July 2019 - wlug - list.wlug.org.nz

SUSE Names Melissa Di Donato New CEO
by Peter Reutemann 22 Jul '19

22 Jul '19

'Melissa Di Donato, SAP's former COO, has been named SUSE's new CEO. ZDNet reports: London-based Di Donato is a well-known technology leader. In particular, she has a proven track record in sales and business operations. Besides being SAP's COO, she was also the company's chief revenue officer. In SAP's latest quarter, SAP saw an increase of 11% year-over-year revenues. Much of that came from the cloud -- where SAP saw 40% year-over-year growth. SAP's cloud is built on SUSE's Linux servers and OpenStack cloud. Di Donato succeeds Nils Brauckmann. While officially Brauckmann is retiring, there seems to be more to the story. On LinkedIn, Brauckmann wrote: "I care very deeply for the SUSE business and its employees, and this difficult decision is based entirely on personal reasons. I am pleased to be handing over the reins to such a talented and accomplished leader as Melissa Di Donato." In his SUSE statement, Brauckman added: "She is a proven and dynamic change agent, and many of her achievements have occurred in subscription businesses that exist in high-growth cloud environments." In April, then-CEO Nils Brauchmann said his company would soon be the largest independent Linux company. This comes after Brauckmann delivered eight years of continuous expansion during his tenure, including record-breaking revenues in FY18, reports ZDNet. "Under Di Donato's leadership, SUSE will continue to focus on growth and expansion. What that means is she's expected to advance SUSE's core business and emerging technologies, both organically and through add-on acquisitions."' -- source: https://linux.slashdot.org/story/19/07/22/2038259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Dropbox Brings Back Support For ZFS, XFS, Btrfs And eCryptFS On Linux
by Peter Reutemann 22 Jul '19

22 Jul '19

'Speaking of Dropbox, the online storage cloud service has enabled support for ZFS and XFS on 64-bit Linux systems, and eCryptFS and Btrfs on all Linux systems. The move comes after it recently pulled support for all file storage systems on Linux except Ext4. From a report: Dropbox stopped supporting folder syncing to drives with filesystems it deemed "uncommon", which on Linux meant anything but Ext4, upsetting quite a few users. The reason cited for this was that "a supported file system is required as Dropbox relies on extended attributes (X-attrs) to identify files in the Dropbox folder and keep them in sync", which doesn't really make sense since there are many filesystems that support xattr (extended attributes) on Linux. After this change was announced, various workarounds started to appear online, including one that I posted on Linux Uprising. There was even a new unofficial, open source Dropbox client developed for this reason (which is also much lighter than the official client by the way). But this didn't last long though, as last week, the Dropbox 77.3.127 beta changelog says that Dropbox has added back support for ZFS (on 64-bit systems only), XFS (on 64bit systems only), Btrfs and eCryptFS.' -- source: https://hardware.slashdot.org/story/19/07/22/1534200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

This pixel tracking demo shows how easy it is to make a creepy surveillance tool
by Peter Reutemann 19 Jul '19

19 Jul '19

'The Superhuman controversy from earlier this month, in which a former Silicon Valley exec blew the lid off a series of controversial email surveillance tools offered by the up-and-coming startup, has prompted a bit of soul searching among those in the tech industry. But in twisted fashion, the public blasting of a company like Superhuman has been the tech equivalent of opening Pandora’s Box, unearthing all sorts of free and easily available tools that have done this for years and can be employed by anyone with just the tiniest shred of tech savvy. For instance, an open source, Python-based web tool called Supertracker has popped up on Github, courtesy of Delian Asparouhov, an investor with the venture capital firm Founder’s Fund. It lets anyone create their own tracking pixel, coyly disguised as either a transparent image, an image of the pokémon pikachu, or a not-so-subtle magnifying glass. Creating it is as easy as inputting a user name, picking a tracking pixel image, and hitting the enter key. From there, you can save the image, paste it in the body of any email, and send it off. Whoever opens it will have the when and even the where transmitted back to you. Of course, you can do similar styles of tracking with any number of available Superhuman competitors and browser extensions. But Asparouhov’s tool has the added benefit of walking you through the process step by step and laying out just how simple it is to siphon away this kind of sensitive info with a few simple lines of code. (He also outlines some good defenses against this type of surveillance.) ' -- source: https://www.theverge.com/2019/7/19/20700843 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

