by Lawrence D'Oliveiro 29 Mar '22

29 Mar '22

A few videos have appeared on YouTube in the last few days about this VisionFive board. Instead of an ARM chip, it uses a RISC-V CPU, but of course it runs Linux. It’s quite clearly gunning for the Raspberry π market, both in its configuration and pricewise, though I don’t think it’s as powerful as a π 4. StarFive Technology have a few quite technical-looking videos on their channel, seemingly going into details like how the OS boots. I’ll see if I can find a decent hands-on review.

1 0

Mozilla To Offer MDN Premium Tier
by Lawrence D'Oliveiro 28 Mar '22

28 Mar '22

The Mozilla Developer Network <https://developer.mozilla.org/en-US/docs/Web> is a really good resource if you’re doing any kind of web development. I’ve found all kinds of well-explained technical detail there that is simply missing from other sources (*cough* w3schools *cough*). Now Mozilla is trying to get some money from it. They’re not taking anything away from existing access, they are merely offering extra personalization features on a paid basis <https://www.theregister.com/2022/03/24/mozillas_mdn_subscription/>.

1 0

'Rolling Rhino' Tool Converts Ubuntu Into a Rolling Release
by Peter Reutemann 28 Mar '22

28 Mar '22

'"Rolling Rhino is a tool long ago created by Martin Wimpress, who until recently was part of the Canonical team," one Linux blog pointed out recently. "What it does is basically change the repositories of the DailyLive developers...." Neowin sees it as a competitive advantage. After more than 17 years, there's a way to get a Ubuntu distro offering the same "rolling" release cycles that helped popularize Arch Linux: While there are many positive qualities that would draw a user into the world of Arch, its headlining feature would be the one that remains the most relevant in today's world of continuous integration and delivery and that's its rolling release strategy. While I don't think Judd Vinet could have predicted the proliferation of DevOps or the massive shift to cloud computing, it must be interesting to see that the entire industry is following the Arch strategy in all sorts of different places. One could even argue that Microsoft Windows has become a rolling release. While many of Arch's contemporaries have joined the fray, one notable open-source giant has yet to make the leap. Rolling Rhino looks to change that by converting Ubuntu into a rolling release.' -- source: https://news.slashdot.org/story/22/03/27/0035232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

KDE's New Swipe Gesture Makes Windows 11 Look Bad
by Peter Reutemann 28 Mar '22

28 Mar '22

'"Microsoft has been struggling to reach a state of convergence between tablet and desktop ever since Windows 8 and the original Surface," argues Neowin, adding "If we're using Windows 11 as a barometer of their progress, they'll likely never get there...." But meanwhile, writes Slashdot reader segaboy81, "KDE's new swipe gesture is awesome. It's about 1000% smoother than the overview in Windows 11 and the swiping mechanism is easier, too. Is KDE getting better for tablets?" >From Neowin's report: Starting in KDE Plasma 5.25, users with touch screen devices will be able to enter their tasks and virtual desktops overview by simply swiping down from the top edge, but with a special twist. The scale of the windows directly follows the path of your finger. The result is every bit as fluid as you might imagine. While you can achieve the same result in Windows 11 with a simple three-finger swipe up, this implementation looks great and performs great too.' -- source: https://tech.slashdot.org/story/22/03/27/201245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Asahi Linux Is Reverse-Engineering Support For Apple Silicon, Including M1 Ultra
by Peter Reutemann 27 Mar '22

27 Mar '22

'Ars Technica: For months, a small group of volunteers has worked to get this Arch Linux-based distribution up and running on Apple Silicon Macs, adapting existing drivers and (in the case of the GPU) painstakingly writing their own. And that work is paying off -- last week, the team released its first alpha installer to the general public, and as of yesterday, the software supports the new M1 Ultra in the Mac Studio. In the current alpha, an impressive list of hardware already works, including Wi-Fi, USB 2.0 over the Thunderbolt ports (USB 3.0 only works on Macs with USB-A ports, but USB 3.0 over Thunderbolt is "coming soon"), and the built-in display. But there are still big features missing, including DisplayPort and Thunderbolt, the webcam, Bluetooth, sleep mode, and GPU acceleration. That said, regarding GPU acceleration, the developers say that the M1 is fast enough that a software-rendered Linux desktop feels faster on the M1 than a GPU-accelerated desktop feels on many other ARM chips. Asahi's developers don't think the software will be "done," with all basic M1-series hardware and functionality supported and working out of the box, "for another year, maybe two." By then, Apple will probably have introduced another generation or two of M-series chips. But the developers are optimistic that much of the work they're doing now will continue to work on future generations of Apple hardware with relatively minimal effort. [...] If you want to try Asahi Linux on an M1 Mac, the current installer is run from the command line and requires "at least 53GB of free space" for an install with a KDE Plasma desktop. Asahi only needs about 15GB, but the installer requires you to leave at least 38GB of free space to the macOS install so that macOS system updates don't break. From there, dual-booting should work similarly to the process on Intel Macs, with the alternate OS visible from within Startup Disk or the boot picker you can launch when your start your Mac. Future updates should be installable from within your new Asahi Linux installation and shouldn't require you to reinstall from scratch.' -- source: https://linux.slashdot.org/story/22/03/25/2333245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ted Nelson Quote From 1995
by Lawrence D'Oliveiro 26 Mar '22

26 Mar '22

I was prompted to browse through old scanned issues of “Byte” magazine (available from vintageapple.org) after watching a YouTube video by a guy who has collected a complete set of actual paper issues <https://www.youtube.com/watch?v=0lU537upx3c>. In the November 1995 issue, there was a back-page column by Ted Nelson (originator of the terms “hypertext” and “hypermedia”) called “Things To Come”, where he casually threw out a bunch of prognostications on how he thought computing would develop. I was struck by this quote, under the title “Tomorrow’s killer applications”: My hope is that there will be no more applications, because future software will be set up to be tied together, piped together, scripted together. I would say that has partially come true. We have a lot of software components now that can be reused via scriptable APIs, or even just shell scripts. However, nobody considered that such usage is the anithesis of how GUIs work. Most of the predictions in the rest of the column were, shall we say, a bit wide of the mark. For example, the next sentence after the above was “The real killer applications will be nanotech bugs that escape”, which is perhaps best left to just lie there quietly ...

1 0

topic for next wlug meeting?
by Peter Reutemann 25 Mar '22

25 Mar '22

Hi everyone At this stage, we don't have a speaker lined up for this month's virtual meeting (we're still at the Red traffic light). With the current world situation and increasing cyber security threats, I was wondering whether we should have a meeting where we discuss together (and showcase) various tools that we can run or use to make our online life safer. A non-exhaustive list: firewalls, virus scanners, rootkit detectors, VPNs. Thoughts? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Two Years After Chrome and Edge, Firefox is Getting AV1 Hardware Acceleration
by Peter Reutemann 24 Mar '22

24 Mar '22

'Firefox is finally gaining proper AV1 support. Neowin reports: According to an update made to a post on Bugzilla, the Mozilla Foundation is finally ready to add hardware acceleration for the AV1 video format. Developers plan to implement improved AV1 support in the upcoming release of Firefox 100, scheduled to arrive on May 3, 2022. Hardware acceleration for AV1 video brings several noticeable benefits to customers. The standard developed by Alliance for Open Media and initially released in March 2018 offers better video compression than H.264 (about 50%) and VP9 (about 20%). Shifting AV1 video processing from software to hardware improves efficiency and reduces energy consumption, resulting in better battery life on tablets and laptops. Google and Microsoft announced hardware-accelerated AV1 video in Chrome and Edge in late 2020. Mozilla, on the other hand, did not rush to introduce improved AV1 support in Firefox. While it is easy to dunk on Firefox, there is a reason why developers took their time. Hardware-accelerated AV1 video is not something you can add to any computer with Windows 10, and it requires a PC with the most recent and powerful hardware.' -- source: https://news.slashdot.org/story/22/03/23/1359219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android's Messages, Dialer Apps Quietly Sent Text, Call Info To Google
by Peter Reutemann 23 Mar '22

23 Mar '22

'Google's Messages and Dialer apps for Android devices have been collecting and sending data to Google without specific notice and consent, and without offering the opportunity to opt-out, potentially in violation of Europe's data protection law. From a report: According to a research paper, "What Data Do The Google Dialer and Messages Apps On Android Send to Google?" [PDF], by Trinity College Dublin computer science professor Douglas Leith, Google Messages (for text messaging) and Google Dialer (for phone calls) have been sending data about user communications to the Google Play Services Clearcut logger service and to Google's Firebase Analytics service. "The data sent by Google Messages includes a hash of the message text, allowing linking of sender and receiver in a message exchange," the paper says. "The data sent by Google Dialer includes the call time and duration, again allowing linking of the two handsets engaged in a phone call. Phone numbers are also sent to Google." The timing and duration of other user interactions with these apps has also been transmitted to Google. And Google offers no way to opt-out of this data collection. [...] Both pre-installed versions of these apps, the paper observes, lack app-specific privacy policies that explain what data gets collected -- something Google requires from third-party developers. And when a request was made through Google Takeout for the Google Account data associated with the apps used for testing, the data Google provided did not include the telemetry data observed.' -- source: https://yro.slashdot.org/story/22/03/22/2146234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Random Number Generator Sees Major Improvements
by Peter Reutemann 22 Mar '22

22 Mar '22

'An anonymous Slashdot reader summarizes some important news from the web page of Jason Donenfeld (creator of the open-source VPN protocol WireGuard): The Linux kernel's random number generator has seen its first set of major improvements in over a decade, improving everything from the cryptography to the interface used. Not only does it finally retire SHA-1 in favor of BLAKE2s [in Linux kernel 5.17], but it also at long last unites '/dev/random' and '/dev/urandom' [in the upcoming Linux kernel 5.18], finally ending years of Slashdot banter and debate: The most significant outward-facing change is that /dev/random and /dev/urandom are now exactly the same thing, with no differences between them at all, thanks to their unification in random: block in /dev/urandom. This removes a significant age-old crypto footgun, already accomplished by other operating systems eons ago. [...] The upshot is that every Internet message board disagreement on /dev/random versus /dev/urandom has now been resolved by making everybody simultaneously right! Now, for the first time, these are both the right choice to make, in addition to getrandom(0); they all return the same bytes with the same semantics. There are only right choices. Phoronix adds: One exciting change to also note is the getrandom() system call may be a hell of a lot faster with the new kernel. The getrandom() call for obtaining random bytes is yielding much faster performance with the latest code in development. Intel's kernel test robot is seeing an 8450% improvement with the stress-ng getrandom() benchmark. Yes, an 8450% improvement.' -- source: https://linux.slashdot.org/story/22/03/19/1821254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 4

KDE Konsole Shows Colours!
by Lawrence D'Oliveiro 22 Mar '22

22 Mar '22

I noticed this happening in my Konsole terminal windows very occasionally over the last couple of months: a little coloured square with a black border would momentarily appear, then disappear when I moved the mouse. I never quite figured out what was going on, thought it was a window manager glitch or something ... until today. It appears Konsole has this (undocumented?) feature where, if you hover over the name of a colour in a terminal session, it will helpfully pop up this square showing what the colour looks like. The colour names come from the traditional X11 set in /usr/share/X11/rgb.txt, with limits: it only looks at single-word names, and does not match names with numeric suffixes. Thus, “darkmagenta” will work (case-insensitive match against “DarkMagenta”), while “dark magenta” only matches the “magenta” part, and “magenta1” is not recognized at all. It will also recognize a sequence of 3 or 6 hex digits preceded by “#” -- “#rgb” or “#rrggbb”, as commonly used in HTML. Just tried 8 hex digits -- “#rrggbbaa” with alpha transparency -- and that works too. This feature might be new in Konsole 21.08 or something.

1 0

Browser-in-the-Browser Attack Can Trick Even Savvy Users
by Peter Reutemann 22 Mar '22

22 Mar '22

'Ars Technica: Hundreds of thousands of sites use the OAuth protocol to let visitors login using their existing accounts with companies like Google, Facebook, or Apple. Instead of having to create an account on the new site, visitors can use an account that they already have -- and the magic of OAuth does the rest. The Browser-in-the-Browser (BitB) technique capitalizes on this scheme. Instead of opening a genuine second browser window that's connected to the site facilitating the login or payment, BitB uses a series of HTML and cascading style sheets (CSS) tricks to convincingly spoof the second window. The URL that appears there can show a valid address, complete with a padlock and HTTPS prefix. The layout and behavior of the window appear identical to the real thing. While the method is convincing, it has a few weaknesses that should give savvy visitors a foolproof way to detect that something is amiss. Genuine OAuth or payment windows are in fact separate browser instances that are distinct from the primary page. That means a user can resize them and move them anywhere on the monitor, including outside the primary window. BitB windows, by contrast, aren't a separate browser instance at all. Instead, they're images rendered by custom HTML and CSS and contained in the primary window. That means the fake pages can't be resized, fully maximized or dragged outside the primary window. All users should protect their accounts with two-factor authentication. One other thing more experienced users can do is right click on the popup page and choose "inspect." If the window is a BitB spawn, its URL will be hardcoded into the HTML. ' -- source: https://it.slashdot.org/story/22/03/21/236242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A big bet to kill the password for good
by Peter Reutemann 21 Mar '22

21 Mar '22

'After years of tantalizing hints that a passwordless future is just around the corner, you're probably still not feeling any closer to that digital unshackling. Ten years into working on the issue, though, the FIDO Alliance, an industry association that specifically works on secure authentication, thinks it has finally identified the missing piece of the puzzle. On Thursday, the organization published a white paper that lays out FIDO's vision for solving the usability issues that have dogged passwordless features and, seemingly, kept them from achieving broad adoption. FIDO's members collaborated to produce the paper, and they span chipmakers like Intel and Qualcomm, prominent platform developers like Amazon and Meta, financial institutions like American Express and Bank of America, and the developers of all major operating systems—Google, Microsoft, and Apple. The paper is conceptual, not technical, but after years of investment to integrate what are known as the FIDO2 and WebAuthn passwordless standards into Windows, Android, iOS, and more, everything is now riding on the success of this next step.' -- source: https://arstechnica.com/information-technology/2022/03/a-big-bet-to-kill-th… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Trickbot is using MikroTik routers to ply its trade. Now we know why
by Peter Reutemann 18 Mar '22

18 Mar '22

'For years, malicious hackers have been hacking large fleets of MikroTik routers and conscripting them into Trickbot, one of the Internet’s most destructive botnets. Now, Microsoft has finally figured out why and how the routers are being put to use. Trickbot came to light in 2016 as a trojan for stealing account passwords for use in bank fraud. Since then, Trickbot has mushroomed into one of the Internet's most aggressive threat platforms, thanks to its highly modular, multistage malware framework that provides a full suite of tools that are used to install ransomware and other forms of malware from other hacking groups. The malware driving Trickbot is notable for its advanced capabilities. It excels at gaining powerful administrator privileges, spreading rapidly from computer to computer in networks, and performing reconnaissance that identifies infected computers belonging to high-value targets. The malware often uses readily available software like Mimikatz or exploits like EternalBlue, which was stolen from the National Security Agency.' -- source: https://arstechnica.com/information-technology/2022/03/trickbot-is-using-mi… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Researcher uses Dirty Pipe exploit to fully root a Pixel 6 Pro and Samsung S22
by Peter Reutemann 17 Mar '22

17 Mar '22

'A researcher has successfully used the critical Dirty Pipe vulnerability in Linux to fully root two models of Android phones—a Pixel 6 Pro and Samsung S22—in a hack that demonstrates the power of exploiting the newly discovered OS flaw. The researcher chose those two handset models for a good reason: they are two of the few—if not the only—devices known to run Android version 5.10.43, the only release of Google's mobile OS that's vulnerable to Dirty Pipe. Because the LPE, or local privilege escalation, vulnerability wasn't introduced until the recently released version 5.8 of the Linux kernel, the universe of exploitable devices—whether mobile, Internet of Things, or servers and desktops—is relatively small.' -- source: https://arstechnica.com/information-technology/2022/03/researcher-uses-dirt… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Nasty Linux Netfilter Firewall Security Hole Found
by Peter Reutemann 16 Mar '22

16 Mar '22

'Sophos threat researcher Nick Gregory discovered a hole in Linux's netfilter firewall program that's "exploitable to achieve kernel code execution (via ROP [return-oriented programming]), giving full local privilege escalation, container escape, whatever you want." ZDNet reports: Behind almost all Linux firewalls tools such as iptables; its newer version, nftables; firewalld; and ufw, is netfilter, which controls access to and from Linux's network stack. It's an essential Linux security program, so when a security hole is found in it, it's a big deal. [...] This problem exists because netfilter doesn't handle its hardware offload feature correctly. A local, unprivileged attacker can use this to cause a denial-of-service (DoS), execute arbitrary code, and cause general mayhem. Adding insult to injury, this works even if the hardware being attacked doesn't have offload functionality! That's because, as Gregory wrote to a security list, "Despite being in code dealing with hardware offload, this is reachable when targeting network devices that don't have offload functionality (e.g. lo) as the bug is triggered before the rule creation fails." This vulnerability is present in the Linux kernel versions 5.4 through 5.6.10. It's listed as Common Vulnerabilities and Exposures (CVE-2022-25636), and with a Common Vulnerability Scoring System (CVSS) score of 7.8), this is a real badie. How bad? In its advisory, Red Hat said, "This flaw allows a local attacker with a user account on the system to gain access to out-of-bounds memory, leading to a system crash or a privilege escalation threat." So, yes, this is bad. Worse still, it affects recent major distribution releases such as Red Hat Enterprise Linux (RHEL) 8.x; Debian Bullseye; Ubuntu Linux, and SUSE Linux Enterprise 15.3. While the Linux kernel netfilter patch has been made, the patch isn't available yet in all distribution releases. ' -- source: https://linux.slashdot.org/story/22/03/15/221258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A brief tour of the PDP-11, the most influential minicomputer of all time
by Peter Reutemann 15 Mar '22

15 Mar '22

'The history of computing could arguably be divided into three eras: that of mainframes, minicomputers, and microcomputers. Minicomputers provided an important bridge between the first mainframes and the ubiquitous micros of today. This is the story of the PDP-11, the most influential and successful minicomputer ever. In their moment, minicomputers were used in a variety of applications. They served as communications controllers, instrument controllers, large system pre-processors, desk calculators, and real-time data acquisition handlers. But they also laid the foundation for significant hardware architecture advances and contributed greatly to modern operating systems, programming languages, and interactive computing as we know them today. In today’s world of computing, in which every computer runs some variant of Windows, Mac, or Linux, it’s hard to distinguish between the CPUs underneath the operating system. But there was a time when differences in CPU architecture were a big deal. The PDP-11 helps explain why that was the case. The PDP-11 was introduced in 1970, a time when most computing was done on expensive GE, CDC, and IBM mainframes that few people had access to. There were no laptops, desktops, or personal computers. Programming was done by only a few companies, mostly in assembly, COBOL, and FORTRAN. Input was done on punched cards, and programs ran in non-interactive batch runs.' -- source: https://arstechnica.com/gadgets/2022/03/a-brief-tour-of-the-pdp-11-the-most… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Researcher uses 379-year-old algorithm to crack crypto keys found in the wild
by Peter Reutemann 15 Mar '22

15 Mar '22

'Cryptographic keys generated with older software now owned by technology company Rambus are weak enough to be broken instantly using commodity hardware, a researcher reported on Monday. This revelation is part of an investigation that also uncovered a handful of weak keys in the wild. The software comes from a basic version of the SafeZone Crypto Libraries, which were developed by a company called Inside Secure and acquired by Rambus as part of its 2019 acquisition of Verimatrix, a Rambus representative said. That version was deprecated prior to the acquisition and is distinct from a FIPS-certified version that the company now sells under the Rambus FIPS Security Toolkit brand. Researcher Hanno Böck said that the vulnerable SafeZone library doesn't sufficiently randomize the two prime numbers it used to generate RSA keys. (These keys can be used to secure Web traffic, shells, and other online connections.) Instead, after the SafeZone tool selects one prime number, it chooses a prime in close proximity as the second one needed to form the key. "The problem is that both primes are too similar," Böck said in an interview. "So the difference between the two primes is really small." The SafeZone vulnerability is tracked as CVE-2022-26320. Cryptographers have long known that RSA keys that are generated with primes that are too close together can be trivially broken with Fermat's factorization method. French mathematician Pierre de Fermat first described this method in 1643.' -- source: https://arstechnica.com/information-technology/2022/03/researcher-uses-600-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel Finds Bug In AMD's Spectre Mitigation, AMD Issues Fix
by Peter Reutemann 14 Mar '22

14 Mar '22

'"News of a fresh Spectre BHB vulnerability that only impacts Intel and Arm processors emerged this week," reports Tom's Hardware, "but Intel's research around these new attack vectors unearthed another issue. "One of the patches that AMD has used to fix the Spectre vulnerabilities has been broken since 2018." Intel's security team, STORM, found the issue with AMD's mitigation. In response, AMD has issued a security bulletin and updated its guidance to recommend using an alternative method to mitigate the Spectre vulnerabilities, thus repairing the issue anew.... Intel's research into AMD's Spectre fix begins in a roundabout way — Intel's processors were recently found to still be susceptible to Spectre v2-based attacks via a new Branch History Injection variant, this despite the company's use of the Enhanced Indirect Branch Restricted Speculation (eIBRS) and/or Retpoline mitigations that were thought to prevent further attacks. In need of a newer Spectre mitigation approach to patch the far-flung issue, Intel turned to studying alternative mitigation techniques. There are several other options, but all entail varying levels of performance tradeoffs. Intel says its ecosystem partners asked the company to consider using AMD's LFENCE/JMP technique. The "LFENCE/JMP" mitigation is a Retpoline alternative commonly referred to as "AMD's Retpoline." As a result of Intel's investigation, the company discovered that the mitigation AMD has used since 2018 to patch the Spectre vulnerabilities isn't sufficient — the chips are still vulnerable. The issue impacts nearly every modern AMD processor spanning almost the entire Ryzen family for desktop PCs and laptops (second-gen to current-gen) and the EPYC family of datacenter chips.... In response to the STORM team's discovery and paper, AMD issued a security bulletin (AMD-SB-1026) that states it isn't aware of any currently active exploits using the method described in the paper. AMD also instructs its customers to switch to using "one of the other published mitigations (V2-1 aka 'generic retpoline' or V2-4 aka 'IBRS')." The company also published updated Spectre mitigation guidance reflecting those changes [PDF].... AMD's security bulletin thanks Intel's STORM team by name and noted it engaged in the coordinated vulnerability disclosure, thus allowing AMD enough time to address the issue before making it known to the public. ' -- source: https://hardware.slashdot.org/story/22/03/13/200224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Copper Lines To Be Cut Starting September
by Lawrence D'Oliveiro 14 Mar '22

14 Mar '22

First I heard about it today, but it’s the beginning of the end for copper phone lines; Chorus is going to cut off a few installations (“fewer than 5000”) on a trial basis later this year <https://www.stuff.co.nz/business/124317060/first-copper-phone-services-to-b…>: Chorus chief executive Jean-Baptiste Rousselot said that outside of those “limited initial trial areas” no-one should feel under any pressure to move off copper. This will only happen in areas where the takeup of fibre is already high, and customers will get six months’ notice.

