September 2017 - wlug - list.wlug.org.nz

Breaking Your Bubble
by Lawrence D'Oliveiro 20 Sep '17

20 Sep '17

A class project at Princeton <http://freedom-to-tinker.com/2017/09/19/breaking-your-bubble/>: In the first step, students measured their filter bubble. More specifically, for homework, at three different time points each week, they scrolled through their feeds until they found five political posts (ads included). Then, they coded these posts as either liberal, neutral, or conservative. Students also kept track of how many posts they had to scroll through to get to five posts as a measure of how much political content was in their feed. ... In the second step, the students developed and implemented a procedure to break their bubble. Their goal was to achieve a “balanced diet” of liberal, neutral, and conservative political content that matched the baseline distribution of what is being shared on Facebook ... Followup <http://freedom-to-tinker.com/2017/09/19/what-our-students-found-when-they-t…>: So, were students able to break their bubble? Initially, we expected that because the News Feed algorithm is complicated, it might be hard for students to break out of their bubbles. But we were wrong. The class was able to move to a more balanced diet pretty quickly.

1 0

Speaking Of DRM ...
by Lawrence D'Oliveiro 20 Sep '17

20 Sep '17

... HP has released <https://www.techdirt.com/articles/20170914/11491238210/hp-brings-back-obnox…> firmware updates for several of its OfficeJet Pro range that block their ability to work with third-party ink cartridges.

1 0

Pencil Project
by Peter Reutemann 19 Sep '17

19 Sep '17

So far, I've always used Dia for creating diagrams. However, last night, I came across the "Pencil Project", a cross-platform tool for wire frames. And I think, I may have found a new favorite! Copy/paste of some of the features: 'Easy GUI Prototyping Pencil provides various built-in shapes collection for drawing different types of user interface ranging from desktop to mobile platforms. Starting from 2.0.2, Pencil is shipped with Android and iOS UI stencils pre-installed. This makes it even easier to start protyping apps with a simple installation. Popular drawing features are also implemented in Pencil to simplify the drawing operations. Built-in Shape Collections Starting from 2.0.2 Pencil has even more shape collections included by default. The list of built-in collections now includes general-purpose shapes, flowchart elements, desktop/web UI shapes, Android and iOS GUI shapes. There are also many other collections created by the community and are distributed freely on the Internet. You can easily grab a collection and install it into Pencil with a simple drag-and-drop operation. Diagram Drawing Support Pencil now supports connectors which can be used to "wire" shapes together in a diagram. A collection of flowchart shapes are also available for drawing diagrams. Exporting to Different Output Formats Pencil supports outputing the drawing document into different types of formats. You can have your drawing exported as a set of rasterized PNG files or as a web page that can be delivered to the viewers. Pencil also supports exporting documents into popular formats including OpenOffice/LibreOffice text documents, Inkscape SVG and Adobe PDF. Inter-page linking Elements in a drawing can be linked to a specific page in the same document. This helps user define the UI flow when creating application or website mockups. Linkings defined in a document are converted into HTML hyper-links when the document is exported into web format. This process creates an interactive version of the mockup in which viewers can see a simulated flow when clicking on the UI elements.' -- source: http://pencil.evolus.vn/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Quote Of The Week
by Lawrence D'Oliveiro 19 Sep '17

19 Sep '17

“These days we hear a lot about luring the young away from happy, fulfilling careers and into the world of programming.” Verity Stob, who else? <http://www.theregister.co.uk/2017/09/19/programming_in_the_middle_ages/>

1 0

Install Ring, a FOSS VOIP Skype alternative
by Peter Reutemann 19 Sep '17

19 Sep '17

'If you ask just about any Linux user, they'll agree that Skype is pretty terrible. There's not a whole lot to like there, especially since the Linux client is just a poorly maintained wrapper for the web app. There have been several attempts to create a free and open source alternative to Skype, but none have been as polished or complete as Ring. ' -- source: https://linuxconfig.org/install-ring-a-foss-voip-skype-alternative -- screenshots: https://ring.cx/en#screenshots Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

4 3

EFF resigns from W3C - An open letter to the W3C Director, CEO, team and membership
by Peter Reutemann 19 Sep '17

