January 2020 - wlug - list.wlug.org.nz

Re: prp treatment in bangalore
by mailinglist 27 Jan '20

27 Jan '20

Sent from my Samsung Galaxy smartphone.In was wondering... But then, a lot of email addresses, mine included, sound a bit odd but are from totally legit people. Don't really have the time to moderate posts initially from everyone signing up till I'm satisfied that they are OK... :-(This doesn't happen too often. Lots of spam gets caught and I (though not so much recently ) just quickly check and discard whatever needs review. Maybe wait and see.Or if someone knows of any changes to the mailing list host....

1 0

Librem 5 phone hands-on—Open source phone shows the cost of being different
by Peter Reutemann 26 Jan '20

26 Jan '20

'It is hard to do something truly different in the smartphone industry. Companies, especially smaller companies, are all working from the same parts bin with the same manufacturing partners. You take your Qualcomm SoC, your Samsung display, and your Sony camera sensor—and you take a flight to China and visit Foxconn, which, in addition to manufacturing, will even do engineering for you if you want. Smartphones are so samey because they have an established, for-hire supply chain that has a certain way of doing things, and it's much cheaper, faster, and easier if you just "go with the flow" and do what everyone else is doing. Big companies like Samsung and Apple have enough money, control, and connections to move the supply chain in whatever direction they want. In terms of smaller companies, though, there is a single one trying to blaze its own path: Purism, the maker of open source Linux laptops, is building the Librem 5 smartphone. Not only is the OS open source and based on GNU/Linux—not Android—the hardware is open source, too. The core components have open source firmware, and there are even public hardware schematics. This is as close as you're going to get to a totally open source smartphone. If you haven't noticed, open source smartphone hardware is not a thing that existed before now. There have been phones that run open source builds of Android, but those are full of closed-source firmware from non-open components. The usual hardware companies cautiously guard their hardware designs and drivers, and Purism's hardline stance on open source has ruled out almost the entire established smartphone supply chain. As the company writes in a blog post, "When we first approached hardware manufacturers almost two years ago with this project most of them instantly said 'No, sorry, impossible, we can not help you'." Others warned us, that it could never work, that it was too complicated, 'the industry does not do that,' and so forth." What followed was a long and winding road, but after two years of work, Purism is finally shipping the Librem 5 smartphones to customers. We were able to spend a few days with a device, and it's definitely one of the most unusual smartphones in recent memory. The thing to keep in mind here is that Purism has taken on an absolutely gargantuan task. It somehow scraped together a new supply chain of mostly open source components, it came up with a smartphone design from scratch, and it is building its own smartphone distribution of Linux. Two years is not enough time to do this. The OS and app package is not nearly finished, and it lacks basic smartphone functionality. The hardware is nearly finished, but you'll have a hard time taking advantage of it right now since the power management isn't really implemented, and support for things like the cameras are non-existent. If you really want open source smartphones to be a thing, though, this is where you need to start. The Librem 5 is a proof of concept.' -- source: https://arstechnica.com/gadgets/2020/01/librem-5-phone-hands-on-a-proof-of-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel CPU Chip Shortages
by Lawrence D'Oliveiro 24 Jan '20

24 Jan '20

This article <https://www.theregister.co.uk/2020/01/20/intel_hpe_xeon_shortage/> talks about the shortage of Intel server chips. But it also mentions that Intel’s attempts to crank up production of these is “to the detriment of desktop and mobile parts”. So there are shortages of CPU chips all round, and AMD is benefiting somewhat from this. Who is buying most of these server chips? It appears it’s not actual hardware vendors like Dell, HP etc, who apparently only buy about half a million CPUs per year each. These are dwarfed by “hyperscaler” companies that are named by one commenter as Alibaba, AWS, Azure, Baidu, Facebook, Google and Tencent, each taking over a million CPUs per year.