1 0

Arch Linux Turns 20
by Peter Reutemann 13 Mar '22

13 Mar '22

'"Arch Linux, the rolling Linux distribution that powers Valve's Steam Deck is now 20 years old," reports Neowin. Slashdot reader segaboy81 writes that "What's cool to see here is that everything changed behind the scenes, but on the surface, things are the same." From the article: Announced on March 11th, 2002, and codenamed Homer, version 0.1 was released to minor fanfare. The release notes were a far cry from today's, essentially announcing it had broken ground and the foundation was going in, as it were. Homer's release notes: I've finally got a bootable iso image on the ftp site. The bad news is that you don't get a pretty interactive installer. But if you wanted one of those, you would have gone with RedHat, right? ;) I'll try to get the docs up for ABS (Arch Build System) which, IMHO, is one of the best advantages of Arch. With ABS, you can easily create new packages, and it's trivial to rebuild existing packages with your own customizations.... It shipped with Linux kernel 2.4.18 which many of the Linux old-timers (myself included) will remember was right before we started to get nice things like auto-mounting USB drives in kernel 2.6. XFree86 4.2.0 was also in stow, which is what we now call Xorg. If you wanted to build software, you had to use an absolutely ancient gcc toolchain (2.95.3). Web browsing was covered by the ghost of Netscape Navigator, Mozilla 0.9.9. Heady days, these were!' -- source: https://linux.slashdot.org/story/22/03/12/0251257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Brave takes on the creepy websites that override your privacy settings
by Peter Reutemann 10 Mar '22

10 Mar '22

'Some websites just can't take "no" for an answer. Instead of respecting visitors' choice to block third-party cookies—the identifiers that track browsing activity as a user moves from site to site—they find sneaky ways to bypass those settings. Now, makers of the Brave browser are taking action. Earlier this week, Brave Nightly—the testing and development version of the browser—rolled out a feature that's designed to prevent what's known as bounce tracking. The new feature, known as unlinkable bouncing, will roll out for general release in Brave version 1.37 slated for March 29.' -- source: https://arstechnica.com/information-technology/2022/03/brave-has-a-plan-to-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

System76 Launch review: Linux-friendly keyboard with a USB hub
by Peter Reutemann 09 Mar '22

09 Mar '22

'The Launch is System76's first mechanical keyboard, but it could be the last keyboard you need. With hot-swappable mechanical switches, legends that won't fade, a durable build, and a pair of detachable cables, this tenkeyless board can evolve with you. It's also open source—from its chassis to its PCB and firmware—allowing for deeper tinkering. There are even some extra keycaps for when you want a new look. And in true System76 style, the board favors Linux users. At $285, though, the Launch is a big investment, and many won't like how hard it is to press the keys. The clicky mechanical switches are so tactile that they'll tire some fingers out.' -- source: https://arstechnica.com/gadgets/2022/03/system76-launch-review-linux-friend… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Open Source Zone Grinds Away At Patent Trolls
by Peter Reutemann 09 Mar '22

09 Mar '22

'For the last two years, Unified Patents, an international organization of over 200 businesses, has been winning the battle against patent trolls "to keep them from stealing from the companies and organizations that actually use patents' intellectual property (IP)," writes ZDNet's Steven Vaughan Nichols. "This is their story to date." From the report: Unified Patents brings the fight to the trolls. It deters patent trolls from attacking its members by making it too expensive for the troll to win. The group does this by examining troll patents and their activities in various technology sectors (Zones). The United Patents Open Source Software Zone (OSS Zone) is the newest of these Zones. [...] Even before OSS Zone was formally launched, Unified Patents along with the Open Invention Network (OIN), the world's largest patent non-aggression group, launched legal cases against poor quality PAE-owned (Patent Assertion Entities) patents. The Linux Foundation and Microsoft have also joined the OSS Zone to battle these bad patents. [...] Together, United Patents uses open-source software evidence as proof to establish that the trolls often don't have a case. This is done using Inter Partes Review (IPR), a 2012 legal tool for showing that a bad patent never should have been granted in the first place. [Linux Foundation Executive Director Jim Zemlin] notes, "The Patent Trial and Appeal Board (PTAB)'s discretionary rulings on IPRs have changed the landscape around NPEs. These cases take a long time to be resolved. Typically, it takes from 12 to 24 months. That also makes them expensive for both the OSS Zone and the trolls. Keith Bergelt, the OIN's CEO, said "In other technology areas when patents go through the IPR process or are reexamined, there is a settlement around 20% of the time. In the OSS Zone, there are few settlements. This makes it more costly and difficult to administer, but also is difficult on the PAEs. When the success rate against their patents is over 95%, certain PAEs that would otherwise hope to settle have essentially given up on defending their patents." Still, with such a high success rate, it's worth the expense. To date, Unified has overseen and managed 43 challenges. Of these, 12 patents were found invalid, another 23 cases have been instituted, and six are still in process. This has led to multiple settlements for Unified Patents members. These, in turn directly pass through to OIN's 3,600+ community members. For example, an Accelerated Memory Tech patent 6,513,062, was used by the troll IP Investments Group to claim that the open-source Redis, which manages cache resources on the cloud, violated the patent. Redis, not having any money, IP Investments Group instead went after Hulu, Citrix Systems, Barracuda Networks, Kemp Technologies, and F5 Networks for their use of Redis software. IP Investments Group gave up rather than fighting it out. Everyone who uses Redis wins. It's one small victory, but that's how the patent troll wars are won. And, with the United Patents' high-success rate in knocking out bad patents, slowly but surely the patent trolls are being driven back from not only open-source software but all software. ' -- source: https://yro.slashdot.org/story/22/03/07/235211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Has Been Bitten By Its Most High-Severity Vulnerability in Years
by Peter Reutemann 09 Mar '22

09 Mar '22

'Ars Technica is reporting a major new vulnerability in Linux. Named "Dirty Pipeline" it involves abuse of 'pipes' at the shell level as you might guess. The name Dirty Pipe is meant to both signal similarities to Dirty Cow and provide clues about the new vulnerability's origins. "Pipe" refers to a pipeline, a Linux mechanism for one OS process to send data to another process. In essence, a pipeline is two or more processes that are chained together so that the output text of one process (stdout) is passed directly as input (stdin) to the next one. Tracked as CVE-2022-0847, the vulnerability came to light when a researcher for website builder CM4all was troubleshooting a series of corrupted files that kept appearing on a customer's Linux machine. After months of analysis, the researcher finally found that the customer's corrupted files were the result of a bug in the Linux kernel. ' -- source: https://it.slashdot.org/story/22/03/08/1524203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Free Software Foundation Appoints a New Executive Director
by Peter Reutemann 06 Mar '22

06 Mar '22

'The Free Software Foundation announced its new executive director this week. Back in 2010 John Sullivan had become the Free Software Foundation's previous executive director, but last year after more than 11 years he'd decided to resign. Taking his place will be the FSF's program manager for the last three years, who writes in a new blog post: The past three years working at the FSF as program manager have been educational and motivational. They have reinforced my belief that what we do is important, and that our goal to give the four freedoms to all computer users continues to be crucial. The work we do reminds people to recognize the power they have to demand change. This change will help free their own digital lives, and their loved ones'. I am grateful to John Sullivan for his leadership and support. His legacy of nineteen years will be hard to live up to, and I look forward to working with him, the FSF board, and the staff on this transition.... We will continue our unwavering focus on our mission, especially working to increase understanding and adoption of copyleft, and bringing new people into the movement by communicating the necessity of the four freedoms. In the short term, we're focused on making the upcoming LibrePlanet conference [March 19-20] the best online edition yet for you. After that, I plan to reach out and ask for your thoughts and ideas on what else the FSF can do this year and beyond to advance the cause of user freedom. As a free software activist, like many of you, each day, I am presented with almost innumerable choices between freedom and convenience, and each day I choose freedom wherever I can. I have learned to do this by questioning my tools, by joining this community, and by learning more and more about the ways that I can stand up for myself. If I can do that, I firmly believe we can reach anyone. I hope that you'll join me in rejecting the ways that Big Tech tries to deprive us of our freedoms, and to help set a positive example for computer users around the globe. In freedom, Zoë Kooyman Executive Director >From the FSF's announcement: Kooyman assumes the executive director role following a series of recent steps taken to make the non-profit's governance and board recruitment practices more transparent and participatory, including a new community engagement process that empowers associate members of the FSF to nominate and evaluate candidates for the board of directors for the first time in the organization's 37-year history. "I want to learn from the community, and will focus on relationship building, and on strengthening the free software movement together," Kooyman said. "Our immediate priority is to convene another successful LibrePlanet conference on March 19 and 20, bringing community activists, domain experts, and other users together to discuss current issues in technology and ethics. With the current and future threats users face, it's critical that we spread the free software message wider than ever before and that we help people understand the steps they can take to defend our user rights and freedom."' -- source: https://news.slashdot.org/story/22/03/05/0550228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

On Raspberry Pi's 10th Anniversary, Eben Upton Ponders the Prospects for a RISC-V Pi
by Peter Reutemann 06 Mar '22

06 Mar '22

'On the 10th anniversary of the Raspberry Pi, the Register takes a look backwards — and forwards — in a new interview Eben Upton: As for the future, a Raspberry Pi 5 is inevitable but, in a blow to those hoping for something even more exotic than the usual Broadcom Arm SoC, RISC-V isn't on the cards, certainly not in the timeframe for the next generation of Pi. "I can't go out today and license a RISC-V core," says Upton, citing the current state of the ecosystem, "which is even as good as the core of the Raspberry Pi 4." "Hopefully I will in the future," he adds. The implosion of the Nvidia/Arm deal has also reduced the chances of a RISC-V Pi (in the 2030 timeframe), down from 20 per cent to 10 per cent, according to Upton. "The ownership of the core of the de-facto standard low-power architecture by an organisation that's also a player was potentially very destabilising... and it was always going to be to the benefit of the obvious alternative architecture." Upton answered questions from Slashdot's readers before the first boards were even ready in 2012. But he already knew that the device would be wildly popular. Upton tells the Register that months before, its Debian-based operating system got 50,000 downloads, "And all you could do was run it in QEMU (there was a QEMU config you could build that was similar enough to a Raspberry Pi). "50,000 people downloaded this really primitive operating system for a machine that you couldn't buy!"' -- source: https://news.slashdot.org/story/22/03/05/0151232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Foundation's 'Census II' of Open Source Libraries Urges Support, Security, and Standardization
by Peter Reutemann 06 Mar '22

06 Mar '22

'"Much of the most widely used free and open source software is developed by only a handful of contributors," warns the Linux Foundation, in the executive summary for its massive new census of free and open source software application libraries. It was prepared in conjunction with Harvard's Laboratory for Innovation Science — and that's just one of its five high-level findings. The census also notes "the increasing importance of individual developer account security," but also the persistence of legacy software, the need for a standardized naming schema for software components, and "complexities" around package versions. But there's also just a lot of data about package popularity, writes SD Times: The report, Census II, is a follow-up to Census I, which was conducted in 2015 to identify the packages in Debian Linux that were most critical to the operation and security of the kernel. According to the Linux Foundation, Census II allows for a more "complete picture of free and open source (FOSS) adoption." "Understanding what FOSS packages are the most critical to society allows us to proactively support projects that warrant operations and security support," said Brian Behlendorf, executive director at Linux Foundation's Open Source Security Foundation (OpenSSF). The census "aggregates data from over half a million observations of FOSS libraries used in production applications at thousands of companies," according to its executive summary. It argues that preserving FOSS will require this kind of data-sharing (about where and how FOSS packages are being used ) as well as coordination — including standardizing terminology — and of course, investment. "The motivation behind publishing these findings is to not only inform, but also to inspire action by developers to improve their security practices and by end users to support the FOSS ecosystem and developers who need assistance." (It suggests companies companies could provide not just financial support but also the technical talent and their time.) The results take the form of eight Top 500 lists — four that include version numbers in the analysis and four that are version agnostic. Further, as mentioned above, we present npm and non-npm packages in separate lists... Although these lists provide valuable, important insights into the most widely used FOSS projects, it is important to also consider the level of security related to these projects. Therefore, in each list, we also include the "Tiered %" measure from the OpenSSF Best Practices Badging Program....' -- source: https://news.slashdot.org/story/22/03/05/0521219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bungie Rejects Steam Deck's Linux, Threatens To Ban Destiny 2 Players There
by Peter Reutemann 04 Mar '22

04 Mar '22

'The Verge: When will Bungie let Destiny 2 come to Valve's Steam Deck handheld gaming PC? It's looking like the answer is never -- because the soon-to-be Sony subsidiary has published a help page that not only says the game's unsupported, but outright threatens to ban prospective Steam Deck players (via Wario64). The help page has a new section titled "Steam Deck and Destiny 2," which reads: "Destiny 2 is not supported for play on the Steam Deck or on any system utilizing Steam Play's Proton unless Windows is installed and running. Players who attempt to launch Destiny 2 on the Steam Deck through SteamOS or Proton will be unable to enter the game and will be returned to their game library after a short time. Players who attempt to bypass Destiny 2 incompatibility will be met with a game ban." To be fair, Bungie isn't the only one to reject the Steam Deck without necessarily providing a satisfying explanation -- Epic Games CEO Tim Sweeney explained to me why Fortnite won't get updated for the Steam Deck last month, even though Epic's own Easy Anti-Cheat (EAC) claims game developers can enable it with "just a few clicks." And while both Apex Legends and Elden Ring now fully work on Deck despite using anti-cheat, it's also true that many other top multiplayer games have yet to fully arrive.' -- source: https://linux.slashdot.org/story/22/03/02/2153252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Google Play app downloaded more than 10,000 times contained data-stealing RAT
by Peter Reutemann 03 Mar '22

03 Mar '22

'A malicious app downloaded from Google Play more than 10,000 times surreptitiously installed a remote access trojan that stole users’ passwords, text messages, and other confidential data, a security firm reported. The trojan, which goes under the names TeaBot and Anatsa, came to light last May. It used streaming software and abused Android’s accessibility services in a way that allowed the malware creators to remotely view the screens of infected devices and interact with the operations the devices carried out. At the time, TeaBot was programmed to steal data from a predefined list of apps from about 60 banks around the world. On Tuesday, security firm Cleafy reported that TeaBot was back. This time, the trojan spread through a malicious app called QR Code & Barcode Scanner, which as the name suggested, allowed users to interact with QR codes and barcodes. The app had more than 10,000 installations before Cleafy researchers notified Google of the fraudulent activity and Google removed it.' -- source: https://arstechnica.com/information-technology/2022/03/google-play-app-drop… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers Demand NVIDIA Open Source Their Drivers Or They Leak More Data
by Peter Reutemann 03 Mar '22

03 Mar '22

'VideoCardz: Hackers that infiltrated NVIDIA systems are now threatening to release more confidential information unless the company commits to open sourcing their drivers. It is unclear what the stolen data contains, but the group confirmed that there are 250GB of hardware related data in their possession. Furthermore, the group confirmed they have evaluated NVIDIA position, which means that NVIDIA is might trying to communicate with the group to prevent future leaks. The group has already published information on NVIDIA DLSS technology and upcoming architectures. Yesterday, Nvidia reportedly retaliated against the hacker group known as "Lapsus$" by sneaking back into the hacker's system and encrypting the stolen data. The group claimed that it had a backup of the data, though.' -- source: https://news.slashdot.org/story/22/03/02/2228207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fixing The Fiji-Tonga Cable
by Lawrence D'Oliveiro 02 Mar '22

02 Mar '22

Reconnecting Tonga’s sole Internet cable link (to Fiji) turned out to be a tricky job <https://www.theregister.com/2022/03/02/tonga_submarine_cable_reconnection_r…>. The cable was ripped in six different places, and a quarter-million-dollar repeater unit went missing altogether. 40km of existing cable was able to be recovered and reused, but another 50km of new cable was needed to complete the repair. Parts of the cable actually moved 5km closer to the volcano, courtesy of an earthquake and associated turbidity currents. Next step: fixing the connections between Tonga’s islands.

1 0

DDoSers are using a potent new method to deliver attacks of unthinkable size
by Peter Reutemann 02 Mar '22

02 Mar '22

'Last August, academic researchers discovered a potent new method for knocking sites offline: a fleet of misconfigured servers more than 100,000 strong that can amplify floods of junk data to once-unthinkable sizes. These attacks, in many cases, could result in an infinite routing loop that causes a self-perpetuating flood of traffic. Now, content-delivery network Akamai says attackers are exploiting the servers to target sites in the banking, travel, gaming, media, and web-hosting industries. These servers—known as middleboxes—are deployed by nation-states such as China to censor restricted content and by large organizations to block sites pushing porn, gambling, and pirated downloads. The servers fail to follow transmission control protocol specifications that require a three-way handshake—comprising an SYN packet sent by the client, a SYN+ACK response from the server, followed by a confirmation ACK packet from the client—before a connection is established. This handshake limits the TCP-based app from being abused as amplifiers because the ACK confirmation must come from the gaming company or other target rather than an attacker spoofing the target’s IP address. But given the need to handle asymmetric routing, in which the middlebox can monitor packets delivered from the client but not the final destination that’s being censored or blocked, many such servers drop the requirement by design.' -- source: https://arstechnica.com/information-technology/2022/03/unending-data-floods… Considering that we suffered a widespread internet outage earlier today (and my internet is still flaky or slow), seems rather relevant: https://www.newshub.co.nz/home/technology/2021/09/internet-down-for-many-ar… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday
by Peter Reutemann 28 Feb '22

28 Feb '22

Hi everyone We have a (virtual) meeting scheduled for next Monday: Peter Reutemann will demo openbalena (https://www.balena.io/open/) and how it can be used for managing an IoT fleet of devices. Ian Stewart will present his modem running the latest version of OpenWrt ( https://openwrt.org/ ). Using ssh into his modem and what the web-based user interface looks like, we will see some of the improvements that have gone into this latest release. Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/283776605/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Australia’s Standoff Against Google And Facebook Worked--Sort Of
by Lawrence D'Oliveiro 28 Feb '22

28 Feb '22

Analysis of how Australia forced Google and Facebook to negotiate with news outlets over compensation for carrying their stories <https://arstechnica.com/tech-policy/2022/02/australias-standoff-against-goo…>. Other countries (most famously Spain) had previously tried something similar, only to have it backfire spectacularly. Australia has succeeded where others failed—up to a point. Seems the two online behemoths are paying off some bigger news outlets, but rebuffing attempts from others to come to a similar deal. While the country’s news media bargaining code is now law, it has not (yet) actually needed enforcement: all the deals so far have been voluntary. So, has it been beneficial for Australian media as a whole, or only for certain favoured players? But even critics of the code suggest it could be a useful starting point. Emily Bell, director of Columbia University’s Tow Center for Digital Journalism, says she is concerned by the code’s lack of transparency, but concedes that Facebook and Google have paid more to publishers in Australia than they do under their philanthropic donations elsewhere. “What we do know is that some legislation is better than none.”

1 0

Samsung Shattered Encryption On 100 Million Phones
by Peter Reutemann 25 Feb '22

25 Feb '22

'Samsung shipped an estimated 100 million smartphones with botched encryption, including models ranging from the 2017 Galaxy S8 on up to last year's Galaxy S21. Threatpost reports: Researchers at Tel Aviv University found what they called "severe" cryptographic design flaws that could have let attackers siphon the devices' hardware-based cryptographic keys: keys that unlock the treasure trove of security-critical data that's found in smartphones. What's more, cyber attackers could even exploit Samsung's cryptographic missteps -- since addressed in multiple CVEs -- to downgrade a device's security protocols. That would set up a phone to be vulnerable to future attacks: a practice known as IV (initialization vector) reuse attacks. IV reuse attacks screw with the encryption randomization that ensures that even if multiple messages with identical plaintext are encrypted, the generated corresponding ciphertexts will each be distinct. The design flaws primarily affect devices that use ARM's TrustZone technology: the hardware support provided by ARM-based Android smartphones (which are the majority) for a Trusted Execution Environment (TEE) to implement security-sensitive functions. TrustZone splits a phone into two portions, known as the Normal world (for running regular tasks, such as the Android OS) and the Secure world, which handles the security subsystem and where all sensitive resources reside. The Secure world is only accessible to trusted applications used for security-sensitive functions, including encryption. Matthew Green, associate professor of computer science at the Johns Hopkins Information Security Institute, explained on Twitter that Samsung incorporated "serious flaws" in the way its phones encrypt key material in TrustZone, calling it "embarrassingly bad." "They used a single key and allowed IV re-use," Green said. "So they could have derived a different key-wrapping key for each key they protect," he continued. "But instead Samsung basically doesn't. Then they allow the app-layer code to pick encryption IVs." The design decision allows for "trivial decryption," he said. Samsung responded to the academics' disclosure by issuing a patch for affected devices that addressed CVE-2021-25444: an IV reuse vulnerability in the Keymaster Trusted Application (TA) that runs in the TrustZone. Keymaster TA carries out cryptographic operations in the Secure world via hardware, including a cryptographic engine. The Keymaster TA uses blobs, which are keys "wrapped" (encrypted) via AES-GCM. The vulnerability allowed for decryption of custom key blobs. Then, in July 2021, the researchers revealed a downgrade attack -- one that lets attacker trigger IV reuse vulnerability with privileged process. Samsung issued another patch -- to address CVE-2021-25490 -- that remoged the legacy blob implementation from devices including Samsung's Galaxy S10, S20 and S21 phones. ' -- source: https://mobile.slashdot.org/story/22/02/24/222207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FreeDOS Puts Out New Release
by Peter Reutemann 25 Feb '22

25 Feb '22

'FreeDOS has put out release 1.3, the latest release in 6-years. Some of the improvements since the 1.2 release, include: new FreeCOM 0.85a, new Kernel 2043 and an 8086 version with FAT32 support, floppy edition now uses compression...let's party like it's 1994.' -- source: https://tech.slashdot.org/story/22/02/24/1540240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Russia’s most cutthroat hackers infect network devices with new botnet malware
by Peter Reutemann 24 Feb '22

24 Feb '22

'Hackers for one of Russia’s most elite and brazen spy agencies have infected home and small-office network devices around the world with a previously unseen malware that turns them into attack platforms that can steal confidential data and target other networks. Cyclops Blink, as the advanced malware has been dubbed, has infected about 1 percent of network firewall devices made by network device manufacturer Watchguard, the company said on Wednesday. The malware is able to abuse a legitimate firmware update mechanism found in infected devices in a way that gives it persistence, meaning it survives reboots. [...] So far, the advisory stated, Sandworm has “primarily” used the malware to infect network devices from WatchGuard, but it’s likely the hackers are able to compile it to run on other platforms as well. The malware gains persistence on WatchGuard devices by abusing the legitimate process they use to receive firmware updates.' -- source: https://arstechnica.com/information-technology/2022/02/russias-most-cut-thr… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ReiserFS Proposed To Be Removed From Linux In 2022
by Peter Reutemann 24 Feb '22

24 Feb '22

'Linux kernel developers have discussed on the kernel developers forum to remove ReiserFS from the kernel starting in 2022. ReiserFS was added as Linux's first journaling file system 21 years ago with SUSE using it as the default filesystem until 2006. However, since Hans Reiser was sent to jail 15 years ago for murder, there has not been much development or interest in it. Noting that there have been no user-spotted fixes since 2019, longtime kernel developer Matthew Wilcox also cited that ReiserFS was only block for some kernel changes he wished to implement. These days there are better alternatives like EXT4, Btrfs, XFS, and OpenZFS.' -- source: https://linux.slashdot.org/story/22/02/23/0537213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

Fwd: [Flounder] new list and updated web site, next meeting 5th March
by Peter Reutemann 22 Feb '22

22 Feb '22

This new list FLOSS Down Under - Internet-Meeting group for Free Software people may be of interest to some of the people on this list as well. Cheers, Peter ---------- Forwarded message --------- From: Russell Coker via Flounder <flounder(a)lists.linux.org.au> Date: Tue, Feb 22, 2022 at 5:08 PM Subject: [Flounder] new list and updated web site, next meeting 5th March To: <flounder(a)lists.linux.org.au> https://flounder.linux.org.au/ Above is the new URL for the web site. It has a link for an iCal file with future meetings. I will add meetings without agenda many months ahead of time and then replace them with proper events when we have an agenda. This is the new list, I subscribed some people who are interested (hope everyone wanted that). Please forward to your friends! -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/ _______________________________________________ Flounder mailing list Flounder(a)lists.linux.org.au http://lists.linux.org.au/mailman/listinfo/flounder -- My Open Source Blog - http://open.fracpete.org

1 0

Tip Of The Week: Controlling The Battery Charge Threshold
by Lawrence D'Oliveiro 21 Feb '22

21 Feb '22

Came across this rather interesting reader comment <https://forums.theregister.com/forum/all/2022/02/18/something_for_the_weeke…> about (supposedly) prolonging the life of your laptop battery by reducing the limit to which it is charged. This is configured by creating a systemd service file (called, for example, /etc/systemd/system/battery-charge-threshold.service) that automatically sets the threshold at boot time. Its contents are [Unit] Description=Set the battery charge threshold After=multi-user.target StartLimitBurst=0 [Service] Type=oneshot Restart=on-failure ExecStart=/bin/bash -c 'echo 50 > /sys/class/power_supply/BAT0/charge_control_end_threshold' [Install] WantedBy=multi-user.target You then use the usual “systemctl start” command to invoke this immediately, plus “systemctl enable” to ensure it runs at every subsequent boot. Regardless of whether it actually prolongs the life of your battery (try at your own risk!), it shows how easy it is to customize aspects of your system behaviour with systemd. As of this writing, that comment has garnered 7 upvotes and no downvotes, on a site where the readers are notorious for being a nest of systemd-haters.