19 Sep '17

'In 2013, EFF was disappointed to learn that the W3C had taken on the project of standardizing “Encrypted Media Extensions,” an API whose sole function was to provide a first-class role for DRM within the Web browser ecosystem. By doing so, the organization offered the use of its patent pool, its staff support, and its moral authority to the idea that browsers can and should be designed to cede control over key aspects from users to remote parties. [...] We believe they will regret that choice. Today, the W3C bequeaths an legally unauditable attack-surface to browsers used by billions of people. They give media companies the power to sue or intimidate away those who might re-purpose video for people with disabilities. They side against the archivists who are scrambling to preserve the public record of our era. The W3C process has been abused by companies that made their fortunes by upsetting the established order, and now, thanks to EME, they’ll be able to ensure no one ever subjects them to the same innovative pressures. [...] We will defend those who are put in harm's way for blowing the whistle on defects in EME implementations. It is a tragedy that we will be doing that without our friends at the W3C, and with the world believing that the pioneers and creators of the web no longer care about these matters. Effective today, EFF is resigning from the W3C.' -- source: https://www.eff.org/deeplinks/2017/09/open-letter-w3c-director-ceo-team-and… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

A Telemarketer Called My Elevator
by Lawrence D'Oliveiro 19 Sep '17

19 Sep '17

Guy steps into lift, gets spiel from emergency intercom inviting him to “press 1” on nonexistent keypad to sign up. <https://arstechnica.com/gaming/2017/09/a-telemarketer-called-my-elevator/> Me, I blame VoIP ...

1 0

Will Linux Innovation Be Driven By Microsoft?
by Peter Reutemann 18 Sep '17

18 Sep '17

'Adobe's VP of Mobile (and a former intellectual property lawyer) sees "a very possible future where Microsoft doesn't merely accept a peaceful coexistence with Linux, but instead enthusiastically embraces it as a key to its future," noting Microsoft's many Linux kernel developers and arguing it's already innovating around Linux -- especially in the cloud. An anonymous reader quotes InfoWorld: Even seemingly pedestrian work -- like making Docker containers work for Windows, not merely Linux -- is a big deal for enterprises that don't want open source politics infesting their IT. Or how about Hyper-V containers, which marry the high density of containers to the isolation of traditional VMs? That's a really big deal... Microsoft has started hiring Linux kernel developers like Matthew Wilcox, Paul Shilovsky, and (in mid-2016) Stephen Hemminger... Microsoft now employs 12 Linux kernel contributors. As for what these engineers are doing, Linux kernel maintainer Greg Kroah-Hartman says, "Microsoft now has developers contributing to various core areas of the kernel (memory management, core data structures, networking infrastructure), the CIFS filesystem, and of course many contributions to make Linux work better on its Hyper-V systems." In sum, the Linux Foundation's Jim Zemlin declares, "It is accurate to say they are a core contributor," with the likelihood that Hemminger's and others' contributions will move Microsoft out of the kernel contribution basement into the upper echelons. The article concludes that "Pigs, in other words, do fly. Microsoft, while maintaining its commitment to Windows, has made the necessary steps to not merely run on Linux but to help shape the future of Linux."' -- source: https://linux.slashdot.org/story/17/09/16/2335251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

4 4

Ad Industry “Deeply Concerned” About Safari’s New Ad-Tracking Restrictions
by Lawrence D'Oliveiro 17 Sep '17

17 Sep '17

Some have called for the total abolition of access to third-party cookies altogether. Apple’s new version of Safari doesn’t go this far, only imposing a 24-hour limit on their usability. But this is already enough to get the ad agencies up in arms. <https://arstechnica.com/tech-policy/2017/09/ad-industry-deeply-concerned-ab…>

1 0

'Bashware' Attacks Exploit Windows 10's Subsystem for Linux
by Peter Reutemann 17 Sep '17

17 Sep '17

'While many people welcomed the arrival of Windows Subsystem for Linux (WSL) in Windows 10, it has been found to be a potential security issue. A new technique known as a Bashware has been discovered by security researchers that makes it possible for malware to use the Linux shell to bypass security software. While administrator access is needed to execute a Bashware attack, this is fairly easily obtained, and the technique can be used to disguise malicious operations from antivirus software and other security tools. Researchers from Check Point Research point out that the danger stems from the fact that "existing security solutions are still not adapted to monitor processes of Linux executables running on Windows."' -- source: https://tech.slashdot.org/story/17/09/16/041251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Uber’s “Greyball” Regulator-Evading System
by Lawrence D'Oliveiro 16 Sep '17

