July 2019 - wlug - list.wlug.org.nz

IBM Closes Its $34 Billion Acquisition of Red Hat
by Peter Reutemann 09 Jul '19

09 Jul '19

'IBM closed its $34 billion acquisition of Red Hat, the companies announced Tuesday. From a report: The deal was originally announced in October, when the companies said IBM would buy all shares in Red Hat for $190 each in cash. The acquisition of Red Hat, an open-source, enterprise software maker, marks the close of IBM's largest deal ever. It's one of the biggest in U.S. tech history. Excluding the AOL-Time Warner merger, it follows the $67 billion deal between Dell and EMC in 2016 and JDS Uniphase's $41 billion acquisition of optical-component supplier SDL in 2000. Under the deal, Red Hat will now be a unit of IBM's hybrid cloud division, according to the original announcement. The companies said Red Hat's CEO, Jim Whitehurst, would join IBM's senior management team and report to CEO Ginni Rometty. IBM previously said it hoped its acquisition of Red Hat will help it do more work in the cloud, one of its four key growth drivers, which are also social, mobile and analytics. The company lags behind Amazon and Microsoft in the cloud infrastructure business. IBM has seen three consecutive quarters of declining year-over-year revenue. But some analysts are hopeful about the Red Hat deal's opportunity to bring in new business.' -- source: https://linux.slashdot.org/story/19/07/09/1740223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Logitech Wireless USB Dongles Vulnerable To New Hijacking Flaws
by Peter Reutemann 09 Jul '19

09 Jul '19

'A security researcher has publicly disclosed new vulnerabilities in the USB dongles (receivers) used by Logitech wireless keyboards, mice, and presentation clickers. New submitter raikoseagle shares a report: The vulnerabilities allow attackers to sniff on keyboard traffic, but also inject keystrokes (even into dongles not connected to a wireless keyboard) and take over the computer to which a dongle has been connected. When encryption is used to protect the connection between the dongle and its paired device, the vulnerabilities also allow attackers to recover the encryption key. Furthermore, if the USB dongle uses a "key blacklist" to prevent the paired device from injecting keystrokes, the vulnerabilities allow the bypassing of this security protection system. Marcus Mengs, the researcher who discovered these vulnerabilities, said he notified Logitech about his findings, and the vendor plans to patch some of the reported issues, but not all.' -- source: https://it.slashdot.org/story/19/07/09/182246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi Admits To Faulty USB-C Design On the Pi 4
by Peter Reutemann 09 Jul '19

09 Jul '19

'The Raspberry Pi 4 was announced two weeks ago as a major new upgrade to the line of cheap single-board hobbyist computers. The Pi 4 featured a faster CPU, options for up to 4GB of RAM, and a new, modern USB-C port for power delivery. The Pi 4 was the Raspberry Pi Foundation's first ever USB-C device, and, well, they screwed it up. As detailed by Tyler Ward, the Raspberry Pi 4 has a non-compliant USB-C charging port and doesn't work with as many chargers as it should. Thanks to the open nature of Raspberry Pi (even the schematics are online!), Ward was able to discover that Raspberry Pi just didn't design its USB-C port correctly. Two "CC" pins on a USB-C port are supposed to each get their own 5.1K ohms resistor, but Raspberry Pi came up with its own circuit design that allows them to share a single resistor. This is not a compliant design and breaks compatibility with some of the more powerful USB-C chargers out there. Whether your USB-C charger works with the Pi 4 has to do with whether it uses an "e-marked" cable. E-marked cables are fully featured USB-C cables with chips inside that negotiate power management, accessory modes, data rates, and other communication specs. Since the Pi 4 USB-C port is wired incorrectly, these smart cables will detect the Pi 4 as an "Audio Adaptor Accessory" and refuse to charge them. Usually, e-marked cables are more expensive and come with larger, higher-powered items, like a USB-C laptop. After reports started popping up on the Internet, Raspberry Pi cofounder Eben Upton admitted to TechRepublic that "A smart charger with an e-marked cable will incorrectly identify the Raspberry Pi 4 as an audio adapter accessory and refuse to provide power." Upton went on to say, "I expect this will be fixed in a future board revision, but for now users will need to apply one of the suggested workarounds. It's surprising this didn't show up in our (quite extensive) field testing program."' -- source: https://hardware.slashdot.org/story/19/07/09/1934205 I'll stick with my RPi3 for the time being... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Blocks UAE Bid To Become an Internet Security Guardian After Hacking Reports
by Peter Reutemann 09 Jul '19

