October 2014 - wlug - list.wlug.org.nz

WLUG meeting next Monday
by Peter Reutemann 06 Nov '14

06 Nov '14

Hi everyone We have a meeting coming up next Monday: "Virtualization has been become commonplace nowadays, with lots of different implementations. Docker provides an as-thin-as-possible approach, making use of the kernel's functionality of resource isolation, eliminating the need for installing an operating system for the guest system. Andrew Parnasov will give an introduction to Docker, how to set it up, how to use and what it can be used for." http://www.meetup.com/WaikatoLinuxUsersGroup/events/197652482/ Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 1

Breaching Air-Gap Security With Radio
by Peter Reutemann 31 Oct '14

31 Oct '14

Not quite Linux, but interesting (scary?) nonetheless... "Security researcher Mordechai Guri with the guidance of Prof. Yuval Elovici from the cyber security labs at Ben-Gurion University in Israel presented at MALCON 2014 a breakthrough method ("AirHopper") for leaking data from an isolated computer to a mobile phone without the presence of a network. In highly secure facilities the assumption today is that data can not leak outside of an isolated internal network. It is called air-gap security. AirHopper demonstrates how the computer display can be used for sending data from the air-gapped computer to a near by smartphone. The published paper and a demonstration video are at the link." -- source: http://it.slashdot.org/story/14/10/31/141207 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Vulnerabilities Found (and Sought) In More Command-Line Tools
by Peter Reutemann 30 Oct '14

30 Oct '14

"The critical Shellshock vulnerabilities found last month in the Bash Unix shell have motivated security researchers to search for similar flaws in old, but widely used, command-line utilities. Two remote command execution vulnerabilities were patched this week in the popular wget download agent and tnftp client for Unix-like systems [also mentioned here]. This comes after a remote code execution vulnerability was found last week in a library used by strings, objdump, readelf and other command-line tools." -- source: http://it.slashdot.org/story/14/10/30/2130248 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Linux computer program brings a smile where it's least expected
by Peter Reutemann 30 Oct '14

30 Oct '14

"Reglue is an organization that has been placing Linux computers in the homes of financially disadvantaged kids since 2005. The program started in central Texas and we'd love to see it grow [...]. Using Linux as the operating system has not been a matter of religion or partisanship. Not even a matter of personal choice. It's a matter of pragmatic necessity. To give you a better picture of why, here's the story of Ricky. In short: We installed a computer for a financially-disadvantaged kid. We taught that kid how to use the computer. That kid was supremely happy with his new Linux computer. We left. The end." -- source: http://opensource.com/life/14/10/reglue-program-linux-computers-kids Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Dangerous Vulnerability Fixed In Wget
by Peter Reutemann 29 Oct '14

29 Oct '14

'A critical flaw has been found and patched in the open source Wget file retrieval utility that is widely used on UNIX systems. The vulnerability is publicly identified as CVE-2014-4877. "It was found that wget was susceptible to a symlink attack which could create arbitrary files, directories or symbolic links and set their permissions when retrieving a directory recursively through FTP," developer Vasyl Kaigorodov writes in Red Hat Bugzilla. A malicious FTP server can stomp over your entire filesystem, tweets HD Moore, chief research officer at Rapid 7, who is the original reporter of the bug.' -- source: http://tech.slashdot.org/story/14/10/29/1333216 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Fwd: [NZOSS-Openchat] Your Drupal website has a backdoor
by Peter Reutemann 29 Oct '14

29 Oct '14

Apologies if you received this already. Cheers, Peter ---------- Forwarded message ---------- From: Bevan Rudge Date: Thu, Oct 30, 2014 at 8:37 AM Subject: [NZOSS-Openchat] Your Drupal website has a backdoor If you administer a Drupal website or know anyone who does, please make sure they see this: Drupal Core - Highly Critical - Public Service announcement - PSA-2014-003 https://www.drupal.org/PSA-2014-003 The short version is; if a Drupal website was not patched within 7 hours of the announcement of Dupal-core-SA-2014-005 (aka Drupageddon) on 16 October (NZ time), it probably has backdoors, and data should be assumed to be compromised. The only safe and certain recovery is to get a new server and restore from backups from before that date. In many ways this is worse than Heartbleed because it is so easy much easier to exploit, and the attacker can get any data they ask for (with Heartbleed, I believe an attacker didn't know what data they were looking at) and control all of Drupal. Most attacks seem to be installing backdoors for sending spam or future amplification of other attacks. But there are many different types of exploits, so assume anything and everything. Cheers, Bevan/ http://Drupal.geek.nz http://Twitter.com/BevanR Sent from Auckland, New Zealand _______________________________________________ Openchat mailing list Openchat(a)lists.nzoss.org.nz http://lists.nzoss.org.nz/mailman/listinfo/openchat -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

