August 2018 - wlug - list.wlug.org.nz

Facebook, Apple and Microsoft Are Contributing To OpenStreetMap
by Peter Reutemann 28 Aug '18

28 Aug '18

'At the recently concluded State of the Map conference in Milan, teams from Microsoft, Apple and Facebook presented their projects, describing how they are working with communities. From a report: The Microsoft Open Maps team has recently released open data on building footprints in the US. Microsoft was among the first to release satellite imagery for use by OpenStreetMap and the images are now integrated into the default editor. It also has a community of mappers directly contributing to OpenStreetMap in Australia. Apple has an internal volunteer programme that has around 5,000 staff contributing to Missing Maps, they've released building data for France and Denmark, and are engaged with data improvement projects around the world. Facebook is exploring how artificial intelligence-assisted tracing can help to improve the quality of OpenStreetMap data in Thailand. DigitalGlobe has made its satellite imagery available under a licence that will allow it to be used by the OpenStreetMap community to improve their mapping efforts. Telenav launched OpenStreetCam to help collect openly-licensed street imagery and has now released open data and code to explore how machine learning can enable the images to be used to improve OpenStreetMap with stop signs and turn directions.' -- source: https://news.slashdot.org/story/18/08/27/2258229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi's PoE HAT Ships For $20, Tosses in a Free Fan
by Peter Reutemann 27 Aug '18

27 Aug '18

'Raspberry Pi is offering a Power-over-Ethernet HAT board for the RPi 3 Model B+ for $20 that ships with a small fan. Per blog LinuxGizmo, the "802.3af-compliant 'Raspberry Pi PoE HAT' allows delivery of up to 15W over the RPi 3 B+'s USB-based GbE port without reducing the port's up to 300Mbps bandwidth." From the report: The Raspberry Pi PoE HAT features a fully isolated switched-mode power supply with 37-57V DC, Class 2 input and 5V/2.5A DC output. The HAT connects to both the 40-pin header and a new PoE-specific 4-pin header introduced with the B+ located near the USB ports. To enable PoE, you need power sourcing equipment, which is either "provided by your network switch or with power injectors on an Ethernet cable," writes the foundation in a blog post.' -- source: https://hardware.slashdot.org/story/18/08/27/1916207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu and CentOS Are Undoing a GNOME Security Feature
by Peter Reutemann 27 Aug '18

27 Aug '18

'Current versions of Ubuntu and CentOS are disabling a security feature that was added to the GNOME desktop environment last year. The feature's name is Bubblewrap, which is a sandbox environment that the GNOME Project added to secure GNOME's thumbnail parsers in July 2017, with the release of GNOME 3.26. In recent years, security researchers have proven that thumbnail parses can be an attack vector [1, 2, 3]. Ubuntu Security Tech Lead Alex Murray said the Ubuntu team chose to disable Bubblewrap inside Ubuntu because they did not have the time to perform a security audit. Murray blamed the many CPU bugs (Spectre, Meltdown, etc.), which kept the team busy and prevented them to audit the feature.' -- source: https://news.slashdot.org/story/18/08/27/1815234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 4.19 Preparing Better CPU Security Mitigations, New EROFS File-System
by Peter Reutemann 27 Aug '18

27 Aug '18

'Linus Torvalds released on Sunday Linux 4.19-rc1 that he describes as a "fairly frustrating merge window" following the new features landing over the past two weeks. What does this "pretty big release" offer? Phoronix's Linux 4.19 feature overview sheds light on more Spectre CPU mitigations for x86/POWER/s390, the new EROFS read-only Android file-system, a Raspberry Pi voltage driver, ThinkPad calculator key support, an in-kernel GPS subsystem, the Google GASKET driver framework, virtual kernel mode-setting, Qualcomm Adreno 600 series support, and many other improvements.' -- source: https://linux.slashdot.org/story/18/08/26/2342240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Smartphones From 11 OEMs, Including Google, Samsung, HTC, Lenovo and Sony, Vulnerable To Attacks Via Hidden AT Commands
by Peter Reutemann 26 Aug '18

26 Aug '18

'In massive and groundbreaking research, a team of eleven scientists from the University of Florida, Stony Brook University, and Samsung Research America, have looked into what types of AT commands, or the Hayes command set, are currently supported on modern Android devices. The research team analyzed over 2,000 Android firmware images from eleven Android OEMs such as ASUS, Google, HTC, Huawei, Lenovo, LG, LineageOS, Motorola, Samsung, Sony, and ZTE. They say they discovered that these devices support over 3,500 different types of AT commands, some of which grant access to very dangerous functions. These AT commands are all exposed via the phone's USB interface, meaning an attacker would have to either gain access to a user's device, or hide a malicious component inside USB docks, chargers, or charging stations. Once an attacker is connected via the USB to a target's phone, s/he can use one of the phone's secret AT commands to rewrite device firmware, bypass Android security mechanisms, exfiltrate sensitive device information, perform screen unlocks, or even inject touch events solely through the use of AT commands.' -- source: https://mobile.slashdot.org/story/18/08/26/1910246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

