February 2017 - wlug - list.wlug.org.nz

The Right Not To Be Searchable
by Lawrence D'Oliveiro 09 Feb '17

09 Feb '17

“[A] website in Romania ... obtained and posted Canadian judicial and tribunal decisions. These were all public documents, but they were not previously indexed by Google, which meant their contents were effectively hidden. The Romanian site allowed its copies to be indexed by Google, which made the decisions and the Canadian citizens involved visible for the first time -- something the people affected were not happy about. They complained to the Privacy Commissioner of Canada, who ruled that the Romanian site violated Canadian privacy law.” <https://www.techdirt.com/articles/20170208/02314536660/landmark-court-decis…>

1 0

Microsoft hosts the Windows source in a monstrous 300GB Git repository
by Peter Reutemann 07 Feb '17

07 Feb '17

'Microsoft has been working to enhance Git to improve the way it handles vast repositories. Central to this effort is a new project released (in part) as open source Git Virtual File system (GVFS). The premise of GVFS is straightforward enough: rather than fetching all the data at once, only a bare skeleton of the repository needs to be populated up front. The virtualized file system subsequently retrieves additional data on a demand-driven, as-needed basis. Building one particular Windows component, for example, will cause GVFS to fetch the files that make up that component, along with anything that the component depends on, but it will stop short of fetching all the many hundreds of gigabytes the repository contains.' -- source: https://arstechnica.com/information-technology/2017/02/microsoft-hosts-the-… I remember using SourceSafe way back. It may not have been great, but it was a big improvement over "not having any" version control. :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 4

Intel's Atom C2000 Chips Are Bricking Products – And It's Not Just Cisco Hit
by Lawrence D'Oliveiro 06 Feb '17

06 Feb '17

Certain models of Intel Atom chips are prone to clock-signal failures after about 18 months, rendering them unusable. This seems to be related to a warning put out by Cisco about some of its products, but neither company will confirm there is a link. <http://www.theregister.co.uk/2017/02/06/cisco_intel_decline_to_link_product…>

1 0

Chrome 56 Quietly Added Bluetooth Snitch API
by Peter Reutemann 06 Feb '17

06 Feb '17

'When Google popped out Chrome 56 at the end of January it was keen to remind us it's making the web safer by flagging non-HTTPS sites. But Google made little effort to publicise another feature that's decidedly less friendly to privacy, because it lets websites ask about users' Bluetooth devices and harvest information from them through the browser. That's more a pitch to developers, as is clear in this YouTube video from Pete LePage of the Chrome Developers team. "Until now, the ability to communicate with Bluetooth devices has been possible only for native apps. With Chrome 56, your Web app can communicate with nearby Bluetooth devices in a private and secure manner, using the Web Bluetooth API," Google shares in the video. "The Web Bluetooth API uses the GATT [Generic Attribute Profile - ed] protocol, which enables your app to connect to devices such as light bulbs, toys, heart-rate monitors, LED displays and more, with just a few lines of JavaScript." In other words, the API lets websites ask your browser "what Bluetooth devices can you see," find out what your fridge, and so on, is capable of, and interact with it.' -- source: https://yro.slashdot.org/story/17/02/06/1425208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

25G/50G Ethernet
by Lawrence D'Oliveiro 06 Feb '17

06 Feb '17

Thought there already was a 100-gigabit-per-second Ethernet spec. But it seems that still isn’t quite practical enough (cost? range?) for common use. Nor is the 40-gigabit-per-second fallback. So here we have two more lesser specs: <http://www.theregister.co.uk/2017/01/31/25g_and_50g_ethernet_spec_finalised/>.

1 1

Windows DRM-Protected Files Used To Decloak Tor Browser Users
by rowan schischka 04 Feb '17

04 Feb '17

It will be interesting to see if advertising companies will exploit this. You can see it as an exploit to track users but it should be possible for users to discover who is tracking them -- Rowan Schischka

1 0

Windows DRM-Protected Files Used To Decloak Tor Browser Users
by Peter Reutemann 03 Feb '17

03 Feb '17

'Downloading and trying to open Windows DRM-protected multimedia files can deanonymize Tor Browser users and reveal their real IP addresses, security researchers from Hacker House have warned. On Windows, multimedia files encoded with special Microsoft SDK will automatically open an IE window and access a URL to check the file's license. Since this request is sent outside of the Tor Browser and without user interaction, this can be used to ping law enforcement servers and detect the user's real IP address and other details. For example, law enforcement could host properly signed DRM-protected files on sites pretending to host child pornography. When a user would try to view the file, the DRM multimedia file would use Internet Explorer to ping a server belonging to the law enforcement agency. The same tactic can also be used to target ISIS militants trying to view propaganda videos, illegal drug and weapons buyers trying to view video product demos, political dissidents viewing news videos, and more. A video of the attack is available here.' -- source: https://yro.slashdot.org/story/17/02/02/231229 Not sure whether that applies to Linux/Wine/IE as well. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Judge Stops PS3 Linux Settlement
by Lawrence D'Oliveiro 03 Feb '17

03 Feb '17

<https://arstechnica.com/tech-policy/2017/02/game-over-for-ps3-linux-settlem…>: “The California judge presiding over the litigation is now killing the proposed settlement amid concerns the lawyers representing the class haven't explained why they should get $2.25 million for their legal services, especially considering that the deal has made it burdensome on gamers to get their cash.” Seems par for the course for class-action settlements, that the lawyers rake it in in fees, while the actual plaintiffs end up with peanuts...

1 0

How Google fought back against a crippling IoT-powered botnet and won
by Peter Reutemann 02 Feb '17

02 Feb '17

'In September, KrebsOnSecurity—arguably the Internet's most intrepid source of security news—was on the receiving end of some of the biggest distributed denial-of-service attacks ever recorded. The site soon went dark after Akamai said it would no longer provide the site with free protection, and no other DDoS mitigation services came forward to volunteer their services. A Google-operated service called Project Shield ultimately brought KrebsOnSecurity back online and has been protecting the site ever since. At the Enigma security conference on Wednesday, a Google security engineer described some of the behind-the-scenes events that occurred shortly after Krebs asked the service for help, and in the months since, they said yes. While there was never significant hesitancy to bring him in, the engineers did what engineers always do—weighed the risks against the benefits. "What happens if this botnet actually takes down google.com and we lose all of our revenue?" Google Security Reliability Engineer Damian Menscher recalls people asking. "But we considered [that] if the botnet can take us down, we're probably already at risk anyway. There's nothing stopping them from attacking us at any time. So we really had nothing to lose here."' -- source: https://arstechnica.com/security/2017/02/how-google-fought-back-against-a-c… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Gitlab Backups ... What Backups?
by Lawrence D'Oliveiro 02 Feb '17

02 Feb '17

A harried sysadmin accidentally deletes nearly 300GB of data during a troublesome data replication process ... and then they discover that, out of 5 different recovery procedures they thought they had available, none work. <http://www.theregister.co.uk/2017/02/01/gitlab_data_loss/>

2 2