2 6

Is Firefox OK?
by Peter Reutemann 21 Feb '22

21 Feb '22

'At the end of 2008, Firefox was flying high. Twenty percent of the 1.5 billion people online were using Mozilla’s browser to navigate the web. In Indonesia, Macedonia, and Slovenia, more than half of everyone going online was using Firefox. “Our market share in the regions above has been growing like crazy,” Ken Kovash, Mozilla’s president at the time, wrote in a blog post. Almost 15 years later, things aren’t so rosy. Across all devices, the browser has slid to less than 4 percent of the market—on mobile it’s a measly half a percent. “Looking back five years and looking at our market share and our own numbers that we publish, there's no denying the decline,” says Selena Deckelmann, senior vice president of Firefox. Mozilla’s own statistics show a drop of around 30 million monthly active users from the start of 2019 to the start of 2022. “In the last couple years, what we've seen is actually a pretty substantial flattening,” Deckelmann adds.' -- source: https://arstechnica.com/gadgets/2022/02/is-firefox-ok/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Millions of WordPress sites get forced update to patch critical plugin flaw
by Peter Reutemann 21 Feb '22

21 Feb '22

'Millions of WordPress sites have received a forced update over the past day to fix a critical vulnerability in a plugin called UpdraftPlus. The mandatory patch came at the request of UpdraftPlus developers because of the severity of the vulnerability, which allows untrusted subscribers, customers, and others to download the site’s private database as long as they have an account on the vulnerable site. Databases frequently include sensitive information about customers or the site’s security settings, leaving millions of sites susceptible to serious data breaches that spill passwords, user names, IP addresses, and more.' -- source: https://arstechnica.com/information-technology/2022/02/millions-of-wordpres… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Developers Patch Bugs Faster Than Microsoft, Apple, and Google, Study Shows
by Peter Reutemann 21 Feb '22

21 Feb '22

'Linux programmers fixed bugs faster than anyone — in an average of just 25 days (improving from 32 days in 2019 to just 15 in 2021). That's the conclusion of Google's "Project Zero" security research team, which studied the speed of bug-fixing from January 2019 to December 2021. ZDNet reports that Linux's competition "didn't do nearly as well." For instance, Apple, 69 days; Google, 44 days; and Mozilla, 46 days. Coming in at the bottom was Microsoft, 83 days, and Oracle, albeit with only a handful of security problems, with 109 days. By Project Zero's count, others, which included primarily open-source organizations and companies such as Apache, Canonical, Github, and Kubernetes, came in with a respectable 44 days. Generally, everyone's getting faster at fixing security bugs. In 2021, vendors took an average of 52 days to fix reported security vulnerabilities. Only three years ago the average was 80 days. In particular, the Project Zero crew noted that Microsoft, Apple, and Linux all significantly reduced their time to fix over the last two years. As for mobile operating systems, Apple iOS with an average of 70 days is a nose better than Android with its 72 days. On the other hand, iOS had far more bugs, 72, than Android with its 10 problems. Browsers problems are also being fixed at a faster pace. Chrome fixed its 40 problems with an average of just under 30 days. Mozilla Firefox, with a mere 8 security holes, patched them in an average of 37.8 days. Webkit, Apple's web browser engine, which is primarily used by Safari, has a much poorer track record. Webkit's programmers take an average of over 72 days to fix bugs.' -- source: https://linux.slashdot.org/story/22/02/20/1915222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Why I Don’t Like Checking Version Numbers
by Lawrence D'Oliveiro 18 Feb '22

18 Feb '22

Some major web browsers will soon be hitting version 100. The rollover to a 3-digit version number is going to trigger a repeat of what happened when version numbers rolled from 9 to 10 -- some sites turned out to have buggy version checking based simplistically on strings rather than numeric values, and misbehave <https://www.theregister.com/2022/02/17/browsers_version_100_websites_bug/>. As a matter of habit, I have long been reluctant to condition behaviour in my own code based on writing code to look up version numbers of things. I prefer to include some kind of check that more directly determines the existence of relevant functionality.

1 0

Ransomware-As-A-Service
by Lawrence D'Oliveiro 10 Feb '22

10 Feb '22

From <https://www.theregister.com/2022/02/09/uk_us_au_ransomware_warning/>: Ransomware attacks are proliferating as criminals turn to gangs providing turnkey post-compromise services, Britain's National Cyber Security Centre (NCSC) has warned. So, ransomware has become so routine, it has spawned specialists who will take care of many of the technical details for you. For a fee, of course. I think “turnkey post-compromise services” shall be my phrase of the week ...

1 0

Listening To The Radio Killed My Car Stereo!
by Lawrence D'Oliveiro 10 Feb '22

10 Feb '22

From <https://arstechnica.com/cars/2022/02/radio-station-snafu-in-seattle-bricks-…>: ... the problem began on January 30 and afflicted Mazdas from model years 2014 to 2017 when the cars were tuned to the local NPR station, KUOW 94.9. At some point during the day's broadcast, a signal from KUOW caused the Mazdas' infotainment systems to crash—the screens died and the radios were stuck on 94.9 FM. The problem was image files† in the HD radio stream that the infotainment system didn’t know how to decode (they were lacking filename extensions). So it crashed. But the files were still in its cache on reboot, so it tried to decode them again. And crashed again. And it appears, there is no way to get rid of those files or reset the system to a safe state without major hardware surgery. And a replacement unit costs USD1,500 -- if you can get one. Luckily, Mazda has advised that it knows about the problem, and will replace the affected units free of charge -- once supplies are available. †Radio with pictures? Who knew?

1 0

System76 Linux workstation looks ready for gaming, too
by Peter Reutemann 04 Feb '22

04 Feb '22

'System76's latest Linux laptop combines one of AMD's most powerful 5000 series mobile CPUs with Nvidia's mid-range RTX 3060. Configurable to up to $3,442, the Kudu targets Linux users who have a lot of work to do, while quietly nodding at those who like to play games every now and then, too. The 15.6-inch Kudu is the second-priciest offering in System76's laptop lineup. It comes with an octa-core AMD Ryzen 9 5900HX, which has a base clock speed of 3.3 GHz and a boost of up to 4.6 GHz.' -- source: https://arstechnica.com/gadgets/2022/02/system76-linux-laptop-unites-amd-nv… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla is Shutting Down Its VR Web Browser, Firefox Reality
by Peter Reutemann 04 Feb '22

04 Feb '22

'A top VR web browser is closing down. Today, Mozilla announced it's shutting down its Firefox Reality browser -- the four-year-old browser built for use in virtual reality environments. The technology had allowed users to access the web from within their VR headset, doing things like visiting URLs, performing searches, and browsing both the 2D and 3D internet using your VR hand controllers, instead of a mouse. >From a report: Firefox Reality first launched in fall 2018 and has been available on Viveport, Oculus, Pico, and Hololens platforms through their various app stores. While capable of surfing the 2D web, the expectation was that users would largely use the new technology to browse and interact with the web's 3D content, like 360-degree panoramic images and videos, 3D models, and WebVR games, for example. But in an announcement published today, Mozilla says the browser will be removed from the stores where it's been available for download in the "coming weeks." Mozilla is instead directing users who still want to utilize a web browser in VR to Igalia's upcoming open-source browser, Wolvic, which is based on Firefox Reality's source code. This browser will be available for download starting next week, so users won't have to go without -- they'll just have to make the switch.' -- source: https://tech.slashdot.org/story/22/02/03/1653218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Slackware, the Oldest Actively Maintained Linux Distro, Releases Version 15.0
by Peter Reutemann 04 Feb '22

04 Feb '22

'Slackware, the oldest actively maintained Linux distribution, released version 15.0 yesterday after a long release cycle that goes all the way back to 2016 where the last version (14.2) was released. According to the release notes, the whole spirit of this release is: "Keep it familiar, but make it modern." Among the news, this release offers kernel 5.15.19, PAM, PipeWire and PulseAudio, Wayland and X11 graphical systems, and Rust and Python 3. As graphical environments, both Xfce 4.16 and the latest Plasma 5 (Plasma 5.23.5, Frameworks 5.90, KDE apps 21.12 running under Qt 5.15.3) are available, with Cinnamon and Mate also available from third parties. The main compilers are gcc-11.2 and llvm 13.0. The default browser is Firefox 91.5esr, with Chromium available as a third-party repository. And... no systemd at all. Slackware can be downloaded from a variety of mirrors. BitTorrent downloads are going to be available too. I've used Slackware for 20 years and it's always impressed me with its stability and speed. I encourage everyone interested to try it.' -- source: https://linux.slashdot.org/story/22/02/04/027213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Says Windows May Need Up To 8 Hours of Online Time To Update
by Peter Reutemann 03 Feb '22

03 Feb '22

'According to a post on the Microsoft IT Pro Blog, Windows computers will need at least eight hours of online time to obtain and install the latest OS updates successfully. Tom's Hardware reports: Another revelation in the post is that Microsoft tracks how long PCs are connected to Windows Update, calling the statistics "Update Connectivity." The data is available to IT managers in the InTune app, a component of the Endpoint management suite. The post details Microsoft's attempts to figure out why some Windows devices aren't getting the latest quality and feature updates, and discovered that two hours of continuous connectivity was required to get updates. It then took six hours after the release of the patch for a machine to update itself reliably. Microsoft's figures show that 50 percent of Windows devices left behind by Windows Update and running a build of Windows 10 that's no longer serviced do not spend enough time connected to have the patches downloaded and installed in the background. This figure drops to 25 percent for customers using a serviced build of the operating system that lags behind in security updates by 60 days or more. The goods news, as noted by Tom's Hardware, is that "Windows 11 updates are smaller than their Windows 10 counterparts due to improved compression [and] new Microsoft Graph APIs," which should help speed up the update process.' -- source: https://tech.slashdot.org/story/22/02/01/2056211 Bloatware? I can download/install full Linux distros in less time (and updates don't take that long either, not even a full version upgrade!). Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

Insights Into WSL 1.0
by Lawrence D'Oliveiro 03 Feb '22

03 Feb '22

You may remember that Microsoft’s initial attempt at “Windows Services for Linux”, WSL 1.0 (or maybe just plain “WSL”), involved emulating Linux APIs on top of the Windows kernel. This was later scrapped in favour of the current WSL 2.0, which runs an actual Linux kernel, virtualized. Clearly, Microsoft found it problematic trying to keep things compatible with the native Linux kernel, and decided it was simpler to just run the real article. This report <https://www.theregister.com/2022/02/02/oracle_linux_microsoft/> links in passing to an interesting blog post <https://jmmv.dev/2020/11/wsl-lost-potential.html> covering some of the technicalities of how WSL 1.0 was implemented. Windows NT has, or had, the notion of different “environment subsystems” or “personalities” implemented in layers on top of the core kernel; in fact, Win32 is (or was) just one of these “personalities”, with the original POSIX layer being another. That blog post says that WSL1 was implemented as just such a “personality”. And if that had not been scrapped, it would have made some interesting kinds of integration across Windows and Linux processes possible. However, a reader comment to the original article <https://forums.theregister.com/forum/all/2022/02/02/oracle_linux_microsoft/…>, claiming to come from a former “PM” (“Product Manager”?) for WSL, emphatically declares ... WSL is not an NT kernel "personality" and is in no way related to NT's POSIX subsystem. Not even slightly. They are entirely different implementations of different things and share zero architecture and implementation details. This reinforces an impression I’ve had, that much of the modularity of the original Windows NT architecture has decayed away over the years, sacrificed by Microsoft to marketing exigencies. And that includes the whole “environment subsystem” concept. So WSL1 was actually less modular than it might have appeared to begin with, and that would have added to the support headaches.

1 0

64-bit Raspberry Pi OS exits beta, is available for all Pi 3, 4, and Zero 2 boards
by Peter Reutemann 03 Feb '22

03 Feb '22

'The Raspberry Pi hardware has included a 64-bit processor since the Pi 3 launched in early 2016, but the Raspberry Pi OS (formerly known as Raspbian) has remained primarily 32-bit. The Raspberry Pi Foundation has been testing a 64-bit version of the OS since 2020, though, and today the organization announced that the 64-bit version is leaving beta and is now a fully supported OS option on all 64-bit Pi hardware. This includes the Pi 3, Pi 4, Pi Zero 2 W, and all variants thereof.' -- source: https://arstechnica.com/gadgets/2022/02/64-bit-raspberry-pi-os-exits-beta-i… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Backblaze Hard Drive Reliability Stats For 2021
by Lawrence D'Oliveiro 02 Feb '22

02 Feb '22

Data-backup company Backblaze has released its annual report on hard-drive reliability for 2021 <https://www.theregister.com/2022/02/01/backblaze_hd_reliability_stats_show/>. Interesting that there is an overall longer-term downward trend in drive failures, though this can fluctuate some. The company is in a good position to compare different brands and models, since they tend to shop around a lot (look at that list). Their whole system is designed to cope with drive failures, and given how many drives they have, they get a lot of failures. So there is plenty of raw data available to analyze, which they make freely available.

1 0

Remembering Windows Vista
by Lawrence D'Oliveiro 02 Feb '22

02 Feb '22

Here is a look back <https://www.theregister.com/2022/02/01/happy_birthday_windows_vista/> at the troubled gestation of Windows Vista. It’s useful as a retrospective, full of links to reports on developments from that time. One of the article links is to this analysis <https://www.theregister.com/2001/08/07/ms_poised_to_switch_windows/> of where Microsoft was supposedly going at the time. (Re)reading that is like peering through a portal into an alien, forgotten world -- one where the company was full of grandiose plans for building an entire OS on Dotnet, making your Exchange mail folders look like a filesystem volume, tying the representation of Office documents to proprietary features of NTFS, and turning the filesystem itself into a database. And one where users and pundits took such plans seriously.

1 0

German Court Fines Company For Linking To Google-Hosted Web Font
by Lawrence D'Oliveiro 01 Feb '22

01 Feb '22

Seems lots of websites link to web fonts hosted by Google. But do they realize this means that users of their sites are sending their IP addresses to Google’s servers? And that not getting the consent of your users to such a thing can land you in legal trouble, at least in the EU? <https://www.theregister.com/2022/01/31/website_fine_google_fonts_gdpr/> I don’t know why people do this anyway -- depending on another site just introduces an additional potential point of failure to your site. Fonts are not that big‡: how great a hardship would it be to copy them to your own site, and link to them there? ‡Had a quick check of my /usr/share/fonts/truetype/noto/ directory, which contains an installation of Google’s entire Unicode-friendly “Noto” font collection; that’s got 2380 entries totalling not quite half a gigabyte.

1 0

A Developer Watching QA Test The Product
by Lawrence D'Oliveiro 01 Feb '22

01 Feb '22

Those with OCD tendencies might want to look away ... <https://www.youtube.com/watch?v=baY3SaIhfl0>

1 0

Fwd: [NZLUG] Fwd: Flounder startup 5th Feb 1PM Melbourne time
by Peter Reutemann 01 Feb '22

01 Feb '22

Apologies for cross-posting, but this event might be of interest to some of you. Cheers, Peter ---------- Forwarded message --------- From: Russell Coker <russell(a)coker.com.au> Date: Sun, Jan 30, 2022 at 10:53 PM Subject: [NZLUG] Fwd: Flounder startup 5th Feb 1PM Melbourne time To: DL Neil <nzlug(a)etelligence.info>, Stephen Dalton <steve(a)refactor.com.au>, NZ Linux Users Group <nzlug(a)lists.nzoss.org.nz>, Mark Foster <blakjak(a)blakjak.net> https://flounder.coker.com.au/2022/01/30/flounder-overview/ The FLOSS Down Under group (Flounder) group is starting next Saturday 1PM Melbourne time (the above page summarises it). https://b.coker.com.au/ The above URL will redirect to the meeting URL, it's deliberately short so if your primary device has an issue you can quickly type it into another device. We haven't entirely decided on the main feature, but thinking of having it be hands on training on BTRFS and ZFS while at the same time discussing new advances (both new technology and older technology that has become cheaper and thus more usable) in storage for FOSS systems. If there's someone who has experience with Optane on Linux who could give a 10+ minute talk about it then please contact me off list. The meetings will include a summary and discussion of new free software that is noteworthy (with input welcome from anyone who thinks we missed something noteworthy). We will also have some mention of recent security issues and other changes to the environment that we operate in. Anyone who wants to contribute to a meeting can contact me in advance to have some time reserved for a lightning talk or a feature talk at a future meeting. Please forward this message to all free software users groups in Australia and NZ. Note that this is not designed to compete with existing LUGs, but to offer something different. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/ _______________________________________________ NZLUG mailing list NZLUG(a)lists.nzoss.org.nz http://lists.nzoss.org.nz/mailman/listinfo/nzlug -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Bug in Early Creative Commons Licenses Has Enabled a New Breed of Superpredator
by Peter Reutemann 01 Feb '22

01 Feb '22

'Here’s a supreme irony: the Creative Commons licenses were invented to enable a culture of legally safe sharing, spurred by the legal terror campaign waged by the entertainment industry, led by a literal criminal predator who is now in prison for sex crimes. But because of a small oversight in old versions of the licenses created 12 years ago, a new generation of legal predator has emerged to wage a new campaign of legal terror. To make matters worse, this new kind of predator specifically targets people who operate in good faith, only using materials that they explicitly have been given permission to use.' -- source: https://doctorow.medium.com/a-bug-in-early-creative-commons-licenses-has-en… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Review: MNT Reform laptop has fully open hardware and software—for better or worse
by Peter Reutemann 01 Feb '22

01 Feb '22

'If you’re a Linux fan or open source advocate looking for a decent laptop, you actually have some solid options right now—much better, at least, than buying a Windows laptop, installing Linux on it, and hoping for the best. Dell has offered Ubuntu editions of some of its XPS laptops and other PCs for years now, and Lenovo sells a respectable collection of desktops and laptops with Linux. System76 sells a selection of Linux-friendly laptops preloaded with Ubuntu or its own Pop!_OS distribution. The repair-friendly Framework Laptop doesn’t ship with Linux, but it can be configured without an OS, and Framework promises robust Linux support from multiple distributions. But those laptops all have something in common with run-of-the-mill Windows PCs: a reliance on closed-source hardware and, often, the proprietary software and drivers needed to make it function. For some people, this is a tolerable trade-off. You put up with the closed hardware because it performs well, and it supports the standard software, development tools, and APIs that keep the computing world spinning. For others, it’s anathema—if you can’t see the source code for these “binary blobs,” they are inherently untrustworthy and should be used sparingly or not at all. The MNT Reform is a laptop for the latter group. It's a crowdfunded, developed-in-the-open, extensively documented device that cares more about being open than it cares about literally any other aspect of the computing experience. Perhaps predictably, this makes for a laptop that is ideologically pure but functionally compromised.' -- source: https://arstechnica.com/gadgets/2022/01/review-mnt-reform-laptop-has-fully-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GitHub Is Broken
by Lawrence D'Oliveiro 28 Jan '22

28 Jan '22

github.com is currently returning a server-error page.

2 4

Only 90s Web Developers Remember This
by Lawrence D'Oliveiro 28 Jan '22

28 Jan '22

An only-slightly-tongue-in-cheek expletive-laden rant <https://zachholman.com/posts/only-90s-developers/> about how Web development used to be: the wonders of the 1×1 GIF (“To this day it is the only way to vertically center elements”) and the fun of “ ”, to the coming of JavaScript to create the “Technology of Terror”, DHTML (Dynamic HTML).

1 0

A bug lurking for 12 years gives attackers root on most major Linux distros
by Peter Reutemann 27 Jan '22

27 Jan '22

'Linux users on Tuesday got a major dose of bad news—a 12-year-old vulnerability in a system tool called Polkit gives attackers unfettered root privileges on machines running most major distributions of the open source operating system. Previously called PolicyKit, Polkit manages system-wide privileges in Unix-like OSes. It provides a mechanism for nonprivileged processes to safely interact with privileged processes. It also allows users to execute commands with high privileges by using a component called pkexec, followed by the command.' -- source: https://arstechnica.com/information-technology/2022/01/a-bug-lurking-for-12… I think, I saw an update coming through the other day... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fwd: [NZLUG] Fwd: [Linux-aus] Australia (and hopefully NZ) LUG meetings
by Peter Reutemann 26 Jan '22

26 Jan '22

Apologies for cross-posting, but this may be of interest to some of you. Cheers, Peter -------- Original Message -------- From: Mark Foster <blakjak(a)blakjak.net> Sent: January 26, 2022 9:12:30 PM GMT+13:00 To: NZ Linux Users Group <nzlug(a)lists.nzoss.org.nz>, russell(a)coker.com.au Subject: [NZLUG] Fwd: [Linux-aus] Australia (and hopefully NZ) LUG meetings There may be some interest in this initiative from the (now largely defunct, it seems) NZLUG mailing list.... Thanks to Russell for offering up this initiative and trying to make it accessible to New Zealanders as well as Australians. I myself am unlikely to be available but am forwarding this to NZLUG in case there's interest here. Cheers Mark (sometime NZLUG admin; there's still a mailing list with some people subscribed to it... so who knows? :)) -------- Forwarded Message -------- Subject: [Linux-aus] Australia (and hopefully NZ) LUG meetings Date: Wed, 26 Jan 2022 17:45:44 +1100 From: Russell Coker via linux-aus <linux-aus(a)lists.linux.org.au> Reply-To: russell(a)coker.com.au To: linux-aus(a)lists.linux.org.au https://etbe.coker.com.au/2022/01/26/australia-nz-linux-meetings/ I'm starting a new group for online meetings with the aim of giving benefits you can't get from watching YouTube etc. Details of how to connect etc will be available shortly. -- My Main Bloghttp://etbe.coker.com.au/ My Documents Bloghttp://doc.coker.com.au/ _______________________________________________ linux-aus mailing list linux-aus(a)lists.linux.org.au http://lists.linux.org.au/mailman/listinfo/linux-aus To unsubscribe from this list, send a blank email to linux-aus-unsubscribe(a)lists.linux.org.au -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/.

