November 2016 - wlug - list.wlug.org.nz

Web of Trust, Downloaded 140M Times, Pulled From Extension Stores After Revelations That It Sells Users' Data
by Peter Reutemann 08 Nov '16

08 Nov '16

'According to multiple reports, Web of Trust, one of the top privacy and security extensions for web browsers with over 140 million downloads, collects and sells some of the data of its users -- and it does without properly anonymizing it. Upon learning about this, Mozilla, Google and Opera quickly pulled the extension off their respective extension stores. From a report on The Register: A browser extension which was found to be harvesting users' browsing histories and selling them to third parties has had its availability pulled from a number of web browsers' add-on repositories. Last week, an investigative report by journalists at the Hamburg-based German television broadcaster, Norddeutscher Rundfunk (NDR), revealed that Web of Trust Services (WoT) had been harvesting netizens' web browsing histories through its browser add-on and then selling them to third parties. While WoT claimed it anonymised the data that it sold, the journalists were able to identify more than 50 users from the sample data it acquired from an intermediary. NDR quoted the data protection commissioner of Hamburg, Johannes Caspar, criticising WoT for not adequately establishing whether users consented to the tracking and selling of their browsing data. Those consent issues have resulted in the browser add-on being pulled from the add-on repositories of both Mozilla Firefox and Google Chrome, although those who have already installed the extension in their browsers will need to manually uninstall it to stop their browsing being tracked.' -- source: https://yro.slashdot.org/story/16/11/08/1551236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Two Critical MySQL Bugs Discovered
by Peter Reutemann 05 Nov '16

05 Nov '16

'Two critical privilege escalation vulnerabilities in MySQL, MariaDB, and PerconaDB can help take control of the whole server, which is very bad for shared environments... Administrators need to check their database versions, as attackers can chain two critical vulnerabilities and completely take over the server hosting the database... The first vulnerability, a privilege escalation/race condition flaw, gives elevated privileges to a local system user with access to a database and allows them to execute arbitrary code as the database system user. This gives an attacker access to all of the databases on the affected server... The privilege escalation/race condition flaw can be chained with another critical vulnerability, a root privilege escalation vulnerability, to further elevate the system level user to gain root on the server.' -- source: https://developers.slashdot.org/story/16/11/05/056227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

US Government Launches Open-Source Repository
by Lawrence D'Oliveiro 04 Nov '16

04 Nov '16

The US Federal Government has just opened code.gov, a “platform designed to improve access to the federal government’s custom-developed software” <http://www.theregister.co.uk/2016/11/04/code_gov_goes_live/>. You can browse projects by department/agency.

2 1

Google Says Bye-Bye To Eclipse
by Lawrence D'Oliveiro 04 Nov '16

04 Nov '16

Google has officially abandoned its Android development plugin for Eclipse, in favour of its Android Studio IDE <http://www.theregister.co.uk/2016/11/03/google_knifes_eclipse_android_devel…>. For me, the nice thing about the Android SDK is that it gives you a choice: you can still build things from the command line, which makes it easy to set up custom build procedures. For example, the largest Android project I have dabbled with so far <https://github.com/ldo/ti5x_android> has 11,000 lines of Java code and 3,000 lines of Python, all created with Emacs. I’m not sure any IDE could gracefully build it at all.

2 1

E-Voting Around The World
by Lawrence D'Oliveiro 03 Nov '16

03 Nov '16

Roundup of how various places implement electronic- and online-based voting systems <http://arstechnica.com/features/2016/11/internet-based-and-open-source-how-…>. Brazil: One major flaw [Prof Aranha] found was that the digital votes are randomly shuffled, as a way to provide extra security while in storage. However, the algorithm to provide that randomness is given a non-random seed: the timestamp. Australia, specifically the Australian Capital Territory: Still, despite the success of the open-source e-voting setup, [Electoral Commissioner] Green says its days may be numbered. Even though he has his doubts about the security and openness of Internet-based setups, he believes that it, not open-source e-voting, will "be the way of the future." Estonia: "If you sign something digitally with your Estonian ID card, it universally replaces a paper written signature and this can be applied anywhere—terminating contracts, creating contracts—everywhere. Everywhere you'd need a paper signature you can replace it with an electronic signature" ... And now, that applies to Internet-based voting as well.

