October 2018 - wlug - list.wlug.org.nz

Greg Kroah-Hartman: Outside Phone Vendors Aren't Updating Their Linux Kernels
by Peter Reutemann 06 Oct '18

06 Oct '18

'"Linux runs the world, right? So we want to make sure that things are secure," says Linux kernel maintainer Greg Kroah-Hartman. When asked in a new video interview which bug makes them most angry, he first replies "the whole Spectre/Meltdown problem. What made us so mad, in a way, is we were fixing a bug in somebody else's layer!" One also interesting thing about the whole Spectre/Meltdown is the complexity of that black box of a CPU is much much larger than it used to be. Right? Because they're doing -- in order to eke out all the performance and all the new things like that, you have to do extra-special tricks and things like that. And they have been, and sometimes those tricks come back to bite you in the butt. And they have, in this case. So we have to work around that. But a companion article on Linux.com notes that "Intel has changed its approach in light of these events. 'They are reworking on how they approach security bugs and how they work with the community because they know they did it wrong,' Kroah-Hartman said." (And the article adds that "for those who want to build a career in kernel space, security is a good place to get started...") Kroah-Hartman points out in the video interview that "we're doing more and more testing, more and more builds," noting "This infrastructure we have is catching things at an earlier stage -- because it's there -- which is awesome to see." But security issues can persist thanks to outside vendors beyond their control. Linux.com reports: Hardening the kernel is not enough, vendors have to enable the new features and take advantage of them. That's not happening. Kroah-Hartman releases a stable kernel every week, and companies pick one to support for a longer period so that device manufacturers can take advantage of it. However, Kroah-Hartman has observed that, aside from the Google Pixel, most Android phones don't include the additional hardening features, meaning all those phones are vulnerable. "People need to enable this stuff," he said. "I went out and bought all the top of the line phones based on kernel 4.4 to see which one actually updated. I found only one company that updated their kernel," he said. "I'm working through the whole supply chain trying to solve that problem because it's a tough problem. There are many different groups involved -- the SoC manufacturers, the carriers, and so on. The point is that they have to push the kernel that we create out to people." "The good news," according to Linux.com, "is that unlike with consumer electronics, the big vendors like Red Hat and SUSE keep the kernel updated even in the enterprise environment. Modern systems with containers, pods, and virtualization make this even easier. It's effortless to update and reboot with no downtime."' -- source: https://linux.slashdot.org/story/18/10/06/1736258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

California Bans Default Passwords on Any Internet-Connected Device
by Peter Reutemann 06 Oct '18

06 Oct '18

'In less than two years, anything that can connect to the internet will come with a unique password -- that is, if it's produced or sold in California. From a report: The "Information Privacy: Connected Devices" bill that comes into effect on January 1, 2020, effectively bans pre-installed and hard-coded default passwords. It only took the authorities about two weeks to approve the proposal made by the state senate. The new regulation mandates device manufacturers to either create a unique password for each device at the time of production or require the user to create one when they interact with the device for the first time. According to the bill, it applies to any connected device, which is defined as a "physical object that is capable of connecting to the Internet, directly or indirectly, and that is assigned an Internet Protocol address or Bluetooth address."' -- source: https://it.slashdot.org/story/18/10/05/1814242 Good bye, "admin/admin"! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox To Support Google's WebP Image Format For a Faster Web
by Peter Reutemann 06 Oct '18

06 Oct '18

'Firefox has joined Google's WebP party, another endorsement for the internet giant's effort to speed up the web with a better image format. From a report: Google revealed WebP eight years ago and since then has built it into its Chrome web browser, Android phone software and many of its online properties in an effort to put websites on a diet and cut network data usage. But Google had trouble encouraging rival browser makers to embrace it. Mozilla initially rejected WebP as not offering enough of an improvement over more widely used image formats, JPEG and PNG. It seriously evaluated WebP but chose to try to squeeze more out of JPEG. But now Mozilla -- like Microsoft with its Edge browser earlier this week -- has had a change of heart. "Mozilla is moving forward with implementing support for WebP," the nonprofit organization said. WebP will work in versions of Firefox based on its Gecko browser engine, Firefox for personal computers and Android but not for iOS.' -- source: https://news.slashdot.org/story/18/10/05/1755247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Look at Facebook's Use of Systemd
by Peter Reutemann 06 Oct '18

06 Oct '18

'At an event this month (you can find the video of it here), Davide Cavalca, a production engineer at Facebook, spoke about the growing adoption of systemd at the data centers of the company. From a report: Facebook continues making use of systemd's many features inside their data centers. Some of their highlights for systemd use in 2018 includes: Facebook's servers have been relying on systemd for about the past two years. Facebook is using CentOS 7 everywhere from hosts to containers. While relying on CentOS 7, Facebook backports a lot of packages including new systemd releases, Meson, other dependencies, and of course new Linux kernel releases. Facebook is working on "pystemd" as a Python (Cython) wrapper on top of SD-BUS.' -- source: https://linux.slashdot.org/story/18/10/05/1717233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Is Embracing Android As the Mobile Version of Windows
by Peter Reutemann 03 Oct '18