09 Jul '19

'Firefox browser maker Mozilla is blocking the United Arab Emirates' government from serving as one of its internet security gatekeepers, citing Reuters reports on a UAE cyber espionage program. From a report: Mozilla said in a statement on Tuesday it was rejecting the UAE's bid to become a globally recognized internet security watchdog, empowered to certify the safety of websites for Firefox users. Mozilla said it made the decision because cybersecurity firm DarkMatter would have administered the gatekeeper role and it had been linked by Reuters and other reports to a state-run hacking program. Reuters reported in January that Abu Dhabi-based DarkMatter provided staff for a secret hacking operation, codenamed Project Raven, on behalf of an Emirati intelligence agency. The unit was largely comprised of former U.S. intelligence officials who conducted offensive cyber operations for the UAE government. Former Raven operatives told Reuters that many DarkMatter executives were unaware of the secretive program, which operated from a converted Abu Dhabi mansion away from DarkMatter's headquarters.' -- source: https://tech.slashdot.org/story/19/07/09/1945241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 68 Arrives With Darker Reader View, Recommended Extensions, and IT Customizations
by Peter Reutemann 09 Jul '19

09 Jul '19

'Mozilla today launched Firefox 68 for Windows, Mac, Linux, Android, and iOS. Firefox 68 includes a darker reader view, recommended extensions, IT Pro customizations, and more. From a report: As part of this release, Mozilla has curated a list of recommended extensions "that have been thoroughly reviewed for security, usability, and usefulness." You can find the list on the Get Add-ons page in the Firefox Add-ons Manager (about:addons). While Firefox has had dark mode for months, the Reader View's dark contrast only covered the text area. Now, when you change the contrast to dark, all sections of the site (including sidebars and toolbars) will be immersed in dark mode. With Firefox 60, Mozilla introduced an enterprise version of the browser that employers can customize. This let IT professionals configure Firefox for their organization, either using Group Policy on Windows or a JSON file that works across Windows, Mac, and Linux. With Firefox 68, Mozilla has added more enterprise policies -- to configure or remove the new tab page, turn off search suggestions, and so on.' -- source: https://news.slashdot.org/story/19/07/09/1959238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

After 25 Months, Debian 10 'buster' Released
by Peter Reutemann 07 Jul '19

07 Jul '19

'"After 25 months of development the Debian project is proud to present its new stable version 10 (code name 'buster'), which will be supported for the next 5 years thanks to the combined work of the Debian Security team and of the Debian Long Term Support team." In this release, GNOME defaults to using the Wayland display server instead of Xorg. Wayland has a simpler and more modern design, which has advantages for security. However, the Xorg display server is still installed by default and the default display manager allows users to choose Xorg as the display server for their next session. Thanks to the Reproducible Builds project, over 91% of the source packages included in Debian 10 will build bit-for-bit identical binary packages. This is an important verification feature which protects users against malicious attempts to tamper with compilers and build networks. Future Debian releases will include tools and metadata so that end-users can validate the provenance of packages within the archive. For those in security-sensitive environments AppArmor, a mandatory access control framework for restricting programs' capabilities, is installed and enabled by default. Furthermore, all methods provided by APT (except cdrom, gpgv, and rsh) can optionally make use of "seccomp-BPF" sandboxing. The https method for APT is included in the apt package and does not need to be installed separately... Secure Boot support is included in this release for amd64, i386 and arm64 architectures and should work out of the box on most Secure Boot-enabled machines. The announcement touts Debian's "traditional wide architecture support," arguing that it shows Debian "once again stays true to its goal of being the universal operating system." It ships with several desktop applications and environments, including the following: - Cinnamon 3.8 - GNOME 3.30 - KDE Plasma 5.14 - LXDE 0.99.2 - LXQt 0.14 - MATE 1.20 - Xfce 4.12 "If you simply want to try Debian 10 'buster' without installing it, you can use one of the available live images which load and run the complete operating system in a read-only state via your computer's memory... Should you enjoy the operating system you have the option of installing from the live image onto your computer's hard disk."' -- source: https://linux.slashdot.org/story/19/07/07/0426205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