16 Sep '17

We reported back in May that the Justice Department had commenced a criminal investigation into Uber's use of a software tool that helped drivers evade picking up local officials in places where the service had not been approved. ... The Greyball software employs a dozen data points on a new user in a given market, including whether a rider's Uber app is opened repeatedly in or around municipal offices, which credit card is linked to the account, and any publicly available information about the new user on social media. If the data suggests the new user is a regulator in a market where Uber is not permitted, the company would present that user with false information about where Uber rides are. <https://arstechnica.com/tech-policy/2017/09/heres-a-real-life-slimy-example…>

1 0

Quantum Computers Calculate Minimum-Energy State of Three Simple Molecules
by Lawrence D'Oliveiro 16 Sep '17

16 Sep '17

From <https://arstechnica.com/science/2017/09/quantum-computers-reach-deeper-find…>: Every time we discuss quantum computers, the headline tends to be that someone, somewhere is going to use the quantum to break your encryption and steal your student loan. If only that were true. But it is probably more realistic to think about quantum computers being used to solve quantum problems. ... However, for lithium hydride and beryllium hydride, the solutions are less accurate. The researchers believe that the falling accuracy is not due to the simplifications but hap[p]ens because the qubits do not stay sufficiently coherent during the calculation. In other words, quantum computers are the modern-day equivalent of analog computers, not digital ones: just like in the early days of mechanical- and electronic-based analog machines, they can give answers more quickly, but with less accuracy than, a digital one.

2 8

Azure Confidential Computing Will Keep Data Secret, Even From Microsoft
by Lawrence D'Oliveiro 15 Sep '17

15 Sep '17

From <https://arstechnica.com/gadgets/2017/09/azure-confidential-computing-will-k…>: The SGX mode uses processor features to carve out a TEE within a regular process—no virtual machines necessary. The processor itself will encrypt and decrypt data from memory, such that the data is only decrypted when it's within the processor itself. With this mode, even Hyper-V's security isn't important; the only thing that an application has to trust is the processor and its implementation of SGX. With SGX enclaves, nobody—not even Microsoft—can see the data in the TEE. So we only have to trust Intel...

1 0

The Big List Of Naughty Strings
by Lawrence D'Oliveiro 15 Sep '17

15 Sep '17

The Big List of Naughty Strings is an evolving list of strings which have a high probability of causing issues when used as user-input data. This is intended for use in helping both automated and manual QA testing; useful for whenever your QA engineer walks into a bar. <https://github.com/minimaxir/big-list-of-naughty-strings> The “walks into a bar” reference is to this <http://www.sempf.net/post/On-Testing1>: QA Engineer walks into a bar. Orders a beer. Orders 0 beers. Orders 999999999 beers. Orders a lizard. Orders -1 beers. Orders a sfdeljknesv. Because that’s what testing is all about...

3 2

Python Explosion Blamed On Pandas
by Lawrence D'Oliveiro 15 Sep '17

15 Sep '17

Not content to bait developers by declaring that Python is the fastest-growing major programming language, coding community site Stack Overflow has revealed the reason for its metastasis. ... Programmers love pandas. <http://www.theregister.co.uk/2017/09/14/python_explosion_blamed_on_pandas/>

2 2

The Community bash Style Guide
by Lawrence D'Oliveiro 15 Sep '17

15 Sep '17

A collection of dos and don’ts for writing bash scripts: <https://github.com/azet/community_bash_style_guide>. Some tips are not bash-specific, but are about external commands usable with any shell: e.g. awk, sed, grep, pgrep, xargs. Also some builtins should be available with any POSIX-compliant shell, e.g. getopts, printf. Most surprising bit of information: that someone has written a “ctypes” (foreign-function interface) addon for bash <https://github.com/taviso/ctypes.sh>.

