September 2017 - wlug - list.wlug.org.nz

Aussie Law >> Maths
by Lawrence D'Oliveiro 02 Oct '18

02 Oct '18

"The laws of Australia prevail in Australia, I can assure you of that," [Malcolm Turnbull] said on Friday. "The laws of mathematics are very commendable, but the only law that applies in Australia is the law of Australia." <https://www.techdirt.com/articles/20170714/10385237789/aussie-prime-ministe…>

1 2

An Ordinary User’s Adventures In Linux
by Lawrence D'Oliveiro 30 Sep '17

30 Sep '17

I helped an elderly friend set up his new PC yesterday. His previous machine, over a decade old, was running Windows XP. I had set up an Ubuntu dual-boot a few years back, and he liked playing the games. But then the Linux boot stopped working--there was a message to the effect “hd0 out of disk”, which sounded like a GRUB problem (“hd0” being a GRUB disk name, not a Linux disk name). I booted up SystemRescueCD, and found that disk space was ample. I did an fsck on the Linux volume, and found no filesystem problems. I ran a badblocks scan, and it reported several bad sectors, though oddly they only seemed to be in the Windows partition (if I interpreted the numbers correctly). Naturally I searched online, but the hits I found for that error message didn’t seem very helpful. Reinstalling GRUB didn’t help, so I concluded there were likely other hardware problems, so time for a new machine. He got an entry-level dual-core AMD box from PBTech--their own house build, in a CoolerMaster case--for well under a grand. Nothing fancy, but good enough for his needs--mainly Web browsing, e-mail, a little bit of word processing, and those games. The PBTech box came without an OS. He could have got Windows 10 for it, but considering he would be facing a learning curve coming from XP regardless, I suggested going 100% Linux for all his daily needs, to see if that would work. He could always spend the $160-odd extra on Windows later if need be. So I set it up with Linux Mint, since that seems to be everybody’s favourite :). He was already using Firefox on Windows, so moving all his Web bookmarks across was easy. The Mint install put an icon for Thunderbird on the desktop by default, so I decided to try that for e-mail. Getting his address book across from Outlook Express was fairly straightforward, once I figured out how to map the exported CSV field names correctly. The mail messages were slightly more fiddly, but I found this extension <https://addons.mozilla.org/en-US/thunderbird/addon/importexporttools/> which directly loads Microsoft’s .dbx files, and that seemed to work OK. Then he wanted to play CDs. When we put in an audio CD, it came up with options to run Banshee (media player) or Brasero (disc burner). The Banshee media player wouldn’t play the CD directly, it insisted on ripping it to the hard drive first. This was not really what he wanted. I had a look round, and found KsCD, which will indeed play audio CDs without trying to rip them to audio files first. As far as I know, this is the only GUI Linux app that can do so. So, day 1 ended on a reasonably successful note. He was already noticing how much faster the new machine was. So we’ll see how it goes from here...

5 13

Well, That’s One Way For A Site To Make Money ...
by Lawrence D'Oliveiro 30 Sep '17

30 Sep '17

Would you let a website run a Bitcoin miner in your browser? <https://www.techdirt.com/articles/20170928/11262538304/showtime-wont-explai…>

1 0

Java Security Plagued By Crappy Docs, Complex APIs, Bad Advice
by rowan schischka 29 Sep '17

29 Sep '17

>Does a system of assigning point scores to people make things better ... or worse? Gamifying an internet forum/social media; My experience with stackoverflow is it really rewards people who have a lot of spare time. The problem of measuring work is, the work will be moulded by your method of measurement. Any point/scoring/KPI system results in cheating & corner cutting in some way.

1 0

Java Security Plagued By Crappy Docs, Complex APIs, Bad Advice
by Lawrence D'Oliveiro 29 Sep '17

29 Sep '17

... researchers from Virginia Tech contend more care needs to be taken when copying code from accepted Stack Overflow answers, at least in the context of Java. ... they found that many of the answers endorsed by the Stack Overflow community led to insecure code. For example, accepted answers often recommended the use of MD5 and SHA-1 crypto algorithms – despite the fact that they're insecure and should not be used. ... They also observed that in some instances, the higher social reputation of Stack Overflow respondents led to incorrect answers being accepted over more correct fixes offered by individuals with lesser reputation scores. <http://www.theregister.co.uk/2017/09/29/java_security_plagued_stack_overflo…>

2 2

Internet Explorer Bug Leaks Whatever You Type In the Address Bar
by Peter Reutemann 28 Sep '17