This Week On GitHub
by Lawrence D'Oliveiro 07 Jul '19

07 Jul '19

Just some random things I found: * BOOTSTRA.386 <https://github.com/kristopolous/BOOTSTRA.386> -- a Bootstrap theme to make your website look like a text display from the 1980s. Does require JavaScript. * GitHarvester <https://github.com/metac0rtex/GitHarvester> -- scans through GitHub repos for wp-config.php files that people might have “accidentally” published. Those familiar with WordPress may realize that this file can contain such sensitive things username and password information for connecting to a MySQL database. * Arduino-TV-B-Gone <https://github.com/shirriff/Arduino-TV-B-Gone>. TV-B-Gone was intended as a universal remote that could switch off any TV. This project implements the same thing on an Arduino. And they wonder why we can’t have nice things ...

1 0

Privacy-First Browsers Look To Take the Shine Off Google's Chrome
by Peter Reutemann 06 Jul '19

06 Jul '19

'Google's Chrome now reigns as the biggest browser on the block, and the company is facing challenges similar to Microsoft's from competitors, as well as government scrutiny. But Google faces a new wrinkle -- a growing realization among consumers that their every digital move is tracked. "I think Cambridge Analytica acted as a catalyst to get people aware that their data could be used in ways they didn't expect," said Peter Dolanjski, the product lead for Mozilla's Firefox web browser, referring to the scandal in which a political consulting firm obtained data on millions of Facebook users and their friends. And in something of a poetic role reversal, Microsoft is positioning itself to pick up the slack from people who may be fed up with Google's Chrome browser and its questionable privacy practices. Microsoft is expected to release an overhaul of its latest browser, called Edge, in the coming months. Microsoft is just one of a number of companies and organizations looking to take a piece out of Google -- some using the company's own open-source software. One name that might be familiar to most consumers -- Mozilla's Firefox browser -- is also a veteran of the "browser wars" of two decades ago. The nonprofit Mozilla, which has been biting at the heels of leading browsers for most of its existence, is introducing more aggressive privacy settings to try to stand out and take advantage of the privacy stumbles by Google and other tech giants.' -- source: https://news.slashdot.org/story/19/07/05/152233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Maintains a List of Everything You Ever Bought Using Gmail, Even if You Delete All Your Emails
by Peter Reutemann 06 Jul '19

06 Jul '19

'In May, I wrote up something weird I spotted on Google's account management page. I noticed that Google uses Gmail to store a list of everything you've purchased, if you used Gmail or your Gmail address in any part of the transaction. If you have a confirmation for a prescription you picked up at a pharmacy that went into your Gmail account, Google logs it. If you have a receipt from Macy's, Google keeps it. If you bought food for delivery and the receipt went to your Gmail, Google stores that, too. You get the idea, and you can see your own purchase history by going to Google's Purchases page. Google says it does this so you can use Google Assistant to track packages or reorder things, even if that's not an option for some purchases that aren't mailed or wouldn't be reordered, like something you bought at a store. At the time of my original story, Google said users can delete everything by tapping into a purchase and removing the Gmail. It seemed to work if you did this for each purchase, one by one. This isn't easy -- for years worth of purchases, this would take hours or even days of time. So, since Google doesn't let you bulk-delete this purchases list, I decided to delete everything in my Gmail inbox. That meant removing every last message I've sent or received since I opened my Gmail account more than a decade ago. Despite Google's assurances, it didn't work.' -- source: https://tech.slashdot.org/story/19/07/05/1728200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fake Samsung Firmware Update App Tricks More Than 10 Million Android Users
by Peter Reutemann 06 Jul '19

