January 2018 - wlug - list.wlug.org.nz

Intel Told Chinese Firms of Meltdown Flaws Before the US Government
by Peter Reutemann 29 Jan '18

29 Jan '18

'According to The Wall Street Journal, Intel initially told a handful of customers about the Meltdown and Spectre vulnerabilities, including Chinese tech companies like Alibaba and Lenovo, before the U.S. government. As a result, the Chinese government could have theoretically exploited the holes to intercept data before patches were available. Engadget reports: An Intel spokesman wouldn't detail who the company had informed, but said that the company couldn't notify everyone (including U.S. officials) in time because Meltdown and Spectre had been revealed early. Lenovo said the information was protected by a non-disclosure agreement. Alibaba has suggested that any accusations of sharing info with the Chinese government was "speculative and baseless," but this doesn't rule out officials intercepting details without Alibaba's knowledge. There's no immediate evidence to suggest that China has taken advantage of the flaws, but that's not the point -- it's that the U.S. government could have helped coordinate disclosures to ensure that enough companies had fixes in place. ' -- source: https://it.slashdot.org/story/18/01/29/0520222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Are the BSDs Dying? Some Security Researchers Think So
by Peter Reutemann 26 Jan '18

26 Jan '18

'The BSDs have lost the battle for mindshare to Linux, and that may well bode ill for the future sustainability of the BSDs as viable, secure operating systems, writes CSO's JM Porup. The reason why is a familiar refrain: more eyeballs mean more secure code. Porup cites the work of Ilja von Sprundel, director of penetration testing at IOActive, who, noting the "small number of reported BSD kernel vulnerabilities compared to Linux," dug into BSD source code. His search 'easily' turned up about 115 kernel bugs. Porup looks at the relative security of OpenBSD, FreeBSD and NetBSD, the effect on Mac OS, and why, despite FreeBSD's relative popularity, OpenBSD may be the most likely to survive.' -- source: https://bsd.slashdot.org/story/18/01/26/1636229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Ubuntu 18.04 LTS Will Default To The X.Org Stack, Not Wayland
by Peter Reutemann 26 Jan '18

26 Jan '18

'Five years after their original goal to ship Ubuntu with Wayland, Ubuntu 17.10 transitioned to using the Wayland display system by default as part of their transition to GNOME Shell as the default desktop. But with the upcoming Ubuntu 18.04 LTS release, Canonical has decided to transition back to the X.Org Server. Their reasoning for moving to an X.Org Server by default is better support for screen sharing, remote desktop, and better recovery from crashes. But for those interested the Wayland session will still be available as a log-in option.' -- source: https://news.slashdot.org/story/18/01/26/1437212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Burger King Explains Net Neutrality
by Lawrence D'Oliveiro 26 Jan '18

26 Jan '18

Burger King uses “Whopper Neutrality” to illustrate why service providers shouldn’t play favourites <https://www.theregister.co.uk/2018/01/24/burger_king_net_neutrality/>.

1 0

Senator Asks FBI Director To Justify His 'Ill-Informed' Policy Proposal For Encryption
by Peter Reutemann 26 Jan '18

26 Jan '18

'In a speech earlier this month, FBI Director Christopher Wray said the inability of law enforcement authorities to access data from electronic devices due to powerful encryption is an "urgent public safety issue." He proposed that Silicon Valley companies should add a backdoor to their encryption so that they could both "provide data security and permit lawful access with a court order." One person is not amused by Wray's proposal. Senator Ron Wyden criticized Wray on Thursday for not consulting him before going public with the proposal for encryption. Wyden said today, via Gizmodo: Your stated position parrots the same debunked arguments espoused by your predecessors, all of whom ignored the widespread and vocal consensus of cryptographers. For years, these experts have repeatedly stated that what you are asking for is not, in fact, possible. Building secure software is extremely difficult, and vulnerabilities are often introduced inadvertently in the design process. Eliminating these vulnerabilities is a mammoth task, and experts are unified in their opinion that introducing deliberate vulnerabilities would likely create catastrophic unintended consequences that could debilitate software functionality and security entirely. [...] I would like to learn more about how you arrived at and justify this ill-informed policy proposal. Please provide me with a list of the cryptographers with whom you've personally discussed this topic since our July 2017 meeting and specifically identify those experts who advised you that companies can feasibly design government access features into their products without weakening cybersecurity. Please provide this information by February 23, 2018.' -- source: https://yro.slashdot.org/story/18/01/25/161245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

