May 2017 - wlug - list.wlug.org.nz

An Ordinary User’s Adventures In Linux
by Lawrence D'Oliveiro 30 Sep '17

30 Sep '17

I helped an elderly friend set up his new PC yesterday. His previous machine, over a decade old, was running Windows XP. I had set up an Ubuntu dual-boot a few years back, and he liked playing the games. But then the Linux boot stopped working--there was a message to the effect “hd0 out of disk”, which sounded like a GRUB problem (“hd0” being a GRUB disk name, not a Linux disk name). I booted up SystemRescueCD, and found that disk space was ample. I did an fsck on the Linux volume, and found no filesystem problems. I ran a badblocks scan, and it reported several bad sectors, though oddly they only seemed to be in the Windows partition (if I interpreted the numbers correctly). Naturally I searched online, but the hits I found for that error message didn’t seem very helpful. Reinstalling GRUB didn’t help, so I concluded there were likely other hardware problems, so time for a new machine. He got an entry-level dual-core AMD box from PBTech--their own house build, in a CoolerMaster case--for well under a grand. Nothing fancy, but good enough for his needs--mainly Web browsing, e-mail, a little bit of word processing, and those games. The PBTech box came without an OS. He could have got Windows 10 for it, but considering he would be facing a learning curve coming from XP regardless, I suggested going 100% Linux for all his daily needs, to see if that would work. He could always spend the $160-odd extra on Windows later if need be. So I set it up with Linux Mint, since that seems to be everybody’s favourite :). He was already using Firefox on Windows, so moving all his Web bookmarks across was easy. The Mint install put an icon for Thunderbird on the desktop by default, so I decided to try that for e-mail. Getting his address book across from Outlook Express was fairly straightforward, once I figured out how to map the exported CSV field names correctly. The mail messages were slightly more fiddly, but I found this extension <https://addons.mozilla.org/en-US/thunderbird/addon/importexporttools/> which directly loads Microsoft’s .dbx files, and that seemed to work OK. Then he wanted to play CDs. When we put in an audio CD, it came up with options to run Banshee (media player) or Brasero (disc burner). The Banshee media player wouldn’t play the CD directly, it insisted on ripping it to the hard drive first. This was not really what he wanted. I had a look round, and found KsCD, which will indeed play audio CDs without trying to rip them to audio files first. As far as I know, this is the only GUI Linux app that can do so. So, day 1 ended on a reasonably successful note. He was already noticing how much faster the new machine was. So we’ll see how it goes from here...

5 13

US Supreme Court Victory for the Right to Tinker in Printer Cartridge Case
by Ian Stewart 01 Jun '17

01 Jun '17

"The [US] Supreme Court struck a blow today for your right to own the things you buy, reversing a lower court decision that had given patent owners the power to sue customers who paid in full for a patented item but then used it in a way the patent owner didn't care for. Together with Public Knowledge and R Street, EFF filed an amicus brief at the Supreme Court. We explained that the ability of patent owners to sell products into the stream of commerce while also writing a wishlist of anti-competitive restrictions, would be a disastrous expansion of patent law, hindering competition, innovation, and your freedom to tinker with and repair your own stuff. The Supreme Court agreed, explaining that when a patent owner "chooses to sell an item, that product is no longer within the limits of the monopoly and instead becomes the private individual property of the purchaser, with the rights and benefits that come along with ownership." The Court emphasized that, by default, people have every right to make, sell, and use things. The limited monopoly that the government bestows upon a patent owner is a deviation from the norm of free market competition and ownership of personal property, and is subject to important limits in order to protect the public interest. The Court explained that people who buy things are allowed to use and resell them without being sued under patent and copyright law, and explained that this freedom is necessary for commerce to function. The next logical step will be for courts to recognize that people who buy digital goods are owners of those goods, not mere licensees, and can resell and tinker with their digital goods to the same extent as purchasers of tangible property." See the Electronic Frontier Foundation (EFF) article for more details... https://www.eff.org/deeplinks/2017/05/supreme-court-victory-right-tinker-pr… [https://www.eff.org/files/issues/patents-2.png]<https://www.eff.org/deeplinks/2017/05/supreme-court-victory-right-tinker-pr…> Supreme Court Victory for the Right to Tinker in Printer Cartridge Case<https://www.eff.org/deeplinks/2017/05/supreme-court-victory-right-tinker-pr…> www.eff.org The Supreme Court struck a blow today [PDF] for yo Maybe the 11 remaining TPP countries will ensure that their agreement endorses this ruling ? cheers, Ian