06 Jul '19

'Over ten million users have been duped in installing a fake Samsung app named "Updates for Samsung" that promises firmware updates, but, in reality, redirects users to an ad-filled website and charges for firmware downloads. From a report: "I have contacted the Google Play Store and asked them to consider removing this app," Aleksejs Kuprins, malware analyst at the CSIS Security Group, told ZDNet this week in an interview, after publishing a report on the app's shady behavior earlier today. The app takes advantage of the difficulty in getting firmware and operating system updates for Samsung phones, hence the high number of users who have installed it. "It would be wrong to judge people for mistakenly going to the official application store for the firmware updates after buying a new Android device," the security researcher said. "Vendors frequently bundle their Android OS builds with an intimidating number of software, and it can easily get confusing."' -- source: https://tech.slashdot.org/story/19/07/05/1456200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Set To Offer Ad-Free News Consumption Capability on Firefox For $5 Per Month
by Peter Reutemann 06 Jul '19

06 Jul '19

'As previously announced, Mozilla has started to tease the launch of a new $5 monthly subscription to a variety of online news publishers that involves no ads. The idea is that a single, low subscription fee gives you access to a number of sites with the ads removed. From a report: You pay a monthly fee to Mozilla, and this money is shared with its partners to help fund an ad-free internet experience. More than this, Mozilla says that the subscription fee will also grant access to audio versions of articles, article synchronization and more. In a page which promises people the chance to "support the sites you love, avoid the ads you hate", Mozilla says: "We've partnered with some of the world's greatest publishers to bring you a better journalism experience. We share your payment directly with the sites you read. They make more money which means they can bring you great content without needing to distract you with ads just to keep the lights on.' -- source: https://news.slashdot.org/story/19/07/05/1712247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Almost a Third of World's Top VPNs Are Secretly Owned By Chinese Firms, Study Finds
by Peter Reutemann 06 Jul '19

06 Jul '19

'Almost a third (30%) of the world's top virtual private network (VPN) providers are secretly owned by six Chinese companies, according to a study by privacy and security research firm VPNpro. The study shows that the top 97 VPNs are run by just 23 parent companies, many of which are based in countries with lax privacy laws. Six of these companies are based in China and collectively offer 29 VPN services, but in many cases, information on the parent company is hidden to consumers. Researchers at VPNpro have pieced together ownership information through company listings, geolocation data, the CVs of employees and other documentation. In some instances, ownership of different VPNs is split amongst a number of subsidiaries. For example, Chinese company Innovative Connecting owns three separate businesses that produce VPN apps: Autumn Breeze 2018, Lemon Cove and All Connected. In total, Innovative Connecting produces 10 seemingly unconnected VPN products, the study shows. Although the ownership of a number of VPN services by one company is not unusual, VPNpro is concerned that so many are based in countries with lax or non-existence privacy laws. ' -- source: https://tech.slashdot.org/story/19/07/05/1944235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Tor Project To Fix Bug Used For DDoS Attacks On Onion Sites For Years
by Peter Reutemann 06 Jul '19

06 Jul '19

'"The Tor Project is preparing a fix for a bug that has been abused for the past years to launch DDoS attacks against dark web (.onion) websites," reports ZDNet. "Barring any unforeseen problems, the fix is scheduled for the upcoming Tor protocol 0.4.2 release." The bug has been known to Tor developers for years, and has been used to launch Slow Loris-like attacks on the web servers that run the Tor service supporting an .onion site. It works by opening many connections to the server and maxing out the CPU. Since Tor connections are CPU intensive because of the cryptography involved to support the privacy and anonymity of the network, even a a few hundreds connections are enough to bring down dark web portals. A tool to exploit the bug and to automate DDoS attacks has been around for four years, and has been used by hackers to extort dark web marketplaces all spring. At least two markets selling illegal products have shut down after refusing to pay attackers. To get the bug fixed, members of a dark web forum banded together and donated to the Tor Project to sponsor the bug's patch.' -- source: https://it.slashdot.org/story/19/07/05/208230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Apologizes To Andrew Little Over Botched Name Suppression
by Lawrence D'Oliveiro 05 Jul '19

05 Jul '19

Whaddaya know, sometimes it is possible to get a response from a human at a powerful, faceless megacorporation that doesn’t feel it has to abide by your country’s laws <https://www.newshub.co.nz/home/politics/2019/07/google-apologises-to-andrew…>. However, the remedy involves turning off a service completely: “In light of the concerns you expressed this week, Google has… suspended Google Trends emails about searches trending in New Zealand.” Be careful what you wish for?