New Unit Of Time: The “Flick”
by Lawrence D'Oliveiro 26 Jan '18

26 Jan '18

Oculus is proposing a new unit for measuring time for audio/video/VR purposes: it is 1/705,600,000 of a second. This denominator was chosen to have sufficient integer factors to allow it to exactly represent various common frame/sample rates as whole numbers of flicks (which cannot be done with the usual SI divisions). And also, from the looks of it, possible future higher multiples of those rates. <https://arstechnica.com/gaming/2018/01/oculus-creates-a-new-open-source-uni…>

1 0

Chrome 64 Released With Stronger Popup Blocker, Spectre Mitigations
by Peter Reutemann 25 Jan '18

25 Jan '18

'Google on Thursday pushed an update to its marquee Web browser Chrome, now at v64, which offers a handful of new features including an improved ad blocker. From a report: Most of the new features included with Chrome 64 are meant to improve the browser's support for the ever-changing web standards that drive the modern Internet. For example, Chrome 64 is choke full of support for new browser APIs, new CSS properties, new JavaScript (ECMAScript) features, and changes to Chrome's V8 JavaScript engine. [...] Other big changes that shipped with Chrome 64 are on the browser's security side. For starters, Chrome 64 includes mitigations against the web-exploitable Spectre flaw. Further, Chrome 64 also comes with a bolstered popup blocker that can now block tab-under behavior, being much more efficient at blocking malvertising redirects.' -- source: https://tech.slashdot.org/story/18/01/25/1717226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Dell and HP Advise All Their Customers To Not Install Spectre BIOS Updates
by Peter Reutemann 25 Jan '18

25 Jan '18

'The Spectre and Meltdown mess continues with Dell now recommending their customers to not install the BIOS updates that are supposed to resolve the Spectre (Variant 2) vulnerabilities. These updates have been causing numerous problems for users including performance issues, boot issues, reboot issues, and general system stability. Due to this, Dell EMC has updated its knowledgebase article with a statement advising customers to not install the BIOS update and to potentially rollback to the previous BIOS if their computers are exhibiting "unpredictable system behavior". ZDNet reports that HP too has issued a similar advisory. The computer manufacturer pulled its softpaqs BIOS updates with Intel's patches from its website, and said it would be releasing a BIOS update with a previous version of Intel's microcode on Thursday.' -- source: https://tech.slashdot.org/story/18/01/24/1312241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

The Death Of Moore’s Law
by Lawrence D'Oliveiro 24 Jan '18

24 Jan '18

From <http://www.theregister.co.uk/2018/01/24/death_notice_for_moores_law/>: The computer science behind microprocessor design has therefore found itself making a rapid U-turn as it learns that its optimisation techniques can be weaponised. ... Hammered by the finance of physics and the weaponisation of optimisation, Moore’s Law has hit the wall, bounced off - and reversed direction. We’re driving backwards now: all things IT will become slower, harder and more expensive. Actually economics probably had more to do with it than physics, as PC sales have been slowing over the past decade.

2 2

City of Barcelona Dumps Windows For Linux and Open Source Software
by Peter Reutemann 24 Jan '18

24 Jan '18

'The City of Barcelona is migrating its computer systems away from the Windows platform, reports the Spanish newspaper El País. The City's strategy is first to replace all user applications with open-source alternatives, until the underlying Windows operating system is the only proprietary software remaining. In a final step, the operating system will be replaced with Linux... According to Francesca Bria, the Commissioner of Technology and Digital Innovation at the City Council, the transition will be completed before the current administration's mandate ends in spring 2019. For starters, the Outlook mail client and Exchange Server will be replaced with Open-Xchange. In a similar fashion, Internet Explorer and Office will be replaced with Firefox and LibreOffice, respectively. The Linux distribution eventually used will probably be Ubuntu, since the City of Barcelona is already running 1,000 Ubuntu-based desktops as part of a pilot... Barcelona is the first municipality to have joined the European campaign 'Public Money, Public Code'. This campaign is an initiative of the Free Software Foundation Europe (FSFE) and revolves around an open letter advocating that publicly funded software should be free. Currently, this call to public agencies is supported by more than 100 organisations and almost 15,000 individuals. With the new open-source strategy, Barcelona's City Council aims to avoid spending large amounts of money on licence-based software and to reduce its dependence on proprietary suppliers through contracts that in some cases have been closed for decades.' -- source: https://linux.slashdot.org/story/18/01/15/0415219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1