OpenBSD Drops Support For Loadable Kernel Modules
by Peter Reutemann 28 Oct '14

28 Oct '14

"The OpenBSD developers have decided to remove support for loadable kernel modules from the BSD distribution's next release. Several commits earlier this month stripped out the loadable kernel modules support. Phoronix's Michael Larabel has not yet found an official reason for the decision to drop support. He wagers that it is due to security or code quality/openness ideals." -- source: http://bsd.slashdot.org/story/14/10/28/1852214 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Firefox OS Coming To Raspberry Pi
by Peter Reutemann 28 Oct '14

28 Oct '14

"Mozilla plans to build a version of its Firefox OS for use in the Raspberry Pi. Plans are afoot to build a version capable of (1) being run on the Pi hardware and (2) eventually achieving parity with Raspbian and (3) enable easy development for robotics." -- source: http://tech.slashdot.org/story/14/10/27/2348204 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

New Oculus SDK Adds Experimental Linux Support and Unity Free For Rift Headset
by Peter Reutemann 25 Oct '14

25 Oct '14

"Oculus, creator of the Rift VR headset, has released a new version of their SDK which brings with it long sought-after support for Linux, which the company says is "experimental." Linux support was previously unavailable since the launch of the company's second development kit, the DK2. The latest SDK update also adds support for Unity Free, the non-commercial version of the popular game authoring engine. Previously, Unity developers needed the Pro version—costing $1,500 or $75/month—to create experiences for the Oculus Rift." -- source: http://linux.slashdot.org/story/14/10/25/1725224 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Italian Supreme Court Bans the 'Microsoft Tax'
by Peter Reutemann 25 Oct '14

25 Oct '14

'In a post at the Free Software Foundation, lawyer Marco Ciurcina reports that the Italian Supreme Court has ruled the practice of forcing users to pay for a Windows license when they buy a new PC is illegal. Manufacturers in Italy are now legally obligated to refund that money if a buyer wants to put GNU/Linux or another free OS on the computer. Ciurcina says, "The focus of the Court's reasoning is that the sale of a PC with software preinstalled is not like the sale of a car with its components (the 4 wheels, the engine, etc.) that therefore are sold jointly. Buying a computer with preinstalled software, the user is required to conclude two different contracts: the first, when he buys the computer; the second, when he turns on the computer for the first time and he is required to accept or not the license terms of the preinstalled software. Therefore, if the user does not accept the software license, he has the right to keep the computer and install free software without having to pay the 'Microsoft tax.'"' -- source: http://tech.slashdot.org/story/14/10/25/1443210 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

5 Deadly Linux Commands You Should Never Run
by Peter Reutemann 23 Oct '14

23 Oct '14

"As a Linux user, you probably have searched online for articles and tutorials that show you how to use the terminal to run some commands. While most of these commands are harmless and could help you become more productive, there are some commands that are deadly and could wipe out your whole machine." -- source: http://goo.gl/fmIOxY I love the obscurity of the fork bomb! Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Turn a Raspberry Pi Into a Super Cheap, Packet-Sniffing Power Strip
by Peter Reutemann 23 Oct '14

23 Oct '14

"If you have a Raspberry Pi and one of those surge protectors that also protects your network cables from voltage fluctuations, you have most of the tools you need to build a cheap network observation device, as long as you're not afraid to use a soldering iron. When you're finished, you'll have the perfect addition to your pen-testing toolkit. " -- source: http://lifehacker.com/5952327 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

How Red Hat is Transforming from a Server-Client to Cloud-Mobile Leader
by Peter Reutemann 23 Oct '14

23 Oct '14

'Red Hat has become a role model for other companies by writing a success story based on open source software and Linux, without a single proprietary component in the soup. The company continues to evolve and transform itself with the changing times to remain a leader, and not simply relevant, unlike many other software giants that are struggling in the market. Everyone is moving towards cloud and mobile; the consumer space has totally switched gears to cloud and mobile, and enterprises aren't far behind. Thomas E. Hogan, CEO of Kony Inc., said a few weeks ago, “With the number of mobile applications downloaded from app stores expected to increase by a 31.7 percent CAGR by 2017, enterprises are realizing that a mobile strategy is no longer a nice-to-have, but a must have."' -- source: http://www.linux.com/news/enterprise/case-studies/792591 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Ubuntu 14.10 Released With Ambitious Name, But Small Changes
by Peter Reutemann 23 Oct '14

