June 2019 - wlug - list.wlug.org.nz

Potent Firefox 0-day used to install undetected backdoors on Macs
by Peter Reutemann 23 Jun '19

23 Jun '19

'Hackers exploited a pair of potent zero-day vulnerabilities in Firefox to infect Mac users with a largely undetected backdoor, according to accounts pieced together from multiple people. Mozilla released an update on Tuesday that fixed a code-execution vulnerability in a JavaScript programming method known as Array.pop. On Thursday, Mozilla issued a second patch fixing a privilege-escalation flaw that allowed code to break out of a security sandbox that Firefox uses to prevent untrusted content from interacting with sensitive parts of a computer operating system. Interestingly, a researcher at Google's Project Zero had privately reported the code-execution flaw to Mozilla in mid April. On Monday, as Mozilla was readying a fix for the array.pop flaw, unknown hackers deployed an attack that combined working exploits for both vulnerabilities. The hackers then used the attack against employees of Coinbase, according to Philip Martin, chief information security officer for the digital currency exchange.' -- source: https://arstechnica.com/information-technology/2019/06/potent-firefox-0day-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Re: [wlug] Chrome 'Has Become Surveillance Software. It's Time to Switch'
by mailinglist 23 Jun '19

23 Jun '19

I thought Chrome being an extension of Google was fairly obvious.The thing I don't understand is why duck duck go and Firefox are free.Sent from my Samsung Galaxy smartphone.-------- Original message --------From: Peter Reutemann <fracpete(a)waikato.ac.nz> Date: 23/06/2019 10:49 (GMT+12:00) To: wlug List <wlug(a)list.waikato.ac.nz> Subject: [wlug] Chrome 'Has Become Surveillance Software. It's Time to Switch' '"You open your browser to look at the Web. Do you know who is lookingback at you?" warns Washington Post technology columnist Geoffrey A.Fowler:Over a recent week of Web surfing, I peered under the hood of GoogleChrome and found it brought along a few thousand friends. Shopping,news and even government sites quietly tagged my browser to let ad anddata companies ride shotgun while I clicked around the Web. This wasmade possible by the Web's biggest snoop of all: Google. Seen from theinside, its Chrome browser looks a lot like surveillance software...My tests of Chrome vs. Firefox unearthed a personal data caper ofabsurd proportions. In a week of Web surfing on my desktop, Idiscovered 11,189 requests for tracker "cookies" that Chrome wouldhave ushered right onto my computer but were automatically blocked byFirefox. These little files are the hooks that data firms, includingGoogle itself, use to follow what websites you visit so they can buildprofiles of your interests, income and personality... And that's notthe half of it. Look in the upper right corner of your Chrome browser.See a picture or a name in the circle? If so, you're logged in to thebrowser, and Google might be tapping into your Web activity to targetads. Don't recall signing in? I didn't, either. Chrome recentlystarted doing that automatically when you use Gmail.Chrome is even sneakier on your phone. If you use Android, Chromesends Google your location every time you conduct a search. (If youturn off location sharing it still sends your coordinates out, justwith less accuracy.)The columnist concludes that "having the world's biggest advertisingcompany make the most popular Web browser was about as smart asletting kids run a candy shop," and argues that through itsDoubleclick and other ad businesses, Google "is the No. 1 cookie maker-- the Mrs. Fields of the web."He also reports that Firefox is now working on ways to block browser"fingerprintin'-- source: https://news.slashdot.org/story/19/06/21/1922233Cheers, Peter-- Peter ReutemannDept. of Computer ScienceUniversity of Waikato, NZ+64 (7) 858-5174http://www.cms.waikato.ac.nz/~fracpete/http://www.data-mining.co.nz/_______________________________________________wlug mailing list | wlug(a)list.waikato.ac.nzUnsubscribe: https://list.waikato.ac.nz/mailman/listinfo/wlug

1 0

Chrome 'Has Become Surveillance Software. It's Time to Switch'
by Peter Reutemann 22 Jun '19