1 0

Who's Paying to Fix Open Source Software?
by Peter Reutemann 26 Jan '22

26 Jan '22

'The Log4Shell exploit "exposes how a vulnerability in a seemingly simple bit of infrastructure code can threaten the security of banks, tech companies, governments, and pretty much any other kind of organization," writes VentureBeat. But the incident also raises some questions: Should large deep-pocketed companies besides Google, which always seems to be heavily involved in such matters, be doing more to support the cause with people and resources? Long-time Slashdot reader frank_adrian314159 shares a related article from a programming author on Dev.To, who'd read hot takes like "Open source needs to grow the hell up." and "Open source' is broken". [T]he log4j developers had this massive security issue dumped in their laps, with the expectation that they were supposed to fix it. How did that happen? How did a group of smart, hard-working people get roped into a thankless, high-pressure situation with absolutely no upside for themselves...? It is this communal mythology I want to talk about, this great open source brainwashing that makes maintainers feel like they need to go above and beyond publishing source code under an open source license — that they need to manage and grow a community, accept contributions, fix issues, follow vulnerability disclosure best practices, and many other things... In reality what is happening, is that open source maintainers are effectively unpaid outsourcing teams for giant corporations. The log4j exploit was first reported by an engineer at Alibaba — a corporation with a market capitalization of $348 billion — so the article wonders what would happen if log4j's team had sent back a bill for the time they'd spend fixing the bug. Some additional opinions (via the "This Week in Programming" column): * PuTTY maintainer Andrew Ducker: "The internet (and many large companies) are dependent on software maintained by people in their spare time, for free. This may not be sustainable." * Filippo Valsorda, a Go team member at Google: "The role of Open Source maintainer has failed to mature from a hobby into a proper profession... The status quo is unsustainable.... GitHub Sponsors and Patreon are a nice way to show gratitude, but they are an extremely unserious compensation structure." Valsorda hopes to eventually see "a whole career path with an onramp for junior maintainers, including training, like a real profession."' -- source: https://news.slashdot.org/story/21/12/18/2016216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Big Surprise Of The Week: Oracle’s Audit Process Is In Cahoots With Sales
by Lawrence D'Oliveiro 26 Jan '22

26 Jan '22

As part of the licensing terms for certain (most?) Oracle products, you have to agree to be audited by the company, to ensure your usage does not exceed the licences you have bought. Such audits are notorious for regularly telling customers that what they thought was compliance with the licence was nothing of the sort, and that they had better hand over more money to make the problem go away. Oracle’s official position has always been that there is some kind of separation between the operations of the audit department and the sales department, so the auditing process was entirely impartial and under no pressure to increase company revenues. Now some ex-Oracle execs are publicly admitting this is a load of nonsense <https://www.theregister.com/2022/01/25/oracle_audits/>. I don’t think Oracle is unique in this. Lots of big software companies (including Microsoft, I believe) offer similar site-licensing of their products, with similar audit requirements. And likely similar outcomes when an audit actually takes place.

1 0

SystemRescueCD is now just SystemRescue
by Lawrence D'Oliveiro 25 Jan '22

25 Jan '22

Since (almost) nobody uses CDs any more, the handy bootable system-fixer Linux distro has dropped the “CD” from its name <https://www.system-rescue.org/>. The latest version, 9.00, is reviewed here <https://www.theregister.com/2022/01/24/systemrescue/>. Not sure what the benefit of the new in-kernel NTFS driver is, since the existing FUSE support works fine, and benchmarks I have seen seem to indicate that one is not unambiguously faster than the other. Seems SystemRescue is very popular with Windows users: “Windows gets its underwear in a twist relatively easily, and it's not generous with tools to fix it.” The writer also says “We would have quite liked to see some tools to help with a dead Linux box, too, though.” But the main (software) issue I get with Linux installations not booting is some screwup in the bootloader, and you can use the Linux installation itself to fix that, by chrooting into it from your SystemRescue boot.

1 0

New MoonBounce UEFI Bootkit Can't Be Removed by Replacing the Hard Drive
by Peter Reutemann 25 Jan '22

25 Jan '22

'Security researchers from Kaspersky said they have discovered a novel bootkit that can infect a computer's UEFI firmware. From a report: What makes MoonBounce -- the name they gave the bootkit -- special is the fact that the malware doesn't burrow and hide inside a section of the hard drive named ESP (EFI System Partition), where some UEFI code typically resides, but instead it infects the SPI flaws memory that is found on the motherboard. This means that, unlike similar bootkits, defenders can't reinstall the operating system and replace the hard drive, as the bootkit will continue to remain on the infected device until the SPI memory is re-flashed (a very complex process) or the motherboard is replaced. According to Kaspersky, MoonBounce marks the third UEFI bootkit they have seen so far that can infect and live inside the SPI memory, following previous cases such as LoJax and MosaicRegressor. Furthermore, MoonBounce's discovery also comes after researchers have also found additional UEFI bootkits in recent months, such as ESPectre, FinSpy's UEFI bootkit, and others, which has led the Kaspersky team to conclude that what was once considered unachievable following the rollout of the UEFI standard has gradually become the norm.' -- source: https://it.slashdot.org/story/22/01/24/1815234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AGM next week
by Peter Reutemann 24 Jan '22

24 Jan '22

Hi everyone We have our AGM coming up on Monday next week, with the following agenda: - President's Report - Treasurer's Report - Election of 2022 Committee - General business - Consumption of pizza (if applicable) However, I'm not sure whether we have a meeting room, as I'm still waiting on the confirmation whether we get our room sponsored or not for the year (head of CMS was on holiday till today). And if we should get it sponsored, then I need to sort out the room booking (which will take time, too). Worst case scenario: it will be an online only one via BigBlueButton. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 7

KDE-Powering Qt's New Framework Lets Developers Bring Ads Into Their Apps
by Peter Reutemann 24 Jan '22

24 Jan '22

'"Qt, the framework that powers the KDE desktop, is announcing support for ads in client-side applications," reports Neowin: This means that application developers will now be able to serve ads in traditional desktop applications.... Windows users have been dealing with this in Metro UI apps since Windows 8 and it's something that's never gone over well on the desktop. While it's doubtful you'll see ads in KDE's core applications, it would be possible for distributions that wish to further monetize their work to fork these applications, placing ads in them.... According to the documentation, the advertising plugin supports a variety of platforms. They are as follows: - Windows 10 - Ubuntu 20.04 - Raspbian Buster - macOS - Android 7.0 — iOS "Our offering aims to disrupt the IoT industry," explains Qt's press release, "enabling new business models and business cases that before were not possible." Reactions have been mixed. Comments on Phoronix ranged from calling it "a great way for boost development on KDE" to "Not sure if I like this."' -- source: https://tech.slashdot.org/story/22/01/22/1751259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

Supply chain attack used legitimate WordPress add-ons to backdoor sites
by Peter Reutemann 24 Jan '22

24 Jan '22

'Dozens of legitimate WordPress add-ons downloaded from their original sources have been found backdoored through a supply chain attack, researchers said. The backdoor has been found on “quite a few” sites running the open source content management system. The backdoor gave the attackers full administrative control of websites that used at least 93 WordPress plugins and themes downloaded from AccessPress Themes. The backdoor was discovered by security researchers from JetPack, the maker of security software owned by Automatic, provider of the WordPress.com hosting service and a major contributor to the development of WordPress. In all, Jetpack found that 40 AccessPress themes and 53 plugins were affected.' -- source: https://arstechnica.com/information-technology/2022/01/supply-chain-attack-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Blender 3.0 Released With More New Features and Improvements
by Peter Reutemann 24 Jan '22

24 Jan '22

'The Free Open Source 3D production software Blender has been released in version 3.0 (official showreel) with more new features, improvements and performance optimizations as well as further improved workflows. In recent years Blender has received an increasing rate of attention from the 3D industry, with various larger businesses such as Epic, Microsoft, Apple and most recently Intel joining the blender foundation and donating to its development fund. Blender has seen an increasing rise in usage in various industries, such as animated feature film production, architecture and game development.' -- source: https://tech.slashdot.org/story/22/01/23/0026257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

New FSF Procedures Let Its 5,000 'Associate Members' Nominate New Board Members
by Peter Reutemann 24 Jan '22

24 Jan '22

'This week the Free Software Foundation's board announced that for the first time in the organization's 37-year-history, its 5,000-plus associate members will now be able to nominate and evaluate candidates for its board of directors. Under new procedures adopted by the FSF board on January 17 and summarized here, the organization will proactively engage associate members with a sufficient history of association with the FSF in the recruiting process by inviting them to suggest board nominees and then research collectively those nominees' suitability for a position on the board, including most importantly their record of commitment to free software ideals.... Following the new procedures, voting members (which include all current directors and are listed here) can start a process to recruit new directors, or a modified process to reconsider existing directors... The FSF intends to first add several new directors in 2022, utilizing these new procedures, and then begin a review of existing directors. The FSF staff and board have made this expanded engagement process a high priority and are working together to put in place the necessary infrastructure to support it, with a target to activate it within the first quarter of 2022... Voting members will review the community's nominations. A nominee may be removed from consideration if at least two voting members vote to do so without opposition from other voting members. The voting members will discuss the candidates and decide which should move forward in the process next. The FSF's associate members will then review each nominee's application, then evaluate and comment on those nominees in a private, staff-moderated discussion forum. Voting members will review this input and privately interview the finalists to assess their candidacy, ideals, and commitment to free software, then vote on their appointment.... The process is designed such that new iterations for both recruiting new directors and reviewing existing directors can be run whenever the need arises in the future. "Opening the director recruitment process to our associate members is a historic and welcome milestone for the FSF," said FSF president Geoffrey Knauth. "We are pleased to engage the free software community in attracting new talent to our leadership who will keep the freedoms.... We have worked hard to strengthen governance standards at the FSF and to create a transparent leadership recruitment process. We look forward to tackling new challenges and opportunities this year." The FSF's announcement calls the new "community engagement process" a "key result of a six-month consultant-led review designed to help make FSF governance and recruitment practices more transparent and participatory, while more systematically ensuring their commitment to the FSF's values and principles."' -- source: https://news.slashdot.org/story/22/01/22/050207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Building Your Own Silicon Chips In Your Parents’ Garage
by Lawrence D'Oliveiro 23 Jan '22

23 Jan '22

Here’s a guy named Sam Zeloof <https://arstechnica.com/information-technology/2022/01/this-22-year-old-bui…> who has been using cast-off equipment from bygone eras to put together his own chip fab. He made his first chip (an op-amp) just about four years ago; it had just six transistors. His second one (more proof of concept of the manufacturing process) had 1200 transistors. He has made a bunch of them, testing each one by hand. He is currently working on his third design, in a plan to get to a full working microprocessor.

1 0

Autodesk Acquires Moxion
by Lawrence D'Oliveiro 20 Jan '22

20 Jan '22

Moxion is an NZ-based company that manages digital “dailies” (raw footage from movie production) for remote working. It is now being acquired by content-creation behemoth Autodesk, known for its CG apps Maya and 3DS Max, among other products <https://www.hollywoodreporter.com/business/digital/autodesk-moxion-digital-…>. Here <https://www.stuff.co.nz/entertainment/film/104976105/moxion-the-kiwi-compan…> is an older backgrounder on the company’s business model. Dating from 2018, it gives some interesting examples of where the logistics of location shooting make their approach superior to traditional methods of managing footage. I’m not sure what the value of the acquitision is. I think I saw a figure of “tens of millions”, which makes Moxion a minnow in typical US terms.

1 0

Is Altering The Appearance Of A Website A Copyright Violation?
by Lawrence D'Oliveiro 20 Jan '22

20 Jan '22

A German court has just decided that a browser extension which strips ads from websites does not violate copyright <https://www.theregister.com/2022/01/19/ad_blockers_copyright_germany/>. One may have concerns with the business model of this particular company, but the general principle of a user being able (perhaps with the help of a third party) to modify a website’s content before displaying it on their own machine seems sacrosanct. However, a similar issue is being re-raised in the US, with a website owner filing a lawsuit against Google for the way its Android search app superimposes its own ads on top of the website display. It has long been decided that this does not violate copyright, but now the plaintiff is trying to argue that a website’s HTML code is not merely “intellectual property”, but actual physical property, so the principle of “trespass to chattels” can be applied to it.

1 0

Are We Getting Closer to the Year of the Linux Desktop?
by Peter Reutemann 19 Jan '22

19 Jan '22

'Earlier this year TechRepublic argued that while 2021 wasn't the year of the Linux desktop, "there was no denying the continued dominance of Linux in the enterprise space and the very slow (and subtle) growth of Linux on the desktop. And in just about every space (minus the smartphone arena), Linux made some serious gains." So would 2022 be the year of the Linux desktop? "Probably not." But developer Tim Wells honestly believes we're getting closer: The idea of the year of the Linux desktop is that there would come a year that the free and open source operating system would reach a stage that the average user could install and use it on their pc without running into problems. Linus Sebastian from Linus Tech Tips recently did an experiment where he installed Linux on his home PC for one month to see if he could use it not only for everyday tasks, but for gaming and also streaming. Ultimately he concluded (in a video just released) that this year will not be the year of the Linux desktop and that while doing everyday stuff was reasonably okay, the state of gaming on Linux (despite Valves lofty goals) is to put it simply, a shit-show. (That's my word, not his)... The experiment done by Linus seems to show that while some games do indeed run well using [Valve's Windows compatibility layer] Proton, there are just as many that run with issues. Some of those issues can be game breaking. Such as the game running, but its multiplayer functionality not working at all. Some games just plain don't work at all due to dependencies on services such as Easy Anti Cheat... In his video Linus mentions that the main problem preventing the "year of the Linux desktop" is the fragmentation. By fragmentation, he means the range of available distributions and the fact that each distribution has (potentially) different versions of libraries and drivers and software that makes the behind the scenes operate.... Flatpak and Snap as well as AppImage are making progress towards fixing this fragmentation issue, but those are not yet perfect either. Flatpak works by ensuring that the expected versions of libraries required for that software are installed along side it and independent of the existing library the distro may provide... Valve have said that the Steamdeck will also use an immutable core operating system for the same reasons. So while Linus is sure that 2022 isn't yet the year of the Linux desktop and that fragmentation is the biggest problem. I think maybe, just maybe, we're closer to solving those problems and closer perhaps to the year of the Linux desktop that some might realise.' -- source: https://linux.slashdot.org/story/22/01/15/0224235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

Safari and iOS users: Your browsing activity is being leaked in real time
by Peter Reutemann 19 Jan '22

19 Jan '22

'For the past four months, Apple’s iOS and iPadOS devices and Safari browser have violated one of the Internet’s most sacrosanct security policies. The violation results from a bug that leaks user identities and browsing activity in real time. The same-origin policy is a foundational security mechanism that forbids documents, scripts, or other content loaded from one origin—meaning the protocol, domain name, and port of a given webpage or app—from interacting with resources from other origins. Without this policy, malicious sites—say, badguy.example.com—could access login credentials for Google or another trusted site when it’s open in a different browser window or tab. Since September’s release of Safari 15 and iOS and iPadOS 15, this policy has been broken wide open, research published late last week found. As a demo site graphically reveals, it’s trivial for one site to learn the domains of sites open in other tabs or windows, as well as user IDs and other identifying information associated with the other sites.' -- source: https://arstechnica.com/information-technology/2022/01/safari-and-ios-bug-r… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linux Malware Sees 35% Growth During 2021
by Peter Reutemann 18 Jan '22

18 Jan '22

'The number of malware infections targeting Linux devices rose by 35% in 2021, most commonly to recruit IoT devices for DDoS (distributed denial of service) attacks. BleepingComputer reports: A Crowdstrike report looking into the attack data from 2021 summarizes the following: - In 2021, there was a 35% rise in malware targeting Linux systems compared to 2020. - XorDDoS, Mirai, and Mozi were the most prevalent families, accounting for 22% of all Linux-targeting malware attacks observed in 2021. - Mozi, in particular, had explosive growth in its activity, with ten times more samples circulating in the wild the year that passed compared to the previous one. - XorDDoS also had a notable year-over-year increase of 123%. [...] The Crowstrike findings aren't surprising as they confirm an ongoing trend that emerged in previous years. For example, an Intezer report analyzing 2020 stats found that Linux malware families increased by 40% in 2020 compared to the previous year. In the first six months of 2020, a steep rise of 500% in Golang malware was recorded, showing that malware authors were looking for ways to make their code run on multiple platforms. This programming, and by extension, targeting trend, has already been confirmed in early 2022 cases and is likely to continue unabated. ' -- source: https://linux.slashdot.org/story/22/01/17/2239204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Why is Android 12 So Buggy?
by Peter Reutemann 18 Jan '22

18 Jan '22

'Android 12 is one of the platform's most ambitious updates in recent history, bringing a major design overhaul to every corner of the operating system. It has also been one of the rockiest Android OS launches in the past few years. From a report: Both Samsung and OnePlus paused the rollout of their stable Android 12-based updates amid reports of serious bugs. Google itself has addressed a laundry list of bug reports from Pixel 6 owners, just as it's trying to convince them it's finally figured out how to build a truly premium phone. What in the heck is going on? The short answer is that there are some unique complicating factors at play this year but also that Android is inherently a little bit messy -- that just comes with the territory when you're designing a delightful public park compared to Apple's walled garden. Despite a refreshed look and some appealing new high-end handsets, Android is still Android -- the good and the bad. To try and figure out what the heck is going on, we talked to Mishaal Rahman, former editor-in-chief of XDA Developers, who's well known for digging into Android codebases and discovering Google's secrets. Speaking to the Pixel 6 bugs in particular, Rahman guesses that it has a lot to do with the unusually large size of the update. "Many people have called it, myself included, the biggest OS update to Android since Android 5.0 Lollipop, and that was many years ago. There are just so many massive changes to the interface and to the feature set." He also suggests that Google's commitment to issue a new Android update every year can make things worse when it's trying to do so much, and the self-imposed one-year development cycle doesn't leave much wiggle room in the timeline. "They started immediately after Android 11 was released to the public -- and they have a hard cutoff date... After that, they just focus on fixing bugs." Delay any longer, and they'd risk bumping into next year's development cycle. It's also possible that the attempt to bring timely Android updates to non-Google devices wound up backfiring. Android phone owners have been asking for faster updates for a long time -- outside of Google's Pixel phones and pricey flagships, many devices face long waits for OS updates. Sure enough, the updates have come faster this year. Case in point: Samsung users are accustomed to waiting about three months after an Android stable release to get their finished One UI update with the new version of the OS, but this year, One UI 4.0 arrived just one and a half months after Android 12. But the way things have gone this year, many users would likely have opted for a slower, stable update rather than a fast one riddled with bugs.' -- source: https://mobile.slashdot.org/story/22/01/17/2026239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

EFF praises Android’s new 2G kill switch, wants Apple to follow suit
by Peter Reutemann 17 Jan '22

17 Jan '22

'The Electronic Frontier Foundation is celebrating Google's addition of a 2G kill switch to Android 12. The digital rights group has been campaigning against the dated, insecure 2G cellular standard since 2020, and Android is the first mobile OS to take the group's advice and let users completely disable 2G. In the US, carriers shut down 2G years ago, and the 3G shutdown is already underway. Phones have not really gotten the message, though, and modems still try to connect to any nearby 2G signals automatically. The problem is that 2G is very old, and it's a lot like connecting to a WEP-secured Wi-Fi hotspot—the security is obsolete, so it's easy to crack. If you're in a country where legitimate uses of 2G are long dead, the standard only serves as an attack vector via fake cell phone towers, so why not just shut it off?' -- source: https://arstechnica.com/gadgets/2022/01/eff-praises-androids-new-2g-kill-sw… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Russia says it has neutralized the cutthroat REvil ransomware gang
by Peter Reutemann 17 Jan '22

17 Jan '22

'Russian law enforcement authorities said on Friday that they have arrested 14 people associated with REvil, a top ransomware group that has disrupted critical operations of wealthy targets and held their data hostage. The action, carried out by Russia’s FSB, the successor agency to the KGB, is a rare example of the country’s government cracking down on cybercrime by its citizens. The US and Russia have no extradition treaty in place, and critics have said the Kremlin routinely harbors cybercriminals as long as they don’t target organizations located in the former Soviet Union. The arrests come as tensions between Russia and the US escalate over a standoff involving Ukraine.' -- source: https://arstechnica.com/information-technology/2022/01/russia-says-it-has-n… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Backdoor RAT for Windows, macOS, and Linux went undetected until now
by Peter Reutemann 17 Jan '22

17 Jan '22

'Researchers have uncovered a never-before-seen backdoor malware written from scratch for systems running Windows, macOS, or Linux that remained undetected by virtually all malware scanning engines. Researchers from security firm Intezer said they discovered SysJoker—the name they gave the backdoor malware—on the Linux-based Webserver of a “leading educational institution.” As the researchers dug in, they found SysJoker versions for both Windows and macOS as well. They suspect the cross-platform RAT—short for remote access trojan—was unleashed in the second half of last year. The discovery is significant for several reasons. First, fully cross-platform malware is something of a rarity, with most malicious software being written for one specific operating system. The RAT was also written from scratch and made use of four separate command-and-control servers, an indication that the people who developed and used it were part of an advanced threat actor that invested significant resources. It’s also unusual for previously unseen Linux malware to be found in a real-world attack.' -- source: https://arstechnica.com/information-technology/2022/01/backdoor-for-windows… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GitHub Restores Account of Developer Who Intentionally Corrupted His Libraries
by Peter Reutemann 17 Jan '22

17 Jan '22

'What happened after a developer intentionally corrupted two of their libraries which collectively had more than 20 million weekly downloads and thousands of dependent projects? Mike Melanson's "This Week in Programming" column reports: In response to the corrupted libraries, Microsoft quickly suspended his GitHub access and reverted the projects on npm.... While this might seem like an open and shut case to some — the developer committed malicious code and GitHub and npm did what it had to do to protect its users — a debate broke out around a developer's rights to do what they wish with their code, no matter how many projects and dependencies it may have. "GitHub suspending someone's account for modifying their own code in a project they own however they want spooks me a lot more than NPM reverting a package," [tweeted one company's Director of Engineering & Technology]. "I kind of love what Marak did to make a point and protest to be honest." An article on iProgrammer further outlines the dilemma present in what might otherwise seem like a clear-cut case.... "Yes, it is open source in that you can fork it and can contribute to it but does this mean that GitHub is justified in denying you the right to change or even destroy your own code?" As of last night, however, it would appear that the entire affair is merely one for intellectual debate, as GitHub has indeed lived up to what some might view as its end of the bargain: the developer's account is active, he has been allowed to remove his faker.js library on GitHub (depended upon as it might be), and has since offered an update that he does "not have Donkey Brains".' -- source: https://developers.slashdot.org/story/22/01/15/212234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Host of Youtube-dl Web Site Sued by Major Record Labels
by Peter Reutemann 17 Jan '22