2 1

Car Emissions Cheating: How It’s Done
by Lawrence D'Oliveiro 29 May '17

29 May '17

Researchers have been digging through car firmware from Volkswagen and Audi to get to the bottom of the emissions-testing scandal that broke a couple of years ago. Turns out the code was written by Bosch, and important information in the form of “function sheets” (documentation for what the firmware does) was not (officially) forthcoming from that company. But unofficial sources can be found on online forums frequented by vehicle-modding enthusiasts. <https://arstechnica.com/cars/2017/05/volkswagen-bosch-fiat-diesel-emissions…>

1 0

Creative Commons Staff Members Release New Free eBook
by Peter Reutemann 28 May '17

28 May '17

'Creative Commons staff-members Sarah Hinchliff Pearson and Paul Stacey have now published Made With Creative Commons, the awaited book they successfully funded on Kickstarter in 2015. "Made With Creative Commons is a book about sharing," explains the book's description. "It is about sharing textbooks, music, data, art, and more. People, organizations, and businesses all over the world are sharing their work using Creative Commons licenses because they want to encourage the public to reuse their works, to copy them, to modify them... But if they are giving their work away to the public for free, how do they make money? "This is the question this book sets out to answer. There are 24 in-depth examples of different ways to sustain what you do when you share your work. And there are lessons, about how to make money but also about what sharing really looks like -- why we do it and what it can bring to the economy and the world. Full of practical advice and inspiring stories, Made with Creative Commons is a book that will show you what it really means to share." There's free versions in PDF, ePub, and MOBI formats for downloading from the Creative Commons site, and there's also an edit-able version on Google Docs. A small Danish non-profit publisher named Ctrl+Alt+Delete Books is also publishing print copies of the book under a Creative Commons license "to ensure easy sharing," and is making the book available on Amazon or through the publisher's own web site.' -- source: https://news.slashdot.org/story/17/05/28/0130259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Timers In systemd
by Lawrence D'Oliveiro 27 May '17

27 May '17

Was referred to this page <https://wiki.gentoo.org/wiki/Systemd> about enabling systemd as the init system in Gentoo. The section on “Timer services” I found particularly useful, as applicable to other distros running systemd: instead of a conventional crontab, you create .timer entries, and corresponding .service descriptions for them to invoke, in your ~/.local/share/systemd/user area. One advantage of this I can see is one less set of user files kept in /var. In fact, do this in conjunction with maildir format for user mail, and you no longer need to have any user files in /var. (That I can think of, anyway...)

1 0

Popularity Contests
by Lawrence D'Oliveiro 26 May '17

26 May '17

In the middle of another Phoronix flame war, someone posted links to a couple of interesting pages. What’s your favourite desktop environment? According to this <https://opensource.com/life/15/7/poll-preferred-desktop-environment>, GNOME is number one, with KDE not far behind. One-third of respondents use something else. Arch Linux offers some stats <https://www.archlinux.de/?page=FunStatistics> on popularity of desktop environments and other software among its users. Here GNOME and KDE add up to only about 50%. By the way, it’s clear from the numbers for browsers and text editors in the latter that lots of people use more than one.

1 0

UK Government May Push Anti-Encryption Laws After Election
by Lawrence D'Oliveiro 25 May '17

25 May '17

Not too surprising to discover that some parties in the UK might be using the Manchester attack as a pretext to push through laws to ban secure encryption <https://www.theregister.co.uk/2017/05/25/uk_to_push_antiencryption_laws_aft…>. As if such a ban would have helped uncover a perpetrator who, by all accounts, had already been reported to the authorities multiple times...

