September 2017 - wlug - list.wlug.org.nz

EFF resigns from W3C - An open letter to the W3C Director, CEO, team and membership
by Peter Reutemann 19 Sep '17

19 Sep '17

'In 2013, EFF was disappointed to learn that the W3C had taken on the project of standardizing “Encrypted Media Extensions,” an API whose sole function was to provide a first-class role for DRM within the Web browser ecosystem. By doing so, the organization offered the use of its patent pool, its staff support, and its moral authority to the idea that browsers can and should be designed to cede control over key aspects from users to remote parties. [...] We believe they will regret that choice. Today, the W3C bequeaths an legally unauditable attack-surface to browsers used by billions of people. They give media companies the power to sue or intimidate away those who might re-purpose video for people with disabilities. They side against the archivists who are scrambling to preserve the public record of our era. The W3C process has been abused by companies that made their fortunes by upsetting the established order, and now, thanks to EME, they’ll be able to ensure no one ever subjects them to the same innovative pressures. [...] We will defend those who are put in harm's way for blowing the whistle on defects in EME implementations. It is a tragedy that we will be doing that without our friends at the W3C, and with the world believing that the pioneers and creators of the web no longer care about these matters. Effective today, EFF is resigning from the W3C.' -- source: https://www.eff.org/deeplinks/2017/09/open-letter-w3c-director-ceo-team-and… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

A Telemarketer Called My Elevator
by Lawrence D'Oliveiro 19 Sep '17

19 Sep '17

Guy steps into lift, gets spiel from emergency intercom inviting him to “press 1” on nonexistent keypad to sign up. <https://arstechnica.com/gaming/2017/09/a-telemarketer-called-my-elevator/> Me, I blame VoIP ...

1 0

Will Linux Innovation Be Driven By Microsoft?
by Peter Reutemann 18 Sep '17

18 Sep '17

'Adobe's VP of Mobile (and a former intellectual property lawyer) sees "a very possible future where Microsoft doesn't merely accept a peaceful coexistence with Linux, but instead enthusiastically embraces it as a key to its future," noting Microsoft's many Linux kernel developers and arguing it's already innovating around Linux -- especially in the cloud. An anonymous reader quotes InfoWorld: Even seemingly pedestrian work -- like making Docker containers work for Windows, not merely Linux -- is a big deal for enterprises that don't want open source politics infesting their IT. Or how about Hyper-V containers, which marry the high density of containers to the isolation of traditional VMs? That's a really big deal... Microsoft has started hiring Linux kernel developers like Matthew Wilcox, Paul Shilovsky, and (in mid-2016) Stephen Hemminger... Microsoft now employs 12 Linux kernel contributors. As for what these engineers are doing, Linux kernel maintainer Greg Kroah-Hartman says, "Microsoft now has developers contributing to various core areas of the kernel (memory management, core data structures, networking infrastructure), the CIFS filesystem, and of course many contributions to make Linux work better on its Hyper-V systems." In sum, the Linux Foundation's Jim Zemlin declares, "It is accurate to say they are a core contributor," with the likelihood that Hemminger's and others' contributions will move Microsoft out of the kernel contribution basement into the upper echelons. The article concludes that "Pigs, in other words, do fly. Microsoft, while maintaining its commitment to Windows, has made the necessary steps to not merely run on Linux but to help shape the future of Linux."' -- source: https://linux.slashdot.org/story/17/09/16/2335251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

4 4

Ad Industry “Deeply Concerned” About Safari’s New Ad-Tracking Restrictions
by Lawrence D'Oliveiro 17 Sep '17

17 Sep '17

Some have called for the total abolition of access to third-party cookies altogether. Apple’s new version of Safari doesn’t go this far, only imposing a 24-hour limit on their usability. But this is already enough to get the ad agencies up in arms. <https://arstechnica.com/tech-policy/2017/09/ad-industry-deeply-concerned-ab…>

1 0

'Bashware' Attacks Exploit Windows 10's Subsystem for Linux
by Peter Reutemann 17 Sep '17

