May 2016 - wlug - list.wlug.org.nz

UK Spooks Say: Don’t Keep Resetting Your Passwords!?
by Lawrence D'Oliveiro 06 May '16

06 May '16

On World Password Day (who knew?), the Communications-Electronics Security Group (CESG), part of GCHQ, is telling sysadmins not to force their users to keep resetting their passwords <http://www.theregister.co.uk/2016/05/05/stop_resetting_your_password_says_u…>. The result, according to CESG, is that we are more likely to write our password down. Or forget the password altogether, forcing service desks to reset them, chewing up time and resources. So what was wrong with writing them down, again? You know how to keep your cash, credit cards and house keys safe; why can’t you keep your written passwords in the same place? The last three paragraphs of the article are, um, worth reading carefully...

2 1

Microsoft unveils new effort to make its documentation great again ... or does it?
by rowan schischka 06 May '16

06 May '16

>Just one problem: while Microsoft itself uses the term ?open sourced? I think you will find that Microsoft will make its own definition of the word 'open'. for example for years they have been calling their bulk license purchasing plan the 'Open License' (OLP, OLV, OVS, etc). Their Open is not GPL. They want hobbyists and students to tinker with their products and if you're not making money they wont bother you. for example they give charities and schools dirt cheap pricing because they just want everyone to use their products. Their bottom line is; if you make money off our product we want our cut of that to return to our investors.

3 2

TLS Proxies: Insecure By Design
by Lawrence D'Oliveiro 06 May '16

06 May '16

A “TLS Proxy” short-circuits the security of TLS/SSL connections so it can do deep-packet inspection on encrypted connections. This kind of thing always seemed dodgy. And now it turns out that is so for good reason: these devices are full of holes <http://www.theregister.co.uk/2016/05/05/tls_proxies_are_insecure/>. The paper mentioned there concentrated on consumer/retail devices. But it’s unlikely ones designed for business/enterprise use are going to fare any better...

1 0

Unity 8 And Snaps Are Conquering The Ubuntu Desktop After Ubuntu 16.10
by Peter Reutemann 05 May '16

05 May '16

"Today is the last day of the Ubuntu Online Summit 2016, and the Ubuntu developers discussed the future of the Ubuntu Desktop for Ubuntu 16.10 (Yakkety Yak) and beyond. It looks like Snaps (Snappy) and Unity 8 with Mir are slowly conquering the Ubuntu Desktop, at least according to Canonical's Will Cooke, Ubuntu Desktop Manager. Work has already begun on pushing these new and modern technologies to the Ubuntu Desktop, as Ubuntu 16.04 LTS has just received support for installing Snaps from the Ubuntu Snappy Store. Canonical's Will Cooke has mentioned the fact that the Unity 7 desktop enters its twilight years, which means that it gets fewer features and it's being reduced to only critical and OEM work. This is because Unity 8 desktop is getting all the attention now, and it will become the default desktop session somewhere after Ubuntu 16.10 (Yakkety Yak)." -- source: https://news.slashdot.org/story/16/05/05/2038256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft unveils new effort to make its documentation great again ... or does it?
by Lawrence D'Oliveiro 05 May '16

05 May '16

<http://arstechnica.com/information-technology/2016/05/microsoft-unveils-new…>: Some teams within Microsoft, such as those developing ASP.NET and .NET Core, had already open sourced their documentation. On the new site, all documentation will be handled similarly. Every article will have an "edit" button enabling changes and fixes to be proposed. These changes will be handled as pull requests on GitHub, with the documentation itself using the popular Markdown markup language. Just one problem: while Microsoft itself uses the term “open sourced” <https://docs.microsoft.com/teamblog/introducing-docs-microsoft-com/>: All documentation on docs.microsoft.com is open sourced and designed to allow community contributions. Nowhere does it actually spell out what the copyright licence is. Clicking on the “Terms of Use” link takes you here <https://www.microsoft.com/en-us/legal/intellectualproperty/copyright/defaul…>, where it says Personal and Non-Commercial Use Limitation Unless otherwise specified, the Services are for your personal and non-commercial use. You may not modify, copy, distribute, transmit, display, perform, reproduce, publish, license, create derivative works from, transfer, or sell any information, software, products or services obtained from the Services.

1 0

Proprietary Software Riddled With Old Open-Source Vulnerabilities
by Lawrence D'Oliveiro 04 May '16

04 May '16

No big news, really: closed-source software, even if it is built on open-source components, will inevitably accumulate long-standing bugs that never get fixed. And sometimes the bugs have security implications. This report from Black Duck uses the term “commercial” software, but it’s quite clear they mean “proprietary” software, i.e. closed-source <http://www.theregister.co.uk/2016/05/04/commercial_software_chokkas_with_an…>. The telling phrase in the report is “visibility into the components that are included in their code base is required”. How would you *not* have such visibility, if the source of your product is open? A lot of companies may hate copyleft licences, but at least they force a level of transparency that makes this kind of thing much harder to cover up.

1 0

Hard Drive Warranties Are Now Specifying Data-Write Limits?
by Lawrence D'Oliveiro 04 May '16

04 May '16

It used to be that warranties for hard drives were for some specified number of years, it didn’t matter how much load they were under (compare SSDs). But it seems that is now changing, as capacities are pushed to the point where ever more creative strategies are needed to get the devices to work at all <http://www.theregister.co.uk/2016/05/03/when_did_hard_drives_get_workload_r…>.

3 2

The Tao Of Programming
by Lawrence D'Oliveiro 04 May '16

04 May '16

<http://www.mit.edu/~xela/tao.html>: 4.3 The Master was explaining the nature of Tao to one of his novices. "The Tao is embodied in all software -- regardless of how insignificant," said the Master. "Is the Tao in a hand-held calculator?" asked the novice. "It is," came the reply. "Is the Tao in a video game?" asked the novice. "It is even in a video game," said the Master. "Is the Tao in the DOS for a personal computer?" asked the novice. The Master coughed and shifted his position slightly. "The lesson is over for today," he said.

1 0

Aging and bloated OpenSSL is purged of 2 high-severity bugs
by Peter Reutemann 03 May '16

03 May '16

"Maintainers of the OpenSSL cryptographic library have patched high-severity holes that could make it possible for attackers to decrypt login credentials or execute malicious code on Web servers. The updates were released Tuesday morning for both versions 1.0.1 and 1.0.2 of OpenSSL, which a large portion of the Internet relies on to cryptographically protect sensitive Web and e-mail traffic using the transport layer security protocol. OpenSSL advisories labeled the severity of both vulnerabilities "high," meaning the updates fixing them should be installed as soon as possible. The fixes bring the latest supported versions to 1.0.1t and 1.0.2h." -- source: http://arstechnica.com/security/2016/05/aging-and-bloated-openssl-is-purged… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Huge number of sites imperiled by critical image-processing vulnerability
by Peter Reutemann 03 May '16

03 May '16

"A large number of websites are vulnerable to a simple attack that allows hackers to execute malicious code hidden inside booby-trapped images. The vulnerability resides in ImageMagick, a widely used image-processing library that's supported by PHP, Ruby, NodeJS, Python, and about a dozen other languages. Many social media and blogging sites, as well as a large number of content management systems, directly or indirectly rely on ImageMagick-based processing so they can resize images uploaded by end users." -- source: http://arstechnica.com/security/2016/05/easily-exploited-bug-exposes-huge-n… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0