3 5

A wormable code-execution bug has lurked in Samba for 7 years. Patch now!
by Peter Reutemann 25 May '17

25 May '17

'Maintainers of the Samba networking utility just patched a critical code-execution vulnerability that could pose a severe threat to users until the fix is widely installed. The seven-year-old flaw, indexed as CVE-2017-7494, can be reliably exploited with just one line of code to execute malicious code, as long as a few conditions are met. Those requirements include vulnerable computers that (a) make file- and printer-sharing port 445 reachable on the Internet, (b) configure shared files to have write privileges, and (c) use known or guessable server paths for those files. When those conditions are satisfied, remote attackers can upload any code of their choosing and cause the server to execute it, possibly with unfettered root privileges depending on the vulnerable platform. "All versions of Samba from 3.5.0 onwards are vulnerable to a remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it," Samba maintainers wrote in an advisory published Wednesday. They urged anyone using a vulnerable version to install a patch as soon as possible.' -- source: https://arstechnica.com/security/2017/05/a-wormable-code-execution-bug-has-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Windows switch to Git almost complete: 8, 500 commits and 1, 760 builds each day
by Peter Reutemann 25 May '17

25 May '17

'Back in February, Microsoft made the surprising announcement that the Windows development team was going to move to using the open source Git version control system for Windows development. A little over three months after that first revelation, and about 90 percent of the Windows engineering team has made the switch.' -- source: https://arstechnica.com/information-technology/2017/05/90-of-windows-devs-n… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Malicious Subtitles Threaten VLC, Kodi and Popcorn Time Users, Researchers Warn
by Peter Reutemann 24 May '17

24 May '17

'Millions of people risk having their devices and systems compromised by malicious subtitles, according to a new research published by security firm Check Point. The threat comes from a previously undocumented vulnerability which affects users of popular streaming software, including Kodi, Popcorn-Time, and VLC. Developers of the applications have already applied fixes and in some cases, working on it. From a report: While most subtitle makers do no harm, it appears that those with malicious intent can exploit these popular streaming applications to penetrate the devices and systems of these users. Researchers from Check Point, who uncovered the problem, describe the subtitle 'attack vector' as the most widespread, easily accessed and zero-resistance vulnerability that has been reported in recent years. "By conducting attacks through subtitles, hackers can take complete control over any device running them. From this point on, the attacker can do whatever he wants with the victim's machine, whether it is a PC, a smart TV, or a mobile device," they write.' -- source: https://it.slashdot.org/story/17/05/24/1329211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Testing Windows Software For Vulns Too Slow? Do It On Linux!
by Lawrence D'Oliveiro 24 May '17

24 May '17

“Distributed, scalable fuzzing on Windows can be challenging and inefficient. This is especially true for endpoint security products, which use complex interconnected components that span across kernel and user space. This often requires spinning up an entire virtualized Windows environment to fuzz them or collect coverage data.” Porting stuff like Windows antivirus tools to Linux lets Ormandy “run the code I’m testing in minimal containers with very little overhead, and easily scale up testing”. Oh, and “I also think Linux has better tools”. <https://www.theregister.co.uk/2017/05/24/whats_got_a_vast_attack_service_an…>