1 0

Yellow Rebrands, Celebrates Turnaround
by Lawrence D'Oliveiro 14 Sep '17

14 Sep '17

The former Yellow Pages Group is getting over a rough patch by finding new business opportunities: Its work with SMEs, however, was the focus [acting CEO] Linton said, with companies able to use Yellow to set up a basic website, through to advertising, adding on e-commerce solutions, booking widgets and other add-on products for an additional regular cost. Yellow is also one of New Zealand's largest resellers of Google Adwords - helping boost customer profile online. ... “Almost 50 per cent of small businesses have no digital presence so you can't even find them on Google.” <http://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=11922410>

1 0

Free Software, Open Access, And Open Science Groups Join Fight Against EU Copyright Directive's Terrible Ideas
by Lawrence D'Oliveiro 14 Sep '17

14 Sep '17

>From an item by the always-excellent Glyn Moody <https://www.techdirt.com/articles/20170912/08434938194/free-software-open-a…>: The problem they identified is that widely-used version control systems (VCS) like GitHub seem to meet the definition of "information society services" laid down by the proposed EU Copyright Directive, and as such would be required to filter all uploads to block copyright infringements. Moreover, as the white paper points out, developer Web sites would not only be held responsible for any material uploaded by users without permission of the copyright holders, but would also seem liable for illegitimate distributions of derivative works in violation of the applicable license. At which I can hear groups affiliated with Big Content™ responding “Yeah? So?”. Sites like YouTube are full of user-generated content, too (what is YouTube most famous for showing? Cat videos!), but that hasn’t stopped them being forced into granting special privileges to major film studios and the like <https://www.techdirt.com/search-g.php?num=20&q=youtube+dmca&search=Search>. If software is not the same as videos, pictures or music, why should the same principles of copyright apply to it?

1 0

Backdoor Found In WordPress Plugin With More Than 200, 000 Installations
by Peter Reutemann 14 Sep '17

14 Sep '17

'According to Bleeping Computer, a WordPress plug that goes by the name Display Widgets has been used to install a backdoor on WordPress sites across the internet for the past two and a half months. While the WordPress.org team removed the plugin from the official WordPress Plugins repository, the plugin managed to be installed on more than 200,000 sites at the time of its removal. The good news is that the backdoor code was only found between Display Widgets version 2.6.1 (released June 30) and version 2.6.3 (released September 2), so it's unlikely everyone who installed the plugin is affected. WordPress.org staff members reportedly removed the plugin three times before for similar violations. Bleeping Computer has compiled a history of events in its report, put together with data aggregated from three different investigations by David Law, White Fir Design, and Wordfence. The report adds: The original Display Widgets is a plugin that allowed WordPress site owners to control which, how, and when WordPress widgets appear on their sites. Stephanie Wells of Strategy11 developed the plugin, but after switching her focus to a premium version of the plugin, she decided to sell the open source version to a new developer who would have had the time to cater to its userbase. A month after buying the plugin in May, its new owner released a first new version -- v2.6.0 -- on June 21' -- source: https://it.slashdot.org/story/17/09/13/2152234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Software In Use At Animation College
by Lawrence D'Oliveiro 13 Sep '17

13 Sep '17

Seeing their ads in various places prompted me to check out their site. There is a list of software that they use in their Bachelor of Animation degree here <http://www.animationcollege.co.nz/bachelor-of-animation/bachelor-faq/>, but it’s just a table of product logos, no names. Interesting to see one open-source product in that list, namely Audacity. Also note that “GitKraken”, which appears to be a GUI for the Git version-control system. I wonder how they use it in studio workflows? Purely to keep track of a linear sequence of revisions of assets? Because I can’t imagine that branching and merging would work very well with binary (e.g. still-image, audio, video) files. The faux-chemical symbols are all Adobe products, I believe; but I can’t find anything at Adobe’s site that has the “An” logo. My best guess for the product denoted by “xN” is this company <http://www.realityvirtual.co/>. And that purple one that looks like a purple pixelated landslide, I can’t identify at all.

1 0

Hacking Voice Assistant Systems With Inaudible Voice Commands
by Lawrence D'Oliveiro 13 Sep '17

13 Sep '17

Turns out that all the major voice assistants -- Siri, Google Now, Samsung S Voice, Huawei HiVoice, Cortana and Alexa -- listen at audio frequencies the human ear can't hear. Which means somebody could send commands to your device that you have no idea about. <https://www.schneier.com/blog/archives/2017/09/hacking_voice_a.html>

1 0

AT HOP: Pitfalls In Electronic Transaction Systems
by Lawrence D'Oliveiro 13 Sep '17