1 1

Apple's Privacy Software Allowed Users To Be Tracked, Says Google
by Peter Reutemann 23 Jan '20

23 Jan '20

'Google researchers have exposed details of multiple security flaws in its rival Apple's Safari web browser that allowed users' browsing behavior to be tracked, despite the fact that the affected tool was specifically designed to protect their privacy. From a report: The flaws, which were ironically found in an anti-tracking feature known as Intelligent Tracking Prevention, were first disclosed by Google to Apple in August last year. In a soon-to-be published paper seen by the Financial Times, researchers in Google's cloud team have since identified five different types of potential attack that could have resulted from the vulnerabilities, allowing third parties to obtain "sensitive private information about the user's browsing habits." "You would not expect privacy-enhancing technologies to introduce privacy risks," said Lukasz Olejnik, an independent security researcher who has seen the paper. "If exploited or used, [these vulnerabilities] would allow unsanctioned and uncontrollable user tracking. Apple rolled out Intelligent Tracking Prevention in 2017, with the specific aim of protecting Safari browser users from being tracked around the web by advertisers' and other third-parties' cookies.' -- source: https://tech.slashdot.org/story/20/01/22/2119245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Wine 5.0 Released
by Peter Reutemann 22 Jan '20

22 Jan '20

'Wine 5.0 has been released today and contains over 7,400 bug fixes and numerous audio and graphics improvements that will increase performance in gaming on Linux. With the release of Wine 5.0, WineHQ hopes to resolve many of these issues, with the main improvements being: -Builtin modules in PE format: To make games think Wine is a real Windows environment, most Wine 5.0 modules have been converted into the PE format rather than ELF binaries. It is hoped that this will allow copy-protection and anti-cheat programs to not flag games running under Wine as being modified. -Multi-monitor support: Multiple displays adapters and multi-monitor configurations are now supported under Wine. -XAudio2 reimplementation: XAudio2 libraries have been added back to Wine and will use the FAudio library for better compatibility. -Vulkan 1.1 support: "The Vulkan driver supports up to version 1.1.126 of the Vulkan spec."' -- source: https://tech.slashdot.org/story/20/01/21/223205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Reuters: Apple cut backup end-to-end encryption plans after FBI complained
by Peter Reutemann 22 Jan '20

22 Jan '20

'Two years ago, Apple dropped a plan that would have made it impossible for the company to decrypt iPhone and iPad backups for law enforcement, according to a Reuters report today. Reuters wrote that "six sources familiar with the matter" confirmed that Apple dropped the end-to-end encryption plan for iCloud Backup "after the FBI complained that the move would harm investigations." Apple had "told the FBI that it planned to offer users end-to-end encryption when storing their phone data on iCloud" more than two years ago, Reuters wrote. "Under that plan, primarily designed to thwart hackers, Apple would no longer have a key to unlock the encrypted data, meaning it would not be able to turn material over to authorities in a readable form even under court order," the report continued. But the FBI objected, and Apple dropped the plan, although the exact reason for doing so isn't clear. One former Apple employee told Reuters that the company "decided they weren't going to poke the bear anymore." However, another former Apple employee "said it was possible the encryption project was dropped for other reasons, such as concern that more customers would find themselves locked out of their data more often."' -- source: https://arstechnica.com/tech-policy/2020/01/apple-reportedly-nixed-plan-for… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Notorious Crime Gang Targets Internet Routers Using Tomato Firmware
by Peter Reutemann 22 Jan '20

22 Jan '20

'Internet routers running the Tomato alternative firmware are under active attack by a self-propagating exploit that searches for devices using default credentials. When credentials are found, the exploit then makes the routers part of a botnet that's used in a host of online attacks, researchers said on Tuesday. The Muhstik botnet came to light about two years ago when it started unleashed a string of exploits that attacked Linux servers and Internet-of-things devices. It opportunistically exploited a host of vulnerabilities, including the so-called critical Drupalgeddon2 vulnerability disclosed in early 2018 in the Drupal content management system. Muhstik has also been caught using vulnerabilities in routers that use Gigabit Passive Optical Network (GPON) or DD-WRT software. The botnet has also exploited previously patched vulnerabilities in other server applications, including the Webdav, WebLogic, Webuzo, and WordPress. On Tuesday, researchers from Palo Alto Networks said they recently detected Muhstik targeting Internet routers running Tomato, an open-source package that serves as an alternative to firmware that ships by default with routers running Broadcom chips. The ability to work with virtual private networks and provide advanced quality of service control make Tomato popular with end users and in some cases router sellers. The exploits use already infected devices to scan the Internet for Tomato routers and, when found, to check if they use the default username and password of "admin:admin" or "root:admin" for remote administration. The exploit causes Tomato routers that haven't been locked down with a strong password to join an IRC server that's used to control the botnet. The infection also causes the routers to scan the Internet for servers or devices running WordPress, Webuzo, or WebLogic packages that are vulnerable.' -- source: https://it.slashdot.org/story/20/01/21/2039246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