1 0

WannaCry Makes an Easy Case For Linux
by Peter Reutemann 23 May '17

23 May '17

'The thing is, WannaCry isn't the first of its kind. In fact, ransomware has been exploiting Windows vulnerabilities for a while. The first known ransomware attack was called "AIDS Trojan" that infected Windows machines back in 1989. This particular ransomware attack switched the autoexec.bat file. This new file counted the amount of times a machine had been booted; when the machine reached a count of 90, all of the filenames on the C drive were encrypted. Windows, of course, isn't the only platform to have been hit by ransomware. In fact, back in 2015, the LinuxEncoder ransomware was discovered. That bit of malicious code, however, only affected servers running the Magento ecommerce solution. The important question here is this: Have their been any ransomware attacks on the Linux desktop? The answer is no. With that in mind, it's pretty easy to draw the conclusion that now would be a great time to start deploying Linux on the desktop. I can already hear the tired arguments. The primary issue: software. I will counter that argument by saying this: Most software has migrated to either Software as a Service (SaaS) or the cloud. The majority of work people do is via a web browser. Chrome, Firefox, Edge, Safari; with few exceptions, SaaS doesn't care. With that in mind, why would you want your employees and staff using a vulnerable system? [...] Imagine, if you will, you have deployed Linux as a desktop OS for your company and those machines work like champs from the day you set them up to the day the hardware finally fails. Doesn't that sound like a win your company could use? If your employees work primarily with SaaS (through web browsers), then there is zero reason keeping you from making the switch to a more reliable, secure platform.' -- source: https://linux.slashdot.org/story/17/05/18/1757205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Check-In Delays At Auckland Airport, Australia And Elsewhere
by Lawrence D'Oliveiro 22 May '17

22 May '17

You may have come across this report <http://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=11860878> about problems with check-in processing at Auckland and Wellington “as a result of a global issue”. This item from The Register <https://www.theregister.co.uk/2017/05/22/sita_failure_australia/> gives a few more details, mentioning an international hookup called “SITA” which was hit by problems in the UK.

1 0

Disabling Microsoft Telemetry Is Not So Easy
by Lawrence D'Oliveiro 22 May '17

22 May '17

Came across a link to this series of tweets <https://twitter.com/m8urnett/status/866353982217699328> detailing a sysadmin’s attempts to block his Windows 10 Enterprise installation from making gratuitous Internet accesses. Seems like the obvious answer--blocking things at your border router--can cause major Windows malfunctions...

1 0

upcoming meeting
by Peter Reutemann 18 May '17

18 May '17

Hi everyone We don't have anything scheduled yet for the upcoming meeting next week. Any ideas? [and apologies if I should have missed your suggestion - I've got too many things going on at the moment...] Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

Google Takes Another Shot At Making Android Great On Low-Budget Smartphones
by Peter Reutemann 17 May '17

17 May '17

'At its developer conference, Google unveiled Android Go, a project wherein Google will offer a version of Android that runs swiftly on budget, low-specced smartphones. With the new strategy, Google hopes to further improve the low-budget smartphone ecosystem in developing markets. Android Go will be focused around building a version of Android for phones with less memory, with the System UI and kernel able to run with as little as 512MB of memory. Apps will be optimized for low bandwidth and memory, with a version of Play Store designed for those markets that will highlight these apps. From a report: Another feature of Android Go will be data management. Android Go will let you easily see your data usage, and thanks to carrier integration, it'll also let you top-up with more data right on your device.' -- source: https://hardware.slashdot.org/story/17/05/17/202209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu 17.04 review: Don’t call it abandonware, per se
by Peter Reutemann 12 May '17

12 May '17

'Last month, it finally happened. Six years after its tumultuous switch from GNOME 2 to the homegrown Unity desktop, Canonical announced it was abandoning work on Unity. Going forward, the company will switch the default Ubuntu desktop back to GNOME beginning with next year's 18.04 LTS release. This means Canonical is also abandoning the development of the Mir display server and its unified interface of Ubuntu for phones and tablets. The company's vision of "convergence," as Canonical founder Mark Shuttleworth termed it, has officially died.' -- source: https://arstechnica.com/gadgets/2017/05/ubuntu-17-04-review-this-is-unitys-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu Arrives in the Windows Store, Suse and Fedora Are Coming To the Windows Subsystem For Linux
by Peter Reutemann 11 May '17

