October 2020 - wlug - list.wlug.org.nz

List Of IPTV Resources
by Lawrence D'Oliveiro 22 Sep '24

22 Sep '24

This user <https://github.com/iptv-org> just popped up in my GitHub feed. One repo <https://github.com/iptv-org/iptv> claims to be a list of links to over 8000 streaming TV channels from nations all over the world, while the other is a list of tools*, providers and other resources. Do be aware it’s a bit of a mixed bag: yes, there are legitimate channels (no encryption so far that I have noticed), but also some dubious-looking links. *Oddly, FFmpeg and youtube-dl aren’t in the list.

2 5

Apple’s Windows 10
by Lawrence D'Oliveiro 19 Jul '22

19 Jul '22

Fred Brooks predicted long ago that complex pieces of software would eventually reach the point of irreducible entropy, where any attempt to fix a bug would simply introduce a new one. Microsoft’s Windows 10 seems to be about there, and it’s now clear that Apple’s macOS 10.15 “Catalina” has also joined that elite group <https://www.theregister.co.uk/2020/05/27/apple_catalina_update/>: The first spin of Catalina, officially released in October 2019, was a mess. ... The biggest issue was that all kinds of apps simply stopped working. ... Peripherals like mice, keyboards and printers stopped working. Email went missing; iCloud backups failed; users were constantly harassed by login requests; updates didn’t update ... ... So came for the first update to its new system one week after the main launch which fixed some, but not all, of the issues. ... Version two came in December 2019 and fixed some of those issues, but not all. ... More bug fixes came with version three in January 2020, but the OS seemed to have finally stabilized; something that was then spectacularly undone with version .4. ... Then we had the “supplemental update” to version 10.15.4, which fixed some, but not all, of the problems – most significantly the problem with Finder and transferring large files. And, amazingly, appeared to undo the good work that had been done with website security and broke SSH for some users. But now, with version point-five this week, that problem appears to have been sorted and, of course, your battery might last longer too.

1 1

Stopping Alert Volume Going To 100%
by Lawrence D'Oliveiro 20 Jan '21

20 Jan '21

For quite a while now, I’ve been annoyed by the system notification volume going to 100% on my Debian systems, regardless of my attempts to set it to a lower level. For example, when I open the KDE System Settings app, change something, then try to close the window, the sound that accompanies the save/discard/cancel alert is always startlingly loud. I think I have finally found a fix: in your /etc/pulse/daemon.conf, put in a line saying flat-volumes = no (You should find an existing comment “; flat-volumes = yes” that indicates the default.) You can make this new setting take effect in the current session immediately without having to logout or reboot, by executing the following as the currently-logged-in user: pulseaudio -k (This kills and restarts the PulseAudio daemon for your user session.) There are several discussions of the pros and cons of this issue online, going back some years. For example, here <https://bugzilla.redhat.com/show_bug.cgi?id=1265267>. Also a mention about the “flat-volumes” setting in the ever-reliable Arch Linux Wiki here <https://wiki.archlinux.org/index.php/PulseAudio>.

1 1

Random Firefox Tweaks
by Lawrence D'Oliveiro 12 Dec '20

12 Dec '20

Been looking at various settings changes you can make in the “about:config” page in Firefox. Here are a couple I have found useful: * keyword.enabled -- set to false to stop Firefox trying to do a search on the contents of the address box if it doesn’t match a URL. This is why I have a search box separate from the address box. * browser.fixup.alternate.enabled -- set to false to stop it helpfully tacking on “www.” and “.com” if the original URL you type doesn’t work. I have occasionally been confused by it complaining about not finding a URL, but showing a different one from the one I typed. By the way, when you first try to view this page, Firefox shows you a warning to ensure you understand the consequences of messing about with settings at this level. It remembers it has shown you this warning by adding the following line to the prefs.js file in your profile: user_pref("browser.aboutConfig.showWarning", false); Firefox seems to overwrite this file when it quits, and reloads it when it is launched again.

