October 2018 - wlug - list.wlug.org.nz

You Can Play Over 2, 600 Windows Games on Linux Via Steam Play
by Peter Reutemann 29 Oct '18

29 Oct '18

'At the end of August, Valve announced a new version of Steam Play for Linux that included Proton, a WINE fork that made many Windows games, including more recent ones ,such as Witcher 3, Dark Souls 3 and Dishonored, playable on Linux. Just two months later, ProtonDB says there are over 2,600 Windows games that users can play on Linux, and the number is rapidly growing daily. From a report: When Valve Software launched Steam Play with Proton, it made it easier for gamers to play Windows games that hadn't yet been ported to Linux with the click of a button. Not all games may run perfectly on Linux, but that's also often the case with Windows 10, which can not play older games as well as previous versions of Windows did, even under Compatibility Mode. In only two months, the database of games that work with Proton has increased to over 2,600 -- more than half of the 5,000 Linux-native games that can be obtained through the Steam store.' -- source: https://linux.slashdot.org/story/18/10/29/1721258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Easy-to-exploit privilege escalation bug bites OpenBSD and other big name OSes
by Peter Reutemann 29 Oct '18

29 Oct '18

'Several big-name Linux and BSD operating systems are vulnerable to an exploit that gives untrusted users powerful root privileges. The critical flaw in the X.org server—the open-source implementation of the X11 system that helps manage graphics displays—affects OpenBSD, widely considered to be among the most secure OSes. It also impacts some versions of the Red Hat, Ubuntu, Debian, and CentOS distributions of Linux. An advisory X.org developers published Thursday disclosed the 23-month-old bug that, depending on how OS developers configure it, lets hackers or untrusted users elevate very limited system rights to unfettered root. The vulnerability, which is active when OSes run X.org in privileged (setuid) mode, allows files to be overwritten using the -logfile and -modulepath parameters. It also makes it trivial for low-privilege users to escalate system rights. A variety of nuances are leading to widely divergent assessments of the bug's severity. “Depending on whom you talk to, the reported severity will vary greatly,” Louis Dion-Marcil, a security researcher at GoSecure, told Ars. “I think most people will tell you it is very severe, and I would agree with them. The bug allows you to write arbitrary data to arbitrary files, which might seem trivial and not that dangerous, but it effectively allows regular, unprivileged users to elevate their privileges to the one of complete administrator of the system.”' -- source: https://arstechnica.com/information-technology/2018/10/x-org-bug-that-gives… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

New Zealand Chooses Google Chromebooks Over Microsoft Windows 10 For Education
by Peter Reutemann 28 Oct '18

28 Oct '18

'Google announced this week that it has signed an agreement with New Zealand's Ministry of Education to provide all state and state integrated schools in the country with Chrome Education licenses. The three-year agreement goes into effect on November 1 next month. From a report: "Starting on November 1, as part of an agreement with Google and the New Zealand Ministry of Education, all state and state-integrated schools across New Zealand will be able to start claiming Ministry-funded Chrome Education licenses to manage new and existing unmanaged Chromebooks. The Chrome Education license was developed to make device management in schools a breeze, so that teachers and students can focus on what's most important -- teaching and learning. Equipped with the Chrome Education license, schools can utilize essential education features to better support the many ways Chromebooks are used in the classroom," says Suan Ye, Head of Google for Education, Australia and New Zealand.' -- source: https://news.slashdot.org/story/18/10/28/2214209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linus Torvalds and Greg K-H Talk About Linux Community, Dealing with Hardware Bugs, Chromebooks Gaining Traction, Microsoft, Companies Gleaning Data and More
by Peter Reutemann 28 Oct '18

28 Oct '18

'Swapnil Bhartiya, who runs the blog TFIR, had a chance to interview Linus Torvalds at Open Source Summit in the second half of August this year. (Some context: The interview, which was published this week, took place before Mr. Torvalds said he needs to take a step back to reflect on how he has dealt with the community over the years. Since then, we have learned that Mr. Torvalds is returning to his position.) In the wide-ranging interview, Mr. Torvalds has touched a wide-range of subjects, including formulating workarounds for the problematic hardware bugs (Meltdown, Spectre), and Chromebooks gaining traction (though it is still not a machine that he could use for his work yet). He also talked about companies gleaning a lot of data about their users, regulations, (a tad bit of politics), Linux community. Greg Kroah-Hartman (aka Greg K-H) joined Mr. Bhartiya and Mr. Torvalds for the second half of the interview. On Sunday, Mr. Bhartiya published an additional interview of Mr. Kroah-Hartman.' -- source: https://linux.slashdot.org/story/18/10/28/1437239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New SystemD Vulnerability Discovered
by Peter Reutemann 28 Oct '18

28 Oct '18

'The Register reports that a new security bug in systemd "can be exploited over the network to, at best, potentially crash a vulnerable Linux machine, or, at worst, execute malicious code on the box" by a malicious host on the same network segment as the victim. According to one Red Hat security engineer, "An attacker could exploit this via malicious DHCP server to corrupt heap memory on client machines, resulting in a denial of service or potential code execution." According to the bug description, systemd-networkd "contains a DHCPv6 client which is written from scratch and can be spawned automatically on managed interfaces when IPv6 router advertisements are received." OneHundredAndTen shared this article from the Register: In addition to Ubuntu and Red Hat Enterprise Linux, systemd has been adopted as a service manager for Debian, Fedora, CoreOS, Mint, and SUSE Linux Enterprise Server. We're told RHEL 7, at least, does not use the vulnerable component by default. Systemd creator Leonard Poettering has already published a security fix for the vulnerable component -- this should be weaving its way into distros as we type. If you run a systemd-based Linux system, and rely on systemd-networkd, update your operating system as soon as you can to pick up the fix when available and as necessary.' -- source: https://news.slashdot.org/story/18/10/27/196227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox and Google Drive: random download locations?
by Peter Reutemann 25 Oct '18