1 0

Interview With PINE64 On the Upcoming Release of the PineBook Pro
by Peter Reutemann 05 Jul '19

05 Jul '19

'One of the consequences of the explosive popularity of the Raspberry Pi is the flourishing of competing ecosystems of single-board computers (SBCs). Aside from the accessibility a $35 price tag offers, the foremost benefit of the Raspberry Pi is the community -- the proliferation of projects and integrations that center around the Raspberry Pi, and the ease-of-use that creates, makes competing products that look better on spec sheets a disappointment when taken out of the box. PINE64 has attempted to head this off by fostering an involved community; the PINE64 website explains their philosophy as "the community gets to actively shape the devices, as well as the social platform, of PINE64 from the ground up. The goal is to deliver ARM64 devices that you really wish to engage with and a platform that you want to be a part of." The first-generation Pinebook was available in an 11.6" or 14" configuration, with a quad-core Allwinner A64, 2GB RAM, 16GB eMMC, and 1366x768 display for $99, beating Nicolas Negroponte's OLPC XO-1, a decade after that project sputtered. PINE64 is differentiating itself by building not just SBCs, but notebooks, tablets, and phones with community input and feedback. Ahead of the release of the Pinebook Pro this summer, a Rockchip RK3399-based ARM laptop with 4GB LPDDR4 RAM, 64GB eMMC, and a 14" 1080p display, TechRepublic interviewed PINE64 community manager Lukasz Erecinski about the Pinebook Pro, and the PINE64 community philosophy. An excerpt from the interview: TechRepublic: Why is Pine64 building a device ecosystem of not just SBCs, but also finished devices, like tablets, laptops, and phones? Lukasz Erecinski: While SBCs are and will remain our bread and butter, there is no denying that our vision for PINE64 has expanded beyond the SBC market. The core aim of our project remains the same however -- to foster a community and bring affordable ARM64 devices to developers and end-users. You have correctly identified that we are building eco-systems; that is to say, we strive for convergence between our SBCs and other ARM64 devices we manufacture. In result, when evaluating future SOCs, we're not only considering if they'll make for good SBCs but also laptops, modules, tablets, etc. As time progresses, you will see more and more of this type of convergence across devices from us. Allwinner A64 and Rockchip RK3399 are two examples of what we strive for: the Pine64-LTS, the SOPine, Pinebook, PineTab and PinePhone all share the Allwinner A64, whilst the RockPro64, Pinebook Pro and SORock (upcoming module akin to the SOPine) use the Rockchip RK3399.' -- source: https://hardware.slashdot.org/story/19/07/05/0045229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

YouTube Bans Content 'Showing Users How To Bypass Secure Computer Systems'
by Peter Reutemann 04 Jul '19

04 Jul '19

'Kody Kinzie from the Null Byte YouTube channel on Tuesday said YouTube banned a video he made about launching fireworks over Wi-Fi for the 4th of July. According to YouTube's Community Guidelines, you are not allowed to post content "showing users how to bypass secure computer systems or steal user credentials and personal data." Doing so will apparently result in a strike. The Register notes that this written policy "first appears in the Internet Wayback Machine's archive of web history in an April 5, 2019 snapshot." "I'm worried for everyone that teaches about infosec and tries to fill in the gaps for people who are learning," Kinzie said on Twitter. "It is hard, often boring, and expensive to learn cybersecurity." Security professionals like Tim Erlin, VP of product management and strategy at cybersecurity biz Tripwire, also finds the policy questionable. "Google's intention here might be laudable, but the result is likely to stifle valuable information sharing in the information security community," he said. "In cybersecurity, we improve our defenses by understanding how attacks actually work. Theoretical explanations are often not the most effective tools, and forcing content creators onto platforms restricted in distribution, like a paid training course, simply creates roadblocks to the industry. Sharing real world examples brings more people to the industry, rather than creating more criminals." ' -- source: https://news.slashdot.org/story/19/07/03/2121250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Android Q(&A): Android Engineers take us on a deep dive of Android Q
by Peter Reutemann 04 Jul '19

