October 2020 - wlug - list.wlug.org.nz

List Of IPTV Resources
by Lawrence D'Oliveiro 22 Sep '24

22 Sep '24

This user <https://github.com/iptv-org> just popped up in my GitHub feed. One repo <https://github.com/iptv-org/iptv> claims to be a list of links to over 8000 streaming TV channels from nations all over the world, while the other is a list of tools*, providers and other resources. Do be aware it’s a bit of a mixed bag: yes, there are legitimate channels (no encryption so far that I have noticed), but also some dubious-looking links. *Oddly, FFmpeg and youtube-dl aren’t in the list.

2 5

Apple’s Windows 10
by Lawrence D'Oliveiro 19 Jul '22

19 Jul '22

Fred Brooks predicted long ago that complex pieces of software would eventually reach the point of irreducible entropy, where any attempt to fix a bug would simply introduce a new one. Microsoft’s Windows 10 seems to be about there, and it’s now clear that Apple’s macOS 10.15 “Catalina” has also joined that elite group <https://www.theregister.co.uk/2020/05/27/apple_catalina_update/>: The first spin of Catalina, officially released in October 2019, was a mess. ... The biggest issue was that all kinds of apps simply stopped working. ... Peripherals like mice, keyboards and printers stopped working. Email went missing; iCloud backups failed; users were constantly harassed by login requests; updates didn’t update ... ... So came for the first update to its new system one week after the main launch which fixed some, but not all, of the issues. ... Version two came in December 2019 and fixed some of those issues, but not all. ... More bug fixes came with version three in January 2020, but the OS seemed to have finally stabilized; something that was then spectacularly undone with version .4. ... Then we had the “supplemental update” to version 10.15.4, which fixed some, but not all, of the problems – most significantly the problem with Finder and transferring large files. And, amazingly, appeared to undo the good work that had been done with website security and broke SSH for some users. But now, with version point-five this week, that problem appears to have been sorted and, of course, your battery might last longer too.

1 1

Stopping Alert Volume Going To 100%
by Lawrence D'Oliveiro 20 Jan '21

20 Jan '21

For quite a while now, I’ve been annoyed by the system notification volume going to 100% on my Debian systems, regardless of my attempts to set it to a lower level. For example, when I open the KDE System Settings app, change something, then try to close the window, the sound that accompanies the save/discard/cancel alert is always startlingly loud. I think I have finally found a fix: in your /etc/pulse/daemon.conf, put in a line saying flat-volumes = no (You should find an existing comment “; flat-volumes = yes” that indicates the default.) You can make this new setting take effect in the current session immediately without having to logout or reboot, by executing the following as the currently-logged-in user: pulseaudio -k (This kills and restarts the PulseAudio daemon for your user session.) There are several discussions of the pros and cons of this issue online, going back some years. For example, here <https://bugzilla.redhat.com/show_bug.cgi?id=1265267>. Also a mention about the “flat-volumes” setting in the ever-reliable Arch Linux Wiki here <https://wiki.archlinux.org/index.php/PulseAudio>.

1 1

Random Firefox Tweaks
by Lawrence D'Oliveiro 12 Dec '20

12 Dec '20

Been looking at various settings changes you can make in the “about:config” page in Firefox. Here are a couple I have found useful: * keyword.enabled -- set to false to stop Firefox trying to do a search on the contents of the address box if it doesn’t match a URL. This is why I have a search box separate from the address box. * browser.fixup.alternate.enabled -- set to false to stop it helpfully tacking on “www.” and “.com” if the original URL you type doesn’t work. I have occasionally been confused by it complaining about not finding a URL, but showing a different one from the one I typed. By the way, when you first try to view this page, Firefox shows you a warning to ensure you understand the consequences of messing about with settings at this level. It remembers it has shown you this warning by adding the following line to the prefs.js file in your profile: user_pref("browser.aboutConfig.showWarning", false); Firefox seems to overwrite this file when it quits, and reloads it when it is launched again.

2 2

LibreOffice: OpenOffice Should Give Up And Die, Already
by Lawrence D'Oliveiro 06 Nov '20

06 Nov '20

Seems OpenOffice still has the edge in brand recognition over LibreOffice, in spite of being a largely moribund project with no major releases in 6 years. Yet, in spite of occasional talk of shutting it down, it continues to lurk, unloved, in some obscure corner of the ASF Orbiting HQ. <https://www.theregister.com/2020/10/15/libreoffice_openoffice_taunts/>

1 1

'youtube-dl' Downloading Software Removed From GitHub By RIAA Takedown Notice
by Peter Reutemann 03 Nov '20