E-Life In NZ
by Lawrence D'Oliveiro 25 Aug '18

25 Aug '18

The Herald website <https://www.nzherald.co.nz/> seems to be having trouble matching some of its headlines with subheads today. From the front page: * Man Hospitalised After Stuffing 15 Hard-Boiled Eggs Up His Bottom How many of these 'only-in-Auckland' dates have you been on? * Lizzie Marvelly: Haters, Trolls And Their Vile Words Kim Kardashian West is 'really proud' of her weight loss. Here's how she did it. * Why Restaurants Hate You The little Prince is getting a well-rounded education at his $38,000 a year school. * Six Reasons Why Superwoman Sucks Italian chef advises home cooks to reach for the most expensive varieties. * Ex-Playboy Model Found Strangled In Her Home Kyle MacDonald on whether or not the term applies to our Prime Minister. Interestingly, all of these are from the “Lifestyle” section.

1 0

“The following packages have been kept back:”
by Peter Reutemann 23 Aug '18

23 Aug '18

Every now and then, I get the message from "apt-get upgrade", that: “The following packages have been kept back:” The following answer on "ask ubuntu" explains this nicely and also several solutions to install these packages after all: https://askubuntu.com/questions/601/the-following-packages-have-been-kept-b… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel's Reworked Microcode Security Fix License No Longer Prohibits Benchmarking
by Peter Reutemann 23 Aug '18

23 Aug '18

'Intel has backtracked on the license for its latest microcode update that mitigates security vulnerabilities in its processors -- after the previous wording outlawed public benchmarking of the chips. The reason for Intel's insistence on a vow of silence is that -- even with the new microcode in place -- turning off hyper-threading is necessary to protect virtual machines from attack via Foreshadow -- and that move comes with a potential performance hit. Predictably, Intel's contractual omerta had the opposite effect and drew attention to the problem. "Performance is so bad on the latest Spectre patch that Intel had to prohibit publishing benchmarks," said Lucas Holt, MidnightBSD project lead, via Twitter. In response to the outcry, Intel subsequently said it would rewrite the licensing terms. And now the fix is in. Via Twitter, Imad Sousou, corporate VP and general manager of Intel Open Source Technology Center, on Thursday said: "We have simplified the Intel license to make it easier to distribute CPU microcode updates and posted the new version here. As an active member of the open source community, we continue to welcome all feedback and thank the community." The reworked license no longer prohibits benchmarking. Long-time Slashdot reader and open-source pioneer, Bruce Perens, first brought Intel's microcode update to our attention. In a phone interview with The Register, Perens said he approved of the change. "This is a relatively innocuous license for proprietary software and it can be distributed in the non-free section of Debian, which is where is used to be, and it should be distributable by other Linux distributions," he said. "You can't expect every lawyer to understand CPUs. Sometimes they have to have a deep conversation with their technical people."' -- source: https://it.slashdot.org/story/18/08/23/2041206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel Publishes Microcode Security Patches With No Benchmarks Or Profiling Allowed
by Peter Reutemann 23 Aug '18

23 Aug '18

'The Register reports that Debian is rejecting a new Intel microcode update because of a new license term prohibiting the use of the CPU for benchmarks and profiling. There is a new license term applied to the new microcode: "You will not, and will not allow any third party to (i) use, copy, distribute, sell or offer to sell the Software or associated documentation; (ii) modify, adapt, enhance, disassemble, decompile, reverse engineer, change or create derivative works from the Software except and only to the extent as specifically required by mandatory applicable laws or any applicable third party license terms accompanying the Software; (iii) use or make the Software available for the use or benefit of third parties; or (iv) use the Software on Your products other than those that include the Intel hardware product(s), platform(s), or software identified in the Software; or (v) publish or provide any Software benchmark or comparison test results."' -- source: https://linux.slashdot.org/story/18/08/22/2213233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ghostscript Leaks Like A Sieve
by Lawrence D'Oliveiro 23 Aug '18

23 Aug '18

Tools like ImageMagick commonly accept graphics in PostScript format, which they render through Ghostscript. Trouble is, there are holes in Ghostscript that can be exploited by malicious parties. In short, you should not be accepting PostScript data from untrusted parties. The fact that PostScript is a full programming language just makes it harder -- in terms of vulnerability exposure, it’s similar to JavaScript, except that I think a lot more effort has gone into securing the latter. <https://www.theregister.co.uk/2018/08/23/imagemagick_ghostscript/>

1 0