04 Jul '19

'As has become tradition for Ars at Google I/O, we recently sat down with some of the people who make Android to learn more about Google's latest OS. For 2019, the talk was all about Android Q and this year's big engineering effort, Project Mainline. Mainline's goal is to enable Google (and sometimes OEMs!) to directly update core parts of the OS without pushing out a whole system update. If that sounds technical and challenging, well, it is. This year running the Ars Android Interview Gauntlet we have veteran interviewee Dave Burke, VP of engineering for Android. As the head of Team Android, Burke is an encyclopedia of Android knowledge and always manages to come up with insightful answers to my grab bag of esoteric questions. And returning for the second year in a row is Iliyan Malchev, principal engineer at Android, the lead of Project Treble, and all-around Linux integration guru.' -- source: https://arstechnica.com/gadgets/2019/07/android-qa-android-engineers-take-u… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Amazon confirms it keeps your Alexa recordings basically forever
by Peter Reutemann 04 Jul '19

04 Jul '19

'If you (like so many of us) hate listening to recordings of your own voice, you may be in for an unpleasant future, as Amazon has confirmed it hangs on to every conversation you've ever had with an Alexa-enabled device until or unless you specifically delete them. That confirmation comes as a response to a list of questions Sen. Chris Coons (D-Delaware) sent to Amazon CEO Jeff Bezos in May expressing "concerns" about how Amazon uses and retains customers' Alexa voice assistant data. Amazon's response to Coons, as first reported by CNET, confirms that the company keeps your data as long as it wants unless you deliberately specify otherwise. "We retain customers' voice recordings and transcripts until the customer chooses to delete them," Amazon said—but even then there are exceptions.' -- source: https://arstechnica.com/tech-policy/2019/07/amazon-confirms-it-keeps-your-a… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Someone Is Spamming and Breaking a Core Component of PGP's Ecosystem
by Peter Reutemann 04 Jul '19

04 Jul '19

'A new wave of spamming attacks on a core component of PGP's ecosystem has highlighted a fundamental weakness in the whole ecosystem. From a report: Unknown attackers are spamming a core component of the ecosystem of the well-known encryption software PGP, breaking users' PGP installations and clients. What's worse, there may be no way to stop them. Last week, contributors to the PGP protocol GnuPG noticed that someone was "poisoning" or "flooding" their certificates. In this case, poisoning refers to an attack where someone spams a certificate with a large number of signatures or certifications. This makes it impossible for the the PGP software that people use to verify its authenticity, which can make the software unusable or break. In practice, according to one of the GnuPG developers targeted by this attack, the hackers could make it impossible for people using Linux to download updates, which are verified via PGP.' -- source: https://it.slashdot.org/story/19/07/03/2048235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

File-Storage App 4shared Caught Serving Invisible Ads and Making Purchases Without Consent
by Peter Reutemann 03 Jul '19

03 Jul '19

'With more than 100 million installs, file-sharing service 4shared is one of the most popular apps in the Android app store. But security researchers say the app is secretly displaying invisible ads and subscribes users to paid services, racking up charges without the user's knowledge -- or their permission -- collectively costing millions of dollars. From a report: "It all happens in the background... nothing appears on the screen," said Guy Krief, chief executive of London-based Upstream, which shared its research exclusively with TechCrunch. The researchers say the app contains suspicious third-party code that allowed the app to automate clicks and make fraudulent purchases. They said the component, built by Hong Kong-based Elephant Data, downloads code which is "directly responsible" for generating the automated clicks without the user's knowledge. The code also sets a cookie to determine if a device has previously been used to make a purchase, likely as a way to hide the activity.' -- source: https://it.slashdot.org/story/19/07/03/1738253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

D-Link To Undergo Security Audits For 10 Years as Part of FTC Settlement
by Peter Reutemann 03 Jul '19