China's Tech Giants Have a Second Job: Helping Beijing Spy on Its People
by Peter Reutemann 19 Jul '19

19 Jul '19

'Tencent and Alibaba are among the firms that assist authorities in hunting down criminal suspects, silencing dissent and creating surveillance cities. From a report: Alibaba Group's sprawling campus has collegial workspaces, laid-back coffee bars and, on the landscaped grounds, a police outpost. Employees use the office to report suspected crimes to the police, according to people familiar with the operation. Police also use it to request data from Alibaba for their own investigations, these people said, tapping into the trove of information the tech giant collects through its e-commerce and financial-payment networks. In one case, the police wanted to find out who had posted content related to terrorism, said a former Alibaba employee. "They came to me and asked me for the user ID and information," he recalled. He turned it over. The Chinese government is building one of the world's most sophisticated, high-tech systems to keep watch over its citizens, including surveillance cameras, facial-recognition technology and vast computers systems that comb through terabytes of data. Central to its efforts are the country's biggest technology companies, which are openly acting as the government's eyes and ears in cyberspace. Companies including Alibaba Group Holding, Tencent Holdings and Baidu, are required to help China's government hunt down criminal suspects and silence political dissent. Their technology is also being used to create cities wired for surveillance.' -- source: https://yro.slashdot.org/story/19/07/19/1443207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Huawei Says Hongmeng OS Isn't Designed as an Android Replacement
by Peter Reutemann 19 Jul '19

19 Jul '19

'Huawei reportedly wants to keep using Google's Android operating system in its phones instead of jumping to its self-developed Hongmeng system. From a report: Company senior vice president Catherine Chen told reporters in Brussels this week that the Hongmeng OS isn't even designed for phones, according to Chinese state news agency Xinhua. Chen apparently said Hongmeng is for industrial use, noting that it contains far fewer lines of code than a phone OS, and has much lower latency than a phone, meaning it can process a very high volume of data messages with little delay. Latest episode in a confusing narrative about what Huawei even intends to do. The company's executives have previously said on record that its homegrown operating system is designed to replace Android on its handsets. One executive said the operating system would be released by last month -- a target that Huawei has missed.' -- source: https://tech.slashdot.org/story/19/07/19/1524253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Rust-Based TLS Library Outperformed OpenSSL in Almost Every Category
by Peter Reutemann 19 Jul '19

19 Jul '19

'A tiny and relatively unknown TLS library written in Rust, an up-and-coming programming language, outperformed the industry-standard OpenSSL in almost every major category. From a report: The findings are the result of a recent four-part series of benchmarks carried out by Joseph Birr-Pixton, the developer behind the Rustls library. The findings showed that Rustls was 10% faster when setting up and negotiating a new server connection, and between 20 and 40% faster when setting up a client connection. But while handshake speeds for new TLS connections are important, most TLS traffic relies on resuming previously negotiated handshakes. Here, too, Rustls outperformed the aging OpenSSL, being between 10 and 20% in resuming a connection on the server-side, and being between 30 and 70% quicker to resume a client connection. Furthermore, Rustls also fared better in sheer bulk performance -- or the speed at which data is transferred over the TLS connection. Birr-Pixton said Rustls could send data 15% faster than OpenSSL, and receive it 5% faster as well.' -- source: https://tech.slashdot.org/story/19/07/19/1546224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

My browser, the spy: How extensions slurped up browsing histories from 4M users
by Peter Reutemann 18 Jul '19