1 0

Spark Wants To Abandon Copper?
by Lawrence D'Oliveiro 03 Nov '16

03 Nov '16

“Spark ... [is] not happy with the quality of the copper provided by the wholesale spin-out, Chorus.” Oh, and “The lucky 400 first houses in the trial are in the suburbs of the North Island city of Hamilton.” <http://www.theregister.co.uk/2016/11/03/cu_later_copper_spark_is_going_to_g…>

4 5

trustworthy computing -- what this?
by Ian Young 03 Nov '16

03 Nov '16

Sorry if this strays off topic, though discussion is fairly eclectic imho ..... I was interested to learn that Microsoft has a senior director of trustworthy computing in this article. http://www.theregister.co.uk/2016/11/01/microsoft_google_bug_disclosure_spa… Perhaps comforting news, I usually assume that computing is minimally trustworthy these days. Not so much in terms of the performance of software (eg Linux) but in the extent of spying and covert mass data gathering. Just as well we have these large corporates to take care of us.

1 0

death of copper, 4G coverage fubar
by rowan schischka 03 Nov '16

03 Nov '16

>As to 4G bwahahaha. When the Skinny mini offshoot offered a 4G deal >earlier this year I had a look. Coverage at that point was confined to >an area round the uni, and for some reason Chartwell. Perhaps it now >covers the entire metropolis of Hamilton? Let me know if I have missed >something there. And the greedies wanted $200 for a 4G modem. Nice one >Spinny. I brought my 4g skinny modem with me from auckland. I had to use it up there because the lease holder of my flat was refusing to upgrade her modem. She reckoned Spark confirmed there was nothing wrong with her modem but after a year I finally got to have a look at it and the arial was broken and there was a large crack through the case; she still refused to accept her modem was damaged and kept dropping connection so I got the 4g. It works very well and now comes in a 100GB plan that is faster than ADSL. Im using the 4g in Rototuna and I haven't been tempted to get fibre because of the lack of ethernet through the house, and my inability to persuade the property manager to allow me to install network ports in the walls. -- Kind Regards Rowan Schischka

1 0

death of copper, 4G coverage fubar
by Ian Young 03 Nov '16

03 Nov '16

Apologies to thread lovers. Yes well. of course our telecom overlords want to get shot of copper. So last century. One annoying aspect of that cable network was that it needed some maintenance. Your modern day utility company doesn't like maintenance costs. And once it is shut down maybe the copper can be pulled out of the ground at some stage. On the shopping block with all those annoying exchange buildings. As to 4G bwahahaha. When the Skinny mini offshoot offered a 4G deal earlier this year I had a look. Coverage at that point was confined to an area round the uni, and for some reason Chartwell. Perhaps it now covers the entire metropolis of Hamilton? Let me know if I have missed something there. And the greedies wanted $200 for a 4G modem. Nice one Spinny. By the way, isn't this article wrong or misguiding in just about every respect? Much of the Register is wryly amusing and even informative on occasion, but this is surely a low point?

1 0

Arch Linux Review
by Lawrence D'Oliveiro 03 Nov '16

03 Nov '16

<http://www.theregister.co.uk/2016/11/02/arch_linux_taster/>: Arch gets very little coverage for a several reasons, not the least of which is that it's somewhat difficult to install and requires you feel comfortable with the command line to get it working. Worse, from the point of view of anyone trying to appeal to mainstream users, that difficulty is by design - nothing keeps the noobs out like a daunting install process. I never knew that about Arch. But my real excuse for mentioning this review is the picture. That looks like a Renault 4. Or rather, 3 of them, cut and joined together in a truly unholy Franken-mess. If you pointed it facing north, it would probably summon Cthulhu...

2 4