03 Jul '19

'D-Link has agreed to a settlement with the US Federal Trade Commission in regards to a 2017 lawsuit in which the US government agency accused the Taiwanese hardware maker of misrepresenting the security of its devices and ignoring vulnerability reports. From a report: As part of the settlement, D-Link has promised to implement a new software security program for its routers and Internet-connected cameras. The company has also agreed to subject itself to ten years of biennial security audits from a third-party, independent auditor. The FTC gets to choose the auditor, while D-Link got to decide the certifications the auditor must obtain before allowing it to review its security program.' -- source: https://news.slashdot.org/story/19/07/03/1926220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Earth Ported To Browsers With WebAssembly
by Peter Reutemann 03 Jul '19

03 Jul '19

'The Google Earth team recently released a beta preview of a WebAssembly port of Google Earth. The new port runs in Chrome and other Chromium-based browsers, including Edge (Canary version) and Opera, as well as Firefox. From a report: The port thus brings cross-browser support to the existing Earth For Web version, which uses the native C++ codebase and Chrome's Native Client (NaCl) technology. Difference in multi-threading support between browsers leads to varying performance. Google Earth was released 14 years ago and allowed users to explore the earth through the comfort of their home. This original version of Google Earth was released as a native C++ based application intended for desktop install because rendering the whole world in real time required advanced technologies that weren't available in the browser. Google Earth was subsequently introduced for Android and iOS smartphones, leveraging the existing C++ codebase through technologies such as NDK and Objective-C++. In 2017, Google Earth was released for the Chrome browser, using Google's Native Client (NaCl) to compile the C++ code and run it in the browser.' -- source: https://tech.slashdot.org/story/19/07/02/1919251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mageia 7 Linux Distro Released
by Peter Reutemann 03 Jul '19

03 Jul '19

'If you're looking to try out a Linux distro that is not based on Ubuntu, Mageia 7 might be worth your consideration. It arrives two years after the release of Mageia 6 -- so unsurprisingly, the changelog is fairly long. The Mageia developers share the significant packages that have been updated below. Significant package updates include: kernel 5.1.14, rpm 4.14.2, dnf 4.2.6, Mesa 19.1, Plasma 5.15.4, GNOME 3.32, Xfce 4.14pre, Firefox 67, Chromium 73, and LibreOffice 6.2.3. Donald Stewart, Mageia developer, adds: There are lots of new features, exciting updates, and new versions of your favorite programs, as well as support for very recent hardware. There are classical installer images for both 32-bit and 64-bit architectures, as well as live DVDs for 64-bit Plasma, GNOME, Xfce, and 32-bit Xfce.' -- source: https://tech.slashdot.org/story/19/07/02/201232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google's Robots.txt Parser is Now Open Source
by Peter Reutemann 02 Jul '19

02 Jul '19

'For 25 years, the Robots Exclusion Protocol (REP) was only a de-facto standard. This had frustrating implications sometimes. On one hand, for webmasters, it meant uncertainty in corner cases, like when their text editor included BOM characters in their robots.txt files. On the other hand, for crawler and tool developers, it also brought uncertainty; for example, how should they deal with robots.txt files that are hundreds of megabytes large? Today, we announced that we're spearheading the effort to make the REP an internet standard. While this is an important step, it means extra work for developers who parse robots.txt files. We're here to help: we open sourced the C++ library that our production systems use for parsing and matching rules in robots.txt files. This library has been around for 20 years and it contains pieces of code that were written in the 90's. Since then, the library evolved; we learned a lot about how webmasters write robots.txt files and corner cases that we had to cover for, and added what we learned over the years also to the internet draft when it made sense.' -- source: https://search.slashdot.org/story/19/07/01/153253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Nostalgia At Glastonbury ...
by Lawrence D'Oliveiro 02 Jul '19

02 Jul '19

>From <https://www.theregister.co.uk/2019/07/01/microsoft_round_up/>, another sighting of Windows XP in mission-critical use: Unfortunate songstress Neneh Cherry was warbling through her set when the veteran OS finally gave up the ghost. Alas, XP was dealing with the stage back projection, meaning that the audience lurched from being vaguely surprised to learn that Cherry was still around to the horrifying realisation that so was XP.

1 0