22 Jun '19

'"You open your browser to look at the Web. Do you know who is looking back at you?" warns Washington Post technology columnist Geoffrey A. Fowler: Over a recent week of Web surfing, I peered under the hood of Google Chrome and found it brought along a few thousand friends. Shopping, news and even government sites quietly tagged my browser to let ad and data companies ride shotgun while I clicked around the Web. This was made possible by the Web's biggest snoop of all: Google. Seen from the inside, its Chrome browser looks a lot like surveillance software... My tests of Chrome vs. Firefox unearthed a personal data caper of absurd proportions. In a week of Web surfing on my desktop, I discovered 11,189 requests for tracker "cookies" that Chrome would have ushered right onto my computer but were automatically blocked by Firefox. These little files are the hooks that data firms, including Google itself, use to follow what websites you visit so they can build profiles of your interests, income and personality... And that's not the half of it. Look in the upper right corner of your Chrome browser. See a picture or a name in the circle? If so, you're logged in to the browser, and Google might be tapping into your Web activity to target ads. Don't recall signing in? I didn't, either. Chrome recently started doing that automatically when you use Gmail. Chrome is even sneakier on your phone. If you use Android, Chrome sends Google your location every time you conduct a search. (If you turn off location sharing it still sends your coordinates out, just with less accuracy.) The columnist concludes that "having the world's biggest advertising company make the most popular Web browser was about as smart as letting kids run a candy shop," and argues that through its Doubleclick and other ad businesses, Google "is the No. 1 cookie maker -- the Mrs. Fields of the web." He also reports that Firefox is now working on ways to block browser "fingerprintin' -- source: https://news.slashdot.org/story/19/06/21/1922233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mattermost Raises $50 Million For Its Open Source Slack Alternative
by Peter Reutemann 22 Jun '19

22 Jun '19

'Mattermost, a startup developing what it characterizes as an open source messaging alternative to Google's Hangouts Chat, Atlassian's HipChat, Slack, and Microsoft Teams, today announced the closure of a $50 million series B funding round. The round was led by Y Combinator's Continuity Fund, with participation from new investor Battery Ventures, as well as existing investors Redpoint and S28 Capital. The capital infusion follows a $20 million series A in February and a $3.5 million seed round in February 2017 and brings the Palo Alto, California-based company's total raised to roughly $70 million. As part of the round, Twitter COO Ali Rowghani will join Mattermost as board director and Battery Ventures' Neeraj Agarwal will join as a board observer. The raise comes as monthly downloads of the open source project pass 10,000. To date, more than 1,000 contributors have helped translate Mattermost into 16 languages.' -- source: https://news.slashdot.org/story/19/06/22/0243233 Haven't even heard of Mattermost before... In terms of "Slack": "Should Slack-Like Chat Clients Replace Email?" https://tech.slashdot.org/story/19/06/21/2233229 Personally, I'm not a fan of chat, as it is even more disruptive than email. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

China Has Almost Half of The World's Supercomputers, Explores RISC-V and ARM
by Peter Reutemann 22 Jun '19

22 Jun '19

'Ten years ago, China had 21 systems on the Top500 list of the world's largest supercomputing systems. It now has 219, according to the biannual listing, which was updated just this week. At its current pace of development, China may have half of the supercomputing systems on the Top500 list by 2021.... U.S. supercomputers make up 116 of the latest Top500 list. Despite being well behind China in total system count, the U.S. leads in overall performance, as measured by the High Performance Linpack (HPL) benchmark. The HPL benchmark is used to solve linear equations. The U.S. has about 38% of the aggregate Top500 list performance. China is in second, at nearly 30% of the performance total. But this performance metric has flip-flopped between China and the U.S., because it's heavily weighted by the largest systems. The U.S. owns the top two spots on the latest Top500 list, thanks to two IBM supercomputers at U.S. national laboratories. These systems, Summit and Sierra, alone, represent 15.6% of the HPL performance measure. Nathan Brookwood, principal analyst at Insight 64, says China is concerned the U.S. may limit its x86 chip imports, and while China may look to ARM, they're also investigating the RISC-V processor architecture. Paresh Kharya, director of product marketing at Nvidia, tells Tech Target "We expect x86 CPUs to remain dominant in the short term. But there's growing interest in ARM for supercomputing, as evidenced by projects in the U.S., Europe and Japan. Supercomputing centers want choice in CPU architecture.' -- source: https://tech.slashdot.org/story/19/06/22/1617211 Looks like such sanctions would backfire for US companies, by losing major customers for their products. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Coincidence Of The Week (Or Not?)
by Lawrence D'Oliveiro 21 Jun '19

21 Jun '19

Just reading through this announcement <https://www.theregister.co.uk/2019/06/21/facebook_pyrobot/> of a new Python framework from Facebook called PyRobot, built on top of ROS (the Robot Operating System). Which led me to thinking of the origin of the word “robot”, which comes from a play by Karel Čapek, called “Rossum’s Universal Robots”, from 1920. And the original mastermind behind Python is named Guido van Rossum. And so another circle closes ...

