July 2017 - wlug - list.wlug.org.nz

Aussie Law >> Maths
by Lawrence D'Oliveiro 02 Oct '18

02 Oct '18

"The laws of Australia prevail in Australia, I can assure you of that," [Malcolm Turnbull] said on Friday. "The laws of mathematics are very commendable, but the only law that applies in Australia is the law of Australia." <https://www.techdirt.com/articles/20170714/10385237789/aussie-prime-ministe…>

1 2

An Ordinary User’s Adventures In Linux
by Lawrence D'Oliveiro 30 Sep '17

30 Sep '17

I helped an elderly friend set up his new PC yesterday. His previous machine, over a decade old, was running Windows XP. I had set up an Ubuntu dual-boot a few years back, and he liked playing the games. But then the Linux boot stopped working--there was a message to the effect “hd0 out of disk”, which sounded like a GRUB problem (“hd0” being a GRUB disk name, not a Linux disk name). I booted up SystemRescueCD, and found that disk space was ample. I did an fsck on the Linux volume, and found no filesystem problems. I ran a badblocks scan, and it reported several bad sectors, though oddly they only seemed to be in the Windows partition (if I interpreted the numbers correctly). Naturally I searched online, but the hits I found for that error message didn’t seem very helpful. Reinstalling GRUB didn’t help, so I concluded there were likely other hardware problems, so time for a new machine. He got an entry-level dual-core AMD box from PBTech--their own house build, in a CoolerMaster case--for well under a grand. Nothing fancy, but good enough for his needs--mainly Web browsing, e-mail, a little bit of word processing, and those games. The PBTech box came without an OS. He could have got Windows 10 for it, but considering he would be facing a learning curve coming from XP regardless, I suggested going 100% Linux for all his daily needs, to see if that would work. He could always spend the $160-odd extra on Windows later if need be. So I set it up with Linux Mint, since that seems to be everybody’s favourite :). He was already using Firefox on Windows, so moving all his Web bookmarks across was easy. The Mint install put an icon for Thunderbird on the desktop by default, so I decided to try that for e-mail. Getting his address book across from Outlook Express was fairly straightforward, once I figured out how to map the exported CSV field names correctly. The mail messages were slightly more fiddly, but I found this extension <https://addons.mozilla.org/en-US/thunderbird/addon/importexporttools/> which directly loads Microsoft’s .dbx files, and that seemed to work OK. Then he wanted to play CDs. When we put in an audio CD, it came up with options to run Banshee (media player) or Brasero (disc burner). The Banshee media player wouldn’t play the CD directly, it insisted on ripping it to the hard drive first. This was not really what he wanted. I had a look round, and found KsCD, which will indeed play audio CDs without trying to rip them to audio files first. As far as I know, this is the only GUI Linux app that can do so. So, day 1 ended on a reasonably successful note. He was already noticing how much faster the new machine was. So we’ll see how it goes from here...

5 13

That Reminds Me ...
by Lawrence D'Oliveiro 10 Aug '17

10 Aug '17

... I finally got around to writing up some notes on the tips I presented for accessing the systemd journal at that talk last year <https://github.com/WLUG/meetings/tree/master/2016/2016-06-27>.

6 11

Systemd wins top gong for 'lamest vendor' in Pwnie security awards
by Bryan Baldwin 30 Jul '17

30 Jul '17

The lamest vendor response award went to Systemd supremo Lennart Poettering for his controversial, and perhaps questionable, handling of the following bugs in everyone's favorite init replacement. Nomination Submission: Awarded to the vendor who mis-handled a security vulnerability most spectacularly. SystemD bugs 5998, 6225, 6214, 5144, 6237 Credit: Lennart Poettering Where you are dereferencing null pointers, or writing out of bounds, or not supporting fully qualified domain names, or giving root privileges to any user whose name begins with a number, there's no chance that the CVE number will referenced in either the change log or the commit message. But CVEs aren't really our currency any more, and only the lamest of vendors gets a Pwnie! https://pwnies.com/nominations/ https://www.theregister.co.uk/2017/07/28/black_hat_pwnie_awards/