11 May '17

'At its Build developer conference today, Microsoft announced that Ubuntu has arrived in the Windows Store. From a report: The company also revealed that it is working with Fedora and Suse to bring their distributions to the Windows Subsystem for Linux (WSL) in Windows 10. At the conference last year, Microsoft announced plans to bring the Bash shell to Windows. The fruits of that labor was WSL, a compatibility layer for running Linux binary executables (in ELF format) natively on Windows, which arrived with the Windows 10 Anniversary Update released in August 2016. Microsoft also partnered with Canonical to allow Ubuntu tools and utilities to run natively on top of the WSL. By bringing Ubuntu to the Windows Store, the company is now making it even easier for developers to install the tools and run Windows and Linux apps side by side. Working with other Linux firms shows that Microsoft's deal with Canonical was not a one-time affair, but rather part of a long-term investment in the Linux world.' -- source: https://news.slashdot.org/story/17/05/11/1535214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Canonical Founder Says Recent Changes In Ubuntu Were Necessary To Prepare the Company For an IPO
by Peter Reutemann 10 May '17

10 May '17

'Canonical was doing well with Ubuntu and cloud and container-related technologies, such as Juju, LXD, and Metal-as-a-Service (MaaS). In addition, its OpenStack and Kubernetes software stacks, according to Shuttleworth, are growing by leaps and bounds on both the public and private cloud. Canonical founder Mark Shuttleworth said "in the last year, Ubuntu cloud growth had been 70 percent on the private cloud and 90 percent on the public cloud." In particular, "Ubuntu has been gaining more customers on the big five public clouds." What hadn't succeeded was Canonical's attempt to make Unity the universal interface for desktops, tablets, and smartphones. Shuttleworth was personally invested in this project, but at day's end, it wasn't getting enough adoption to make it profitable. So, Shuttleworth said with regret, Unity had to be dropped. This move also means Canonical will devote more of its time to "putting the company on the path to a IPO. We must figure out what steps we need to take moving forward." That means focusing on Canonical's most profitable lines. Specifically, "Ubuntu will never die. Ubuntu is the default platform on cloud computing. Juju, MaaS, and OpenStack are nearly unstoppable. We need to work out more of our IoT path. At the same time, we had to cut out those parts that couldn't meet an investors' needs. The immediate work is get all parts of the company profitable."' -- source: https://linux.slashdot.org/story/17/05/09/1553255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Re: [wlug] How Psychology Today Sees Richard Stallman
by rowan schischka 09 May '17

09 May '17

>He is a control freak, and a prophet. He has been right more than once >(the dangers of software patents, pitfalls of online services). But >some of his policy decisions (e.g. the reluctance to allow a plugin >architecture into GCC for fear it would lead to evasion of the GPL) >have, I think, been counterproductive. >But isn?t it grand that Free Software is all about having a choice? >That we can use what he and everybody else working for the FSF has been >responsible for, without necessarily having to subscribe to every tenet >of his philosophy? You can't expect anyone to be 100% correct on everything.

2 1

Re: [wlug] The hijacking flaw that lurked in Intel chips is worse than anyone thought
by rowan schischka 09 May '17

09 May '17

I went through Intel's press release and document on how to detect the exploit. https://downloadmirror.intel.com/26754/eng/Intel-SA-00075%20Mitigation%20Gu… Intel says this to detect: netstat -na | findstr "\<16993\> \<16992\> \<16994\> \<16995\> \<623\> \<664\>" Is that all we can do? just scan for port numbers and throw them into our firewalls?

1 0

Google’s “Fuchsia” smartphone OS dumps Linux, has a wild new UI
by Peter Reutemann 09 May '17

09 May '17

'Google, never one to compete in a market with a single product, is apparently hard at work on a third operating system after Android and Chrome OS. This one is an open source, real-time OS called "Fuchsia." The OS first popped up in August last year, but back then it was just a command line. Now the mysterious project has a crazy new UI we can look at, so let's dive in. Unlike Android and Chrome OS, Fuchsia is not based on Linux—it uses a new, Google-developed microkernel called "Magenta." With Fuchsia, Google would not only be dumping the Linux kernel, but also the GPL: the OS is licensed under a mix of BSD 3 clause, MIT, and Apache 2.0. Dumping Linux might come as a bit of a shock, but the Android ecosystem seems to have no desire to keep up with upstream Linux releases. Even the Google Pixel is still stuck on Linux Kernel 3.18, which was first released at the end of 2014.' -- source: https://arstechnica.com/gadgets/2017/05/googles-fuchsia-smartphone-os-dumps… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How Psychology Today Sees Richard Stallman
by Peter Reutemann 08 May '17