03 Nov '20

'The GitHub repository for the popular youtube-dl utility is offline after GitHub received a DMCA takedown notice from the RIAA. The notice claims that "The clear purpose of this source code is to (i) circumvent the technological protection measures used by authorized streaming services such as YouTube, and (ii) reproduce and distribute music videos and sound recordings owned by our member companies without authorization for such use." "Whether you're looking to backup contents of your personal YouTube account or download some of your favorite YouTuber's videos for offline use, many turn to youtube-dl as the most reliable and in-depth tool for downloading videos from YouTube -- along with many, many other sites that have videos like Vimeo, CNN, etc," writes Kyle Bradshaw via 9to5Google. "Beyond simple downloading features, youtube-dl is also able to convert your download into nearly any format, including creating an mp3 of just a video's audio track." "One of the primary bases for the RIAA's claim is that youtube-dl appears to be developed with the explicit intention of enabling the downloading of copyrighted works, with music videos from the likes of Icona Pop, Justin Timberlake, and Taylor Swift being used to test the tool's functionality, a claim which we were able to independently verify." It's now up to the project's creators to file a counterclaim in the hopes of restoring youtube-dl's status on GitHub.' -- source: https://news.slashdot.org/story/20/10/23/2341202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

Registering An XSS Attack As A UK Company Name
by Lawrence D'Oliveiro 31 Oct '20

31 Oct '20

It is permissible under UK law <https://www.theregister.com/2020/10/30/companies_house_xss_silliness/> to register a company name that, when inserted without escapes into a web page, will trigger certain ... interesting ... behaviour. Companies House blocked such an attempt, but frankly I don’t see why they don’t just allow it. It would serve as a wake-up call to a whole lot of lazy/naïve web developers, anyway.

1 0

Is X.Org Server Abandonware?
by Peter Reutemann 31 Oct '20

31 Oct '20

'Phoronix ran a story this morning with this provocative headline: "It's Time To Admit It: The X.Org Server Is Abandonware." The last major release of the X.Org Server was in May 2018 but don't expect the long-awaited X.Org Server 1.21 to actually be released anytime soon. This should hardly be surprising but a prominent Intel open-source developer has conceded that the X.Org Server is pretty much "abandonware" with Wayland being the future. [Or, more specifically, that "The main worry I have is that xserver is abandonware without even regular releases from the main branch."] This comes as X.Org Server development hits a nearly two decade low, the X.Org Server is well off its six month release regimen in not seeing a major release in over two years, and no one is stepping up to manage the 1.21 release. A year ago was a proposal to see new releases driven via continuous integration testing but even that didn't take flight and as we roll into 2021 there isn't any motivation for releasing new versions of the X.Org Server by those capable of doing so. Red Hat folks have long stepped up to manage X.Org Server releases but with Fedora Workstation using Wayland by default and RHEL working that way, they haven't been eager to devote resources to new X.Org Server releases. Other major stakeholders also have resisted stepping up to ship 1.21 or commit any major resources to new xorg-server versions.' -- source: https://tech.slashdot.org/story/20/10/25/1523253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

NSA “Learned Its Lesson” About Crypto Backdoors -- Take Their Word For It
by Lawrence D'Oliveiro 29 Oct '20

29 Oct '20

Some years ago, the US National Security Agency was quite keen to see the “Dual EC DRBG” pseudorandom number generator become widely adopted for secure encryption purposes <https://www.theregister.com/2020/10/28/nsa_backdoor_wyden/>. But two independent researchers at Microsoft discovered that there were weaknesses in the algorithm, that could be exploited to implant backdoors -- that is, it was possible to compromise the algorithm such that the output still looked random, but a knowledgeable attacker would be able to predict enough statistical characteristics of the bitstream to fatally weaken its randomness. Naturally you can figure out what the NSA were assuming -- that they would be the only ones in the world with the capability to take advantage of such a weakness. This turned out to be wrong. Apparently a report was written up about “lessons learned” from this episode (would it be too much to assume it concluded that such backdoors should never be planted again?) ... but the NSA cannot find the report.

1 0

Hackers Can Now Reverse Engineer Intel Updates Or Write Their Own Custom Firmware
by Peter Reutemann 29 Oct '20

29 Oct '20

'Researchers have extracted the secret key that encrypts updates to an assortment of Intel CPUs, a feat that could have wide-ranging consequences for the way the chips are used and, possibly, the way they're secured. The key makes it possible to decrypt the microcode updates Intel provides to fix security vulnerabilities and other types of bugs. Having a decrypted copy of an update may allow hackers to reverse engineer it and learn precisely how to exploit the hole it's patching. The key may also allow parties other than Intel -- say a malicious hacker or a hobbyist -- to update chips with their own microcode, although that customized version wouldn't survive a reboot. "At the moment, it is quite difficult to assess the security impact," independent researcher Maxim Goryachy said in a direct message. "But in any case, this is the first time in the history of Intel processors when you can execute your microcode inside and analyze the updates." Goryachy and two other researchers -- Dmitry Sklyarov and Mark Ermolov, both with security firm Positive Technologies -- worked jointly on the project. The key can be extracted for any chip -- be it a Celeron, Pentium, or Atom -- that's based on Intel's Goldmont architecture. In a statement, Intel officials wrote: "The issue described does not represent security exposure to customers, and we do not rely on obfuscation of information behind red unlock as a security measure. In addition to the INTEL-SA-00086 mitigation, OEMs following Intel's manufacturing guidance have mitigated the OEM specific unlock capabilities required for this research. The private key used to authenticate microcode does not reside in the silicon, and an attacker cannot load an unauthenticated patch on a remote system."' -- source: https://developers.slashdot.org/story/20/10/28/217212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0