03 Oct '18

'Microsoft unveiled a bunch of new hardware during a press event last night, but one of the most interesting announcements the company made was their new "Your Phone" app for Windows 10. Basically, the feature will let Android users mirror any app on their device to a Windows 10 desktop. The Verge's Tom Warren writes about how Microsoft is embracing Android as the mobile version of Windows: We've seen a variety of ways of bringing Android apps to Windows in recent years, including Bluestacks and even Dell's Mobile Connect software. This app mirroring is certainly easier to do with Android, as it's less restricted than iOS. Still, Microsoft's welcoming embrace of Android in Windows 10 with this app mirroring is just the latest in a number of steps the company has taken recently to really help align Android as the mobile equivalent of Windows. Microsoft Launcher is designed to replace the default Google experience on Android phones, and bring Microsoft's own services and Office connectivity to the home screen. It's a popular launcher that Microsoft keeps updating, and it's even getting support for the Windows 10 Timeline feature that lets you resume apps and sites across devices. All of this just reminds me of Windows Phone. It's only been three years since Microsoft launched its Lumia 950 Windows 10 Mobile device at a packed holiday hardware event. Windows Phone has vanished in the last couple of years, and Microsoft finally admitted Windows Phone was dead nearly a year ago. The software maker has now embraced the reality that people don't need Windows on a phone. Instead, it's embracing Android as the mobile version of Windows.' -- source: https://tech.slashdot.org/story/18/10/03/2051239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Alphabet's Intra App Encrypts DNS Queries To Help Users Bypass Online Censorship
by Peter Reutemann 03 Oct '18

03 Oct '18

'Catalin Cimpanu, writing for ZDNet: Jigsaw, a technology incubator created by Google and operated as a subsidiary under the Alphabet brand, has released today an Android app named Intra that can encrypt DNS queries as a protection against DNS manipulation at the ISP (internet service provider) level. DNS manipulation is one of the most common forms of online censorship used by oppressive regimes or unscrupulous ISPs, used to block access to news sites, information portals, social media platforms, undesirable software, and more. Intra protects against DNS manipulation by keeping DNS traffic hidden from third-parties with state-level surveillance capabilities, such as internet service providers in countries with autocratic regimes. Reports suggest that Alphabet tested the app with a few dozen political activists in Venezuela before the global roll-out.' -- source: https://yro.slashdot.org/story/18/10/03/2042219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ungoogled-chromium
by Lawrence D'Oliveiro 03 Oct '18

03 Oct '18

Even though the Chromium browser is Open Source, it still does a whole lot of communication with Google’s servers, when it’s built and when it runs. This project <https://github.com/Eloston/ungoogled-chromium> tries to strip out all of that, while preserving the user-visible behaviour as much as possible.

1 0

Aussie Law >> Maths
by Lawrence D'Oliveiro 02 Oct '18

02 Oct '18

"The laws of Australia prevail in Australia, I can assure you of that," [Malcolm Turnbull] said on Friday. "The laws of mathematics are very commendable, but the only law that applies in Australia is the law of Australia." <https://www.techdirt.com/articles/20170714/10385237789/aussie-prime-ministe…>

1 2

Who Needs Special Hardware Random Number Generators?
by Lawrence D'Oliveiro 02 Oct '18

02 Oct '18

The weak point in any encryption system has long been: how random are your random numbers? Providing special hardware for generating random numbers, special CPU instructions etc has always been open to the objection that their randomness could be subverted -- whether through some minor stupid mistake in implementation, or deliberately by certain powerful agencies -- and you would never know. Now, a new research paper <https://www.theregister.co.uk/2018/10/01/hardware_random_numbers/> proposes that normal CPU operation itself can be a source of random numbers. And the way these are obtained would in fact be very hard to subvert, since it is based on detecting subtle timing variations in the operations of various circuits. In other words, it is obtaining randomness from hardware that is not designed to be working randomly at all. And this should -- hopefully -- make the randomness very difficult to compromise.

1 0

NZ Customs Can Now Demand You Unlock Your Phone
by Lawrence D'Oliveiro 01 Oct '18

01 Oct '18

You can now face a $5,000 fine for not unlocking your phone if ordered to do so, when coming into NZ <https://www.theregister.co.uk/2018/10/01/nz_border_customs/>. Justice Minister Andrew Little says: “The bill provides for that power of search and examination, but in order to exercise that power, a customs officer, first of all, has to be satisfied, or at least to have a reasonable suspicion, that a person in possession of such a device—it would be a cellphone or a laptop or anything else that might be described as an 'e-device'—has been involved in criminal offending.” Howver, ... the Council of Civil Liberties criticised the “reasonable cause” protection as inadequate, because someone asked to unlock a device isn't told what that cause might be, and therefore has no way to challenge the request.

1 0