28 Sep '17

'The latest version of Internet Explorer has a bug that leaks the addresses, search terms, or any other text typed into the address bar. The flaw was disclosed Tuesday by security researcher Manual Caballero. Ars Technica reports: The bug allows any currently visited website to view any text entered into the address bar as soon as the user hits enter. The technique can expose sensitive information a user didn't intend to be viewed by remote websites, including the Web address the user is about to visit. The hack can also expose search queries, since IE allows them to be typed into the address bar and then retrieved from Bing or other search services. The proof-of-concept makes it transparent that the attacking website is viewing the entered text. The hack, however can easily be modified to make the information theft completely stealthy. A proof-of-concept site shows the exploit in action.' -- source: https://tech.slashdot.org/story/17/09/28/0245228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

System76 Pop!_OS Beta Ubuntu-based Linux Distribution Now Available To Download
by Peter Reutemann 28 Sep '17

28 Sep '17

'Next month, a new era of Ubuntu begins. Unity is dead, and GNOME 3 takes over as the default desktop environment. While this change was for the best, it was still shocking for many. For a company like System76, for instance, that sells computers pre-loaded with Ubuntu, this was problematic. Why? Well, the company essentially lost control of the overall user experience by relying on vanilla Ubuntu. It was being forced to follow Canonical's path. To solve this, and regain some control, System76 has been developing its own operating system called 'Pop!_OS.' No, it is not reinventing the wheel here -- it will still use Ubuntu as a base, and GNOME will be the desktop environment. The company is customizing the operating system, however, with things like fonts, themes, and icons, to create something truly unique. This could lead to an improved user experience. Today, the first official beta of the operating system becomes available for download.' -- source: https://linux.slashdot.org/story/17/09/28/190247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The World's First Blockchain Smartphone Is In Development
by Peter Reutemann 28 Sep '17

28 Sep '17

'A company called Sirin Labs is developing an open-source smartphone that runs on a fee-less blockchain. "The Finney -- named in honor of bitcoin pioneer Hal Finney -- will be the only smartphone in the world that's fully secure and safe enough to hold cryptographic coins," reports Engadget. The company is launching a crowdsale event this October (date to be confirmed) to support the phone's development. >From the report: According to Sirin, all Finney devices (there's an all-in-one PC coming, too) will form an independent blockchain network powered by IOTA's Tangle technology. The network will operate without centralized backbones or mining centers cluttering up the transaction process, using the SRN token as its default currency (only SRN token holders will be able to purchase the device). And it'll all run on a Sirin operating system specially designed to support blockchain applications such as crypto wallets and secure exchange access. The phone comes with all the bells and whistles you'd expect from a device with a $1,000 price tag, including a 256GB internal memory and 16MP camera, plus a hefty suite of security measures. ' -- source: https://mobile.slashdot.org/story/17/09/27/0749240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla's 'Firefox Quantum' Browser Challenges Chrome In Speed
by Peter Reutemann 28 Sep '17

28 Sep '17

'The next version of Firefox, aptly named Firefox Quantum, is getting a big speed boost. "The idea, of course, is that the upcoming version 57 is a quantum leap over predecessors -- or, in the words of Mozilla CEO Chris Beard, a 'big bang,'" reports CNET. While Mozilla stopped short of declaring victory over Chrome, Nick Nguyen, vice president of Firefox product, said Firefox Quantum's page-load speed "is often perceivably faster" while using 30 percent less memory. From the report: The new Firefox revamp includes lots of under-the-covers improvements, like Quantum Flow, which stamps out dozens of performance bugs, and Quantum CSS, aka Stylo, which speeds up website formatting. More obvious from the outside is a new interface called Photon that wipes out Firefox's rounded tabs and adds a "page action" menu into the address bar. It also builds in the Pocket bookmarking service Mozilla acquired and uses it to recommend sites you might be interested in. A screenshot tool generates a website link so you can easily share what you see by email or Twitter. Mozilla even simplified the Firefox logo, a fox wrapping itself around the globe. More improvements are in the pipeline for later Firefox versions, too, including Quantum Render, which should speed up Firefox's ability to paint web pages onto your screen. ' -- source: https://news.slashdot.org/story/17/09/27/0727226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Distrowatch opinion piece about DRM in browsers
by Ian Young 27 Sep '17

27 Sep '17

Some may not have seen an opinion piece in this week's Distrowatch Weekly. Link on front page to article by one Jesse Smith who does most of the reviews on DW. The W3C, encrypted media and software freedom ~ Ian Y