18 Jul '19

'When we use browsers to make medical appointments, share tax returns with accountants, or access corporate intranets, we usually trust that the pages we access will remain private. DataSpii, a newly documented privacy issue in which millions of people’s browsing histories have been collected and exposed, shows just how much about us is revealed when that assumption is turned on its head. DataSpii begins with browser extensions—available mostly for Chrome but in more limited cases for Firefox as well—that, by Google's account, had as many as 4.1 million users. These extensions collected the URLs, webpage titles, and in some cases the embedded hyperlinks of every page that the browser user visited. Most of these collected Web histories were then published by a fee-based service called Nacho Analytics, which markets itself as “God mode for the Internet” and uses the tag line “See Anyone’s Analytics Account.” Web histories may not sound especially sensitive, but a subset of the published links led to pages that are not protected by passwords—but only by a hard-to-guess sequence of characters (called tokens) included in the URL. Thus, the published links could allow viewers to access the content at these pages. (Security practitioners have long discouraged the publishing of sensitive information on pages that aren't password protected, but the practice remains widespread.)' -- source: https://arstechnica.com/information-technology/2019/07/dataspii-inside-the-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Slack Resets Passwords For 1% of Its Users Because of 2015 Hack
by Peter Reutemann 18 Jul '19

18 Jul '19

'Slack published more details about a password reset operation that ZDNet reported earlier today. According to a statement the company published on its website, the password reset operation is related to the company's 2015 security breach. In March 2015, Slack said hackers gained access to some Slack infrastructure, including databases storing user credentials. Hackers stole hashed passwords, but they also planted code on the company's site to capture plaintext passwords that users entered when logging in. At the time, Slack reset passwords for users who it believed were impacted, and also added support for two-factor authentication for all accounts. But as ZDNet reported earlier today, the company recently received a batch of Slack users credentials, which prompted the company to start an investigation into its source and prepare a password reset procedure. "We immediately confirmed that a portion of the email addresses and password combinations were valid, reset those passwords, and explained our actions to the affected users," Slack said. In a message on its website, Slack said this batch of credentials came via its bug bounty program. The company said it initially believed the data came from users who had their PCs infected with malware, or users who reused passwords across different services.' -- source: https://tech.slashdot.org/story/19/07/18/1610221 Yep, been one of them... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft To Explore Using Rust
by Peter Reutemann 18 Jul '19

18 Jul '19

'Microsoft plans to explore using the Rust programming language as an alternative to C, C++, and others, as a way to improve the security posture of its and everyone else's apps. From a report: The announcement was made yesterday by Gavin Thomas, Principal Security Engineering Manager for the Microsoft Security Response Center (MSRC). "You're probably used to thinking about the Microsoft Security Response Center as a group that responds to incidents and vulnerabilities," Thomas said. "We are a response organization, but we also have a proactive role, and in a new blog series we will highlight Microsoft's exploration of safer system programming languages, starting with Rust." The end game is to find a way to move developers from the aging C and C++ programming language to so-called "memory-safe languages." Memory-safe languages, such as Rust, are designed from the ground up with protections against memory corruption vulnerabilities, such as buffer overflows, race conditions, memory leaks, use-after free and memory pointer-related bug' -- source: https://developers.slashdot.org/story/19/07/17/1630241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox To Warn When Saved Logins are Found in Data Breaches
by Peter Reutemann 18 Jul '19

18 Jul '19

'Starting in Firefox 70, Mozilla aims to have the browser report when any of your saved logins were found in data breaches. This will be done through their partnership with the Have I Been Pwned data breach site. From a report: Mozilla is slowly integrating their independent Firefox Monitor service and the new Firefox Lockwise password manager directly into Firefox. Mozilla is also considering premium services based around these features in the future. As part of this integration, Firefox will scan the saved login names and passwords and see if they were exposed in a data breach listed on Have I been Pwned. If one is found, Firefox will alert the user and prompt them to change their password. This new feature will only work, though, for data breaches that exposed passwords and when the password was saved prior to an associated data breach.' -- source: https://news.slashdot.org/story/19/07/17/1933231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fwd: Join us at the Red Hat & Ingram Micro Partner Day!
by Roger Hardy 17 Jul '19