1 0

Enter The Virtual Supercomputer
by Lawrence D'Oliveiro 21 Jun '19

21 Jun '19

A company called Descartes Labs has become number 136 on the top500 supercomputer list just by paying for a large enough collection of nodes on its Amazon Web Services account <https://www.theregister.co.uk/2019/06/20/supercomputer_aws/>. However, Dr Paul Calleja, directory of the University of Cambridge Research Computing Services, argues that this is not really cost-effective compared to buying your own actual gear, and the I/O performance is not that good anyway. Such a cloud cluster may score well on LINPACK, but not so well on real-world supercomputing problems. Dr Calleja advocates using OpenStack to build a “hybrid” combination of on-premise physical hardware backed up by cloud services for those times when you need a bit of a (temporary) boost. And for learner supercomputer drivers, there is always the option of a Raspberry π cluster to practise on, before being allowed behind the wheel of a real big-iron machine ...

1 0

Flushing All iptables Rules
by Lawrence D'Oliveiro 21 Jun '19

21 Jun '19

I have a script that I run on my Internet router machine to set up iptables rules for NAT forwarding and various other things. To ensure things are consistent, it starts by deleting any existing packet filter rules. The following sequence used to work for this: if test -f /proc/net/ip_tables_names; then for table in $(cat /proc/net/ip_tables_names); do iptables -t $table -F done fi However, while the file /proc/net/ip_tables_names still exists in current kernels, it no longer lists the names of tables for which rules are defined; instead, its contents are now always empty. It turns out there is now a new “nftables” interface for managing packet filter rules. The nice thing is, it has a command for listing all defined tables. For example, on my router machine, the command nft list tables prints out table ip filter table ip nat which means there are two tables named “filter” and “nat”, both part of the “ip” protocol stack. Interestingly, the nft(8) man page does not mention the “list tables” command (at least on Debian), only the more specific “list table «table»” form, which print out the rules within a given table. However, the nftables wiki <https://wiki.nftables.org/wiki-nftables/index.php/Quick_reference-nftables_…> does give all the details. As usual, the Arch Linux wiki entry <https://wiki.archlinux.org/index.php/Nftables> offers some additional useful info.

1 0

next lug meet
by Ian Young 20 Jun '19

20 Jun '19

Greets If required I may be able to find a few words about a new project on Distrowatch last week named Resilient Linux. Listed on GitHub. https://github.com/marco-buratto/resilientlinux Seems to have some interesting aspects. It would help if the iso image could unzip successfully. Should anyone obtain such let me know. ~ Ian Y

2 1

Microsoft’s Linux Strategy
by Lawrence D'Oliveiro 19 Jun '19

19 Jun '19

When Microsoft first embraced Docker and containers some years ago, no doubt people thought it was trying to nab some of that “virtualization-lite” action for its own Windows platform--at least I know I did. But with the release of WSL 2, which includes a full Linux kernel in Windows, it looks like this strategy has changed <https://www.theregister.co.uk/2019/06/18/the_future_of_docker_on_windows_is…>: The Docker news is of no interest to developers using Windows Containers, but there are not many of them. At Microsoft's Build conference last month, Gabe Monroy, lead program manager for the Azure Container Compute team, was asked whether Windows Containers are for legacy and Linux Containers for new projects. "I think that is a fair description," he said, demonstrating how the company's thinking on the subject has shifted. It seems Microsoft is now pushing the concept of develop on Windows, deploy on Linux. It is clearly hoping that those Linux deployments will happen on its Azure cloud, and so it still profits that way. Also, WSL 2 actually makes for worse Linux-Windows integration compared to WSL 1, which emulated the Linux APIs on top of Windows: Similarly, WSL 2 makes life better for developing Linux applications on Windows, but there are downsides. Running Linux in a VM as opposed to redirecting system calls is better for compatibility but inherently worse for integration. One aspect of this is that in WSL 2 I/O performance to files within the Linux VM is much faster, but I/O performance between Linux and the host is worse. Another is that WSL 2 has no access to serial or USB ports. Seems to me the obvious way to fix this, at least partially, is to flip things round, so instead of virtualizing Linux on top of Windows, you virtualize Windows on top of Linux. Then both your development and deployment platforms become fundamentally Linux-based. How long before that happens?

2 7