January 2020 - wlug - list.wlug.org.nz

Opera Accused of Offering Predatory Loans Through Android apps
by Peter Reutemann 21 Jan '20

21 Jan '20

'"It's no secret that Opera isn't doing so well in the era of Chrome dominance," reports Android Police. "According to a report published by Hindenburg Research, the company's losses in browser revenue have apparently led it to create multiple loan apps with short payment windows and interest rates of ~365-876%, which are in violation of new Play Store rules Google enacted last year." The apps are aimed at India, Kenya and Nigeria, reports Engadget: The apps would claim to offer maximum annual percentage rate (APR) of 33 percent or less, but the actual rates were much higher, climbing to 438 percent in the case of OPesa. And while they publicly offered reasonable loan terms of 91 to 365 days, the real length was no more than 29 days (for OKash) and more often 15 days -- well under Google's 60-day minimum. The conditions only got worse for borrowers who missed their payments. Falling short by just a day could raise the APR as high as 876 percent. Also, the apps reportedly scraped phone contacts to harass family, friends and others with calls and texts in hopes this would pressure customers into paying up. These same notices often threatened legal action. Android Police points out that Opera became a public company in mid-2017, shortly after it was purchased by a China-based investor group. But since then, "Opera's market share has continued to fall, due to the increasing dominance of Chrome.' -- source: https://slashdot.org/story/20/01/20/0329242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday
by Peter Reutemann 20 Jan '20

20 Jan '20

Hi everyone We have a meeting schedule for *next* Monday (a week earlier than usual due to Auckland Anniversary holiday): 'Is your Android phone no longer supported by your manufacturer? Then you might able to update it using a custom ROM from LineageOS (https://wiki.lineageos.org/devices/) or AospExtended ROM (https://www.aospextended.com/devices/pie) Peter Reutemann will show the process of updating the ROM on an Android phone.' Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/266791984 https://gettogether.community/events/3274/wlug-meeting/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Researchers find serious flaws in WordPress plugins used on 400k sites
by Peter Reutemann 20 Jan '20

20 Jan '20

'Serious vulnerabilities have recently come to light in three WordPress plugins that have been installed on a combined 400,000 websites, researchers said. InfiniteWP, WP Time Capsule, and WP Database Reset are all affected. The highest-impact flaw is an authentication bypass vulnerability in the InfiniteWP Client, a plugin installed on more than 300,000 websites. It allows administrators to manage multiple websites from a single server. The flaw lets anyone log in to an administrative account with no credentials at all. From there, attackers can delete contents, add new accounts, and carry out a wide range of other malicious tasks.' -- source: https://arstechnica.com/information-technology/2020/01/researchers-find-ser… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Another Project Goes Private: Amara Stops Being Developed As Open Source
by Peter Reutemann 20 Jan '20

20 Jan '20

'Slashdot reader northar writes: Subtitling project Amara closes its repository as focus is shifting... Amara was AGPL up until going private. While future improvements to the code base from the Participatory Culture Foundation (PCF) will not be public, a copy of the last public code base has been preserved at Gitlab, should anyone be interested in the work done up until now. Note that no support is given from PCF for this code >From Amara's official statement on the move: The Participatory Culture Foundation began as a nonprofit in 2006 with a focus on creating open source software to ensure that emerging video technologies were accessible to all.... For an organization like PCF, which relies on revenue generated from sustainability initiatives to fund social impact work, we believe the risk to these initiatives outweighs the potential or perceived public benefit from maintaining open code. Releasing software as open source unfortunately does not provide protection against well-funded technology firms that are driven by profit... Without the proper market position and resources, a smaller organization that relies on revenue from software they build can be outmaneuvered or overpowered with the very technology they created (assuming their code is open source). This is not only a threat to smaller organizations, but has also become a bigger debate that much larger companies are also hashing out. For venture-funded or publicly traded firms, the open source approach can be a calculated risk that makes business sense. But for less-capitalized organizations or nonprofits, like PCF, who lack significant market power, making software open source puts other more well-resourced players in position to leverage the technology in ways that may undermine the sustainability and/or the values of the original developer. With these shifts in the computing landscape, PCF has not seen individuals or communities as the primary beneficiary of releasing Amara code as open source. Instead, we have unfortunately had firsthand experience with a venture-funded organization deploying code we created and using it in ways that we did not think aligned well with our values.... As we undertake this shift in 2020, we are aware that the computing landscape will continue to change and thus we remain open to newer and better strategies for making source code available in the long-term. Future strategies might include data trusts and/or new licenses that better align with our sustainability initiatives and mission.' -- source: https://news.slashdot.org/story/20/01/18/1753246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Are Software Designers Ignoring The Needs of the Elderly?
by Peter Reutemann 20 Jan '20