17 Jul '19

Below was the source of that. In my experience, this is usually more sales than technical, but can be interesting all the same. Sorry for the spam..... What’s new with Red Hat?To make sure our emails get to your inbox, add imnz_ms(a)ingrammicro.co.nz to your address book.Email not displaying correctly? View it in your browser.Dear Rodger, You’re invited to join Ingram Micro and Red Hat as we bring you the very first Red Hat Partner Day. We’ll be presenting updates and insights on the newest technologies and architectures in hybrid multi-cloud solutions to help you: Learn how Red Hat's latest technologies can help you and your customers break down the barriers to true hybrid and multi-cloud environments.Understand how to use automation and intelligent management of cloud technologies to reduce security risks and exposures.Find out what’s new and happening at Red Hat.LOCATIONSAucklandRydges Hotel Hobson Room Tuesday, 23 July 2019 8:30 am - 11:40 am WellingtonThe Intercontinental Wellington Room Thursday, 25 July 2019 8:30 am - 11:40 amAGENDA8:30 - 9:30Breakfast9:30 - 9:35Welcome9:30 - 10:15Red Hat Enterprise Linux 8 with Insights and Ansible Automation10:15 - 10:55Red Hat OpenShift Container Platform 4: Enterprise Kubernetes & the Future of Open Hybrid Cloud10:55 - 11:10Industry Trends11:10 - 11:40Panel Discussion on Strategic portfolio Hybrid Cloud Register Now For more information, please contact: helen.chan(a)ingrammicro.com.Ingram Micro (N.Z.) Ltd 78 Apollo Drive, Rosedale, Auckland 0632nz.ingrammicro.com Follow on Twitter Follow on Linkedin Like on Facebook Copyright © 2019, All rights reserved. Our mailing address is: Ingram Micro New Zealand 78 Apollo Drive Rosedale Auckland, 0632 New Zealand Standard terms and conditions apply View our privacy policy Update preferences Unsubscribe

1 0

Red Hat Tech Talk: Hybrid Cloud New Zealand
by Peter Reutemann 17 Jul '19

17 Jul '19

Just saw the following (free, I believe) event come through on the NZOSS mailing list and thought people on here might be interested as well: Red Hat Tech Talk: Hybrid Cloud New Zealand At this afternoon event, meet our experts, hear what's new at Red Hat and get the latest insights on: - How to deliver innovative apps through containers - Security, compliance and governance for apps and workloads that run on a mix of public and private clouds - Automation and management capabilities for genuine portability of workloads into public cloud - How Red Hat Enterprise Linux 8 and Red Hat OpenShift 4 are transformational for hybrid clouds Select from two cities: Auckland - 23 July Wellington - 25 July Event registration: https://events.redhat.com/profile/form/index.cfm?PKformID=0x69788abcd# Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Giving Greylisting A Try
by Lawrence D'Oliveiro 15 Jul '19

15 Jul '19

I have decided to try installing sqlgrey on my VPS to see if that cuts down on the volume of spam. The basic idea is more than a decade old, and I can’t find much in the way of newer testimonials as to how wonderful it continues to be. On the other hand, I can’t see anyone saying it is now a terrible idea that should have a stake put through its heart and buried in an unmarked grave at midnight and forgotten. (Actually I’m posting this message just to see how legitimate mail makes it through the greylist obstacle course; it’s only been running less than an hour, and has already blocked 10 spam messages so far.)