17 Jan '22

'"As part of their growing battle against popular open source software tool youtube-dl, three major music labels are now suing Uberspace, the company that currently hosts the official youtube-dl homepage," reports TorrentFreak: According to plaintiffs Sony, Universal and Warner, youtube-dl circumvents YouTube's "rolling cipher" technology, something a German court found to be illegal in 2017.... While the RIAA's effort to take down youtube-dl from GitHub grabbed all the headlines, moves had already been underway weeks before that in Germany. Law firm Rasch works with several major music industry players and it was on their behalf that cease-and-desist orders were sent to local hosting service Uberspace. The RIAA complained that the company was hosting the official youtube-dl website although the tool itself was hosted elsewhere. "The software itself wasn't hosted on our systems anyway so, to be honest, I felt it to be quite ridiculous to involve us in this issue anyway — a lawyer specializing in IT laws should know better," Jonas Pasche from Uberspace said at the time. In emailed correspondence today Uberspace informed TorrentFreak that, following the cease-and-desist in October 2020, three major music labels are now suing the company in Germany... According to the labels, youtube-dl poses a risk to their business and enables users to download their artists' copyrighted works by circumventing YouTube's technical measures. As a result, Uberspace should not be playing a part in the tool's operations by hosting its website if it does not wish to find itself liable too.... The alleged illegality of youtube-dl is indeed controversial. While YouTube's terms of service generally disallow downloading, in Germany there is the right to make a private copy, with local rights group GEMA collecting fees to compensate for just that. Equally, when users upload content to YouTube under a Creative Commons license, for example, they agree to others in the community making use of that content. "Even if YouTube doesn't provide video download functionality right out of the box, the videos are not provided with copy protection," says former EU MP Julia Reda from the Society for Freedom Rights (GFF) to NetzPolitik. "Not only does YouTube pay license fees for music, we all pay fees for the right to private copying in the form of the device fee, which is levied with every purchase of smartphones or storage media," says Reda. "Despite this double payment, Sony, Universal and Warner Music want to prevent us from exercising our right to private copying by saving YouTube videos locally on the hard drive."' -- source: https://news.slashdot.org/story/22/01/16/025217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Pine64's Newest Linux Smartphone 'PinePhone Pro Explorer Edition' Now Available for Pre-Order
by Peter Reutemann 17 Jan '22

17 Jan '22

'"Linux fans rejoice!" writes Hot Hardware. " Pine64's newest smartphone is officially available for pre-order." PinePhone Pro Explorer Edition pre-orders opened up Tuesday. Devices that are pre-ordered before January 18th will be shipped from Pine64's Hong Kong warehouse by January 24th and should arrive by early February.... According to Pine64, the PinePhone Pro Explorer Edition is the "fastest mainline Linux smartphone on the market." It uses a Rockchip RK3399S SoC that is composed of two ARM A72 cores (1.5GHz) and four A53 efficiency cores (1.5GHz).... Consumers will also likely be pleased with the price of the device. The PinePhone Pro Explorer Edition currently rings in at $399 USD. The production run is purportedly "large" and interested consumers should therefore be able to easily purchase the device at this price. Liliputing adds: While the PinePhone Pro has better hardware than the original PinePhone, Pine64 plans to continue selling both phones indefinitely. The first-gen phone will continue to sell for $150 to $200, offering an entry-level option for folks that want to experiment with mobile Linux, while the higher-priced PinePhone Pro should offer a hardware experience closer to what folks would expect from a modern mid-range phone.... In addition to the PinePhone Keyboard, the recently launched PinePhone wireless charging case, fingerprint reader case, and LoRa cases should all work with either phone. But the new phone has a faster processor, more memory and storage, higher-resolution cameras, a higher-speed USB-C port and support for WiFi 5 and Bluetooth 4.1. And those features should make it a little more viable as a replacement for an iPhone or Android device... if you're comfortable running work-in-progress software. They also add that "Thanks to the recent launch of the $50 PinePhone Keyboard, you can also think of the PinePhone Pro as a $400 phone that can be used as a $449 mini-laptop...." And the Pine64 site's January update also points out that "Pico 8 Raspberry Pi port works on the PinePhone," adding "yes, it does run DOOM."' -- source: https://mobile.slashdot.org/story/22/01/16/0051226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Pine64's 'PineNote' E-Ink Tablet Now Available for $399 for Developers
by Peter Reutemann 17 Jan '22

17 Jan '22

'"The PineNote is a tablet with a 10.1 inch grayscale E Ink display and pen support," reports Liliputing. "It's designed to be a hackable, Linux-friendly device and it's one of the latest products from the makers of the PinePhone and PineBook line of devices." First introduced last summer, the PineNote began shipping to developers in limited quantities in December. Now it's available for anyone to purchase for $399 — no invitation required. But it's probably only a good idea to buy one if you're a developer or very early adopter because there's very little software available for the PineNote so far. At this point, Pine64 is shipping the PineNote without an operating system installed. It will have only a bootloader, allowing developers and enthusiasts to load their own software... [D]evelopers have already made some progress in getting builds Alpine and Debian Linux to run on the E Ink slate, and according to Pine64, there are ports for NixOS and other operating systems on the way. There's already a partially working display driver, but it's still a work in progress. The goal is to allow developers to port mainline Linux operating systems and applications to play well with a monochrome display with a slow refresh rate. Developers have also figured out how to enable support PineNote's touchscreen, audio playback, and USB port, making it possible to use USB keyboards, storage devices, and other peripherals.' -- source: https://hardware.slashdot.org/story/22/01/16/012231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Adhole, the Massive Public Pi-hole Instance, Shuts Down
by Peter Reutemann 14 Jan '22

14 Jan '22

'segaboy81 writes: I've been running Pihole for years (for myself), but this guy was running one for everybody! Since 2017, those not so savvy who still wanted the experience of Pi-hole, could turn to Adhole.org. That is, until now. Adhole.org is shutting down, citing issues with maintenance and stability' -- source: https://it.slashdot.org/story/22/01/13/1858208 Haven't used Pi-Hole myself, but maybe someone here would be willing to demo it at one of our up-coming meetings? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Nikola Static Website Generator now supports Māori language
by Ian Stewart 13 Jan '22

13 Jan '22

Kia ora, The developers of the Nikola static website and blog generator ( https://getnikola.com/ ) recently released version 8.2.0. The website generator is written in python and is an open-source project that is developed on a github repository ( https://github.com/getnikola/nikola ) Nikola V8.2.0 supports 55 languages and now includes support for Māori. Thus a website may be built that is only in Māori. Alternatively a website may default to displaying English and then have the options to select Māori, French or Chinese, etc. For details on how to install Nikola refer to: https://getnikola.com/getting-started.html Kia pārekareka, Ian.

1 0

Raspberry Pi Can Detect Malware By Scanning For Electromagnetic Waves
by Peter Reutemann 13 Jan '22

13 Jan '22

'Gizmodo reports: A team of researchers at France's Research Institute of Computer Science and Random Systems created an anti-malware system centered around a Raspberry Pi that scans devices for electromagnetic waves. As reported by Tom's Hardware, the security device uses an oscilloscope (Picoscope 6407) and H-Field probe connected to a Raspberry Pi 2B to pick up abnormalities in specific electromagnetic waves emitted by computers that are under attack, a technique the researchers say is used to "obtain precise knowledge about malware type and identity." The detection system then relies on Convolution Neural Networks (CNN) to determine whether the data gathered indicates the presence of a threat. Using this technique, researchers claims they could record 100,000 measurement traces from IoT devices infected by genuine malware samples, and predicted three generic and one benign malware class with an accuracy as high as 99.82%. Best of all, no software is needed and the device you're scanning doesn't need to be manipulated in any way. As such, bad actors won't be successful with their attempts to conceal malicious code from malware detection software using obfuscation techniques. "Our method does not require any modification on the target device. Thus, it can be deployed independently from the resources available without any overhead. Moreover, our approach has the advantage that it can hardly be detected and evaded by the malware authors," researchers wrote in the paper.' -- source: https://hardware.slashdot.org/story/22/01/12/2214257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Reinvention Of The Chord Keyboard
by Lawrence D'Oliveiro 13 Jan '22

13 Jan '22

Someone else has invented a new chord keyboard <https://www.nzherald.co.nz/technology/the-end-of-the-qwerty-keyboard-new-ga…>. The idea of being able to type using multiple fingers for each keystroke, instead of just one, is not new. There is also the convenience aspect, for example being able to mount the two halves on the sides of your body, so you can use the keyboard on the go. And adding a predictive system allows it to exceed the speeds of the world’s fastest typists on a conventional keyboard. But the drawback is always the same: it needs special training to use, and most people simply cannot be bothered. Come to think of it, is there any reason you cannot add chord recognition to a conventional typewriter-style keyboard? As in holding down multiple non-modifier keys at once.

2 1

Something Is Jamming Our Remote Car Locks ...
by Lawrence D'Oliveiro 13 Jan '22

13 Jan '22

This is such a weird story <https://www.nzherald.co.nz/nz/hamilton-customers-unable-to-lock-cars-after-…>, and right in our neighbourhood, too: Customers at a Hamilton shopping complex were mysteriously unable to lock their cars on the weekend after a rather bizarre fault in the centre's system. ... On January 11, The Base Shopping Centre confirmed the issue on social media. "We have received reports of an issue that interfered with vehicle remote locking over the weekend. "This has been linked to an incident off-site which was out of our control and is being addressed. No malicious or intentional signal blocking activity was involved." The next day: "An external electrical event had caused a fault to onsite equipment resulting in the interference - this equipment has now been reset and checked by authorities. ..." No mention of what exactly the “system” or “equipment” was, or the “event” was about ... Were any readers of this list there at the time?

2 1

Hotel Chain Switches To Chrome OS To Recover From Ransomware Attack
by Peter Reutemann 13 Jan '22

13 Jan '22

'A Scandinavian hotel chain that fell victim to a ransomware attack last month said it took a novel approach to recover from the incident by switching all affected systems to Chrome OS. The Record reports: Nordic Choice Hotels, which operates 200 hotels across Northern Europe, fell victim to a ransomware attack on December 2, when hackers encrypted some of its internal systems using the Conti ransomware strain. The attack prevented staff from accessing guest reservation data and from issuing key cards to newly arriving guests, as one of the hotel's guests told The Record in an interview last month. But in a press release today, Nordic Choice said that instead of contacting the hackers and negotiating a ransom for the decryption key that would have unlocked the infected devices, the hotel chose to migrate its entire PC fleet from Windows to Chrome OS. "[I]n less than 24 hours, the first hotel was operating in the Chrome OS ecosystem from Google. And in the following two days, 2000 computers were converted all over the company consisting of 212 hotels in five different countries," the hotel chain explained. Kari Anna Fiskvik, VP Technology at Nordic Choice Hotels, said the hotel had already run a pilot program to test the tool before the attack as a way to save money by reusing old computers with a less-demanding OS. "So when we suddenly had to deal with the cyberattack, the decision to go all in and fasttrack the project was made in seconds," Fiskvik said. Nordic Choice said it plans to migrate another 2,000 computers to Chrome OS, on top of the 2,000 it migrated during the attack. The hotel chain said they expect to save $6.7 million by converting old computers to Chrome OS instead of buying new hardware.' -- source: https://yro.slashdot.org/story/22/01/11/227251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Is Going To Track Facebook Tracking You
by Peter Reutemann 13 Jan '22

13 Jan '22

'Gizmodo reports: Researchers at Mozilla announced this week the launch of its "Facebook Pixel Hunt" study, which seeks to track the company's immense web-wide tracking network and investigate the intel it's collecting on users. As the name suggests, this study is focused on a piece of tracking tech known as the "Facebook pixel." Chances are, you've visited a site that uses it; these tiny pieces of tech are buried in literally millions of sites across the web, from online stores to news outlets to... well, you name it. In exchange for onboarding a free pixel on their site, these sites can then track their own visitors and microtarget ads with the same sort of precision you'd expect from a data-hungry company like Facebook. In exchange for giving these sites the power to track every pageview, purchase, search query, and much, much more, Facebook (naturally) requires that this data be shared with it, too. In cases where the website visitor has an account on some Facebook platform, this offsite data just gets glombed onto whatever Facebook already knows about that person. If they don't have a Facebook account, then the company collects that data anyway, and uses it to create a "shadow profile" of that particular person. These are the sorts of shadowy practices that Mozilla's team wants to research with this study -- and you can help them do it if you're a Firefox user. Mozilla teamed up with reporters from the Markup to gather details about Facebook tracking using a free-to-download browser extension, Mozilla Rally, that will hoover up data sent out by Facebook's pixels as you browse across the web. Aside from that data, the extension also keeps track of the time spent on different web pages, the URLs that the browser visits, and more. Mozilla was quick to note in its announcement that the only data being exported from the extension will be de-identified, and not shared with any third parties besides the Markup's reporters.' -- source: https://news.slashdot.org/story/22/01/11/2257237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome Will Limit Access To Private Networks, Citing Security Reasons
by Peter Reutemann 13 Jan '22

13 Jan '22

'Google says that its Chrome browser will soon block internet websites from querying and interacting with devices and servers located inside local private networks, citing security reasons and past abuse from malware operations. From a report: The change will take place through the implementation of a new W3C specification called Private Network Access (PNA) that will be rolled out in the first half of the year. The new PNA specification adds a mechanism inside the Chrome browser through which internet sites can ask systems inside local networks for permission before establishing a connection. If local devices, such as servers or routers fail to respond, internet websites will be blocked from connecting.' -- source: https://it.slashdot.org/story/22/01/12/2012211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 96 Yields Less Load On The Main Thread, WebP Encoder For Canvas
by Peter Reutemann 12 Jan '22

12 Jan '22

'Firefox 96.0 is officially shipping today as the first update of 2022 for this open-source web browser. From a report: Firefox 96.0 has "significantly" reduced the amount of load placed on the browser's main thread and there is also "significant" improvements in noise suppression and auto-gain-control and improvements in echo cancellation. In addition to that performance work, there are also WebRTC improvements, an improved cookie policy to reduce the likelihood of Cross-Site Request Forgery (CSRF) attacks, video quality degradation fixes, and other fixes. Over on developer.mozilla.org are some of the web developer changes with Firefox 96 including CSS color value function hwb() support for specifying the hue/whiteness/blackness, support for the CSS color-scheme property, the Web Locks API is enabled by default, image encoder support for WebP for exporting HTML5 canvas elements, and other additions.' -- source: https://news.slashdot.org/story/22/01/11/1639243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chip Shortage Has Canon Telling Customers How To Defeat Its DRM
by Peter Reutemann 11 Jan '22

11 Jan '22

'Ars Technica: For years, printers have been encumbered with digital rights management systems that prevent users from buying third-party ink and toner cartridges. Printer companies have claimed that their chip-enabled cartridges can "enhance the quality and performance" of their equipment, provide the "best consumer experience," and "protect [the printers] from counterfeit and third-party ink cartridges." Left unsaid is the fact that requiring first-party cartridges also ensures a recurring revenue stream. It's an old business model -- Gillette sold its razor handles cheaply to sell more razors, for example -- and it's one that printer companies have enthusiastically embraced. Lexmark, HP, Canon, Brother, and others all effectively require users to purchase first-party ink and toner. To enforce the use of first-party cartridges, manufacturers typically embed chips inside the consumables for the printers to "authenticate." But when chips are in short supply, like today, manufacturers can find themselves in a bind. So Canon is now telling German customers how to defeat its printers' warnings about third-party cartridges. "Due to the worldwide continuing shortage of semiconductor components, Canon is currently facing challenges in procuring certain electronic components that are used in our consumables for our multifunction printers (MFP)," a Canon support website says in German. "In order to ensure a continuous and reliable supply of consumables, we have decided to supply consumables without a semiconductor component until the normal supply takes place again." [...] The software on these printers comes with a relatively simple way to defeat the chip checks. Depending on the model, when an error message occurs after inserting toner, users can press either "I Agree," "Close," or "OK." When users press that button, the world does not end. Rather, Canon says users may find that their toner cartridge doesn't give them a low-toner warning before running empty. "Although there are no negative effects on print quality when consumables are used without electronic components, certain additional functions, such as the detection of the toner level, may be impaired," Canon's support site says.' -- source: https://hardware.slashdot.org/story/22/01/10/1959243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Is Antivirus Software More Trouble Than It’s Worth?
by Lawrence D'Oliveiro 11 Jan '22

11 Jan '22

<https://www.theregister.com/2022/01/10/opinion_column_consumer_av/>: Game knows game. Thus it came as little surprise that Norton's consumer security software not only sprouted a cryptominer that slurps your computer's life essence and skims a cut, but that it's hard to turn it off. ... Now? Even the meanest computer has hardware and software architectures that can be, and often are, configured for very high resilience against classic virus attacks. The observant may have noted that data security has not been solved – but the attacks aren't the sort of thing that resident consumer AV software can do much about. Endpoint protection managed in the cloud, whether explicit anti-malware services or OS-led protection as seamless as Chrome OS or through aggressive online patching, is as good as it's going to get. Keep up to date, and third-party security software you have to manage has no right to your system at all. Obvious question: how long before proprietary “OS-managed” or “cloud-managed” antimalware starts resorting to the same sharp practices as the consumer-grade stuff? Just consider how often Microsoft has tricked or strong-armed users into installing things they may not want, and made it hard to remove them ...

2 1

Source Of The Famous “Now You Have Two Problems” Quote
by Lawrence D'Oliveiro 11 Jan '22

11 Jan '22

Lots of us have come across this: Some people, when confronted with a problem, think “I know, I'll use regular expressions.” Now they have two problems. -- usually attributed to Jamie Zawinski The form of this joke is also versatile enough to adapt to dumping on other things that the speaker might not like, e.g. “Some people, when confronted with a memory-management programming problem, think ‘I know, I’ll use a garbage-collected language.’ Now they have two problems.” Some time back, a guy named Jeffrey Friedl published a book called “Mastering Regular Expressions”, and the Slashdot discussion† got flooded with posts quoting this at him. So he took the trouble to track down the precise provenance of the quote, and how it had spread. His report is here <http://regex.info/blog/2006-09-15/247>. While his original blog post was put up in 2006, the last update is from the end of 2020. Some reader comments are interesting, too. By the way, something I didn’t know before, is that Jamie Zawinski really, really hates Perl. Or at least he used to. †I told you it was some time back.

1 0

Linux Mint Sells Out for Mozilla Money
by Peter Reutemann 11 Jan '22

11 Jan '22

'Brian Fagioli, reporting for BetaNews: The developers of the Ubuntu-based operating system have agreed to accept an undisclosed amount of money from Mozilla in exchange for making significant changes to Linux Mint. This includes removal of modifications to Firefox and a big change for search. The devs share the upcoming changes to Firefox in Linux Mint 19 and higher. The default start page no longer points to https://www.linuxmint.com/start/ The default search engines no longer include Linux Mint search partners (Yahoo, DuckDuckGo...) but Mozilla search partners (Google, Amazon, Bing, DuckDuckGo, Ebay...) The default configuration switches from Mint defaults to Mozilla defaults. Firefox no longer includes code changes or patches from Linux Mint, Debian or Ubuntu.' -- source: https://linux.slashdot.org/story/22/01/10/1930243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Invents The “Year 2022” Bug
by Lawrence D'Oliveiro 04 Jan '22

04 Jan '22

Microsoft released a new version of Exchange Server at the start of the new year, which promptly caused everybody’s on-premises servers to crash. The reason? The version number. There is apparently code somewhere in the bowels of the software that interprets that number as a signed 32-bit integer, computed as the (year - 2000) × 100 million + additional digits for the month and day etc. Spot the problem with that? The largest representable such integer is 2147483647, so the top two digits can’t be greater than 21. So it can’t actually represent the correct version number for any version released after 2021. Why does the code do that? Who knows... Microsoft’s fix? Change the version number to restrict the top two digits to 21, and increment the lower digits instead, beyond their usual range (e.g. so the release date becomes effectively something like “33 December 2021”). They released a PowerShell script to automate the fix, but it might not work properly, so there is an option for a manual fix as well. <https://arstechnica.com/information-technology/2022/01/exchange-server-bug-…>

1 1

Developer creates ‘Quite OK Image Format’ – but it performs better than just OK
by Peter Reutemann 27 Dec '21

27 Dec '21

'A developer named Dominic Szablewski has given the world a new file format with a splendid name: the Quite OK Image Format (QOI). The file format might be better than that. Szablewski explained that he decided the world needed a new image format because the likes of PNG, JPEG, MPEG, MOV and MP4 “burst with complexity at the seams.” “Every tiny aspect screams ‘design by consortium’,” he added, going on to lament the fact that most common codecs are old, closed, and “require huge libraries, are compute hungry and difficult to work with.” Szablewski thought he could do better and appears to have achieved that objective by cooking up some code, floating it on GitHub, and paying attention to the 500-plus comments it generated. While Szablewski admits that QOI will not compress images as well as an optimized PNG encoder, he claims it “losslessy compresses images to a similar size of PNG, while offering 20x-50x faster encoding and 3x-4x faster decoding.”' -- source: https://www.theregister.com/2021/12/21/quite_ok_image_format/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/.

1 0

Second Ransomware Family Exploiting Log4j Spotted In US, Europe
by Peter Reutemann 23 Dec '21

23 Dec '21

'Researchers say a second family of ransomware has been growing in usage for attack attempts that exploit the critical vulnerability in Apache Log4j, including in the U.S. and Europe. VentureBeat reports: A number of researchers, including at cybersecurity giant Sophos, have now said they've observed the attempted deployment of a ransomware family known as TellYouThePass. Researchers have described TellYouThePass as an older and largely inactive ransomware family -- which has been revived following the discovery of the vulnerability in the widely used Log4j logging software. TellYouThePass is the second family of ransomware that's been observed to exploit the vulnerability in Log4j, known as Log4Shell, joining the Khonsari ransomware, according to researchers. While previous reports indicated that TellYouThePass was mainly being directed against targets in China, researchers at Sophos told VentureBeat that they've observed the attempted delivery of TellYouThePass ransomware both inside and outside of China -- including in the U.S. and Europe. "Systems in China were targeted, as well as some hosted in Amazon and Google cloud services in the U.S. and at several sites in Europe," said Sean Gallagher, a senior threat researcher at Sophos Labs, in an email to VentureBeat on Tuesday. Sophos detected attempts to deliver TellYouThePass payloads by utilizing the Log4j vulnerability on December 17 and December 18, Gallagher said. TellYouThePass has versions that run on either Linux or Windows, "and has a history of exploiting high-profile vulnerabilities like EternalBlue," said Andrew Brandt, a threat researcher at Sophos, in an email. The Linux version is capable of stealing Secure Socket Shell (SSH) keys and can perform lateral movement, Brandt said. Sophos initially disclosed its detection of TellYouThePass ransomware in a December 20 blog post. The first report of TellYouThePass ransomware exploiting the Log4j vulnerability appears to have come from the head of Chinese cybersecurity group KnownSec 404 Team on December 12. The attempted deployment of TellYouThePass in conjunction with Log4Shell was subsequently confirmed by additional researchers, according to researcher community Curated Intelligence. In a blog post Tuesday, Curated Intelligence said its members can now confirm that TellYouThePass has been seen exploiting the vulnerability "in the wild to target both Windows and Linux systems." TellYouThePass had most recently been observed in July 2020, Curated Intelligence said. It joins Khonsari, a new family of ransomware identified in connection with exploits of the Log4j vulnerability. ' -- source: https://it.slashdot.org/story/21/12/22/2255231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Patch fixing critical Log4J 0-day has its own vulnerability that’s under exploit
by Peter Reutemann 20 Dec '21

20 Dec '21

'Last Thursday, the world learned of an in-the-wild exploitation of a critical code-execution zero-day in Log4J, a logging utility used by just about every cloud service and enterprise network on the planet. Open source developers quickly released an update that patched the flaw and urged all users to install it immediately. Now, researchers are reporting that there are at least two vulnerabilities in the patch, released as Log4J 2.15.0, and that attackers are actively exploiting one or both of them against real-world targets who have already applied the update. The researchers are urging organizations to install a new patch, released as version 2.16.0, as soon as possible to fix the vulnerability, which is tracked as CVE-2021-45046. ' -- source: https://arstechnica.com/information-technology/2021/12/patch-fixing-critica… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

This USB 'Kill Cord' Can Instantly Wipe Your Laptop if Snatched or Stolen
by Peter Reutemann 18 Dec '21

18 Dec '21

'Journalists, activists, and human rights defenders face a constant battle to keep files safe from a growing set of digital threats and surveillance. But physical attacks can be challenging to defend against, whether an opportunist snatch-and-grab thief or an oppressive government kicking down someone's door. This week, a project called BusKill launched a custom USB magnetic breakaway cable that acts as a "dead man's switch," locking a computer if someone physically snatches it and severs the magnetic connectors. BusKill has been in the works for more than two years as a do-it-yourself project. Anyone with the hardware could compile the source code, but it only worked on Linux and components quickly sold out. After a crowdsourcing effort, the cable is now available to buy starting at $59 and has an accompanying app that works on macOS, Windows, and Linux, allowing the person using the cable to easily arm and disarm the cable with a touch of a button.' -- source: https://tech.slashdot.org/story/21/12/17/1530254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Pop!_OS 21.10 Review
by Lawrence D'Oliveiro 17 Dec '21

17 Dec '21

This review <https://www.theregister.com/2021/12/16/pop_os_2110_new_system76/> of the new version of the Ubuntu variant from System76 mentions a lot of trouble getting it to play nicely with other installed OSes on the same machine. One key difference is that it doesn’t boot with GRUB. Instead, it is EFI-only, and requires your kernel and initial RAM disk to live inside the “EFI System Partition” (ESP), where they can be found by systemd-boot. This typically requires the ESP to be enlarged beyond its initial size. And, depending on the tools you use, that can be problematic. This EFI-only boot procedure can also complicate coexistence with other OS installations on a multiboot system. But, interestingly, not Microsoft Windows, at least according to one of the reader comments. Indeed, a well-known issue where installing Windows on an MBR-based system destroys your ability to boot other OSes goes away with EFI-only booting. Seems Windows is well-enough behaved to only replace its own EFI state, leaving that for other OSes alone.