20 Jan '20

'"[A]t the very time that it's become increasingly difficult for anyone to conduct their day to day lives without using the Net, some categories of people are increasingly being treated badly by many software designers," argues long-time Slashdot reader Lauren Weinstein: The victims of these attitudes include various special needs groups — visually and/or motor impaired are just two examples — but the elderly are a particular target. Working routinely with extremely elderly persons who are very active Internet users (including in their upper 90s!), I'm particularly sensitive to the difficulties that they face keeping their Net lifelines going. Often they're working on very old computers, without the resources (financial or human) to permit them to upgrade. They may still be running very old, admittedly risky OS versions and old browsers — Windows 7 is going to be used by many for years to come, despite hitting its official "end of life" for updates a few days ago. Yet these elderly users are increasingly dependent on the Net to pay bills (more and more firms are making alternatives increasingly difficult and in some cases expensive), to stay in touch with friends and loved ones, and for many of the other routine purposes for which all of us now routinely depend on these technologies.... There's an aspect of this that is even worse. It's attitudes! It's the attitudes of many software designers that suggest they apparently really don't care about this class of users much — or at all. They design interfaces that are difficult for these users to navigate. Or in extreme cases, they simply drop support for many of these users entirely, by eliminating functionality that permits their old systems and old browsers to function. He cites the example of Discourse, the open source internet forum software, which recently announced they'd stop supporting Internet Explorer. Weinstein himself hates Microsoft's browser, "Yet what of the users who don't understand how to upgrade? Who don't have anyone to help them upgrade? Are we to tell them that they matter not at all?" So he confronted Stack Exchange co-founder Jeff Atwood (who is also one of the co-founders of Discourse) on Twitter — and eventually found himself blocked. "Far more important though than this particular case is the attitude being expressed by so many in the software community, an attitude that suggests that many highly capable software engineers don't really appreciate these users and the kinds of problems that many of these users may have, that can prevent them from making even relatively simple changes or upgrades to their systems — which they need to keep using as much as anyone — in the real world."' -- source: https://developers.slashdot.org/story/20/01/19/0255220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Telnet Passwords Leaked For More Than 500,000 Servers, Routers, and IoT Devices
by Peter Reutemann 20 Jan '20

20 Jan '20

'ZDNet is reporting on a security breach leaking "a massive list of Telnet credentials for more than 515,000 servers, home routers, and IoT (Internet of Things) 'smart' devices." The list, which was published on a popular hacking forum, includes each device's IP address, along with a username and password for the Telnet service, a remote access protocol that can be used to control devices over the internet... Some devices were located on the networks of known internet service providers (indicating they were either home router or IoT devices), but other devices were located on the networks of major cloud service providers... According to experts to who ZDNet spoke this week, and a statement from the leaker himself, the list was compiled by scanning the entire internet for devices that were exposing their Telnet port. The hacker then tried using (1) factory-set default usernames and passwords, or (2) custom, but easy-to-guess password combinations.... To our knowledge, this marks the biggest leak of Telnet passwords known to date. As ZDNet understands, the list was published online by the maintainer of a DDoS-for-hire (DDoS booter) service... When asked why he published such a massive list of "bots," the leaker said he upgraded his DDoS service from working on top of IoT botnets to a new model that relies on renting high-output servers from cloud service providers.' -- source: https://it.slashdot.org/story/20/01/19/1649234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Why Did Red Hat Drop Its Support for Docker's Runtime Engine?
by Peter Reutemann 19 Jan '20