25 Oct '18

Hi everyone In case you're using Google Drive frequently in conjunction with Firefox and always wondered about the random download locations (when "always ask" is enabled), I just found the reason for this... Firefox has a boolean setting "browser.download.lastDir.savePerSite" (not defined by default) that defines whether to remember the download location per site. However, with Google Drive, you will get a random URL serving the file, turning the last known download directory into a useless feature unfortunately. So, just go into "about:config", and create the above mentioned boolean setting and use "false" as the value. Now you have a "global" last known download location. -- source: https://support.mozilla.org/en-US/questions/925960 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

New Study Claims Data Harvesting Among Android Apps Is 'Out of Control'
by Peter Reutemann 25 Oct '18

25 Oct '18

'A new study from Oxford University revealed that almost 90 percent of free apps on the Google Play store share data with Alphabet. "The researchers, who analyzed 959,000 apps from the U.S. and UK Google Play stores, said data harvesting and sharing by mobile apps was now 'out of control,'" reports TechSpot. "'We find that most apps contain third party tracking, and the distribution of trackers is long-tailed with several highly dominant trackers accounting for a large portion of the coverage,' reads the report." From the report: It's revealed that most of the apps, 88.4 percent, could share data with companies owned by Google parent Alphabet. Next came a firm that's no stranger to data sharing controversies, Facebook (42.5 percent), followed by Twitter (33.8 percent), Verizon (26.27 percent), Microsoft (22.75 percent), and Amazon (17.91 percent). [I]nformation shared by these third-party apps can include age, gender, location, and information about a user's other installed apps. The data "enables construction of detailed profiles about individuals, which could include inferences about shopping habits, socio-economic class or likely political opinions." Big firms then use the data for a variety of purposes, such as credit scoring and for targeting political messages, but its main use is often ad targeting. Not surprising, given that revenue from online advertising is now over $59 billion per year. According to the research, the average app transfers data to five tracker companies, which pass the data on to larger firms. The biggest culprits are news apps and those aimed at children, both of which tend to have the most third-party trackers associated with them.' -- source: https://yro.slashdot.org/story/18/10/24/2340207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The World’s First Video Game?
by Lawrence D'Oliveiro 24 Oct '18

24 Oct '18

Tennis For Two, almost certainly the first computer-controlled real-time video game, 60 years old this month <https://www.theregister.co.uk/2018/10/22/tennis_for_two_at_60/>. Note this was an analog computer, which would have been faster at simulating the physics than the digital ones available in 1958.

1 0

Google News App Bug Is Using Up Gigabytes of Background Data Without Users' Knowledge
by Peter Reutemann 23 Oct '18

23 Oct '18

'A bug in the Google News app for Android is reportedly causing the app to use up excessive amounts of background data, leading to overage charges. "According to dozens of posts on the Google News Help Forum, users have been experiencing this issue as early as June," reports The Verge. "The issue was verified and addressed by a Google News community manager in September, stating that the company was investigating and working toward a fix, but the issue is still ongoing." From the report: Verge reader Zach Dowdle emailed in with his experience, and screenshots of his app and Wi-Fi data usage: "The Google News app is randomly using a ridiculous amount of background data without users' knowledge. The app burned through over 12 gigs of data on my phone while I slept and my Wi-Fi had disconnected. It lead to $75 in overage charges." According to several users, the app burned through mobile data despite having "Download via Wi-Fi" turned on in the settings. In some extreme cases, the Google News app used up to 24GB of data, leading to overage charges of up to $385, users reported. So far, the only solutions seem to be disabling background data, and deleting the app altogether. ' -- source: https://tech.slashdot.org/story/18/10/23/0340211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Is Reportedly Going To Sell VPN Subscriptions Within Firefox
by Peter Reutemann 23 Oct '18

23 Oct '18

'Mozilla is reportedly preparing to offer a VPN service for Firefox users to help protect them when surfing the web. According to Trusted Reviews, Mozilla has partnered with the ProtonVPN service, "with a new notification piping-up when the browser detects an unsecured connection, or in a scenario when VPN might be preferable to users." >From the report: However, it appears Firefox users will have to pay for the privilege. Austrian site Soeren-hentzschel reports the premium VPN service will be $10 a month, which is what ProtonVPN charges its users. Users will receive a "Firefox Recommends" pop-up when browsing an unsecured wireless network. The pop-up says the VPN service will provide a "private and secure' internet connection. According to the reports, a subset of Firefox 62 users in the United States will begin receiving the pop-up from today. Mozilla will reportedly get a cut of any subscription fee handed over by users to access the VPN service. MSPowerUser points out that this will be the first advertised service that costs money for Firefox users.' -- source: https://tech.slashdot.org/story/18/10/23/0351220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0