3 2

Trust Me, I’m A Random-Number Generator
by Lawrence D'Oliveiro 30 Jul '17

30 Jul '17

SK Telecom has created a “quantum random number generator” chip <https://www.theregister.co.uk/2017/07/26/sk_telecom_makes_light_of_random_n…>. Seems like slapping the label “quantum” on anything is enough to make people believe you know what you are talking about. Random-number generators are notorious for being easily subverted. And hearing things like “SK Telecom hasn't specified what kind [of quantum noise source they are using]” is not exactly reassuring. You can never be sure your random numbers are truly random. But you try to stack the deck as much in your favour as you can. The Linux kernel mixes in several sources of entropy to feed /dev/random (and from there, /dev/urandom), in the hope that, as long as one of them remains unsubverted (intentionally or otherwise), the output can be trusted. This is also the principle behind the Fortuna PRNG <https://en.wikipedia.org/wiki/Fortuna_(PRNG)>, which well-known computer security guru Bruce Schneier had a hand in.

2 3

Anti-systemd Trolls
by Lawrence D'Oliveiro 27 Jul '17

27 Jul '17

I keep wondering about these random names who pop up with all the badmouthing every time somebody mentions something about systemd. I don’t recall any faces at WLUG meetings that go with them. Who are you and where do you come from? Do you people have any interest in the Waikato Linux User Group at all, or are you just here to shoot your mouths off?

4 9

Some Low-Cost Android Phones Come at a Price -- Your Privacy
by Peter Reutemann 27 Jul '17

27 Jul '17

'At $60, the BLU R1 HD is the top-selling phone on Amazon. Last November, researchers caught it secretly sending private data to China. Shanghai Adups Technology, the group behind the spying software on the BLU R1 HD, called it a mistake. But analysts at Kryptowire found the software provider is still making the same "mistake" on other phones. At the Black Hat security conference in Las Vegas on Wednesday, researchers from Kryptowire, a security firm, revealed that Adups' software is still sending a device's data to the company's server in Shanghai without alerting people. But now, it's being more secretive about it. "They replaced them with nicer versions," Ryan Johnson, a research engineer and co-founder at Kryptowire, said. "I have captured the network traffic of them using the Command and Control channel when they did it." An Adups spokeswoman said that it had resolved the issues in 2016 and that the issues "are not existing anymore." Kryptowire said it has observed the company sending data without telling users on at least three different phones.' -- source: https://it.slashdot.org/story/17/07/26/187258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Wellcome Trust Wants To Share
by Lawrence D'Oliveiro 26 Jul '17

26 Jul '17

You’ve probably heard of the Wellcome Trust: they’re a UK-based nonprofit that funds scientific research, primarily into health. They’ve long had an open-access policy, meaning that “all original research articles and scholarly monographs resulting from our funding are made freely available”. Contrast this with what more commonly happens with scientific research, where the journal publishers get exclusive copyright over the papers, and charge an arm and a leg to everyone wanting a copy. Now the Wellcome Trust is going even further, and requiring open access in a timely manner to the raw research data (within reasonable limits, such as privacy concerns etc), material such as cell lines, antibodies and reagents, and also any software developed. No actual mention of “open source” or “Free software” licences as such, though; the news article only uses the word “freeware”, which I’m not sure is the word they should be using. <https://www.theregister.co.uk/2017/07/25/wellcome_trust_extends_research_da…> <https://wellcome.ac.uk/news/our-new-policy-sharing-research-data-what-it-me…>

1 0

Intel Abandons Consumer/Hobbyist IoT
by Lawrence D'Oliveiro 26 Jul '17

26 Jul '17

Intel is giving up on its consumer/hobbyist-oriented Internet of Things products <https://www.theregister.co.uk/2017/07/25/intel_arduino_board_curie_canceled/>. However, the “enterprise”-oriented efforts remain for now. Not sure what “enterprise” means in this space: are there companies building IoT-type devices for their own internal use? Or is this referring to companies selling readymade IoT products? In any case, I suspect this is the one area left where “Windows 10 IoT Edition” can be mentioned without raising hails of derisive laughter...

1 0

The systemd House Of Horror
by Lawrence D'Oliveiro 26 Jul '17

26 Jul '17

Came across this link in one of the comments to The Register’s article on Fedora 26, rife with the usual anti-systemd moaning. “Here are some examples of how people commonly use systemd in an egregiously wrong manner ... Don't ask me why, so far, all of these have involved starting Java programs. Maybe it's Oracle in general.” <https://jdebp.eu/FGA/systemd-house-of-horror/>

2 6