19 Jan '20

'"I've grown quite fond of the docker container runtime. It's easy to install and use, and many of the technologies I write about depend upon this software," writes TechRepublic/Linux.com contributor Jack Wallen. "But Red Hat has other plans." The company decided -- seemingly out of the blue -- to drop support for the docker runtime engine. In place of docker came Podman. When trying to ascertain why Red Hat split with Docker, nothing came clear. Sure, I could easily draw the conclusion that Red Hat had grown tired of the security issues surrounding Docker and wanted to take matters in their own hands. There was also Red Hat's issue with "no big fat daemons." If that's the case, how do they justify their stance on systemd? Here's where my tinfoil hat comes into play. Understand this is pure conjecture here and I have zero facts to back these claims up... Red Hat is now owned by IBM. IBM was desperate to gain serious traction within the cloud. To do that, IBM needed Red Hat, so they purchased the company. Next, IBM had to score a bit of vendor lock-in. Using a tool like docker wouldn't give them that lock-in. However, if Red Hat developed and depended on their own container runtime, vendor lock-in was attainable.... Red Hat has jettisoned a mature, known commodity for a less-mature, relatively unknown piece of software -- without offering justification for the migration.... Until Red Hat offers up a sound justification for migrating from the docker container engine to Podman, there's going to be a lot of people sporting tinfoil hats. It comes with the territory of an always-connected world. And if it does turn out to be an IBM grab for vendor lock-in, there'll be a lot of admins migrating away from RHEL/CentOS to the likes of Ubuntu Server, SUSE/openSUSE, Debian, and more. Red Hat's product manager of containers later touted Podman's ability to deploy containers without root access privileges in an interview with eWeek. "We felt the sum total of its features, as well as the project's performance, security and stability, made it reasonable to move to 1.0. Since Podman is set to be the default container engine for the single-node use case in Red Hat Enterprise Linux 8, we wanted to make some pledges about its supportability." And a Red Hat spokesperson also shared their position with The New Stack. "We saw our customer base wanting the container runtime lifecycle baked-in to the OS or in delivered tandem with OpenShift."' -- source: https://linux.slashdot.org/story/20/01/18/0236253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Tuxedo's New Manjaro Linux Laptops Will Include Massive Customization
by Peter Reutemann 19 Jan '20

19 Jan '20

'Tuxedo Computers "has teamed up with Manjaro to tease not one, not two, but several" Linux laptops, Forbes reports: The Tuxedo Computers InfinityBook Pro 15...can be loaded with up to 64GB of RAM, a 10th-generation Intel Core i7 CPU, and as high as a 2TB Samsung EVO Plus NVMe drive. You can also purchase up to a 5-year warranty, and user-installed upgrades will not void the warranty... Manjaro Lead Project Developer Philip Müller also teased a forthcoming AMD Ryzen laptop [on Forbes' "Linux For Everyone" podcast]. "Yes, we are currently evaluating which models we want to use because the industry is screaming for that," Müller says. "In the upcoming weeks we might get some of those for internal testing. Once they're certified and the drivers are ready, we'll see when we can launch those." Müller also tells me they're prepping what he describes as a "Dell XPS 13 killer." "It's 10th-generation Intel based, we will have it in 14-inch with a 180-degree lid, so you can lay it flat on your desk if you like," he says. The Manjaro/Tuxedo Computers partnership will also offer some intense customization options, Forbes adds. "Want your company logo laser-etched on the lid? OK. Want to swap out the Manjaro logo with your logo on the Super key? Sure, no problem. Want to show off your knowledge of fictional alien races? Why not get a 100% Klingon keyboard?"' -- source: https://linux.slashdot.org/story/20/01/18/0045242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

“Windows Refund Day” Retrospective
by Lawrence D'Oliveiro 18 Jan '20

18 Jan '20

Just been watching this video <https://www.youtube.com/watch?v=1j9j-Ywjmbk> about that day in 1999 when open-source fans in a number of countries (including NZ) staged a march to demand a refund for the copies of Microsoft Windows that were bundled with hardware that they bought, even though they didn’t want that OS. It also recounts the story of the first person to actually get such a refund, and the rigmarole she had to go through to get it. Nowadays, I expect such a demand would be even less effective than it was then. The price of Windows to the hardware manufacturers is heavily offset (likely by more than 100%) by payments they get for preinstalling “crapware” (demo, time-limited and “lite” versions of various apps) from software vendors. So if they have to refund you the one, they will also deduct the other, and you end up with a net pittance, or very likely nothing at all, for saying no to Windows.

1 0

Do Parents Think Free Software Is Malware?
by Lawrence D'Oliveiro 18 Jan '20

18 Jan '20

Came across this article <https://opensource.com/life/15/12/dear-parents-let-your-kids-use-open-sourc…> from a few years ago, relating the tale of a teenager who was given an expensive laptop, who chose to replace its Windows OS (and included software) with Ubuntu. His parents were livid when they found out--two years after the fact. They jumped to the conclusion that his machine was now under the control of malware and hackers and all the rest of it, not to mention his throwing away the software they had paid good money for. So he resorted to Reddit (!) to get advice on how to explain things to his parents. The thread <https://www.reddit.com/r/linux/comments/3rfukp/i_really_need_advice/> has, in perhaps typical Reddit fashion, a mix of useful and not-so-useful responses. Though the upshot was, he was able to come to an accommodation with his parents, even if it did involve paying back the cost of the firewall/antivirus subscription that he didn’t use. That teen is an adult now. I wonder if it was an isolated case...

3 2