1 0

AGM next month
by Peter Reutemann 17 Dec '21

17 Dec '21

Hi everyone We have our Annual General Meeting (AGM) coming up on January 24th with the following (preliminary) agenda: - President's Report - Treasurer's Report - Election of 2022 Committee - General business - Consumption of pizza Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/282720630/ BTW Meeting venue (or whether to be held online due to COVID) will be confirmed closer to the date. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Is Building a New AR Device and OS
by Peter Reutemann 15 Dec '21

15 Dec '21

'According to job listings on LinkedIn, Google appears to be working on an augmented reality device and operating system to pair with it. Ars Technica reports: On LinkedIn, operating system engineering director Mark Lucovsky announced that he has joined Google. He previously headed up mixed reality operating system work for Meta, and before that he was one of the key architects of Windows NT at Microsoft. "My role is to lead the Operating System team for Augmented Reality at Google," he wrote. He also posted a link to some job listings at Google that give the impression Google is getting just as serious about AR as Apple or Meta. As 9to5Google discovered, one of the listings ("Senior Software Developer, Embedded, Augmented Reality OS") described Google's objective in clear terms: "Our team is building the software components that control and manage the hardware on our Augmented Reality (AR) products. These are the software components that run on the AR devices and are the closest to the hardware. As Google adds products to the AR portfolio, the OS Foundations team is the very first software team to work with new hardware." Other job listings say new hires will be working on an "innovative AR device." And one specifies that Google is "focused on making immersive computing accessible to billions of people through mobile devices." The roles are largely in the United States, but some are located in Waterloo, Ontario -- the HQ of Canadian smart glasses maker North, which Google acquired in 2020.' -- source: https://tech.slashdot.org/story/21/12/14/2233208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android 12 Go Edition Brings New Speed, Battery, Privacy Features To Lower-end Phones
by Peter Reutemann 15 Dec '21

15 Dec '21

'Google's Pixel 6 line may have served as Android 12's big debut for higher-end phones, but Android 12 (Go edition) plans to bring many of the enhancements and features of Android 12 to lower-end phones, too. Google on Tuesday unveiled a host of new features for the Go edition that are set to roll out to devices in 2022. From a report: Google says that in addition to speed enhancements that'll help apps launch up to 30% faster, Android 12 (Go edition) will include a feature that'll save battery life and storage by automatically "hibernating apps that haven't been used for extended periods of time." And with the Files Go app, you'll be able to recover files within 30 days of deletion. Android 12 (Go edition) will also help you easily translate any content, listen to the news and share apps with nearby devices offline to save data, Google says. The company said Android Go has amassed 200 million users.' -- source: https://mobile.slashdot.org/story/21/12/14/1848213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Log4Shell Vuln Rated 10 Out Of 10
by Lawrence D'Oliveiro 14 Dec '21

14 Dec '21

The Log4Shell vulnerability has been given the highest possible CVE severity rating <https://arstechnica.com/information-technology/2021/12/the-log4shell-zeroda…>. It’s a really, really stupid bug in a logging framework called Log4J, which is used by an incredible variety of Java-based applications, including Minecraft. Log messages are generated according to customizable format templates that the admin can specify. These templates allow the creation of a range of different messages, including all kinds of useful information which can aid in debugging, performance monitoring, usage statistics gathering etc. But one thing you should never, ever do is, having substituted some text from some random source (e.g. user input), go back and scan that text for format substitution codes. But that is what the buggy code does.

1 1

VPOTUS Getting Flak For Her Bluetooth Aversion
by Lawrence D'Oliveiro 14 Dec '21

14 Dec '21

Seems US Vice President Kamala Harris is copping a fair amount of ridicule after saying she prefers wired headphones to wireless Bluetooth ones, for security reasons <https://www.theregister.com/2021/12/13/in_brief_security/>. She’s just listening to her security advisors, folks. And their advice makes sense.

1 0

n-dimensional image tool powers up Python
by Matthew Skiffington 08 Dec '21

08 Dec '21

>From the nature science briefing: A free, open-source and extensible image viewer for arbitrarily complex (‘ <https://nature.us17.list-manage.com/track/click?u=2c6057c528fdc6f73fa196d9d…> *n* <https://nature.us17.list-manage.com/track/click?u=2c6057c528fdc6f73fa196d9d…>-dimensional’) data <https://nature.us17.list-manage.com/track/click?u=2c6057c528fdc6f73fa196d9d…> fills a gap in the Python scientific ecosystem. napari — whose name refers to a Pacific island village midway between the developers’ bases in San Francisco and Melbourne — features a simple graphical interface with a built-in Python console. Early adopters are using it to streamline everything from visualizing atmospheric jet streams to identifying cells in tissue. Nature | 4 min read <https://nature.us17.list-manage.com/track/click?u=2c6057c528fdc6f73fa196d9d…> Cheers,Matthew *Doctoral Researcher, TAIAO project <https://taiao.ai/>**, University of Waikato* *Machine Learning Laboratory, FG.2.01LinkedIn <https://www.linkedin.com/in/matthew-skiffington>*

1 0

A Mysterious Threat Actor is Running Hundreds of Malicious Tor Relays
by Peter Reutemann 07 Dec '21

07 Dec '21

'Since at least 2017, a mysterious threat actor has run thousands of malicious servers in entry, middle, and exit positions of the Tor network in what a security researcher has described as an attempt to deanonymize Tor users. The Record: Tracked as KAX17, the threat actor ran at its peak more than 900 malicious servers part of the Tor network, which typically tends to hover around a daily total of up to 9,000-10,000. Some of these servers work as entry points (guards), others as middle relays, and others as exit points from the Tor network. Their role is to encrypt and anonymize user traffic as it enters and leaves the Tor network, creating a giant mesh of proxy servers that bounce connections between each other and provide the much-needed privacy that Tor users come for. Servers added to the Tor network typically must have contact information included in their setup, such as an email address, so Tor network administrators and law enforcement can contact server operators in the case of a misconfiguration or file an abuse report. However, despite this rule, servers with no contact information are often added to the Tor network, which is not strictly policed, mainly to ensure there's always a sufficiently large number of nodes to bounce and hide user traffic.' -- source: https://it.slashdot.org/story/21/12/06/1941209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FSF's Anti-DRM Campaign Plans Bad-Review Protest Against Disney+
by Peter Reutemann 07 Dec '21

07 Dec '21

'For their fifteenth International Day Against DRM this Friday, the Free Software Foundation's "Defective by Design" campaign is "calling on you to help us send a message to purveyors of Digital Restrictions Management (DRM)". And this year they're targeting Disney+ The ongoing pandemic has only tightened the stranglehold streaming services have as some of the most dominant forms of entertainment media, and Disney+ is among the worst of them. After years of aggressive lobbying to extend the length of copyright, based on their perceived need to keep a certain rat from entering the public domain, they've now set their sights on "protecting" their various franchises in a different way: by shackling them with digital restrictions. If Disney's stated mission is to keep "inspiring hope and sparking the curiosity of all ages", using DRM to limit that curiosity remains the wrong move. This year, we'll be using one of Disney's own means of spreading their "service" and the DRM bundled with it: their mobile app. If you're an existing user of the Google Play (Android) or Apple App Stores, you can support the International Day Against DRM by voicing your objection to Disney's subjugation of their users. Streaming services like Netflix and Peacock have the same issues, but by targeting a newer one with such massive investment and capital behind it, we can make sure that we're heard. Disney+ is new: that gives it time to change. Disney+ is placed near the top of the most frequently downloaded apps on both the Google Play and Apple App Stores. We invite you to write a well-thought objection to Disney's use of DRM, with a fitting review. It is the perfect way to let the corporation, and other users intending to use its services know Disney's grievous mistake in using DRM to restrict customers who already want to view their many films and television shows. It will give you a chance to give them the exact rating that any service that treats its users so poorly: a single star. DRM isn't the only problem with the Disney+ app. It's also nonfree software. If you're not already an Android or iOS user, we don't recommend starting an account just to participate in this action. You can also choose to send an email to Disney executives following our template. They're urging supporters to also share the actions they've taken on social media using the tag #DayAgainstDRM. (And there's also an IRC channel "to discuss and share strategies for anti-DRM activism," with more anti-DRM actions still to come. "While some aspects of the struggle have changed, the core principles remain the same: users should not be forced to surrender their digital autonomy in exchange for media."' -- source: https://slashdot.org/story/21/12/04/187207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 95 Will Include RLBox Sandboxing for Added Security
by Peter Reutemann 07 Dec '21

07 Dec '21

'Mozilla has announced through its Mozilla Hacks blog that it plans to ship a 'novel sandboxing technology' called RLBox with Firefox 95 which it has been developing alongside researchers from the University of California San Diego and the University of Texas. From a report: It said RLBox makes it easier to isolate subcomponents of the browser efficiently and gives Mozilla more options than traditional sandboxing granted it. Mozilla said this new method of sandboxing, which uses WebAssembly to isolate potentially-buggy code, builds on a prototype that was shipped in Firefox 74 and Firefox 75 to Linux and Mac users respectively. With Firefox 95, RLBox will be deployed on all supported Firefox platforms including desktop and mobile to isolate three different modules: Graphite, Hunspell, and Ogg. With Firefox 96, two more modules, Expat and Woff2, will also be isolated.' -- source: https://news.slashdot.org/story/21/12/06/1558251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Blender 3.0 Is Out
by Lawrence D'Oliveiro 04 Dec '21

04 Dec '21

A new major release of Blender, the 3D modelling/animation/sculpting/rendering software, finally hit stable earlier today. The version numbering is now taking bigger jumps. This is a far cry from the old days, when, for example, major new features would come out with only small version number changes (e.g. the Cycles ray-traced renderer appearing in 2.61, geometry nodes in 2.92 etc). My only worry is that the file format only has a single digit for the major version number. What happens after 9.99? Get it from <https://www.blender.org/>. Release notes are at <https://wiki.blender.org/wiki/Reference/Release_Notes/3.0>.

1 0

Regulators Flocking To Block Nvidia’s ARM Acquisition
by Lawrence D'Oliveiro 04 Dec '21

04 Dec '21

The US FTC has joined in <https://arstechnica.com/tech-policy/2021/12/ftc-sues-nvidia-to-preserve-arm…> the growing list of Government regulators from various countries looking askance at Nvidia’s plans to buy ARM. I like their description of ARM as being the “Switzerland” of semiconductors. Also found this interesting fact mentioned: Last year, companies sold 25 billion ARM chips, an increase of more than four-fold since 2010. That’s nearly four chips for every person on the planet. Per year.

2 1

JupyterHub 2.0 Is Out
by Lawrence D'Oliveiro 03 Dec '21

03 Dec '21

Just saw this report <https://devclass.com/2021/12/02/jupyterhub-2/> on the new release of JupyterHub. This is the version of Jupyter designed to support multiuser deployments with proper access control. The new version supports role-based access control with delegation of admin responsibilities, so you can have group admins with control over their particular users but no privileges outside of that. For those new to Jupyter: <https://jupyter.org>.

1 0

70 Years Ago, LEO
by Lawrence D'Oliveiro 01 Dec '21

01 Dec '21

Seventy years ago, in 1951, the world’s first computer built for business use was put into production <https://www.theregister.com/2021/11/30/leo_70/>. It was called “LEO”, short for “Lyons Electronic Office”. The J Lyons company ran a string of teashops across the UK, and an ongoing problem that the shop managers (and central office) faced was how to accurately predict the supplies needed for the next day’s business, given that much of it (cakes etc) was highly perishable, and so had to be manufactured on a few hours’ notice. This “bakery valuation” was a statistical problem, based on crunching a lot of raw data, looking at past demand, seasonal variations etc, and it was still a novel concept that a computer turned out to be better than humans at doing the necessary calculations. The computer turned out to be so useful that the UK Ministry of Supply hired it to get some ballistic calculations done. Later it also did other jobs at the company, like payroll. Actually, a lot of this (except the payroll) sounds to me very much like number-crunching, which would surely have been considered more of a “scientific” than a “business” computing application. Remember, there was this dichotomy between “scientific” and “business” computing use back then, that continued right into about the 1970s. This division existed in hardware (e.g. decimal arithmetic for “business” use, binary for “scientific”) and software (COBOL being the preferred programming language for “business” use, things like FORTRAN and ALGOL for “scientific”). The teashop company spun off the computer business as a separate operation in 1954, which went on to bring out the LEO II and LEO III machines before being acquired by English Electric, which in turn later merged with ICT to create ICL. According to the article linked above, the last LEO machine was decommissioned in 1981, and the last Lyons teashop closed that same year. I first learned about LEO and the Lyons teashops some decades ago, from a book called “Early British Computers”, by Simon Lavington, published in 1980.

1 0

Raspberry Pi Trading Could Go Public This Spring
by Peter Reutemann 30 Nov '21

30 Nov '21

'"According to a report in The Telegraph, Raspberry Pi Trading, the arm responsible for the creation of the Raspberry Pi 4, Raspberry Pi Pico and the new Raspberry Pi Zero 2 W could soon be listed with a value of more than £370m ($493m)," reports Tom's Hardware: Raspberry Pi Trading has hired advisors from two investment banks, Stifel and Liberum to advise on floating the company in spring 2022. The news comes just a few months after Raspberry Pi received a £45m ($60m) investment from Lansdowne Partners and the Ezrah Charitable Trust which was used to fund the development of new products as demand increased during the global pandemic. A source close to The Telegraph has valued Raspberry Pi at a premium of $500m... "Obviously, the $45m we raised in September takes away some of the urgency around figuring out how we fund the future. On the other hand, we have great plans for what we are going to do over the next five years." Eben Upton, talking to The Telegraph.' -- source: https://hardware.slashdot.org/story/21/11/28/2328201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Google Play apps downloaded 300,000 times stole bank credentials
by Peter Reutemann 30 Nov '21

30 Nov '21

'Researchers said they’ve discovered a batch of apps downloaded from Google Play more than 300,000 times before the apps were revealed to be banking trojans that surreptitiously siphoned user passwords and two-factor authentication codes, logged keystrokes, and took screenshots. The apps—posing as QR scanners, PDF scanners, and cryptocurrency wallets—belonged to four separate Android malware families that were distributed over four months. They used several tricks to sidestep restrictions that Google has devised in an attempt to rein in the unending distribution of fraudulent apps in its official marketplace. Those limitations include restricting the use of accessibility services for sight-impaired users to prevent the automatic installation of apps without user consent.' -- source: https://arstechnica.com/information-technology/2021/11/google-play-apps-dow… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Nvidia's DLSS Has Come To Linux Gaming
by Peter Reutemann 29 Nov '21

29 Nov '21

'Years after its failed Steam Machines, Valve is slowly but surely improving the state of Linux gaming. From a report: The company's upcoming Steam Deck handheld runs atop Linux, and its Proton compatibility layer lets it -- and other computers -- play Windows games as well. Now, Valve has officially added support for Nvidia's DLSS machine learning temporal upscaling technique to Proton, potentially bringing big FPS boosts and less flicker in games that support the technology. Proton 6.3-8 is the first stable release to include support for DLSS, after the feature previously hit experimental builds in October, though it appears you'll still need to set PROTON_ENABLE_NVAPI=1 and dxgi.nvapiHack = False to turn it on. DLSS won't come to the AMD-powered Steam Deck, of course, since it requires proprietary Nvidia machine learning silicon, but we recently learned the Steam Deck will support AMDâ(TM)s arguably much less capable FSR.' -- source: https://linux.slashdot.org/story/21/11/27/0325250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AWS Embraces Fedora Linux for Its Cloud-Based 'Amazon Linux'
by Peter Reutemann 29 Nov '21

29 Nov '21

'ZDNet reports: By and large, the public cloud runs on Linux. Most users, even Microsoft Azure customers, run Linux on the cloud. In the case of market giant Amazon Web Services (AWS), the cloud provider will let you run many Linux distros or their own homebrew Linux, Amazon Linux. Now, AWS has released an early version of its next distro, Amazon Linux 3, which is based on Red Hat's community Linux, Fedora. AWS has long tried to incorporate Red Hat Enterprise Linux (RHEL) compatibility into Amazon Linux, but this latest release takes that to new heights. By using Fedora as its upstream, the new Amazon distro, also called AL2022, is a stable distribution. It's gone through extensive testing to offer package stability, and it also includes all available security updates.... TechRadar adds some more details: The distro has had two major releases till now; the first in 2010, and the second in 2017. However, with the third AL2022 release the service is committing to a two year release cycle, with each release supported for a period of five years... AWS argues that the two year major release cycle, with updates shipped quarterly via minor releases, will help keep the software current, while the five year support commitment for each major release will give customers the stability they need to manage long project lifecycles. ' -- source: https://linux.slashdot.org/story/21/11/27/0328223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Addressing 'Bus Factor', PHP Gets a Foundation
by Peter Reutemann 29 Nov '21

29 Nov '21

'How many members of your team are so irreplaceable that if they were hit by a bus, your project would grind to a halt? For PHP, that number is: two. (According to a post by PHP contributor Joe Watkins earlier this year that's now being cited in Mike Melanson's "This Week in Programming" column.) "Maybe as few as two people would have to wake up this morning and decide they want to do something different with their lives in order for the PHP project to lack the expertise and resources to move it forward in its current form, and at current pace," Watkins wrote at the time, naming Dmitry Stogov and Nikita Popov as those two. Well, last week, Nikita Popov was thankfully not hit by a bus, but he did decide to move on from his role with PHP to instead focus his activities on LLVM. Also thankfully, Watkins' article earlier this year opened some eyes to the situation at hand and, as he writes in a follow-up article this week, JetBrains (Popov's employer) reached out to him at the time regarding starting a PHP Foundation. This week, with Popov's departure, the PHP Foundation was officially launched with the goal of funding part/full-time developers to work on the PHP core in 2022. At launch, the PHP Foundation will count 10 companies — Automattic, Laravel, Acquia, Zend, Private Packagist, Symfony, Craft CMS, Tideways, PrestaShop, and JetBrains — among its backers, with an expectation to raise $300,000 per year, and with JetBrains contributing $100,000 annually. Alongside that, the foundation is being launched using foundation-as-a-service provider Open Collective, and just under 700 contributors have already raised more than $40,000 for the foundation. One of the key benefits to creating a foundation, rather than sticking with the status quo, goes beyond increasing the bus factor — it diversifies the influences on PHP. Watkins points out that, for much of the history of PHP, Zend, the employer of Dmitry Stogov, has been a primary financial backer, and as such has had some amount of influence on the language's direction. Similarly, JetBrains had increased influence during its time employing Popov on PHP."To say they have not influenced the direction of the language as a whole would just not be true...." While Watkins says that everything has been above board and gone through standard processes to ensure so, influence is nonetheless indisputable, and that "The Foundation represents a new way to push the language forward..." The current RFC process, JetBrains writes, "will not change, and language decisions will always be left to the PHP Internals community." And in addition, Watkins adds, "It provides us the mechanism by which to raise the bus factor, so that we never face the problems we face today, and have faced in the past."' -- source: https://developers.slashdot.org/story/21/11/27/0225217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Computation-Intensive Research And The Quest For Scientific Reproducibility
by Lawrence D'Oliveiro 26 Nov '21

26 Nov '21

The fruits of scientific research are supposed to be open to all. A key part of this is the need for reproducibility -- the idea that somebody else can repeat the same experiments and analysis and (hopefully) come to the same conclusions. It has long been a common expectation that researchers will make their raw data available to others for this purpose, but nowadays even that is likely no longer enough. The analysis of the data usually requires some particular piece of computer software, even if this was just some in-house scripting done on top of a commonly-available toolkit or package. Two different reports on this subject have come out recently, this one <https://www.theregister.com/2021/11/25/research_software_inquiry/> from the UK and this <https://arstechnica.com/science/2021/11/keeping-science-reproducible-in-a-w…> with examples from the US and elsewhere. The latter goes into a lot more detail, including good news (the rise of publicly-available data sets which get heavily used for many different analyses), and bad: From 2017 through 2019, Tsuyoshi Miyakawa, the editor-in-chief of the journal Molecular Brain, replied to 41 article submissions by requesting that the authors provide their complete source data for review, as per the stated policy of the journal. Only one author did so. ... Based on his efforts to replicate papers from other statisticians, Thomas Lumley, a professor of biostatistics at the University of Auckland in New Zealand, says of the phrase data available upon request: "When people put it in their papers, what they typically mean is 'data not available.'" As for making code available, that has its own challenges: often the scripts/programs are hastily thrown together, and the creators may be embarrassed to have others see it in this state. Or it’s not likely to work properly anyway, outside of the original systems where it was developed. The good news is, bodies that fund the research and the journals that publish the results are becoming more aware of such issues, and increasingly trying to ensure that procedures for dealing with them are built into the projects from the beginning.

3 2

Bye-Bye MIPS
by Lawrence D'Oliveiro 26 Nov '21

26 Nov '21

You know a CPU architecture is really dead when the Linux kernel drops support for it. I just learned that MIPS64 has joined this club as of the 5.15 kernel, according to <https://www.theregister.com/2021/11/25/alpine_3_15/> (presumably “MIPS32” vanished some time before?). Even the company formerly known as “MIPS” is now rebranding (at least its parent) as “Wave”, and is going to base its future products on the RISC-V architecture instead.