08 May '17

'After our article about Richard Stallman's new video interview, Slashdot reader silverjacket shared this recent profile from Psychology Today that describes Richard Stallman's quest "to save us from a web of spyware -- and from ourselves." By using proprietary software, Stallman believes, we are forfeiting control of our computers, and thus of our digital lives. In his denunciation of all nonfree software as inherently abusive and unethical, he has alienated many possible allies and followers. But he is not here to make friends. He is here to save us from a software industry he considers predatory in ways we've yet to recognize... for Stallman, moralism is the whole point. If you write or use free software only for practical reasons, you'll stop when it's inconvenient, and freedom will disappear. Stallman collaborator Eben Moglen -- a law professor at Columbia, as well as the FSF's general counsel -- assesses Stallman's legacy by saying "the idea of copyleft and the proposition that social and political freedom can't happen in a society without technological freedom -- those are his long-term meanings. And humanity will be aware of those meanings for centuries, whatever it does about them." The article also includes quotes from Linus Torvalds and Eric S. Raymond -- along with some great artwork. In addition to insisting the reporter refer to Linux as "GNU/Linux," Stallman also required that the article describe free software without using the term open source, a phrase he sees as "a way that people who disagree with me try to cause the ethical issues to be forgotten." And he ultimately got Psychology Today to tell its readers that "Nearly all the software on our phones and computers, as well as on other machines, is nonfree or 'proprietary' software and is riddled with spyware and back doors installed by Apple, Google, Microsoft, and the like."' -- source: https://news.slashdot.org/story/17/05/06/0258204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

The hijacking flaw that lurked in Intel chips is worse than anyone thought
by Peter Reutemann 08 May '17

08 May '17

'A remote hijacking flaw that lurked in Intel chips for seven years was more severe than many people imagined, because it allowed hackers to remotely gain administrative control over huge fleets of computers without entering a password. This is according to technical analyses published Friday. As Ars reported Monday, the authentication bypass vulnerability resides in a feature known as Active Management Technology. AMT, as it's usually called, allows system administrators to perform a variety of powerful tasks over a remote connection. Among the capabilities: changing the code that boots up computers, accessing the computer's mouse, keyboard, and monitor, loading and executing programs, and remotely powering on computers that are turned off. In short, AMT makes it possible to log into a computer and exercise the same control enjoyed by administrators with physical access. AMT, which is available with many vPro processors, was set up to require a password before it could be remotely accessed over a Web browser interface. But, remarkably, that authentication mechanism can be bypassed by entering any text string—or no text at all. According to a blog post published Friday by Tenable Network Security, the cryptographic hash that the interface's digest access authentication requires to verify someone is authorized to log in can be anything at all, including no string at all.' -- source: https://arstechnica.com/security/2017/05/the-hijacking-flaw-that-lurked-in-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Debian 8.8 Released
by Peter Reutemann 07 May '17

07 May '17

'The Debian Project announced today Debian GNU/Linux 8.8, the most advanced stable version of the Jessie series, which brings corrections for numerous packages and various security flaws discovered and patched since the release of the Debian GNU/Linux 8.7 maintenance update back in mid-January 2017... "This update mainly adds corrections for security problems to the stable release, along with a few adjustments for serious problems. Security advisories were already published separately and are referenced where available," reads today's announcement. "Please note that this update does not constitute a new version of Debian 8 but only updates some of the packages included. There is no need to throw away old 'jessie' CDs or DVDs but only to update via an up-to-date Debian mirror after an installation, to cause any out of date packages to be updated." Debian 8.8 contains more than 150 bug fixes and security updates.' -- source: https://linux.slashdot.org/story/17/05/06/2243254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0