23 Oct '14

'Ubuntu 14.10, dubbed Utopic Unicorn, has been released today (here are screenshots). PC World says that at first glance "isn't the most exciting update," with not so much as a new default wallpaper — but happily so: it's a stable update in a stable series, and most users will have no pressing need to update to the newest version. In the Ubuntu Next unstable series, though, there are big changes afoot: Along with Mir comes the next version of Ubuntu’s Unity desktop, Unity 8. Mir and the latest version of Unity are already used on Ubuntu Phone, so this is key for Ubuntu's goal of convergent computing — Ubuntu Phone and Ubuntu desktop will use the same display server and desktop shell. Ubuntu Phone is now stable and Ubuntu phones are arriving this year, so a lot of work has gone into this stuff recently. The road ahead looks bumpy however. Ubuntu needs to get graphics drivers supporting Mir properly. The task becomes more complicated when you consider that other Linux distributions — like Fedora — are switching to the Wayland display server instead of Mir. When Ubuntu Desktop Next becomes the standard desktop environment, the changes will be massive indeed. But for today, Utopic Unicorn is all about subtle improvements and slow, steady iteration.' -- source: http://linux.slashdot.org/story/14/10/23/1946243 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

wlug meeting tomorrow
by Peter Reutemann 23 Oct '14

23 Oct '14

Hi there We've got a WLUG meeting tomorrow - due to Labor Day a week earlier that usual. 'Greg B.: A talk with an overview of the so-called "Crypto2.0" open source projects that are attempting to be overlays for the bitcoin network. Why does bitcoin need overlays and possible future directions in cryptofinance in general? A brief round-up of the emerging Crypto2.0 projects out there, Counterparty, Mastercoin, Bitshares, Ripple, Stellar, Next and CoinSpark. Then a more in-depth discussion of Open-Transactions (openTXS). Peter R.: Running OwnCloud on a Raspberry Pi.' http://www.meetup.com/WaikatoLinuxUsersGroup/events/212122742/ Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 1

BitTorrent Performance Test: Sync Is Faster Than Google Drive, OneDrive, Dropbox
by Peter Reutemann 22 Oct '14

22 Oct '14

"Now that its file synchronization tool has received a few updates, BitTorrent is going on the offensive against cloud-based storage services by showing off just how fast BitTorrent Sync can be. More specifically, the company conducted a test that shows Sync destroys Google Drive, Microsoft's OneDrive, and Dropbox. The company transferred a 1.36 GB MP4 video clip between two Apple MacBook Pros using two Apple Thunderbolt to Gigabit Ethernet Adapters, the Time.gov site as a real-time clock, and the Internet connection at its headquarters (1 Gbps up/down). The timer started when the file transfer was initiated and then stopped once the file was fully synced and downloaded onto the receiving machine. Sync performed 8x faster than Google Drive, 11x faster than OneDrive, and 16x faster than Dropbox." -- source: http://hardware.slashdot.org/story/14/10/22/2012258 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Raspberry Pi Founder Demos Touchscreen Display For DIY Kits
by Peter Reutemann 22 Oct '14

22 Oct '14

'Over 4 million Raspberry Pis have been sold so far, and now founder Eben Upton has shown off a touchscreen display panel that's designed to work with it. It's a 7" panel, roughly tablet sized, but slightly thicker. "With the incoming touchscreen panel The Pi Foundation is clearly hoping to keep stoking the creative fires that have helped drive sales of the Pi by slotting another piece of DIY hardware into the mix." Upton also discussed the Model A+ Raspberry Pi board — an updated version they'll be announcing soon.' -- source: http://build.slashdot.org/story/14/10/22/1532200 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Take Control With Open Source Hardware
by Peter Reutemann 22 Oct '14

22 Oct '14

"Free and open source software are no good without open hardware. If we can't install our software on a piece of hardware, it's not good for anything. Truly open hardware is fully-programmable and replicable: OSHWA, Raspberry Pi, OLinuXino, Arduino, BeagleBoard, RepRap 3D Printer, Open Prosthetics, OpenROV Submarine, Open Source Cell Phones" -- source: http://www.linux.com/news/hardware/peripherals/792185 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Delivering Malicious Android Apps Hidden In Image Files
by Peter Reutemann 22 Oct '14