1 0

Mozilla Is Ending Support For Its Firefox Password Manager Sync App
by Peter Reutemann 24 Nov '21

24 Nov '21

'Mozilla announced last week via a support article that its Firefox Lockwise password manager app will reach end-of-life on December 13th. The final release versions are 1.8.1 (iOS) and 4.0.3 (Android) and will no longer be available to download or reinstall after that date. The Verge reports: What started in 2018 as a small experimental mobile app called Lockbox ended up bringing a way to access saved passwords and perform autofills on iOS, Android, and desktop devices to a small but enthusiastic following of Firefox fans. The app was also later adapted as a Firefox extension. It seemed like it was apt to stick around for the long run. The support article recommends that users continue accessing passwords using the native Firefox browsers on desktop and mobile. In an added note on the support site, Mozilla suggests that later in December, the Firefox iOS app will gain the ability to manage Firefox passwords systemwide. The note alludes to Mozilla adopting the features of Lockwise and eventually integrating them into the Firefox browser apps natively on all platforms. ' -- source: https://tech.slashdot.org/story/21/11/23/2157244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Trying To Reclaim The Word “Crypto”
by Lawrence D'Oliveiro 24 Nov '21

24 Nov '21

For decades, the word “crypto” has been synonymous with “cryptography”. But increasingly now, some are using it to mean “cryptocurrency” instead. Naturally this is annoying some who have been working in the crypto field for years, and they are demanding that this new (mis)usage be stopped. What do you think? <https://www.theregister.com/2021/11/23/crypto_graphy_or_currency/>

2 2

Attackers Don't Bother Brute-forcing Long Passwords, Microsoft Engineer Says
by Peter Reutemann 23 Nov '21

23 Nov '21

'According to data collected by Microsoft's network of honeypot servers, most brute-force attackers primarily attempt to guess short passwords, with very few attacks targeting credentials that are either long or contain complex characters. From a report: "I analysed the credentials entered from over -- million brute force attacks against SSH. This is around 30 days of data in Microsoft's sensor network," said Ross Bevington, a security researcher at Microsoft. "77% of attempts used a password between 1 and 7 characters. A password over 10 characters was only seen in 6% of cases," said Bevington, who works as Head of Deception at Microsoft, a position in which he's tasked with creating legitimate-looking honeypot systems in order to study attacker trends.' -- source: https://it.slashdot.org/story/21/11/22/2036243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

GoDaddy Security Breach Exposes WordPress Users' Data
by Peter Reutemann 23 Nov '21

23 Nov '21

'Web hosting company GoDaddy said on Monday email addresses of up to 1.2 million active and inactive Managed WordPress customers had been exposed in an unauthorized third-party access. From a report: The company said the incident was discovered on Sept. 6 and the third-party accessed the system using a compromised password.' -- source: https://it.slashdot.org/story/21/11/22/1523234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A German State is Switching Its 25,000 Computers From Windows to Linux
by Peter Reutemann 22 Nov '21

22 Nov '21

'The north-German state of Schleswig-Holstein plans to switch to open source software..." reports Mike Saunders from LibreOffice. "By the end of 2026, Microsoft Office is to be replaced by LibreOffice on all 25,000 computers used by civil servants and employees (including teachers), and the Windows operating system is to be replaced by GNU/Linux." The tech site Foss Force writes: This seems to be a done deal, as the steps for the transition from proprietary to open have already been codified by the Schleswig-Holstein state parliament, and explained in plain language in an interview with Jan Philipp Albrecht, the state's digital minister, that was published in c't, a German language computer magazine (Google Translate version here). In the interview, Albrecht said that part of the transition to open source is already in the works, and pointed out that 90% of state administration conferencing is conducted using the open source video conferencing platform Jitsi. "We have been testing LibreOffice in our IT department for two years, and our experience is clear: it works," he said. "This also applies, for example, when editing Microsoft Word documents with comments... No Linux distribution has been chosen yet to use as a standard, although Albrecht said they're currently looking at five distributions that suit their purposes.' -- source: https://linux.slashdot.org/story/21/11/21/0231218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Thousands of Firefox Users Accidentally Commit Login Cookies On GitHub
by Peter Reutemann 19 Nov '21

19 Nov '21

'Thousands of Firefox cookie databases containing sensitive data are available on request from GitHub repositories, data potentially usable for hijacking authenticated sessions. The Register reports: These cookies.sqlite databases normally reside in the Firefox profiles folder. They're used to store cookies between browsing sessions. And they're findable by searching GitHub with specific query parameters, what's known as a search "dork." Aidan Marlin, a security engineer at London-based rail travel service Trainline, alerted The Register to the public availability of these files after reporting his findings through HackerOne and being told by a GitHub representative that "credentials exposed by our users are not in scope for our Bug Bounty program." Marlin then asked whether he could make his findings public and was told he's free to do so. "I'm frustrated that GitHub isn't taking its users' security and privacy seriously," Marlin told The Register in an email. "The least it could do is prevent results coming up for this GitHub dork. If the individuals who uploaded these cookie databases were made aware of what they'd done, they'd s*** their pants." Marlin acknowledges that affected GitHub users deserve some blame for failing to prevent their cookies.sqlite databases from being included when they committed code and pushed it to their public repositories. "But there are nearly 4.5k hits for this dork, so I think GitHub has a duty of care as well," he said, adding that he's alerted the UK Information Commissioner's Office because personal information is at stake. Marlin speculates that the oversight is a consequence of committing code from one's Linux home directory. "I imagine in most of the cases, the individuals aren't aware that they've uploaded their cookie databases," he explained. "A common reason users do this is for a common environment across multiple machines."' -- source: https://news.slashdot.org/story/21/11/18/2227206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Has a Serious Security Problem That Once Again Enables DNS Cache Poisoning
by Peter Reutemann 18 Nov '21

18 Nov '21

'As much as 38 percent of the Internet's domain name lookup servers are vulnerable to a new attack that allows hackers to send victims to maliciously spoofed addresses masquerading as legitimate domains, like bankofamerica.com or gmail.com. The exploit, unveiled in research presented today, revives the DNS cache-poisoning attack that researcher Dan Kaminsky disclosed in 2008. He showed that, by masquerading as an authoritative DNS server and using it to flood a DNS resolver with fake lookup results for a trusted domain, an attacker could poison the resolver cache with the spoofed IP address. >From then on, anyone relying on the same resolver would be diverted to the same imposter site. The sleight of hand worked because DNS at the time relied on a transaction ID to prove the IP number returned came from an authoritative server rather than an imposter server attempting to send people to a malicious site. The transaction number had only 16 bits, which meant that there were only 65,536 possible transaction IDs. Kaminsky realized that hackers could exploit the lack of entropy by bombarding a DNS resolver with off-path responses that included each possible ID. Once the resolver received a response with the correct ID, the server would accept the malicious IP and store the result in cache so that everyone else using the same resolver -- which typically belongs to a corporation, organization, or ISP -- would also be sent to the same malicious server.' -- source: https://linux.slashdot.org/story/21/11/17/1856235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

meeting next Monday
by Peter Reutemann 18 Nov '21

18 Nov '21

Hi everyone We have a WLUG meeting next week on Monday: 'For the last meeting of the year, let's have general get-together. Ian Stewart will demo the latest Ubuntu 21.10 and Peter Reutemann will try to show what you can use the frp fast reverse proxy for (https://github.com/fatedier/frp) And of course, general Linux related troubleshooting and questions answered.' -- source: https://www.meetup.com/WaikatoLinuxUsersGroup/events/274861098/ This is once again an online event, so make sure to RSVP on meetup to get the link (you only need a browser). Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Latency Numbers Every Programmer Should Know
by Lawrence D'Oliveiro 17 Nov '21

17 Nov '21

Somebody did a nice chart a while back <https://gist.github.com/hellerbarde/2843375> of the time it takes to perform many common data transfer operations on contemporary hardware. And note the multi-part figure, where the basic unit in each block is a bit more than an order of magnitude greater than the one in the previous block. And if the figure isn’t dramatic enough, a commenter has said “let’s multiply all the numbers by a billion” (just to bring them into more human-comprehensible scales), and then liken them to common things that people do, from making a cup of coffee, all the way up to completing a bachelor’s degree.

2 5

Scientists Send Data Using Nuclear Radiation
by Lawrence D'Oliveiro 16 Nov '21

16 Nov '21

A research group has used fast neutrons <https://www.theregister.com/2021/11/15/wireless_information_transfer_with_f…> as a communication channel, to send legible data between a transmitter and a receiver. Their proof of concept is very low-bandwidth and requires a lot of complicated equipment, but at least it does show (safety issues aside) that it is theoretically possible. The issue with high-energy subatomic particles is, how do you turn them on and off at will -- i.e. modulate the intensity of the beam to convey information? This group used some kind of shutter system (“neutron chopper”) in conjunction with some quantity of radioactive californium-252 as their neutron source. But they mention that someone else has come up with a device that is basically a particle accelerator on a chip, able to produce a stream of neutrons from non-radioactive starting components on demand.

1 0

Microsoft Fixes An Issue
by Lawrence D'Oliveiro 16 Nov '21

16 Nov '21

The latest Windows 11 update <https://www.theregister.com/2021/11/15/windows_11_insiders_bug_fixes/> gets ever closer to perfection. I like this one: We fixed an issue that prevents your device from starting up, and it becomes unresponsive because of licensing API calls. Because what would that good old “enrichment of the user experience” be like without licensing API calls ... The writer’s verdict on the new OS sounds more like damning with faint praise: We have been running Windows 11 for daily work since official release and are happy to report that it is usable and stable in our experience so far, though useful improvements over its predecessor are hard to identify.

1 0

DDR4 memory protections are broken wide open by new Rowhammer technique
by Peter Reutemann 16 Nov '21

16 Nov '21

'Rowhammer exploits that allow unprivileged attackers to change or corrupt data stored in vulnerable memory chips are now possible on virtually all DDR4 modules due to a new approach that neuters defenses chip manufacturers added to make their wares more resistant to such attacks. Rowhammer attacks work by accessing—or hammering—physical rows inside vulnerable chips millions of times per second in ways that cause bits in neighboring rows to flip, meaning 1s turn to 0s and vice versa. Researchers have shown the attacks can be used to give untrusted applications nearly unfettered system privileges, bypass security sandboxes designed to keep malicious code from accessing sensitive operating system resources, and root or infect Android devices, among other things. All previous Rowhammer attacks have hammered rows with uniform patterns, such as single-sided, double-sided, or n-sided. In all three cases, these “aggressor” rows—meaning those that cause bitflips in nearby “victim” rows—are accessed the same number of times. Research published on Monday presented a new Rowhammer technique. It uses non-uniform patterns that access two or more aggressor rows with different frequencies. The result: all 40 of the randomly selected DIMMs in a test pool experienced bitflips, up from 13 out of 42 chips tested in previous work from the same researchers.' -- source: https://arstechnica.com/gadgets/2021/11/ddr4-memory-is-even-more-susceptibl… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

topics for next month?
by Peter Reutemann 15 Nov '21

15 Nov '21

Hi everyone Next month will be the last meeting for the year and I'm once again looking for presenters. I can give a short introduction/show'n'tell of frp (fast reverse proxy) and what it can be used for: https://github.com/fatedier/frp Who else is willing to talk about something? It doesn't have to be admin-type stuff at all, but instead useful applications that you use/have come across. If you have something, even just for 5-10 min, please reply in this thread or contact me off-list. Have a great and safe weekend! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 2

Ask Slashdot: Why Is Firefox Losing Users?
by Peter Reutemann 05 Nov '21

05 Nov '21

'This weekend finds some long-time Slashdot readers debating why research shows Firefox losing market share. Long-time Slashdot reader chiguy shares one theory: "Firefox keeps losing users, according to this rant, because it arrogantly refuses to listen to its users." Slashdot reader BAReFO0t countered that that can't be the reason, "because Google does that too." (They blame Chrome's "feature" addition treadmill, where "they keep adding stupid kitchen sinks for the sole and only purpose to make others unable to keep up.") Long-time Slashdot reader Z00L00K thinks that "All those totally unnecessary UI changes are what REALLY annoys users. Not only the immediately visible things in the header but also the renaming of items in the menus just bugs people." But long-time Slashdot reader AmiMoJo argues that "the most popular browser, Chrome, has all those things. In fact all the browsers that are more popular than Firefox do, so the idea that those are unpopular and driving people away doesn't really hold up... Firefox's decline is mostly due to Chrome just being really good, and [Firefox] not having a decent mobile version." I'm still a loyal Firefox user. (Although the thing that annoyed me was when Firefox suddenly changed the keyboard shortcut for copying a link from CNTRL-A to CNTRL-L.) The "rant" at ItsFoss argues that Firefox's original sin was in 2009 when it decided to move tabs to the top of the browser, and when favorite features could no longer be re-enabled in Firefox's about:config file. But that's what I like about Firefox -- at it's best, it's ultimately customizable, with any feature you want easily enabled in what's essentially an incredibly detailed "preferences" menu. Maybe other browsers are just better at attracting new users through purely mechanical advantages like default placement on popular systems? Long-time Slashdot reader zenlessyank is also a long-time Firefox user -- "Been using it since Netscape" -- and countered all the doubters with a comment headlined "Firefox rocks!" "Doesn't matter to me how many other users there are or aren't I will still use it as long as it stays updated." But what are your thoughts? Feel free to share your own opinions and experiences with Firefox in the comments.' -- source: https://news.slashdot.org/story/21/09/12/181257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 7

The Booming Underground Market for Bots That Steal Your 2FA Codes
by Peter Reutemann 04 Nov '21

04 Nov '21

'The bots convincingly and effortlessly help hackers break into Coinbase, Amazon, PayPal, and bank accounts. From a report: The call came from PayPal's fraud prevention system. Someone had tried to use my PayPal account to spend $58.82, according to the automated voice on the line. PayPal needed to verify my identity to block the transfer. "In order to secure your account, please enter the code we have sent your mobile device now," the voice said. PayPal sometimes texts users a code in order to protect their account. After entering a string of six digits, the voice said, "Thank you, your account has been secured and this request has been blocked. Don't worry if any payment has been charged to your account: we will refund it within 24 to 48 hours. Your reference ID is 1549926. You may now hang up," the voice said. But this call was actually from a hacker. The fraudster used a type of bot that drastically streamlines the process for hackers to trick victims into giving up their multi-factor authentication codes or one-time passwords (OTPs) for all sorts of services, letting them log in or authorize cash transfers. Various bots target Apple Pay, PayPal, Amazon, Coinbase, and a wide range of specific banks. Whereas fooling victims into handing over a login or verification code previously would often involve the hacker directly conversely with the victim, perhaps pretending to be the victim's bank in a phone call, these increasingly traded bots dramatically lower the barrier of entry for bypassing multi-factor authentication.' -- source: https://yro.slashdot.org/story/21/11/03/1842245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft's Edge Browser for Linux is Now Available for All Users
by Peter Reutemann 03 Nov '21

03 Nov '21

'A year after releasing the first preview build of its Chromium-based Edge browser for Linux, Microsoft is announcing its general availability. From a report: The new release supports a variety of Linux distributions, including Ubuntu, Debian, Fedora and openSUSE. Microsoft announced Linux on Edge's availability milestone during the first day of its Ignite IT Pro conference. As of the release of Edge for Linux to the "stable" (mainstream user) channel, Edge is now available on Windows, Mac, iOS, Android and Linux. As it did when introducing the new Edge on macOS, Microsoft has been positioning Edge on Linux as more of an offering for IT pros and developers who want to test web sites than as a browser for "normal" users on those platforms. However, any user on any supported platform can use the new Edge.' -- source: https://linux.slashdot.org/story/21/11/02/1627250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

'Trojan Source' Bug Threatens the Security of All Code
by Peter Reutemann 02 Nov '21

02 Nov '21

'"Virtually all compilers -- programs that transform human-readable source code into computer-executable machine code -- are vulnerable to an insidious attack in which an adversary can introduce targeted vulnerabilities into any software without being detected," warns cybersecurity expert Brian Krebs in a new report. An anonymous reader shares an excerpt: Researchers with the University of Cambridge discovered a bug that affects most computer code compilers and many software development environments. At issue is a component of the digital text encoding standard Unicode, which allows computers to exchange information regardless of the language used. Unicode currently defines more than 143,000 characters across 154 different language scripts (in addition to many non-script character sets, such as emojis). Specifically, the weakness involves Unicode's bi-directional or "Bidi" algorithm, which handles displaying text that includes mixed scripts with different display orders, such as Arabic -- which is read right to left -- and English (left to right). But computer systems need to have a deterministic way of resolving conflicting directionality in text. Enter the "Bidi override," which can be used to make left-to-right text read right-to-left, and vice versa. "In some scenarios, the default ordering set by the Bidi Algorithm may not be sufficient," the Cambridge researchers wrote. "For these cases, Bidi override control characters enable switching the display ordering of groups of characters." Bidi overrides enable even single-script characters to be displayed in an order different from their logical encoding. As the researchers point out, this fact has previously been exploited to disguise the file extensions of malware disseminated via email. Here's the problem: Most programming languages let you put these Bidi overrides in comments and strings. This is bad because most programming languages allow comments within which all text -- including control characters -- is ignored by compilers and interpreters. Also, it's bad because most programming languages allow string literals that may contain arbitrary characters, including control characters. "So you can use them in source code that appears innocuous to a human reviewer [that] can actually do something nasty," said Ross Anderson, a professor of computer security at Cambridge and co-author of the research. "That's bad news for projects like Linux and Webkit that accept contributions from random people, subject them to manual review, then incorporate them into critical code. This vulnerability is, as far as I know, the first one to affect almost everything." The research paper, which dubbed the vulnerability "Trojan Source," notes that while both comments and strings will have syntax-specific semantics indicating their start and end, these bounds are not respected by Bidi overrides. [...] Anderson said such an attack could be challenging for a human code reviewer to detect, as the rendered source code looks perfectly acceptable. "If the change in logic is subtle enough to go undetected in subsequent testing, an adversary could introduce targeted vulnerabilities without being detected," he said. Equally concerning is that Bidi override characters persist through the copy-and-paste functions on most modern browsers, editors, and operating systems.' -- source: https://it.slashdot.org/story/21/11/01/2147254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi Zero 2 W: 5x faster than the original for $5 more
by Peter Reutemann 01 Nov '21

01 Nov '21

'The diminutive Raspberry Pi Zero is getting its first upgrade in nearly five years. Today, Raspberry Pi founder Eben Upton announced the Raspberry Pi Zero 2 W, a new $15 product that puts the processor from the Raspberry Pi 3 into a board the exact same size as the original Zero. The new board swaps the old Zero's 1 GHz single-core ARM11 processor for a quad-core Cortex A53-based Broadcom BCM2710A1 processor, also clocked at 1 GHz—the same processor used in the original Raspberry Pi 3 released back in 2016, albeit clocked slightly lower. This is a substantial increase in power and capability for the Pi Zero, going from one core to four and from 32 bits to 64. Upton said that the performance increase over the original Zero "varies across workloads" but that for multithreaded tasks like those simulated by sysbench, "it is almost exactly five times faster." Heat dissipation is provided by "thick internal copper layers" in the board, which should help prevent thermal throttling without the use of additional fans or heatsinks.' -- source: https://arstechnica.com/gadgets/2021/10/raspberry-pi-zero-2-w-crams-pi-3-pa… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Newly-Discovered 'AbstractEmu' Malware Rooted Android Devices, Evaded Detection
by Peter Reutemann 01 Nov '21

01 Nov '21

'"New Android malware can root infected devices to take complete control and silently tweak system settings, as well as evade detection using code abstraction and anti-emulation checks," reports BleepingComputer. Cybersecurity company Lookout said on its blog that they'd spotted the malware on Google Play "and prominent third-party stores such as the Amazon Appstore and the Samsung Galaxy Store.... To protect Android users, Google promptly removed the app as soon as we notified them of the malware." We named the malware "AbstractEmu" after its use of code abstraction and anti-emulation checks to avoid running while under analysis. A total of 19 related applications were uncovered, seven of which contain rooting functionality, including one on Play that had more than 10,000 downloads... This is a significant discovery because widely-distributed malware with root capabilities have become rare over the past five years. As the Android ecosystem matures there are fewer exploits that affect a large number of devices, making them less useful for threat actors... By using the rooting process to gain privileged access to the Android operating system, the threat actor can silently grant themselves dangerous permissions or install additional malware — steps that would normally require user interaction. Elevated privileges also give the malware access to other apps' sensitive data, something not possible under normal circumstances... AbstractEmu does not have any sophisticated zero-click remote exploit functionality used in advanced APT-style threats, it is activated simply by the user having opened the app. As the malware is disguised as functional apps, most users will likely interact with them shortly after downloading... By rooting the device, the malware is able to silently modify the device in ways that would otherwise require user interaction and access data of other apps on the device. "Apps bundling the malware included password managers and tools like data savers and app launchers," reports BleepingComputer, "all of them providing the functionality they promised to avoid raising suspicions..." Lookout's blog post said they'd spotted people affected by the malware in 17 different countries.' -- source: https://it.slashdot.org/story/21/10/31/1253225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Sprite Fright: Not Your Father’s Blender Open Movie
by Lawrence D'Oliveiro 31 Oct '21

31 Oct '21

The latest short feature from the Blender Studio is now out <https://www.blender.org/>. While past efforts have had the occasional sombre, not to say dark, elements, this one just takes the darkness to the next level. It’s an out-and-out horror story, with overtones of environmental retribution in its plot. Carnage, gore, deaths, and just plain ickiness in full measure, packed into a mere 10 minutes. I just hope the script writer is getting therapy ...