2 7

meeting next Monday
by Peter Reutemann 15 Jul '19

15 Jul '19

Hi everyone We have a WLUG meeting next Monday: "Ben Radburnd will showcase GalliumOS (https://galliumos.org/) on his Chromebook." Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/257884291/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

What Does Ubuntu's Post-Unity Future Look Like?
by Peter Reutemann 14 Jul '19

14 Jul '19

'Following Canonical's pivot away from its internally-developed Unity user interface and Mir display server, Ubuntu has enjoyed two relatively low-drama years, as the Linux Desktop market homogenized during its transition back to a customized GNOME desktop. In a review of the most recent release, TechRepublic's Jack Wallen declared that "Ubuntu 19.04 should seriously impress anyone looking for a fast and reliable Linux desktop platform." Largely, it's been a slow-and-steady pace for Ubuntu since the pivot from Unity to GNOME, though the distribution made headlines for plans to end support for 32-bit support. This prompted Valve, operators of games marketplace Steam, to re-think its approach toward Ubuntu, which it previously characterized as "as the best-supported path for desktop users." TechRepublic's James Sanders interviewed Will Cooke, director of engineering for Ubuntu Desktop at Canonical, about the distribution's long-term plans for legacy 32-bit support, shipping a desktop in a post-Unity-era Ubuntu, and why Linux should be the first choice for users migrating from Windows 7 prior to the end of support. >From the interview: When we did the switch to GNOME Shell from Unity, we did a survey [asking] people straightforward questions like, "What sort of features do you want to see continue in Ubuntu Desktop?" The answer came through very, very clearly that people liked having the launcher on the left, and they wanted to keep that feature there. They liked having desktop icons and they wanted to keep that feature there. We've made decisions based on data from our user base, from our community. They have provided that feedback and we've done what the majority of people want. Sometimes that doesn't go with the ideals of GNOME design, but we're comfortable with delivering what we see as value on top of GNOME. That's delivering a product which gives people consistency between the old days of Unity 7, and the new days of GNOME Shell. That transition was as easy as possible, everybody had a chance to have a say in it, and the answers were pretty clear. ' -- source: https://linux.slashdot.org/story/19/07/13/0425257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

What's New in Linux 5.2?
by Peter Reutemann 14 Jul '19

14 Jul '19

'Linux 5.2 has been released. This release includes Sound Open Firmware, a project that brings open source firmware to DSP audio devices; open firmware for many Intel products is also included. This release also improves the Pressure Stall Information resource monitoring to make it usable by Android; the mount API has been redesigned with new syscalls; the BFQ I/O scheduler has gained some performance improvements; a new CLONE_PIDFD flag lets clone(2) return pidfs usable by pidfd_send_signal(2); Ext4 has gained support for case-insensitive name lookups; there is also a new device mapper target that simulates a device that has failing sectors and/or read failures; open source drivers for the ARM Mali t4xx and newer 6xx/7xx have been added. Many other new drivers, features and changes can be found in the changelog. But there's more besides supporting "a handful of extra ARM-powered single-board computers," according to CRN: The biggest feature in 5.2 is probably support for Intel's forthcoming Comet Lake architecture, which will power the tenth generation of its Core desktop and mobile CPUs due. The new silicon is due to ship late in 2019 and appear in products early the next year. Linux 5.2 also includes many tweaks that improve its performance on laptops.' -- source: https://linux.slashdot.org/story/19/07/13/0436246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel Patches Two New Security Flaws
by Peter Reutemann 14 Jul '19

14 Jul '19

'This week Intel announced two new patches, according to Tom's Hardware: The flaw in the processor diagnostic tool (CVE-2019-11133) is rated 8.2 out 10 on the CVSS 3.0 scale, making it a high-severity vulnerability. The flaw [found by security researcher Jesse Michael from Eclypsium] "may allow an authenticated user to potentially enable escalation of privilege, information disclosure or denial of service via local access," according to Intel's latest security advisory. Versions of the tool that are older than 4.1.2.24 are affected. The second vulnerability, found by Intel's internal team, is a medium-severity vulnerability in Intel's SSD DC S4500/S4600 series sold to data center customers. The flaw found in the SSD firmware versions older than SCV10150 obtained a 5.3 score on the CVSS 3.0 scale, so it was labeled medium-severity. The bug may allow an unprivileged user to enable privilege escalation via physical access. As one of the flaws was uncovered by Intel itself and for the other the Eclypsium research coordinated with Intel for its disclosure, Intel was able to have ready the patches in time for the public announcement. ' -- source: https://slashdot.org/story/19/07/13/2027223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

PC Sales Are Up--Or Are They?
by Lawrence D'Oliveiro 12 Jul '19

12 Jul '19

Another report highlighting the usual discrepancy in analysis of PC sales between IDC and Gartner <https://arstechnica.com/information-technology/2019/07/gartner-idc-agree-th…>: the difference seems down to the fact that one includes Chromebooks in their definition of a “PC”, while the other one counts Microsoft Surface tablets instead. Obvious conclusion: if it weren’t for Chromebooks, the PC market would be a pretty gloomy place indeed.

