December 2016 - wlug - list.wlug.org.nz

Firefox Takes the Next Step Towards Rolling Out Multi-Process To Everyone
by Peter Reutemann 22 Dec '16

22 Dec '16

'With Firefox 50, Mozilla has rolled out the first major piece of its new multi-process architecture. Edge, Internet Explorer, Chrome, and Safari all have a multiple process design that separates their rendering engine -- the part of the browser that reads and interprets HTML, CSS, and JavaScript -- from the browser frame. They do this for stability reasons (if the rendering process crashes, it doesn't kill the entire browser) and security reasons (the rendering process can be run in a low-privilege sandbox, so exploitable flaws in the rendering engine are harder to take advantage of). Moreover, these browsers can all create multiple rendering engine processes and use different processes for different tabs. This means that the scope of a crash is narrowed even further, typically to a single tab. Internet Explorer and Chrome both implemented this long ago, in 2009. Firefox, however, has not offered a similar design. Although work on a multi-process browser was started in 2009, under the codename Electrolysis, that work was suspended between 2011 and 2013 as priorities within the organization shifted. In response, Mozilla started switching to a new extension system in 2015 that opened the door to a multi-process design. The first stage of Firefox's move to multi-process involves separating the browser shell from a single rendering process that's used by every tab. In Firefox 48, that feature was enabled for a small number of users who used no extensions. Firefox 49 was rolled out to include users running a limited selection of extensions. Now, in Firefox 50, a separate renderer process is used for most users and most extensions. Developers are now able to mark their extensions as explicitly multi-process compatible. Firefox 51 will extend this even further to cover all extensions, except those that are explicitly marked as incompatible. Mozilla says that, even with the limited changes made in Firefox 50, responsiveness of the browser has improved by 400 percent due to the separation between the renderer and the browser shell. During page loads, responsiveness will increase to 700 percent.' -- source: https://news.slashdot.org/story/16/12/22/0120256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

MUFFIN, a new tasty user interface concept for LibreOffice
by Peter Reutemann 21 Dec '16

21 Dec '16

'The Document Foundation announces the MUFFIN, a new tasty user interface concept for LibreOffice, based on the joint efforts of the development and the design teams, supported by the marketing team. MUFFIN is an acronym for My User Friendly & Flexible INterface, and focuses on the three areas suggested by LibreOffice users during the development of the concept: My: LibreOffice users want a “personal” UI, with different options capable of adapting to the user’s personal habits, and not a single UI without options. User Friendly: of course, any UI should be as user friendly as possible, but LibreOffice users have clearly asked for a “modular” UI, where they can set their own level of user friendliness, and not a single UI without options. Flexible: the increasing number of LibreOffice users deploying the software on different hardware platforms (for instance, a desktop and a laptop), each one with different characteristics and screen size and resolution, have asked for a UI that can be tweaked to leverage the screen real estate, and not a single UI without options. INterface: The MUFFIN concept is the combination of different UI elements, which are going to be available starting from LibreOffice 5.3 either as a standard or experimental feature: the Default UI (with toolbars), a Single Toolbar UI, the Sidebar with a Single Toolbar, and the new Notebook Bar (experimental). Each UI layout has been thought to serve a different cluster of LibreOffice users.' -- source: https://blog.documentfoundation.org/blog/2016/12/21/the-document-foundation… It's about choice, that's why I love open-source! :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Home routers under attack in ongoing malvertisement blitz
by Peter Reutemann 19 Dec '16

19 Dec '16

'As you read these words, malicious ads on legitimate websites are targeting visitors with malware. But that malware doesn't infect their computers, researchers said. Instead, it causes unsecured routers to connect to fraudulent domains. Using a technique known as steganography, the ads hide malicious code in image data. The hidden code then redirects targets to webpages hosting DNSChanger, an exploit kit that infects routers running unpatched firmware or are secured with weak administrative passwords. Once a router is compromised, DNSChanger configures it to use an attacker-controlled domain name system server. This causes most computers on the network to visit fraudulent servers, rather than the servers corresponding to their official domain.' -- source: http://arstechnica.com/security/2016/12/home-routers-under-attack-in-ongoin… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Old Masters Reinterpreted
by Lawrence D'Oliveiro 16 Dec '16