3 2

Manjaro Linux Discontinues 32-bit Support
by Peter Reutemann 26 Sep '17

26 Sep '17

'Recently, Philip, the lead developer of Manjaro Linux, announced that the project would be dropping support for the 32-bit architecture. He said that the reason for the move was “due to the decreasing popularity of i686 among the developers and the community”. While Manjaro 17.0.3 is the last release to have a 32-bit ISO, current 32-bit installs will receive a short window of continued support. During September and October, 32-bit package will continue to be updated. However, starting in November, packages will be limited to 64-bit. After that period, 32-bit installs of Manjaro will essentially be unsupported.' -- source: https://itsfoss.com/manjaro-drops-32-bit-support/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Krita 3.3 Digital Painting App Promises Better HiDPI Support on Linux & Windows
by Peter Reutemann 26 Sep '17

26 Sep '17

'In the release announcement, Krita devs reveal the fact that they were forced to bump the version number from 3.2.x to 3.3.x because the upcoming Krita 3.3 release will be introducing some important changes for Windows platforms, such as support for the Windows 8 event API, thus supporting the n-trig pen in Surface laptops. "Alvin Wong has implemented support for the Windows 8 event API, which means that Krita now supports the n-trig pen in the Surface line of laptops (and similar laptops from Dell, HP and Acer) natively. This is still very new, so you have to enable this in the tablet settings," said the devs.' -- source: http://news.softpedia.com/news/krita-3-3-digital-painting-app-promises-bett… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Clear Linux Project Announces the Next Generation of Intel's Clear Containers
by Peter Reutemann 26 Sep '17

26 Sep '17

Since I mentioned Clear Linux at last night's meeting... 'Rewritten in the Go language, Intel Clear Containers 3.0 introduces support for leveraging code used for namespace-based containers and better integrates into the container ecosystem, allowing support for Docker container engine and Kubernetes. It also improves the compatibility with the POSIX family of standards. "Today’s release presents a generational and architectural shift to utilize virtcontainers, a modular and hypervisor agnostic library for hardware virtualized containers. Clear Containers 3.0 is written in Go language and boasts an OCI compatible runtime implementation (cc-runtime) that works both on top of virtcontainers, and as a platform for deployment," said Amy L Leeland, Technical Program Manager, Intel Corporation. Additionally, this release ships with a new agent based on the libcontainer library that has been designed from the offset to let users apply filters and policies, such as the well-known SELinux and seccomp security facilities found in the Linux kernel, inside the Clear Containers guests.' -- source: http://news.softpedia.com/news/clear-linux-project-announces-the-next-gener… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Tiny PocketBeagle is the RPi Zero of the BeagleBone world
by Peter Reutemann 25 Sep '17

25 Sep '17

'BeagleBoard.org’s tiny $25 PocketBeagle is a BeagleBone SBC clone, based on Octavo’s OSD3358-SM SiP module and offering micro-USB, microSD, and 72 I/O pins. BeagleBoard.org has released its smallest BeagleBone variant yet. The COM-like, 56 x 35 x 5mm PocketBeagle is a USB key-fob SBC built on the Octavo Systems OSD335x-SM System-In-Package (SiP) module that was announced earlier this week. Octavo’s 21 x 21mm SiP module, which packs a 1GHz Texas Instruments Sitara AM3358 SoC and nearly all the functions of a BeagleBone Black SBC into a BGA form factor, is 40 percent smaller than the original 27 x 27mm OSD335x.' -- source: http://linuxgizmos.com/tiny-pocketbeagle-is-the-rpi-zero-of-the-beaglebone-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Richard Stallman vs. Canonical's CEO: 'Will Microsoft Love Linux to Death?'
by Peter Reutemann 25 Sep '17

25 Sep '17

' TechRepublic got different answers about Microsoft's new enthusiasm for Linux from Canonical's founder and CEO Mark Shuttleworth, and from Richard Stallman. Stallman "believes that Microsoft's decision to build a Windows Subsystem for Linux (WSL) amounts to an attempt to extinguish software that users are free to run, copy, distribute, study, change and improve." "It certainly looks that way. But it won't be so easy to extinguish us, because our reasons for using and advancing free software are not limited to practical convenience," he said. "We want freedom. As a way to use computers in freedom, Windows is a non-starter..." Stallman remains adamant that the WSL can only help entrench the dominance of proprietary software like Windows, and undermine the use of free software. "That doesn't advance the cause of free software, not one bit," he says... "The aim of the free software movement is to free users from freedom-denying proprietary programs and systems, such as Windows. Making a non-free system, such Windows or MacOS or iOS or ChromeOS or Android, more convenient is a step backward in the campaign for freedom..." For Shuttleworth, Windows' embrace of GNU/Linux is a net positive for open-source software as a whole. "It's not like Microsoft is stealing our toys, it's more that we're sharing them with Microsoft in order to give everyone the best possible experience," he says. "WSL provides users who are well versed in the Windows environment with greater choice and flexibility, while also opening up a whole new potential user base for the open source platform..." Today Shuttleworth takes Microsoft's newfound enthusiasm for GNU/Linux at face value, and says the company has a different ethos to that of the 1990s, a fresh perspective that benefits Microsoft as much as it does open-source software. "Microsoft is a different company now, with a much more balanced view of open and competitive platforms on multiple fronts," he says. "They do a tremendous amount of engineering specifically to accommodate open platforms like Ubuntu on Azure and Hyper-V, and this work is being done in that spirit." The article also points out that Microsoft "does seem to be laying the groundwork for WSL to extend what's possible using a single GNU/Linux distro today, for instance, letting the user chain together commands from different GNU/Linux distros with those from Windows."' -- source: https://linux.slashdot.org/story/17/09/24/2132218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