1 0

The Most Clever 'Zip Bomb' Ever Made Explodes a 46MB File To 4.5 Petabytes
by Peter Reutemann 11 Jul '19

11 Jul '19

'Programmer and engineer David Fifield has unveiled a brand-new Zip bomb that explodes a 46-megabyte file to 4.5 petabytes of data. Fifield's new type of "Zip bomb" or "compression bomb" is particularly novel because he "figured out how to 'overlap' files inside of a Zip archive, allowing for compression rates far beyond those of a traditional archive," reports Motherboard. From the report: In an email interview, Fifield noted that, while 42.zip (which has a 106 billion-to-one compression ratio and has been hosted on the same single-serving website for at least 15 years) gets much of the attention, he finds later attempts more technically interesting. "eI find 42.zip inspiring on an aesthetic level -- not so much the file itself but the circumstances around it," Fifield said. "It's like folklore. There must have been many examples of the same basic idea, but for whatever reason 42.zip is the one that had staying power." Fifield noted that part of what makes his process possible was by coming up with ways to handle cyclic redundancy checks, or CRCs, a basic error-correction functionality baked into Zip, PNG, Ethernet, and numerous other technical standards. Messing around with CRC -- 32 checksums, as they're called, was where Fifield said he learned the most. Fifield, who will present his findings at the USENIX Workshop on Offensive Technologies (WOOT) conference next month, noted that while the work itself adds to a history of research and likely will be superseded in the future, its benefit from an awareness standpoint is importan' -- source: https://hardware.slashdot.org/story/19/07/10/2341251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linode Democratizes Cloud GPUs: Brings Powerful Nvidia GPUs To Its Linux Cloud
by Peter Reutemann 11 Jul '19

11 Jul '19

'Linode today launched new GPU-optimized cloud computing instances tailored specifically for developers and businesses requiring massive parallel computational power. The new instances are built on NVIDIA Quadro RTX 6000 GPU cards with all three major types of processing cores (CUDA, Tensor, and Real-Time Ray Tracing) available to users. Linode is one of the first cloud providers to deploy NVIDIA's latest GPU architecture. These new GPU instances give scientists, artists, and engineers working on artificial intelligence, graphic visualization, and complex modeling a cost-competitive alternative to hyperscale cloud providers.' -- source: https://linux.slashdot.org/story/19/07/10/1826238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Academics Steal Data From Air-Gapped Systems Via a Keyboard's LEDs
by Peter Reutemann 11 Jul '19

11 Jul '19

'The Caps Lock, Num Lock, and Scroll Lock LEDs on a keyboard can be used to exfiltrate data from a secure air-gapped system, academics from an Israeli university have proved. From a report: The attack, which they named CTRL-ALT-LED, is nothing that regular users should worry about but is a danger for highly secure environments such as government networks that store top-secret documents or enterprise networks dedicated to storing non-public proprietary information. he attack requires some pre-requisites, such as the malicious actor finding a way to infect an air-gapped system with malware beforehand. CTRL-ALT-LED is only an exfiltration method. But once these prerequisites are met, the malware running on a system can make the LEDs of an USB-connected keyboard blink at rapid speeds, using a custom transmission protocol and modulation scheme to encode the transmitted data. A nearby attacker can record these tiny light flickers, which they can decode at a later point, using the same modulation scheme used to encode it.' -- source: https://it.slashdot.org/story/19/07/10/1836232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Samba 4.11 Removes SMB1 File-Sharing Protocol Version By Default
by Peter Reutemann 11 Jul '19

