July 2014 - wlug - list.wlug.org.nz

Yubikey, Lastpass and Brewpi.
by chris 21 Oct '14

21 Oct '14

Hi all, I've posted my notes from last Monday's meeting here. It's the slide show plus a few links. https://github.com/WLUG/meetings Cheers, Chris

3 2

The Art of Failure 2014
by chris 31 Jul '14

31 Jul '14

http://spectrum.ieee.org/slideshow/semiconductors/materials/the-art-of-failu re-2014/ The Art of Failure 2014 <http://www.mmsend10.com/link.cfm?r=788576329&sid=47555527&m=5637048&u=IEEEN Y&j=20644385&s=http://spectrum.ieee.org/slideshow/semiconductors/materials/t he-art-of-failure-2014/?utm_source=techalert&utm_medium=email&utm_campaign=0 73114> When chipmakers examine failed semiconductors for clues regarding why they went kaput, they sometimes discover beauty amid the ashes. We've collated some of the more spectacular happy accidents from factories and labs around the world for this year's showcase.

1 0

LibreOffice 4.3 upgrades spreadsheets, brings 3D models to presentations
by Peter Reutemann 31 Jul '14

31 Jul '14

"LibreOffice's latest release provides easier ways of working with spreadsheets and the ability to insert 3D models into presentations, along with dozens of other changes." -- source: http://bit.ly/1tvDM9e Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Old Apache Code At Root of Android FakeID Mess
by Peter Reutemann 30 Jul '14

30 Jul '14

'A four-year-old vulnerability in an open source component that is a critical part of Android leaves hundreds of millions of mobile devices susceptible to silent malware infections. The vulnerability affects devices running Android versions 2.1 to 4.4 ("KitKat"), according to a statement released by Bluebox. The vulnerability was found in a package installer in affected versions of Android. The installer doesn't attempt to determine the authenticity of certificate chains that are used to vouch for new digital identity certificates. In short, Bluebox writes, "an identity can claim to be issued by another identity, and the Android cryptographic code will not verify the claim." The security implications of this are vast. Malicious actors could create a malicious mobile application with a digital identity certificate that claims to be issued by Adobe Systems. Once installed, vulnerable versions of Android will treat the application as if it was actually signed by Adobe and give it access to local resources, like the special webview plugin privilege, that can be used to sidestep security controls and virtual 'sandbox' environments that keep malicious programs from accessing sensitive data and other applications running on the Android device. The flaw appears to have been introduced to Android through an open source component, Apache Harmony. Google turned to Harmony as an alternative means of supporting Java in the absence of a deal with Oracle to license Java directly. Work on Harmony was discontinued in November, 2011. However, Google has continued using native Android libraries that are based on Harmony code. The vulnerability concerning certificate validation in the package installer module persisted even as the two codebases diverged.' -- source: http://news.slashdot.org/story/14/07/29/2230242 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

The great Ars experiment—free and open source software on a smartphone?!
by Peter Reutemann 29 Jul '14

29 Jul '14

"Android is a Google product—it's designed and built from the ground up to integrate with Google services and be a cloud-powered OS. A lot of Android is open source, though, and there's nothing that says you have to use it the way that Google would prefer. With some work, it’s possible to turn a modern Android smartphone into a Google-less, completely open device—so we wanted to try just that. After dusting off the Nexus 4 and grabbing a copy of the open source parts of Android, we jumped off the grid and dumped all the proprietary Google and cloud-based services you'd normally use on Android. Instead, this experiment runs entirely on open source alternatives. FOSS or bust!" -- source: http://bit.ly/1ppiC8V First time that I came across F-Droid, the FLOSS app catalogue: https://f-droid.org/ Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

15 alternatives to your default image viewer on Fedora
by Peter Reutemann 29 Jul '14

29 Jul '14

"Is the default image viewer in your desktop environment just not working the way you want? need more features (or maybe something simpler) from an image viewer? Well, you are in luck, as there is no shortage of choices when looking at alternative image viewers in Fedora. This article covers 17 image viewers in Fedora." -- source: http://fedoramagazine.org/15-alternatives-to-your-default-image-viewer-on-f… And most likely not limited to Fedora. Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

seL4 Verified Microkernel Now Open Source
by Peter Reutemann 29 Jul '14

29 Jul '14

'Back in 2009, OKLabs/NICTA announced the first formally verified microkernel, seL4 (a member of the L4 family). Alas, it was proprietary software. Today, that's no longer the case: seL4 has been released under the GPLv2 (only, no "or later versions clause" unfortunately). An anonymous reader writes OSnews is reporting that the formally verified sel4 microkernel is now open source: "General Dynamics C4 Systems and NICTA are pleased to announce the open sourcing of seL4, the world's first operating-system kernel with an end-to-end proof of implementation correctness and security enforcement. It is still the world's most highly assured OS." Source is over at Github. It supports ARM and x86 (including the popular Beaglebone ARM board). If you have an x86 with the VT-x and Extended Page Table extensions you can even run Linux atop seL4 (and the seL4 website is served by Linux on seL4).' -- source: http://developers.slashdot.org/story/14/07/29/1913259 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Valencia Linux School Distro Saves 36 Million Euro
by Peter Reutemann 27 Jul '14

27 Jul '14

"The government of the autonomous region of Valencia (Spain) earlier this month made available the next version of Lliurex, a customisation of the Edubuntu Linux distribution. The distro is used on over 110,000 PCs in schools in the Valencia region, saving some 36 million euro over the past nine years, the government says." -- source: http://linux.slashdot.org/story/14/07/27/223220 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Linus Torvalds: "GCC 4.9.0 Seems To Be Terminally Broken"
by Peter Reutemann 27 Jul '14

27 Jul '14

'A pointed critique from Linus Torvalds of GCC 4.9.0. after a random panic was discovered in a load balance function in Linux 3.16-rc6. in an email to the Linux kernel mailing list outlining two separate but possibly related bugs, Linus describes the compiler as "terminally broken," and worse ("pure and utter sh*t," only with no asterisk). A slice: "Lookie here, your compiler does some absolutely insane things with the spilling, including spilling a *constant*. For chrissake, that compiler shouldn't have been allowed to graduate from kindergarten. We're talking "sloth that was dropped on the head as a baby" level retardation levels here .... Anyway, this is not a kernel bug. This is your compiler creating completely broken code. We may need to add a warning to make sure nobody compiles with gcc-4.9.0, and the Debian people should probably downgrate their shiny new compiler."' -- source: http://linux.slashdot.org/story/14/07/27/1838219 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

GOG.com Announces Linux Support
by Peter Reutemann 24 Jul '14

24 Jul '14

"We've put much time and effort into this project and now we've found ourselves with over 50 titles, classic and new, prepared for distribution, site infrastructure ready, support team trained and standing by ... We're still aiming to have at least 100 Linux games in the coming months, but we've decided not to delay the launch just for the sake of having a nice-looking number to show off to the press. ... Note that we've got many classic titles coming officially to Linux for the very first time, thanks to the custom builds prepared by our dedicated team of penguin tamers. ... For both native Linux versions, as well as special builds prepared by our team, GOG.com will provide distro-independent tar.gz archives and support convenient DEB installers for the two most popular Linux distributions: Ubuntu and Mint, in their current and future LTS editions." -- source: http://games.slashdot.org/story/14/07/24/1438211 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0