December 2017 - wlug - list.wlug.org.nz

Updated Debian Linux 9.3 and 8.10 Released
by Peter Reutemann 10 Dec '17

10 Dec '17

'The Debian project is pleased to announce the third update of its stable distribution Debian 9 (codename stretch). This point release mainly adds corrections for security issues, along with a few adjustments for serious problems. Security advisories have already been published separately and are referenced where available. The Debian project also announces the tenth update of its oldstable distribution Debian 8 (codename jessie). Please note that the point release does not constitute a new version of Debian 9 or 8 but only updates some of the packages included. There is no need to throw away old jessie or stretch DVD/CD media. After installation, packages can be upgraded to the current versions using an up-to-date Debian mirror. This stable update adds a few important corrections to packages. New installation images will be available soon at the mirrors. Those who frequently install updates from security.debian.org won't have to update many packages, and most such updates are included in the point release. One can use the apt command or apt-get command to apply updates. A step-by-step update guide is posted here.' -- source: https://linux.slashdot.org/story/17/12/09/1958254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Canadian ISPs And Hollywood Agree On Plan To Make Themselves Judge, Jury and Website Executioner
by Lawrence D'Oliveiro 08 Dec '17

08 Dec '17

Think it could happen here <https://www.techdirt.com/articles/20171205/03452738742/canadian-isps-hollyw…>? A bunch of Canadian ISPs, together with various entertainment groups, is submitting a plan to the Canadian Radio-television and Communications Commission (CRTC), which is the regulatory body for broadcasting and telecoms, to maintain a list of sites which will be blocked by the ISPs at the request of the entertainment groups. Is there any recourse, any review process, any independent oversight? Nope. Any prospect for, shall we say, “mission creep”? Oh boy, is there... The CRTC seems less than enthused. I like this comment from their spokesperson: “Our government supports an open internet where Canadians have the ability to access the content of their choice in accordance to Canadian laws,” Sasseville says. “While other parts of the world are focused on building walls, we’re focused on opening doors‎.”

1 0

Google Vs Amazon Smackdown
by Rowan Schischka 06 Dec '17

06 Dec '17

> There is a tussle going on at the moment between a couple of large > corporations--but then, isn?t there always? There is a saying in some > parts of Africa that ?when elephants fight, the grass gets trampled?. > The ?grass?, in this case, being ordinary consumers like you and me. > > * Once Amazon started offering its own video-streaming hardware, it > banned competing products offered by Apple and Google from its store. > (Can you say ?conflict of interest??) > * Google/YouTube retaliated by blocking YouTube from Amazon?s Echo Show. > * Amazon upped the ante by denying sales of Google?s Nest devices as > well. > > And so it goes... so each store does not list their competitors spyware? no loss to me.

1 0

Google Vs Amazon Smackdown
by Lawrence D'Oliveiro 06 Dec '17

06 Dec '17

There is a tussle going on at the moment between a couple of large corporations--but then, isn’t there always? There is a saying in some parts of Africa that “when elephants fight, the grass gets trampled”. The “grass”, in this case, being ordinary consumers like you and me. * Once Amazon started offering its own video-streaming hardware, it banned competing products offered by Apple and Google from its store. (Can you say “conflict of interest”?) * Google/YouTube retaliated by blocking YouTube from Amazon’s Echo Show. * Amazon upped the ante by denying sales of Google’s Nest devices as well. And so it goes... <https://www.techdirt.com/articles/20171206/10385638755/google-amazon-are-ha…>

3 2

Windows RT Strike 2
by Lawrence D'Oliveiro 06 Dec '17

06 Dec '17

The first Windows-10-on-ARM machines are due to ship from HP and Asus in the autumn <https://arstechnica.com/gadgets/2017/12/hp-asus-announce-first-windows-10-a…>. It will include some kind of x86 emulator to run 32-bit regular-Windows apps. Of which I didn’t realize that there were still many around. Of course you can have either the ARM native performance and the long battery life, or you can have the Windows compatibility, but you are not going to get both at once. Prognosis: whenever either member of the Wintel symbiote has tried to step out on their own, the results have been uniformly disastrous. I expect this foray to be no different.

2 1

MacOS High Sierra Bug Allows Login As Root With No Password
by Peter Reutemann 04 Dec '17

04 Dec '17

'A trivial-to-exploit flaw in macOS High Sierra, aka macOS 10.13, allows users to gain admin rights, or log in as root, without a password. The security bug is triggered via the authentication dialog box in Apple's operating system, which prompts you for an administrator's username and password when you need to do stuff like configure privacy and network settings. If you type in "root" as the username, leave the password box blank, hit "enter" and then click on unlock a few times, the prompt disappears and, congrats, you now have admin rights. You can do this from the user login screen. The vulnerability effectively allows someone with physical access to the machine to log in, cause extra mischief, install malware, and so on. You should not leave your vulnerable Mac unattended until you can fix the problem. And while obviously this situation is not the end of the world -- it's certainly far from a remote hole or a disk decryption technique -- it's just really, really sad to see megabucks Apple drop the ball like this. Developer Lemi Orhan Ergan was the first to alert the world to the flaw. The Register notes: "If you have a root account enabled and a password for it set, the black password trick will not work. So, keep the account enabled and set a root password right now..."' -- source: https://it.slashdot.org/story/17/11/28/2135236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 5