11 Jul '19

'Samba says version 4.11.0 will switch off previously on-by-default support for the aging and easily subverted SMB1 protocol. Slashdot reader Jeremy Allison - Sam shares a report from The Register detailing the new changes: The open-source SMB toolkit's developers say the Samba 4.11 build, currently in preview, will by default set SMB2_02 as the earliest supported version of the Windows file-sharing protocol. Admins will still have the option to allow SMB1 on their servers if they so choose, but support will be turned off by default. The move by Samba to drop SMB1 can be seen as long overdue, given that Microsoft has been moving to get rid of the file-server protocol version from its operating systems for several years now, even before it was revealed to be one of the NSA's favorite weak points to exploit. ' -- source: https://tech.slashdot.org/story/19/07/10/2119238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Contractors Are Secretly Listening To Your Assistant Recordings
by Peter Reutemann 11 Jul '19

11 Jul '19

'A new report from Belgian broadcaster VRT News describes the process by which Google Home recordings end up being listened to by contractors -- and the scary part is that it apparently doesn't take much, if anything, to start a recording. While the recordings are not listened to live, audio clips are sent to subcontractors. The Next Web reports: VRT, with the help of a whistleblower, was able to listen to some of these clips and subsequently heard enough to discern the addresses of several Dutch and Belgian people using Google Home -- in spite of the fact some hadn't even uttered the words "Hey Google," which are supposed to be the device's listening trigger. The person who leaked the recordings was working as a subcontractor to Google, transcribing the audio files for subsequent use in improving its speech recognition. They got in touch with VRT after reading about Amazon Alexa keeping recordings indefinitely. According to the whistleblower, the recordings presented to them are meant to be carefully annotated, with notes included about the speakers presumed identity and age. From the sound of the report, these transcribers have heard just about everything. Personal information? Bedroom activities? Domestic violence? Yes, yes, and yes. While VRT only listened to recordings from Dutch and Belgian users, the platform the whistleblower showed them had recordings from all over the world -- which means there are probably thousands of other contractors listening to Assistant recordings. The VRT report states that the Google Home Terms of Service don't mention that recordings might be listened to by other humans. The report says that the recordings are identified by numbers rather than user names, but VRT "was able to pick up enough data from the recordings to find the addresses of the users in question, and even confront some of the users in the recordings -- to their great dismay," reports The Next Web. What does Google have to say about all this? That they only transcribe and use "about 0.2% of all audio clips" to improve their voice recognition technology.' -- source: https://yro.slashdot.org/story/19/07/10/2153210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Internet group brands Mozilla ‘internet villain’ for supporting DNS privacy feature
by Peter Reutemann 10 Jul '19

10 Jul '19

'An industry group of internet service providers has branded Firefox browser maker Mozilla an “internet villain” for supporting a DNS security standard. The U.K.’s Internet Services Providers’ Association (ISPA), the trade group for U.K. internet service providers, nominated the browser maker for its proposed effort to roll out the security feature, which they say will allow users to “bypass UK filtering obligations and parental controls, undermining internet safety standards in the UK.” Mozilla said late last year it was planning to test DNS-over-HTTPS to a small number of users.' -- source: https://techcrunch.com/2019/07/05/isp-group-mozilla-internet-villain-dns-pr… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Skype Snap App Remains Hopelessly Outdated
by Peter Reutemann 10 Jul '19

10 Jul '19

'The official Skype Snap app for Linux has not been updated in nearly six months, and Microsoft is yet to say why. When introducing the cross-distro build in early 2018, the company said the Skype Snap app would give it the "... ability to push the latest features straight to our users, no matter which device or distribution they happen to use." Clearly, not. Because at the time of writing this post the Skype Snap app sits on version 8.34.0.78, which the Snapcraft store reports was 'last updated' in November 2018. However, the "regular" Linux version available to download from the Skype website is on version 8.47.0.73, released June 2019.' -- source: https://linux.slashdot.org/story/19/07/09/2014250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0