September 2017 - wlug - list.wlug.org.nz

ISO Rejects NSA Encryption Algorithms
by Lawrence D'Oliveiro 21 Sep '17

21 Sep '17

From <https://www.schneier.com/blog/archives/2017/09/iso_rejects_nsa.html>: The ISO has decided not to approve two NSA-designed block encryption algorithms: Speck and Simon. It's because the NSA is not trusted to put security ahead of surveillance ... I don't trust the NSA, either. I should point out that SELinux was created by the NSA, too. The difference being that that has been subjected to years of careful independent scrutiny.

1 0

FSF Europe Calls For Taxpayer-Funded Software To Be Licensed For Free Re-use
by Lawrence D'Oliveiro 21 Sep '17

21 Sep '17

There are many things one can say about the US, but they have once nice law, at least at the Federal level--anything that might be copyrightable, that is created with taxpayer funds, is automatically in the public domain. For example, this is why everybody gets to have free use of all that stunning imagery from NASA. It also applies to US-Government-developed software as well. I have often wondered why other governments do not follow the same rule. Here in NZ, as in the UK, there is this weird concept of “Crown copyright”, which means that we, as taxpayers, do not get the use of material developed with our own money, we have to pay for it yet again. The European branch of the Free Software Foundation is calling for software developed with European taxpayer money to be made freely available in the same way <https://www.techdirt.com/articles/20170914/09163238207/free-software-founda…>.

3 4

GNOME Partners With Purism On Librem 5 Linux-based Privacy-focused Smartphone
by Peter Reutemann 20 Sep '17

20 Sep '17

'The Librem 5 smartphone by Purism has a long and difficult road ahead of it. Competing against the likes of Apple and Google on the mobile market has proven to be a death sentence for many platforms -- including Microsoft with its failed Windows 10 Mobile. Luckily, Purism has found itself a new partner on this project -- one of the most important organizations in the Linux community -- The GNOME Foundation. The GNOME Foundation explains, 'The Librem 5 is a hardware platform the Foundation is interested in advancing as a GNOME/GTK phone device. The GNOME Foundation is committed to partnering with Purism to create hackfests, tools, emulators, and build awareness that surround moving GNOME/GTK onto the Librem 5 phone. As part of the collaboration, if the campaign is successful the GNOME Foundation plans to enhance GNOME shell and general performance of the system with Purism to enable features on the Librem 5.'' -- source: https://linux.slashdot.org/story/17/09/20/1723246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday
by Peter Reutemann 20 Sep '17

20 Sep '17

Hi everyone I might give a quick run down on some security tools next week, depending how much time I have over the weekend (never used any of these apart from ClamAV): - ClamAV - Sophos scanner - Chkrootkit - Rkhunter - Lynis Might show off the Pencil Project as well. A volunteer for demoing NixOS? https://nixos.org/ "completely declarative approach to configuration management" "atomic upgrades and rollbacks" Any other cool software that you'd like to demo for a few minutes? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apache bug leaks contents of server memory for all to see—Patch now
by Peter Reutemann 20 Sep '17

20 Sep '17

'There's a bug in the widely used Apache Web Server that causes servers to leak pieces of arbitrary memory in a way that could expose passwords or other secrets, a freelance journalist has disclosed. The vulnerability can be triggered by querying a server with what's known as an OPTIONS request. Like the better-known GET and POST requests, OPTIONS is a type of HTTP method that allows users to determine which HTTP requests are supported by the server. Normally, a server will respond with GET, POST, OPTIONS, and any other supported methods. Under certain conditions, however, responses from Apache Web Server include the data stored in computer memory. Patches are available here and here.' -- source: https://arstechnica.com/information-technology/2017/09/apache-bug-leaks-con… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Breaking Your Bubble
by Lawrence D'Oliveiro 20 Sep '17

20 Sep '17

A class project at Princeton <http://freedom-to-tinker.com/2017/09/19/breaking-your-bubble/>: In the first step, students measured their filter bubble. More specifically, for homework, at three different time points each week, they scrolled through their feeds until they found five political posts (ads included). Then, they coded these posts as either liberal, neutral, or conservative. Students also kept track of how many posts they had to scroll through to get to five posts as a measure of how much political content was in their feed. ... In the second step, the students developed and implemented a procedure to break their bubble. Their goal was to achieve a “balanced diet” of liberal, neutral, and conservative political content that matched the baseline distribution of what is being shared on Facebook ... Followup <http://freedom-to-tinker.com/2017/09/19/what-our-students-found-when-they-t…>: So, were students able to break their bubble? Initially, we expected that because the News Feed algorithm is complicated, it might be hard for students to break out of their bubbles. But we were wrong. The class was able to move to a more balanced diet pretty quickly.

1 0

Speaking Of DRM ...
by Lawrence D'Oliveiro 20 Sep '17

20 Sep '17

... HP has released <https://www.techdirt.com/articles/20170914/11491238210/hp-brings-back-obnox…> firmware updates for several of its OfficeJet Pro range that block their ability to work with third-party ink cartridges.

1 0

Pencil Project
by Peter Reutemann 19 Sep '17

19 Sep '17

So far, I've always used Dia for creating diagrams. However, last night, I came across the "Pencil Project", a cross-platform tool for wire frames. And I think, I may have found a new favorite! Copy/paste of some of the features: 'Easy GUI Prototyping Pencil provides various built-in shapes collection for drawing different types of user interface ranging from desktop to mobile platforms. Starting from 2.0.2, Pencil is shipped with Android and iOS UI stencils pre-installed. This makes it even easier to start protyping apps with a simple installation. Popular drawing features are also implemented in Pencil to simplify the drawing operations. Built-in Shape Collections Starting from 2.0.2 Pencil has even more shape collections included by default. The list of built-in collections now includes general-purpose shapes, flowchart elements, desktop/web UI shapes, Android and iOS GUI shapes. There are also many other collections created by the community and are distributed freely on the Internet. You can easily grab a collection and install it into Pencil with a simple drag-and-drop operation. Diagram Drawing Support Pencil now supports connectors which can be used to "wire" shapes together in a diagram. A collection of flowchart shapes are also available for drawing diagrams. Exporting to Different Output Formats Pencil supports outputing the drawing document into different types of formats. You can have your drawing exported as a set of rasterized PNG files or as a web page that can be delivered to the viewers. Pencil also supports exporting documents into popular formats including OpenOffice/LibreOffice text documents, Inkscape SVG and Adobe PDF. Inter-page linking Elements in a drawing can be linked to a specific page in the same document. This helps user define the UI flow when creating application or website mockups. Linkings defined in a document are converted into HTML hyper-links when the document is exported into web format. This process creates an interactive version of the mockup in which viewers can see a simulated flow when clicking on the UI elements.' -- source: http://pencil.evolus.vn/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Quote Of The Week
by Lawrence D'Oliveiro 19 Sep '17

19 Sep '17

“These days we hear a lot about luring the young away from happy, fulfilling careers and into the world of programming.” Verity Stob, who else? <http://www.theregister.co.uk/2017/09/19/programming_in_the_middle_ages/>

1 0

Install Ring, a FOSS VOIP Skype alternative
by Peter Reutemann 19 Sep '17

19 Sep '17

'If you ask just about any Linux user, they'll agree that Skype is pretty terrible. There's not a whole lot to like there, especially since the Linux client is just a poorly maintained wrapper for the web app. There have been several attempts to create a free and open source alternative to Skype, but none have been as polished or complete as Ring. ' -- source: https://linuxconfig.org/install-ring-a-foss-voip-skype-alternative -- screenshots: https://ring.cx/en#screenshots Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

4 3