Researchers Run Unsigned Code on Intel ME By Exploiting USB Ports
by Peter Reutemann 04 Dec '17

04 Dec '17

'A pair of security researchers in Russia are claiming to have compromised the Intel Management Engine just using one of the computer's USB ports. The researchers gained access to a fully functional JTAG connection to Intel CSME via USB DCI. The claim is different from previous USB DCI JTAG examples from earlier this year. Full JTAG access to the ME would allow making permanent hidden changes to the machine. "Getting into and hijacking the Management Engine means you can take full control of a box," reports the Register, "underneath and out of sight of whatever OS, hypervisor or antivirus is installed." They add that "This powerful God-mode technology is barely documented," while The Next Web points out that USB ports are "a common attack vector."' -- source: https://it.slashdot.org/story/17/11/11/237236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

Is Open Source Innovation Now All About Vendor On-Ramps?
by Peter Reutemann 03 Dec '17

03 Dec '17

'InfoWorld published an interesting essay from Matt Asay, former COO at Canonical (and an emeritus board member of the Open Source Initiative), about innovation from the big public cloud vendors, which "even when open-sourced, doesn't really help the community at large... All this innovation is available to buy; none of it is available to build. Not for mere mortals, anyway." Google in particular has figured out how to both open-source code in a useful way and make it pay. As Server Density CEO David Mytton has underlined, Google hopes to "standardize machine learning on a single framework and API," namely TensorFlow, then supplement it "with a service that can [manage] it all for you more efficiently and with less operational overhead," namely Google Cloud. By open-sourcing TensorFlow and backing it with machine-learning-heavy Google Cloud, Google has open-sourced a great on-ramp to future revenue. My question: why not do this with the rest of its code? The simple answer is "Because it's a lot of work." That is, Google could open-source everything tomorrow without any damage to its revenue, but the code itself would provide other providers and enterprises only limited ability to increase their revenue unless Google did all the necessary prep work to make it useful to mere mortals not running superhuman Google infrastructure. This is the trick that AWS, Microsoft, and Google are all racing to figure out today. Not open source, per se, because that's the easy table stakes. No, the AWS/Microsoft Azure/Google Cloud trio are figuring out how to turn their innovations into open source on-ramps to their proprietary services. Companies used to lock up their code to sell it. Today, it's the opposite: They need to open it up to make their ability to operate the code at scale more valuable. For them.' -- source: https://news.slashdot.org/story/17/12/02/0833217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Understanding the New Red Hat-IBM-Google-Facebook GPL Enforcement Announcement
by Peter Reutemann 03 Dec '17

03 Dec '17

'Bruce Perens co-founded the Open Source Initiative with Eric Raymond -- and he's also Slashdot reader #3872. Bruce Perens writes: Red Hat, IBM, Google, and Facebook announced that they would give infringers of their GPL software up to a 30-day hold-off period during which an accused infringer could cure a GPL violation after one was brought to their attention by the copyright holder, and a 60 day "statute of limitations" on an already-cured infringement when the copyright holder has never notified the infringer of the violation. In both cases, there would be no penalty: no damages, no fees, probably no lawsuit; for the infringer who promptly cures their infringement. Perens sees the move as "obviously inspired" by the kernel team's earlier announcement, and believes it's directed against one man who made 50 copyright infringement claims involving the Linux kernel "with intent to collect income rather than simply obtain compliance with the GPL license." Unfortunately, "as far as I can tell, it's Patrick McHardy's legal right to bring such claims regarding the copyrights which he owns, even if it doesn't fit Community Principles which nobody is actually compelled to follow."' -- source: https://linux.slashdot.org/story/17/12/02/2024240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

'24 Pull Requests' Suggests Contributing Code For Christmas
by Peter Reutemann 03 Dec '17

03 Dec '17

'"On December 1st, 24 Pull Requests will be opening its virtual doors once again, asking you to give the gift of a pull request to an open source project in need," writes UK-based software developer Andrew Nesbitt -- noting that last year the site registered more than 16,000 pull requests. "And they're not all by programmers. Often the contribution with the most impact might be an improvement to technical documentation, some tests, or even better -- guidance for other contributors." This year they're even touting "24 Pull Requests hack events," happening around the world from Lexington, Kentucky to Torino, Italy. (Last year 80 people showed up for an event in London.) "You don't have to hack alone this Christmas!" suggests the site, also inviting local communities and geek meetups (as well as open source-loving companies) to host their own events. Contributing to open source projects can also beef up your CV (for when you're applying for your next job), the site points out, and "Even small contributions can be really valuable to a project." "You've been benefiting from the use of open source projects all year. Now is the time to say thanks to the maintainers of those projects, and a little birdy tells me that they love receiving pull requests!"' -- source: https://developers.slashdot.org/story/17/12/03/2018213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0