ARM TrustZone Hacked By Abusing Power Management
by Peter Reutemann 24 Sep '17

24 Sep '17

'Many CPUs these days have DVFS (Dynamic Voltage and Frequency Scaling), which allows the CPU's clockspeed and voltage to vary dynamically depending on whether the CPU is idling or not. By turning the voltage up and down with one thread, researchers were able to flip bits in another thread. By flipping bits when the second thread was verifying the TrustZone key, the researchers were granted permission. If number 'A' is a product of two large prime numbers, you can flip a few bits in 'A' to get a number that is a product of many smaller numbers, and more easily factorable. "As the first work to show the security ramifications of energy management mechanisms," the researchers reported at Usenix, "we urge the community to re-examine these security-oblivious designs."' -- source: https://hardware.slashdot.org/story/17/09/23/2113243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Sublime Text 3.0 is Here! See, How to Install it on Linux
by Peter Reutemann 22 Sep '17

22 Sep '17

Not an open-source editor, but still a favorite of a lot of people... 'The stable version of Sublime Text 3.0 has been released with major changes seen in almost every aspect of version 2.0. According to the release statement, “virtually every aspect of the editor has been improved in some way, and even a list of the major changes would be too long.”' -- source: https://itsfoss.com/sublime-text-3-linux/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The CCleaner Malware Fiasco Targeted at Least 20 Specific Tech Firms
by Peter Reutemann 21 Sep '17

21 Sep '17

'Hundreds of thousands of computers getting penetrated by a corrupted version of an ultra-common piece of security software was never going to end well. But now it's becoming clear exactly how bad the results of the recent CCleaner malware outbreak may be. Researchers now believe that the hackers behind it were bent not only on mass infections, but on targeted espionage that tried to gain access to the networks of at least 20 tech firms. Earlier this week, security firms Morphisec and Cisco revealed that CCleaner, a piece of security software distributed by Czech company Avast, had been hijacked by hackers and loaded with a backdoor that evaded the company's security checks. It wound up installed on more than 700,000 computers. On Wednesday, researchers at Cisco's Talos security division revealed that they've now analyzed the hackers' "command-and-control" server to which those malicious versions of CCleaner connected. On that server, they found evidence that the hackers had attempted to filter their collection of backdoored victim machines to find computers inside the networks of 20 tech firms, including Intel, Google, Microsoft, Akamai, Samsung, Sony, VMware, HTC, Linksys, D-Link and Cisco itself. In about half of those cases, says Talos research manager Craig Williams, the hackers successfully found a machine they'd compromised within the company's network, and used their backdoor to infect it with another piece of malware intended to serve as a deeper foothold, one that Cisco now believes was likely intended for industrial espionage.' -- source: https://it.slashdot.org/story/17/09/21/1350214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Security Researchers Warn that Third-Party GO Keyboard App is Spying on Millions of Android Users
by Peter Reutemann 21 Sep '17

21 Sep '17

'Security researchers from Adguard have issued a warning that the popular GO Keyboard app is spying on users. Produced by Chinese developers GOMO Dev Team, GO Keyboard was found to be transmitting personal information about users back to remote servers, as well as "using a prohibited technique to download dangerous executable code." Adguard made the discovery while conducting research into the traffic consumption and unwanted behavior of various Android keyboards. The AdGuard for Android app makes it possible to see exactly what traffic an app is generating, and it showed that GO Keyboard was making worrying connections, making use of trackers, and sharing personal information. Adguard notes that there are two versions of the keyboard in Google Play which it claims have more than 200 million users in tot' -- source: https://it.slashdot.org/story/17/09/21/1959218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox For iOS Gets Tracking Protection, Firefox Focus For Android Gets Tabs
by Peter Reutemann 21 Sep '17