13 Sep '17

There seems to be a subtle issue with topping up the balance on AT HOP cards used by Auckland Transport: you actually have to use the card somewhere within 60 days of the topup, otherwise the deposit will get taken out again. It appears this has to do with the terminals having to be refreshed daily with their own copies of details about valid cards, and these uploads only include active cards. But try explaining that to the customers... <http://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=11921624>

2 1

Researchers Catch Microsoft Zero-Day Used To Install Government Spyware
by Peter Reutemann 13 Sep '17

13 Sep '17

'Government hackers were using a previously-unknown vulnerability in Microsoft's .NET Framework, a development platform for building apps, to hack targets and infect them with spyware, according to security firm FireEye. The firm revealed the espionage campaign on Tuesday, on the same day Microsoft patched the vulnerability. According to FireEye, the bug, which until today was a zero-day, was being used by a customer of FinFisher, a company that sells surveillance and hacking technologies to governments around the world. The hackers sent a malicious Word RTF document to a "Russian speaker," according to Ben Read, FireEye's manager of cyber espionage research. The document was programmed to take advantage of the recently-patched vulnerability to install FinSpy, spyware designed by FinFisher. The spyware masqueraded as an image file called "left.jpg," according to FireEye.' -- source: https://it.slashdot.org/story/17/09/12/2022235 For Windows, there seems to be Detekt (written in Python) which can detect some versions of FinSpy apparently: https://www.kubuntuforums.net/archive/index.php/t-66896.html Maybe we should finally look at demoing some security tools at the next meeting? - ClamAV - Sophos scanner - Chkrootkit - Rkhunter - Lynis - ... (other suggestions?) In other words, I'd need volunteers to do a short show and tell. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Only Safe Email is Text-Only Email
by Peter Reutemann 13 Sep '17

13 Sep '17

'Sergey Bratus, Research Associate Professor of Computer Science, Dartmouth College, and Anna Shubina, Post-doctoral Associate in Computer Science, Dartmouth College write: The real issue is that today's web-based email systems are electronic minefields filled with demands and enticements to click and engage in an increasingly responsive and interactive online experience. It's not just Gmail, Yahoo mail and similar services: Desktop-computer-based email programs like Outlook display messages in the same unsafe way. Simply put, safe email is plain-text email -- showing only the plain words of the message exactly as they arrived, without embedded links or images. Webmail is convenient for advertisers (and lets you write good-looking emails with images and nice fonts), but carries with it unnecessary -- and serious -- danger, because a webpage (or an email) can easily show one thing but do another. Returning email to its origins in plain text may seem radical, but it provides radically better security. Even the federal government's top cybersecurity experts have come to the startling, but important, conclusion that any person, organization or government serious about web security should return to plain-text email (PDF).' -- source: https://yro.slashdot.org/story/17/09/12/0436206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

BlueBorne Vulnerabilities Impact Over 5 Billion Bluetooth-Enabled Devices
by Peter Reutemann 13 Sep '17

13 Sep '17

'Security researchers have discovered eight vulnerabilities -- codenamed collectively as BlueBorne -- in the Bluetooth implementations used by over 5.3 billion devices. Researchers say the vulnerabilities are undetectable and unstoppable by traditional security solutions. No user interaction is needed for an attacker to use the BleuBorne flaws, nor does the attacker need to pair with a target device. They affect the Bluetooth implementations in Android, iOS, Microsoft, and Linux, impacting almost all Bluetooth device types, from smartphones to laptops, and from IoT devices to smart cars. Furthermore, the vulnerabilities can be concocted into a self-spreading BlueTooth worm that could wreak havoc inside a company's network or even across the world. "These vulnerabilities are the most serious Bluetooth vulnerabilities identified to date," an Armis spokesperson told Bleeping Computer via email. "Previously identified flaws found in Bluetooth were primarily at the protocol level," he added. "These new vulnerabilities are at the implementation level, bypassing the various authentication mechanisms, and enabling a complete takeover of the target device." Consumers are recommended to disable Bluetooth unless you need to use it, but then turn it off immediately. When a patch or update is issued and installed on your device, you should be able to turn Bluetooth back on and leave it on safely. The BlueBorne Android App on the Google Play Store will be able to determine if a user's Android device is vulnerable. A technical report on the BlueBorne flaws is available here (PDF).' -- source: https://mobile.slashdot.org/story/17/09/12/2030213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0