17 Sep '17

'While many people welcomed the arrival of Windows Subsystem for Linux (WSL) in Windows 10, it has been found to be a potential security issue. A new technique known as a Bashware has been discovered by security researchers that makes it possible for malware to use the Linux shell to bypass security software. While administrator access is needed to execute a Bashware attack, this is fairly easily obtained, and the technique can be used to disguise malicious operations from antivirus software and other security tools. Researchers from Check Point Research point out that the danger stems from the fact that "existing security solutions are still not adapted to monitor processes of Linux executables running on Windows."' -- source: https://tech.slashdot.org/story/17/09/16/041251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Uber’s “Greyball” Regulator-Evading System
by Lawrence D'Oliveiro 16 Sep '17

16 Sep '17

We reported back in May that the Justice Department had commenced a criminal investigation into Uber's use of a software tool that helped drivers evade picking up local officials in places where the service had not been approved. ... The Greyball software employs a dozen data points on a new user in a given market, including whether a rider's Uber app is opened repeatedly in or around municipal offices, which credit card is linked to the account, and any publicly available information about the new user on social media. If the data suggests the new user is a regulator in a market where Uber is not permitted, the company would present that user with false information about where Uber rides are. <https://arstechnica.com/tech-policy/2017/09/heres-a-real-life-slimy-example…>

1 0

Quantum Computers Calculate Minimum-Energy State of Three Simple Molecules
by Lawrence D'Oliveiro 16 Sep '17

16 Sep '17

From <https://arstechnica.com/science/2017/09/quantum-computers-reach-deeper-find…>: Every time we discuss quantum computers, the headline tends to be that someone, somewhere is going to use the quantum to break your encryption and steal your student loan. If only that were true. But it is probably more realistic to think about quantum computers being used to solve quantum problems. ... However, for lithium hydride and beryllium hydride, the solutions are less accurate. The researchers believe that the falling accuracy is not due to the simplifications but hap[p]ens because the qubits do not stay sufficiently coherent during the calculation. In other words, quantum computers are the modern-day equivalent of analog computers, not digital ones: just like in the early days of mechanical- and electronic-based analog machines, they can give answers more quickly, but with less accuracy than, a digital one.

2 8

Azure Confidential Computing Will Keep Data Secret, Even From Microsoft
by Lawrence D'Oliveiro 15 Sep '17

15 Sep '17

From <https://arstechnica.com/gadgets/2017/09/azure-confidential-computing-will-k…>: The SGX mode uses processor features to carve out a TEE within a regular process—no virtual machines necessary. The processor itself will encrypt and decrypt data from memory, such that the data is only decrypted when it's within the processor itself. With this mode, even Hyper-V's security isn't important; the only thing that an application has to trust is the processor and its implementation of SGX. With SGX enclaves, nobody—not even Microsoft—can see the data in the TEE. So we only have to trust Intel...

1 0

The Big List Of Naughty Strings
by Lawrence D'Oliveiro 15 Sep '17

15 Sep '17

The Big List of Naughty Strings is an evolving list of strings which have a high probability of causing issues when used as user-input data. This is intended for use in helping both automated and manual QA testing; useful for whenever your QA engineer walks into a bar. <https://github.com/minimaxir/big-list-of-naughty-strings> The “walks into a bar” reference is to this <http://www.sempf.net/post/On-Testing1>: QA Engineer walks into a bar. Orders a beer. Orders 0 beers. Orders 999999999 beers. Orders a lizard. Orders -1 beers. Orders a sfdeljknesv. Because that’s what testing is all about...

3 2

Python Explosion Blamed On Pandas
by Lawrence D'Oliveiro 15 Sep '17

15 Sep '17

Not content to bait developers by declaring that Python is the fastest-growing major programming language, coding community site Stack Overflow has revealed the reason for its metastasis. ... Programmers love pandas. <http://www.theregister.co.uk/2017/09/14/python_explosion_blamed_on_pandas/>

2 2