14% of Android App Privacy Policies Contain Contradictions About Data Collection
by Peter Reutemann 22 Jan '20

22 Jan '20

'A large number of Android mobile apps listed on the official Google Play Store contain self-contradictory language in their privacy policies in regards to data collection practices. From a report: In an academic study published last year, researchers created a tool named PolicyLint that analyzed the language used in the privacy policies of 11,430 Play Store apps. They found that 14.2% (1,618 apps) contained a privacy policy with logical contradicting statements about data collection. Examples include privacy policies that stated in one section that they do not collect personal data, only to contradict themselves in subsequent sections, where they state they collect emails or customer names -- which are clearly personally-idenfiable information. While the research team could not determine the app maker's intent in using contradicting statements in their privacy policy, researchers feel the primary purpose was to mislead users if they ever took the time to read the policies.' -- source: https://yro.slashdot.org/story/20/01/21/188216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Official Kubuntu 'Focus' Linux Laptop Goes on Sale
by Peter Reutemann 21 Jan '20

21 Jan '20

'You can buy an official Kubuntu laptop. Called "Focus". It is an absolutely powerhouse with top specs. From a report: Here's the specs list: CPU: Core i7-9750H 6c/12t 4.5GHz Turbo GPU: 6GB GTX-2060 RAM: 32GB Dual Channel DDR4 2666 RAM Storage: 1TB Samsung 970 EVO Plus NVMe Display: 16.1" matte 1080p IPS Keyboard: LED backlit, 3-4mm travel User expandable SDD, NVMe, and RAM Superior cooling The starting price for the Kubuntu Focus Laptop is $2395. ' -- source: https://linux.slashdot.org/story/20/01/20/1856240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

Why This Time The New Browser Wars Are Different
by Peter Reutemann 21 Jan '20

21 Jan '20

'The Verge argues that the browser wars "are back, but it's different this time." The mobile web is broken and unfettered tracking and data sharing have made visiting websites feel toxic, but since the ecosystem of websites and ad companies can't fix it through collective action, it falls on browser makers to use technological innovations to limit that surveillance, however each company that makes a browser is taking a different approach to creating those innovations, and everybody distrusts everybody else to act in the best interest of the web instead of the best interest of their employers' profits... I've been avoiding getting into the precise details of the proposals out there to fix the tracking problem because things are changing so quickly across so many different tracks... Until then, know that there are two important things to know. First: there are new browser technologies and limits coming that could radically change how ads work and could make it easier for you to protect your privacy no matter what browser you use. Since this is the web, it'll take time, but everybody seems committed. Second: the way many of us think about a Browser War is in terms of marketshare -- and that is the wrong metric this time. There is a browser war, but it won't be won or lost based on who can convince the most people to switch to their browser. Because most people can't or won't switch on the platform that matters: mobile. In 2020, the desktop is a minor skirmish compared to browsers on phones. On phones, many people aren't really free to choose their browser. That's literally true on the iPhone, which Apple locks down so apps can only use its web rendering technology. And it's for-intents-and-purposes true on Android, where the vast majority of browsers just use Chromium. Yes, there is an Android browser ballot happening in Europe, but it's much too early to know what its effects will be.... The new Browser Wars aren't about who makes the fastest or best browser, they're about whose services you want and whose data policies you trust. ' -- source: https://news.slashdot.org/story/20/01/20/048217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1