1 0

Protonmail Celebrates Swiss Court Victory Exempting it From Telco Data Retention Laws
by Peter Reutemann 28 Oct '21

28 Oct '21

'Encrypted email provider Protonmail has hailed a recent Swiss legal ruling as a "victory for privacy," after winning a lawsuit that sees it exempted from data retention laws in the mountainous realm. From a report: Referring to a previous ruling that exempted instant messaging services from data capture and storage laws, the Protonmail team said this week: "Together, these two rulings are a victory for privacy in Switzerland as many Swiss companies are now exempted from handing over certain user information in response to Swiss legal orders." Switzerland's Federal Administrative Court ruled on October 22 that email providers in Switzerland are not considered telecommunications providers under Swiss law, thereby removing them from the scope of data retention requirements imposed on telcos. The victory comes after controversy over a previous (and not directly related) Swiss court order that forced the company to collect mobile device push notification identifiers from a specified user's account. That user was later arrested by French police, who had asked their Swiss counterparts to obtain the surveillance order. Protonmail chief exec Andy Yen told The Register his business doesn't routinely collect such data on its users.' -- source: https://yro.slashdot.org/story/21/10/27/147224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel Core i9 11900K: Five Linux Distros Show Sizable Lead Over Windows 11
by Peter Reutemann 28 Oct '21

28 Oct '21

'Phoronix: Now that Windows 11 has been out as stable and the initial round of updates coming out, I've been running fresh Windows 11 vs. Linux benchmarks for seeing how Microsoft's latest operating system release compares to the fresh batch of Linux distributions. First up is the fresh look at the Windows 11 vs. Linux performance on an Intel Core i9 11900K Rocket Lake system. Microsoft Windows 11 Pro with all stable updates as of 18 October was used for this round of benchmarking on Intel Rocket Lake. The Windows 11 performance was being compared to all of the latest prominent Linux distributions, including: Ubuntu 20.04.3 LTS, Ubuntu 21.10, Arch Linux (latest rolling), Fedora Workstation 35, Clear Linux 35150. All the testing was done on the same Intel Core i9 11900K test system at stock speeds (any frequency differences reported in the system table come down to how the information is exposed by the OS, i.e. base or turbo reporting) with 2 x 16GB DDR4-3200 memory, 2TB Corsair Force MP600 NVMe solid-state drive, and an AMD Radeon VII graphics card. Each operating system was cleanly installed and then run at its OS default settings for seeing how the out-of-the-box OS performance compares for these five Linux distributions to Microsoft Windows 11 Pro. But for the TLDR version... Out of 44 tests run across all six operating systems, Windows 11 had just three wins on this Core i9 11900K system. Meanwhile Intel's own Clear Linux platform easily dominated with coming in first place 75% of the time followed by Fedora Workstation 35 in second place with first place finishes 9% of the time. The geometric mean for all 44 tests showed Linux clearly in front of Windows 11 for this current-generation Intel platform. Ubuntu / Arch / Fedora were about 11% faster overall than Windows 11 Pro on this system. Meanwhile, Clear Linux was about 18% faster than Windows 11 and enjoyed about 5% better performance overall than the other Linux distributions.' -- source: https://linux.slashdot.org/story/21/10/27/1625217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Setback for Nvidia's $54 Billion ARM Bid as EU Regulators Open Probe
by Peter Reutemann 28 Oct '21

28 Oct '21

'Nvidia suffered a setback on Wednesday as EU antitrust regulators opened a full-scale investigation into its $54 billion bid for British chip designer ARM on concerns the deal could lead to higher prices, less choice and reduced innovation. From a report: Britain's competition agency is also probing the deal for the country's most important technology company, warning that it could damage competition and weaken rivals. Reuters reported the European Commission viewed as insufficient concessions offered by the world's biggest maker of graphics and artificial intelligence (AI) chips during its preliminary review. Nvidia has not disclosed what these are but it has previously said it would maintain ARM as a neutral technology supplier to sooth concerns from customers such as Qualcomm, Samsung and Apple. The Commission said it would decide by March 15 whether to clear or block the deal. "Whilst Arm and Nvidia do not directly compete, Arm's IP is an important input in products competing with those of Nvidia, for example in datacentres, automotive and in Internet of Things," EU competition chief Margrethe Vestager said in a statement.' -- source: https://slashdot.org/story/21/10/27/1648229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android's 12L Feature Drop Aims To Be a Big Improvement for Folding Phones
by Peter Reutemann 28 Oct '21

28 Oct '21

'At this year's Android Dev Summit, Google announced an upcoming update for devices with larger screens, which includes tablets, foldables, and devices that run ChromeOS. From a report: Google is calling the update 12L, and it's supposed to make Android 12 run smoother on big screens. We first heard the possibility of a "12.1" update in late September, and it looks like many of the rumored features are true. 12L optimizes the layout of a device's UI, adjusting the placement of the home screen, lock screen, notifications, Quick Settings, and more. Google notes that any screen 600 density-independent pixels (dp) and above will display a two-column layout that makes use of the entire screen. In the example Google shows, the Quick Settings menu is pushed towards the left side of the screen, while the notifications panel is locked to the right, giving you the ability to access both simultaneously -- all without opening one app and closing another. 12L also introduces a new taskbar that makes it easier for users to quickly switch between different apps. Dragging and dropping an app from the taskbar opens it up in split-screen mode, which Google notes it has enabled for all apps, whether they're resizable or not.' -- source: https://tech.slashdot.org/story/21/10/27/1821200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Trying To Cripple Its Own Open-Source Project
by Lawrence D'Oliveiro 23 Oct '21

23 Oct '21

Microsoft is trying to remove a feature called “Hot Reload” from Dotnet, saying it is something that should only be available through Visual Studio <https://www.theregister.com/2021/10/22/microsoft_net_hot_reload_visual_stud…>. Trouble is, this is the (supposedly) Open-Source version of Dotnet. And you do not take away useful features from Open-Source projects. You can do that to proprietary products, where the users have no choice but to put up with it. As of this writing, the commit that removes the feature has already been merged, but a follow up request to revert that change, while gathering a lot of support, has not been accepted into the official code base yet. As one of the commenters says: “This is the PR that is truly going to decide .NET is really an OSS or not!”. This is just one in a long line of incidents <https://www.theregister.com/2021/10/18/net_foundation_gnome/> casting doubt on the independence of Dotnet as an Open-Source project.

1 0

App Telemetry For Developers
by Lawrence D'Oliveiro 23 Oct '21

23 Oct '21

Here’s an interesting idea <https://www.theregister.com/2021/10/22/new_relic_codestream/>: if an app should crash during a production run, it can send telemetry data back to the developer providing some program state and pinpointing exact locations in the source code. This is done using eBPF (Extended Berkeley Packet Filter), which is able to collect information about running applications with minimal impact. You thought packet-filtering was only about managing network activity, but no, it is more useful than that. Yes, there is potential for this sort of thing to be misused, if it is not correctly managed. With great power comes great responsibility etc. By the way, while eBPF may have its roots in the older BPF as found in the BSDs, it is nevertheless a Linux-only technology <https://ebpf.io/>. Though Microsoft is trying to port some parts of it to Windows <https://cloudblogs.microsoft.com/opensource/2021/05/10/making-ebpf-work-on-…>.

1 0

GPSD Bug Will Switch Your Time-Keeping Systems To March 2002 This Weekend, Unless You Update
by Peter Reutemann 22 Oct '21

22 Oct '21

'"Apparently a bug in GPSD, the daemon responsible for deriving time from the GPS system, is going to trigger on October 24, 2021, jumping the time back to March of 2002," writes Slashdot reader suutar. "There's a fix that's been committed since August, but of course not everything is up to date." ZDNet's Steven J. Vaughan-Nichols writes: This will be ugly. Or, as Stephen Williams, who uncovered the bug put it, "I have a feeling that there will be some 'interesting moments' in the early morning when a bunch of the world's stratum 1 NTP servers using GPSD take the long strange trip back to 2002." GPSD maintainer Gary E. Miller has acknowledged the problem, and a fix has been made to the code. To be exact, the fix is in August 2021's GPSD 3.23 release. So, what's the problem if the fix is already in? Well, there are two problems. First, it won't be backported to previous releases. If you're still using an older version, you may be out of luck. Second, as Miller observed, not all distros "pick up GPSD updates or upstream their patches. [This] is a very sore spot with me." So, just because your operating system is up to date does not mean that it will have the necessary GPSD fix. Miller suggests that you check it and do it yourself: "I [am] gonna fall back on Greg K_H's dictum: All users must update." Oh, wondering what the mysterious root cause of all this commotion GPS Week Rollover? It's a legacy GPS problem. The GPS signal GPS week number uses a 10-bit code with a maximum value of 1,023. This means every 19.7 years; the GPS week number rolls over to zero. Or, as Miller noted, "This code is a 1024 week time warp waiting to happen." So, check your systems now for this problem. And, if, like most of us, you're relying on someone upstream from you for the correct time, check with them to make sure they've taken care of this forthcoming trouble.' -- source: https://it.slashdot.org/story/21/10/21/2053248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Software Freedom Conservancy Sues Vizio for GPL Violations
by Peter Reutemann 21 Oct '21

21 Oct '21

'Jeremy Allison - Sam writes: Software Freedom Conservancy, a non-profit organization that promotes open-source software and defends the free software General Public License (GPL), announced today it has filed a lawsuit against Vizio for what it calls repeated failures to fulfill even the basic requirements of the GPL. The lawsuit alleges that Vizio's TV products, built on its SmartCast system, contain software that Vizio unfairly appropriated from a community of developers who intended consumers to have very specific rights to modify, improve, share, and reinstall modified versions of the software.' -- source: https://yro.slashdot.org/story/21/10/19/2043203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Intel Versus The Chip Foundries
by Lawrence D'Oliveiro 21 Oct '21

21 Oct '21

Nice backgrounder <https://arstechnica.com/tech-policy/2021/10/intel-slipped-and-its-future-no…> on how Intel (and American chipmakers generally) slipped from their leadership position by overlooking an important new business: manufacturing chips according to other people’s designs. We’ve all heard of Taiwan-based TSMC, which is the world leader in this area; when it was founded way back in 1987 (with help from the Taiwanese Government and from Philips), none of the US companies would take such an idea seriously. They didn’t think it would amount to a very profitable business, and anyway they wanted to control their own Intellectual Property. Plus, a company that made chips both for its own internal businesses and for others could never be seen to be entirely above accusations of conflict of interest. Note also the role played by Carver Mead, basically the father of the whole concept of RISC. He wanted a place to go to, where his students (and those of other teachers) could get their designs turned into actual working chips. He had special personal connections with Intel to get access to their fabs, but he knew others were not so lucky. So he played an influential part in getting TSMC started.

1 0

Google Removes Support for FTP and Old-gen U2F Security Keys in Chrome 95
by Peter Reutemann 21 Oct '21

21 Oct '21

'Google today released Chrome v95, the latest version of its popular web browser and a version that contains several changes that will likely cause problems for a considerable part of its users. The problematic changes include: removing support for File Transfer Protocol (FTP) URLs -- ftp:// removing support for the Universal 2nd Factor (U2F) standard, used in old-generation security keys (Chrome will only support FIDO2/WebAuth security keys going forward) adding file size limits for browser cookies removing support for URLs with non-IPv4 hostnames ending in numbers, such as http://example.0.1 In addition to breaking changes, Chrome 95 also comes with a new UI component called the "Side Panel," which can be used to view the Chrome browser's Reading List and Bookmarks.' -- source: https://tech.slashdot.org/story/21/10/20/206210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Supply chain woes lead to a “temporary” Raspberry Pi 4 price hike
by Peter Reutemann 21 Oct '21

21 Oct '21

'Pandemic-driven supply chain problems have prompted the first-ever price increase for a Raspberry Pi product, according to Raspberry Pi founder Eben Upton. Acknowledging that the 2GB configuration of the Raspberry Pi 4 and the Raspberry Pi Zero had been particularly hard-hit by shortages, Upton announced that the price of the 2GB Pi 4 would increase from $35 to $45 and that a previously discontinued version of the Pi 4 with 1GB of RAM would be reintroduced at $35.' -- source: https://arstechnica.com/gadgets/2021/10/supply-chain-woes-lead-to-a-tempora… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Linux laptop offers RTX 3080 and 144 Hz 17-inch screen
by Peter Reutemann 20 Oct '21

20 Oct '21

'Linux users like to game, too, and the Juno Neptune 17-inch V3 laptop announced this week ensures that people on Ubuntu can play their favorite titles on the go. Keeping up with the Alienwares, Asus ROGs, and other Windows-focused gaming brands, the new portable packs up to an RTX 3080 discrete graphics card and the 8-core Intel Core i7-11800H. And it lets you experience all the action on a spacious, 17.3-inch screen with a 144 Hz refresh rate. A colorfully backlit keyboard completes the package.' -- source: https://arstechnica.com/gadgets/2021/10/new-linux-laptop-offers-rtx-3080-an… Well, if you have a spare USD3,699, then the maxed out version can be yours... ;-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Brave Removes Google as its Default Search Engine
by Peter Reutemann 20 Oct '21

20 Oct '21

'As Paul Thurrott reports, Brave is removing Google Search as its default search engine. From the report: Going forward, the Brave web browser will default to Brave Search. "Brave Search has grown significantly since its release last June, with nearly 80 million queries per month," Brave CEO and co-founder Brendan Eich says. "Our users are pleased with the comprehensive privacy solution that Brave Search provides against Big Tech by being integrated into our browser. As we know from experience in many browsers, the default setting is crucial for adoption, and Brave Search has reached the quality and critical mass needed to become our default search option, and to offer our users a seamless privacy-by-default online experience." Brave Search is built on top of an independent index, and doesn't track users, their searches, or their clicks, the firm says. And starting with Brave 1.3 on desktop and Android, and Brave 1.32 on iOS, it will be the default search engine in the browser, instead of Google, in the United States, Canada, and the United Kingdom. It is also replacing Qwant in France and DuckDuckGo in Germany, and Brave says that more locales will be added in the next several months. Existing users can keep their chosen search engine default, of course, and new users who prefer other search engines can configure as needed. Brave Search doesn't display ads today, but the free version of the service will soon be ad-supported. An ad-free Premium version is coming "in the near future," Brave says. Along with this search engine news, Brave announced the Web Discovery Project (WDP), "which it describes as a privacy-preserving system for users to anonymously contribute data to improve Brave Search results," writes Thurrott. "The WDP is an opt-in feature that protects user privacy and anonymity by ensuring that contributed data is not linked to individuals, their devices, or any set of users." It has a GitHub repo available to help you learn more about this system.' -- source: https://tech.slashdot.org/story/21/10/19/2121251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

(virtual) meeting next Monday
by Peter Reutemann 19 Oct '21

19 Oct '21

Hi everyone We have a meeting coming up next week. Due to the small venue size, we will still hold it in a virtual manner, even if Hamilton should go back to level 2 (though we will record it): 'Peter Reutemann will demo Syncthing (https://syncthing.net/) a continuous file synchronization program. It synchronizes files between two or more computers in real time, respecting your privacy. Runs on Linux, Windows, Mac and Android among other platforms.' Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/274861093/ You will get access to the meeting link when RSVPing on meetup. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Quote Of The Week
by Lawrence D'Oliveiro 18 Oct '21

18 Oct '21

From <https://arstechnica.com/gadgets/2021/10/fixes-for-amd-ryzen-performance-oth…>: Now that Windows 11 is out, the arduous process of fixing the new operating system's bugs can begin. So goodbye Windows 10, no PrintNightmare fix for you...

1 0

PowerPC Fork of Firefox Reaches End of the Road
by Peter Reutemann 15 Oct '21

15 Oct '21

'Ars Technica: It has been well over a decade since PowerPC Macs roamed the earth -- so long that the Intel Macs that replaced them are themselves being replaced by something else. But to this day, there's a small community of people still developing software for PowerPC Macs and Mac OS 9. One of those projects was TenFourFox, a fork of the Firefox browser for G3, G4, and G5-based PowerPC Macs running Mac OS X 10.4 or 10.5. Maintained primarily by Cameron Kaiser, the TenFourFox project sprang up in late 2010 after Mozilla pulled PowerPC support from Firefox 4 during its development. And amazingly, the browser has continued to trundle on ever since. But continuing to backport Firefox features to aging, stuck-in-time PowerPC processors only got more difficult as time went on. And in March of this year, Kaiser announced that TenFourFox updates would be ending after over a decade of development. The final planned release of TenFourFox was earlier this month. Kaiser's full post is long, but it's worth a read for vintage-computer enthusiasts or anyone who works on software -- Kaiser expresses frustration with the realities of developing and supporting a niche app, but he also highlights TenFourFox's impressive technical achievements and ruminates on the nature of the modern Internet and open source software development [...]. Kaiser doesn't intend to fully halt work on the browser, but he is downshifting it into what he calls "hobby mode." He will continue to backport security patches from newer ESR releases of Firefox and post them to the TenFourFox Github page, but anyone who wants to use these will need to build the app themselves. Kaiser also won't commit to providing support for these additions or providing them on any kind of schedule. Other developers are also welcome to continue to release TenFourFox builds on their own. ' -- source: https://news.slashdot.org/story/21/10/14/2116255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Modular Framework Laptop Gets Marketplace For All Those Modules
by Peter Reutemann 15 Oct '21

15 Oct '21

'Framework, makers of the modular 13.5-inch Framework laptop that's designed to be easily repaired and upgraded, has launched a dedicated marketplace filled with replacement parts and upgrades for its portable computer. The Verge reports: Writing in a blog post, the company said the marketplace is currently focused on replacement parts and expansion cards, but that it hopes to add more customization modules like additional language keyboards later this year, as well as third-party and community developed modules in 2022. The marketplace already includes a range of expansion cards for the laptop, which are designed to slot into its four modular compartments to add everything from extra storage to features like MicroSD card slots or more USB ports. There's also user upgradeable RAM and storage for sale. But the store is clearly a work in progress, and lists a host of other items like replacement CPU-equipped mainboards, keyboards, and spare parts like batteries and displays as "coming soon." ' -- source: https://hardware.slashdot.org/story/21/10/14/2110258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

OpenBSD 7.0 Released
by Peter Reutemann 15 Oct '21

15 Oct '21

'Everyone's favorite security-focused operating system, OpenBSD, released version 7.0 today. In addition to the usual bug fixes and performance enhancements, support for RISC-V processors has been added. The changelog and mirrors can be found at their respective links.' -- source: https://bsd.slashdot.org/story/21/10/14/217206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Canonical Releases Ubuntu Linux 21.10 Impish Indri
by Peter Reutemann 15 Oct '21

15 Oct '21

'Following a brief beta-testing period, Ubuntu 21.10 has finally become available to download in the "final" stable form. BetaNews: Code-named "Impish Indri," this version of Ubuntu is not a Long Term Support (LTS) version, so it is only supported for nine months. Ubuntu 21.10 features Linux kernel 5.13 and a Snap variant of the Mozilla Firefox browser. "Ubuntu 21.10 brings the all-new PHP 8 and GCC 11 including full support for static analysis, greatly improving everyday developer security awareness in low-level programming. With Gnome 40 desktop users gain dynamic workspaces and touchpad gestures. The new Firefox snap, published by Mozilla, improves security and guarantees access to both the latest and the extended support release versions of the browser. The exact same versions of the browser are available on multiple different versions of Ubuntu, simplifying enterprise developer platform management," says Canonical.' -- source: https://linux.slashdot.org/story/21/10/14/2013235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

LibreOffice, OpenOffice Bug Allows Hackers To Spoof Signed Docs
by Peter Reutemann 12 Oct '21

12 Oct '21

'LibreOffice and OpenOffice have pushed updates to address a vulnerability that makes it possible for an attacker to manipulate documents to appear as signed by a trusted source. Although the severity of the flaw is classified as moderate, the implications could be dire. BleepingComputer reports: The discovery of the flaw, which is tracked as CVE-2021-41832 for OpenOffice, was the work of four researchers at the Ruhr University Bochum. The same flaw impacts LibreOffice, which is a fork of OpenOffice spawned from the main project over a decade ago, and for their project is tracked as CVE-2021-25635. If you're using either of the open-source office suites, you're advised to upgrade to the latest available version immediately. For OpenOffice, that would be 4.1.10 and later, and for LibreOffice, 7.0.5 or 7.1.1 and later. Since neither of these two applications offer auto-updating, you should do it manually by downloading the latest version from the respective download centers -- LibreOffice, OpenOffice. If you're using Linux and the aforementioned versions aren't available on your distribution's package manager yet, you are advised to download the "deb", or "rpm" package from the Download center or build LibreOffice from source. If updating to the latest version is not possible for any reason, you can always opt to completely disable the macro features on your office suite, or avoid trusting any documents containing macros. ' -- source: https://it.slashdot.org/story/21/10/11/212215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New 'FontOnLake' Malware Family Can Target Linux Systems
by Peter Reutemann 11 Oct '21

11 Oct '21

'Security Week reports: A previously unknown, modular malware family that targets Linux systems has been used in targeted attacks to collect credentials and gain access to victim systems, ESET reported on Thursday. Dubbed FontOnLake, the malware family employs a rootkit to conceal its presence and uses different command and control servers for each sample, which shows how careful its operators are to maintain a low profile. What's more, the malware developers are constantly modifying the FontOnLake modules, and use three categories of components that have been designed to work together, namely trojanized applications, backdoors, and rootkits. Evidence suggests that FontOnLake has been used in attacks aimed at organizations in Southeast Asia. The first malware samples related to this family emerged last May. The malware was previously described by Avast and Lacework as the HCRootkit / Sutersu Linux rootkit, as well as by Tencent Security Response Center in a February report. The various trojanized applications that ESET's researchers have identified during their investigation are used to load custom backdoor or rootkit modules, but also to collect sensitive data when needed. Posing as standard Linux utilities, these files were also designed to achieve persistence on the compromised systems. What the researchers haven't figured out yet is the manner in which the trojanized applications are delivered to the victims. ESET's analysis of FontOnLake has revealed the use of three different backdoors, all written in C++, all using the same Asio library from Boost, and all capable of exfiltrating sshd credentials and bash command history. The simplest of the three was designed to launch and mediate access to a local SSH server, update itself, and transmit collected credentials. The malware appears to be under development. The second backdoor was also capable of file manipulation, updating itself, and uploading and downloading files, according to the article, while the third backdoor "accepts remote connections, serves as a proxy and can download and run Python scripts, in addition to exfiltrating credentials."' -- source: https://linux.slashdot.org/story/21/10/10/000240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

All Linux and Mac Computers Get Their Time Zones From the Same Database
by Peter Reutemann 11 Oct '21

11 Oct '21

'"All Linux and Mac-based computers pull their time zones from a massively important database — the time zone database," explains Medium's tech site OneZero. And this vastly crucial project is ultimately overseen by one man who Medium calls "The Time Zone King." The process of defining time zones is centralized. This is actually quite a big deal in its own right because people tend to grossly underestimate how pivotal Linux is to ... the entire internet and technology as we know it... The time zone database — which is sometimes called the Olson data or zoneinfo database — has a fascinating history... Not only are time zones apparently a longstanding menace for computer developers, but the time zone maintenance community is currently, it seems, mired among some procedural dispute regarding how this essential database should best be maintained. Of course that's an interesting fact in its own right: there is a world time zone data community. In fact, The Register recently described them as being no less than " up in arms " about the direction the project was proceeding down... A difference of vision among time zone enthusiasts might be the neatest summary anybody can advance.... Not only can't the time zone titans currently agree on the best way to carry the timezone database forward, it seems. But the entire process of codifying and standardizing time zones is also decidedly contentious political business with a long and tumultuous history to go with it. Those who enter the fray need to be therefore not only technical heavyweights but also prepared to have the occasional audacity to stand up to countries like the Hashemite Republic of Jordan and tell them that their attempt to prematurely end DST is unacceptable and will not be promulgated in the database... Weary time zone mavericks are bursting to the seams with horror stories of African states who made rash time zone decisions on only four days' notice... Time zone data insiders say that every single one of these high stakes deliberations represents a near Y2K disaster that must be averted... At the helm of this project is one individual. One guy. Paul Eggert, a computer scientist who teaches at the Department of Computer Science at the University of California's LA Campus... This is a man, after all, whose codebase helps hundreds of millions of users know what time zone they're in and who — for the past ten years — has gone to bed knowing that hundreds of millions of computers are using his code to know what time zone they're in. He's lived under that pressure for over a decade. And by all accounts thrived... Untold millions have been made by startups announcing dubious advents upon existing technologies heralded with the breathless fanaticism of companies announcing that they have found a way to turn air water into oil. Many of these will vanish into oblivion within a few short years. The time zone database won't. Because it can't. And those at the very bottom of the tech stack — those tirelessly and thanklessly maintaining open source projects upon which so much of the world's computing derives — languish in comparable obscurity... In recent years, the project has fallen under the purview of ICANN [through its Internet Assigned Numbers Authority]. Its code reads like a cross between a JSON file and a historical novel. And while I'm sure the project has many noteworthy contributors, there's ultimately one guy who's responsible for maintaining it. The Time Zone King. His name is Paul Eggert. And he's a computer scientist based out of UCLA. We probably all owe him a 'thank you'.' -- source: https://tech.slashdot.org/story/21/10/10/1950239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0