21 Sep '17

'Mozilla today released Firefox 9.0 for iOS and updated Firefox Focus for Android. The iOS browser is getting tracking protection, improved sync, and iOS 11 compatibility. The Android privacy browser is getting tabs. You can download the former from Apple's App Store and the latter from Google Play. This is the first time Firefox has offered tracking protection on iOS, and Nick Nguyen, vice president of product at Mozilla, notes that it's finally possible "thanks to changes by Apple to enable the option for 3rd party browsers." This essentially means iPhone and iPad users with Firefox and iOS 11 will have automatic ad and content blocking in Private Browsing mode, and the option to turn it on in regular browsing. This is the same feature that's available in Firefox for Android, Windows, Mac, and Linux, as well as the same ad blocking technology used in Firefox Focus for Android and iOS' -- source: https://news.slashdot.org/story/17/09/21/1953205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ISO Rejects NSA Encryption Algorithms
by Lawrence D'Oliveiro 21 Sep '17

21 Sep '17

From <https://www.schneier.com/blog/archives/2017/09/iso_rejects_nsa.html>: The ISO has decided not to approve two NSA-designed block encryption algorithms: Speck and Simon. It's because the NSA is not trusted to put security ahead of surveillance ... I don't trust the NSA, either. I should point out that SELinux was created by the NSA, too. The difference being that that has been subjected to years of careful independent scrutiny.

1 0

FSF Europe Calls For Taxpayer-Funded Software To Be Licensed For Free Re-use
by Lawrence D'Oliveiro 21 Sep '17

21 Sep '17

There are many things one can say about the US, but they have once nice law, at least at the Federal level--anything that might be copyrightable, that is created with taxpayer funds, is automatically in the public domain. For example, this is why everybody gets to have free use of all that stunning imagery from NASA. It also applies to US-Government-developed software as well. I have often wondered why other governments do not follow the same rule. Here in NZ, as in the UK, there is this weird concept of “Crown copyright”, which means that we, as taxpayers, do not get the use of material developed with our own money, we have to pay for it yet again. The European branch of the Free Software Foundation is calling for software developed with European taxpayer money to be made freely available in the same way <https://www.techdirt.com/articles/20170914/09163238207/free-software-founda…>.

3 4

GNOME Partners With Purism On Librem 5 Linux-based Privacy-focused Smartphone
by Peter Reutemann 20 Sep '17

20 Sep '17

'The Librem 5 smartphone by Purism has a long and difficult road ahead of it. Competing against the likes of Apple and Google on the mobile market has proven to be a death sentence for many platforms -- including Microsoft with its failed Windows 10 Mobile. Luckily, Purism has found itself a new partner on this project -- one of the most important organizations in the Linux community -- The GNOME Foundation. The GNOME Foundation explains, 'The Librem 5 is a hardware platform the Foundation is interested in advancing as a GNOME/GTK phone device. The GNOME Foundation is committed to partnering with Purism to create hackfests, tools, emulators, and build awareness that surround moving GNOME/GTK onto the Librem 5 phone. As part of the collaboration, if the campaign is successful the GNOME Foundation plans to enhance GNOME shell and general performance of the system with Purism to enable features on the Librem 5.'' -- source: https://linux.slashdot.org/story/17/09/20/1723246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday
by Peter Reutemann 20 Sep '17

20 Sep '17

Hi everyone I might give a quick run down on some security tools next week, depending how much time I have over the weekend (never used any of these apart from ClamAV): - ClamAV - Sophos scanner - Chkrootkit - Rkhunter - Lynis Might show off the Pencil Project as well. A volunteer for demoing NixOS? https://nixos.org/ "completely declarative approach to configuration management" "atomic upgrades and rollbacks" Any other cool software that you'd like to demo for a few minutes? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apache bug leaks contents of server memory for all to see—Patch now
by Peter Reutemann 20 Sep '17

20 Sep '17

'There's a bug in the widely used Apache Web Server that causes servers to leak pieces of arbitrary memory in a way that could expose passwords or other secrets, a freelance journalist has disclosed. The vulnerability can be triggered by querying a server with what's known as an OPTIONS request. Like the better-known GET and POST requests, OPTIONS is a type of HTTP method that allows users to determine which HTTP requests are supported by the server. Normally, a server will respond with GET, POST, OPTIONS, and any other supported methods. Under certain conditions, however, responses from Apache Web Server include the data stored in computer memory. Patches are available here and here.' -- source: https://arstechnica.com/information-technology/2017/09/apache-bug-leaks-con… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0