22 Oct '14

"Researchers have found a way to deliver a malicious app to Android users by hiding it into what seems to be an encrypted image file, which is then delivered via a legitimate, seemingly innocuous wrapper app. Fortinet malware researcher Axelle Apvrille and reverse engineer Ange Albertini created a custom tool they dubbed AngeCryption, which allows them to encrypt the payload Android application package (APK) and make it look like an image (PNG, JPG) file . They also had to create another APK that carries the "booby-trapped" image file and which can decrypt it to unveil the malicious APK file and install it. A malicious app thusly encrypted is nearly invisible to reverse engineers, and possibly even to AV solutions and Google's Android Bouncer." -- source: http://mobile.slashdot.org/story/14/10/21/1325236 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

2 2

Ubuntu 16.04 Might Be The Distribution's Last 32-Bit Release
by Peter Reutemann 21 Oct '14

21 Oct '14

"Ubuntu contributor Bryan Quigley is considering a proposal to make Ubuntu 16.04 LTS the last release of Ubuntu with 32-bit installation images. Come April 2016, Intel 32-bit users might be on their last, overdue leg for upgrading their distribution. Quigley is considering a proposal to kill off the 32-bit install (ISO) images after that point while support for 32-bit applications on 64-bit Ubuntu would still be supported. The proposal would only involve Intel/AMD x86 with 32-bit ARM being unaffected given that 32-bit ARM is still very common to devices. " -- source: http://www.phoronix.com/scan.php?page=news_item&px=MTgxOTQ Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

2 3

Yubikey, Lastpass and Brewpi.
by chris 21 Oct '14

21 Oct '14

Hi all, I've posted my notes from last Monday's meeting here. It's the slide show plus a few links. https://github.com/WLUG/meetings Cheers, Chris

3 2

Features GNOME Developers Want In The Linux Kernel
by Peter Reutemann 21 Oct '14

21 Oct '14

'Made into a concise list is a number of features that GNOME developers want to see landed within the Linux kernel, in hopes of kernel developers eventually tackling these wish list features that could help not only GNOME but other desktops too. Bastien Nocera wrote to the kernel mailing list explaining, "GNOME has had discussions with kernel developers in the past, and, fortunately, in some cases we were able to make headway. There are however a number of items that we still don't have solutions for, items that kernel developers might not realise we'd like to rely on, or don't know that we'd make use of if merged." Among the features sought after in the kernel include a hibernation mode not using SWAP space, native hybrid suspend support in the kernel, a connected stand-by suspend mode, screen backlight guidelines, time changes for files/folders within a sub-directory, LinuxApps containers support (OverlayFS and KDBUS), memory compression being enabled by default for capable hardware, and various other changes. ' -- source: http://www.phoronix.com/scan.php?page=news_item&px=MTgxOTI Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Microsoft “Loves Linux” as it Makes Azure Bigger, Better
by Peter Reutemann 21 Oct '14

21 Oct '14

"In San Francisco on Monday, Microsoft CEO Satya Nadella said something that was more than a little surprising: Microsoft loves Linux. The operating system once described as a "cancer" by Nadella's predecessor, Steve Ballmer, is now being embraced with open arms (if not extended), at least when it comes to Redmond's Azure cloud platform. Nadella told us that some 20 percent of VMs on Azure use the open source operating system." -- source: http://www.linux.com/news/enterprise/cloud-computing/792539 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Rejuvenate your Fedora desktop with Moka
by Peter Reutemann 21 Oct '14

21 Oct '14

"GNOME is cool and beautiful, and the default Adwaita theme has matured greatly since it was introduced in GNOME 3.0. In fact, the Adwaita theme in Fedora 21 is now looking better than ever. However, I have used it for a long time, and I kinda feel like using a different theme — After all, who doesn’t like to have a change once in a while? So, I decided to put new life into my desktop, and my search ended with the great moka project." -- source: http://fedoramagazine.org/rejuvenate-your-fedora-desktop-with-moka/ Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

wlug meeting next Monday
by Peter Reutemann 20 Oct '14

20 Oct '14

Hi there We've got a WLUG meeting coming up next Monday - due to Labor Day a week earlier that usual. 'Greg B.: A talk with an overview of the so-called "Crypto2.0" open source projects that are attempting to be overlays for the bitcoin network. Why does bitcoin need overlays and possible future directions in cryptofinance in general? A brief round-up of the emerging Crypto2.0 projects out there, Counterparty, Mastercoin, Bitshares, Ripple, Stellar, Next and CoinSpark. Then a more in-depth discussion of Open-Transactions (openTXS). Peter R.: Running OwnCloud on a Raspberry Pi.' http://www.meetup.com/WaikatoLinuxUsersGroup/events/212122742/ Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

2 1