16 Dec '16

“We Rolled Our Own Crypto”, by Peter Bruegel the Elder, c. 1562 <http://classicprogrammerpaintings.com/post/148027314949/we-rolled-our-own-c…>

1 1

Razors Edge database
by Roderick Aldridge 16 Dec '16

16 Dec '16

Does anybody know about running Razors Edge database under Linux or anybody who does? I successfully installed Citrix Receiver and logged into the database and ran a Report to get information, but could not save it or export it. Although I used the Linux Debian Citrix Receiver the options to save were all Windows destinations. when I tried to save to the computer option the message says The operation has been cancelled due to restrictions in effect on the computer. Please contact your system administrator. This could be a permissions problem. Any help welcome. Roderick Aldridge.

1 0

0-days hitting Fedora and Ubuntu open desktops to a world of hurt
by Peter Reutemann 16 Dec '16

16 Dec '16

'If you run a mainstream distribution of Linux on a desktop computer, there's a good chance security researcher Chris Evans can hijack it when you do nothing more than open or even browse a specially crafted music file. And in the event you're running Chrome on the just-released Fedora 25, his code-execution attack works as a classic drive-by.' -- source: http://arstechnica.com/security/2016/12/fedora-and-ubuntu-0days-show-that-h… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Yahoo admits it’s been hacked again, and 1 billion accounts were exposed
by Peter Reutemann 15 Dec '16

15 Dec '16

'On December 14, Yahoo announced that after an investigation into data provided by law enforcement officials in November, the company and outside forensics experts have determined that there was in fact a previously undetected breach of data from more than 1 billion user accounts. The breach took place in August 2013 and is apparently distinct from the previous mega-breach revealed this fall—one Yahoo claims was conducted by a "state-sponsored actor." The information accessed from potentially exposed accounts "may have included names, email addresses, telephone numbers, dates of birth, hashed passwords (using MD5) and, in some cases, encrypted or unencrypted security questions and answers," Yahoo's chief information security officer, Bob Lord, reported in the statement issued by the company. "The investigation indicates that the stolen information did not include passwords in clear text, payment card data, or bank account information. Payment card data and bank account information are not stored in the system the company believes was affected."' -- source: http://arstechnica.com/security/2016/12/yahoo-reveals-1-billion-more-accoun… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

OpenStreetView
by Lawrence D'Oliveiro 14 Dec '16

14 Dec '16

You’ve heard of OpenStreetMap, the (very popular) project to compile mapping information for the whole world under a freely shareable, open licence; now there is OpenStreetView, which attempts to do the same for street-level photos <http://www.theregister.co.uk/2016/12/14/open_source_insider_openstreetview_…>.

1 0

First Version of Sandboxed Tor Browser Available
by Peter Reutemann 12 Dec '16

12 Dec '16

'To protect Tor users from FBI hacking tools that include all sorts of Firefox zero-days, the Tor Project started working on a sandboxed version of the Tor Browser in September. Over the weekend, the Tor Project released the first alpha version of the sandboxed Tor Browser. "Currently, this version is in an early alpha stage, and only available for Linux," reports BleepingComputer. "There are also no binaries available, and users must compile it themselves from the source code, which they can grab from here." The report notes: "Sandboxing is a security mechanism employed to separate running processes. In computer security, sandboxing an application means separating its process from the OS, so vulnerabilities in that app can't be leveraged to extend access to the underlying operating system. This is because the sandboxed application works with its own separate portion of disk and memory that isn't linked with the OS."' -- source: https://yro.slashdot.org/story/16/12/12/2042225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Mint 18.1 'Serena' BETA Ubuntu-based Operating System Now Available For Download
by Peter Reutemann 05 Dec '16

05 Dec '16

'Feeling fatigued by Windows 10 and its constant updates and privacy concerns? Can't afford one of those beautiful new MacBook Pro laptops? Don't forget, Linux-based desktop operating systems are just a free download away, folks! If you do decide to jump on the open source bandwagon, a good place to start is Linux Mint. Both the Mate and Cinnamon desktop environments should prove familiar to Windows converts, and since it is based on Ubuntu, there is a ton of compatible packages. Today, the first beta of Linux Mint 18.1 'Serena' becomes available for download.' -- source: https://linux.slashdot.org/story/16/12/04/236236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0