2 2

LibreOffice: OpenOffice Should Give Up And Die, Already
by Lawrence D'Oliveiro 06 Nov '20

06 Nov '20

Seems OpenOffice still has the edge in brand recognition over LibreOffice, in spite of being a largely moribund project with no major releases in 6 years. Yet, in spite of occasional talk of shutting it down, it continues to lurk, unloved, in some obscure corner of the ASF Orbiting HQ. <https://www.theregister.com/2020/10/15/libreoffice_openoffice_taunts/>

1 1

'youtube-dl' Downloading Software Removed From GitHub By RIAA Takedown Notice
by Peter Reutemann 03 Nov '20

03 Nov '20

'The GitHub repository for the popular youtube-dl utility is offline after GitHub received a DMCA takedown notice from the RIAA. The notice claims that "The clear purpose of this source code is to (i) circumvent the technological protection measures used by authorized streaming services such as YouTube, and (ii) reproduce and distribute music videos and sound recordings owned by our member companies without authorization for such use." "Whether you're looking to backup contents of your personal YouTube account or download some of your favorite YouTuber's videos for offline use, many turn to youtube-dl as the most reliable and in-depth tool for downloading videos from YouTube -- along with many, many other sites that have videos like Vimeo, CNN, etc," writes Kyle Bradshaw via 9to5Google. "Beyond simple downloading features, youtube-dl is also able to convert your download into nearly any format, including creating an mp3 of just a video's audio track." "One of the primary bases for the RIAA's claim is that youtube-dl appears to be developed with the explicit intention of enabling the downloading of copyrighted works, with music videos from the likes of Icona Pop, Justin Timberlake, and Taylor Swift being used to test the tool's functionality, a claim which we were able to independently verify." It's now up to the project's creators to file a counterclaim in the hopes of restoring youtube-dl's status on GitHub.' -- source: https://news.slashdot.org/story/20/10/23/2341202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

Registering An XSS Attack As A UK Company Name
by Lawrence D'Oliveiro 31 Oct '20

31 Oct '20

It is permissible under UK law <https://www.theregister.com/2020/10/30/companies_house_xss_silliness/> to register a company name that, when inserted without escapes into a web page, will trigger certain ... interesting ... behaviour. Companies House blocked such an attempt, but frankly I don’t see why they don’t just allow it. It would serve as a wake-up call to a whole lot of lazy/naïve web developers, anyway.

1 0

Is X.Org Server Abandonware?
by Peter Reutemann 31 Oct '20

31 Oct '20

'Phoronix ran a story this morning with this provocative headline: "It's Time To Admit It: The X.Org Server Is Abandonware." The last major release of the X.Org Server was in May 2018 but don't expect the long-awaited X.Org Server 1.21 to actually be released anytime soon. This should hardly be surprising but a prominent Intel open-source developer has conceded that the X.Org Server is pretty much "abandonware" with Wayland being the future. [Or, more specifically, that "The main worry I have is that xserver is abandonware without even regular releases from the main branch."] This comes as X.Org Server development hits a nearly two decade low, the X.Org Server is well off its six month release regimen in not seeing a major release in over two years, and no one is stepping up to manage the 1.21 release. A year ago was a proposal to see new releases driven via continuous integration testing but even that didn't take flight and as we roll into 2021 there isn't any motivation for releasing new versions of the X.Org Server by those capable of doing so. Red Hat folks have long stepped up to manage X.Org Server releases but with Fedora Workstation using Wayland by default and RHEL working that way, they haven't been eager to devote resources to new X.Org Server releases. Other major stakeholders also have resisted stepping up to ship 1.21 or commit any major resources to new xorg-server versions.' -- source: https://tech.slashdot.org/story/20/10/25/1523253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

NSA “Learned Its Lesson” About Crypto Backdoors -- Take Their Word For It
by Lawrence D'Oliveiro 29 Oct '20

29 Oct '20

Some years ago, the US National Security Agency was quite keen to see the “Dual EC DRBG” pseudorandom number generator become widely adopted for secure encryption purposes <https://www.theregister.com/2020/10/28/nsa_backdoor_wyden/>. But two independent researchers at Microsoft discovered that there were weaknesses in the algorithm, that could be exploited to implant backdoors -- that is, it was possible to compromise the algorithm such that the output still looked random, but a knowledgeable attacker would be able to predict enough statistical characteristics of the bitstream to fatally weaken its randomness. Naturally you can figure out what the NSA were assuming -- that they would be the only ones in the world with the capability to take advantage of such a weakness. This turned out to be wrong. Apparently a report was written up about “lessons learned” from this episode (would it be too much to assume it concluded that such backdoors should never be planted again?) ... but the NSA cannot find the report.

1 0

Hackers Can Now Reverse Engineer Intel Updates Or Write Their Own Custom Firmware
by Peter Reutemann 29 Oct '20

29 Oct '20

'Researchers have extracted the secret key that encrypts updates to an assortment of Intel CPUs, a feat that could have wide-ranging consequences for the way the chips are used and, possibly, the way they're secured. The key makes it possible to decrypt the microcode updates Intel provides to fix security vulnerabilities and other types of bugs. Having a decrypted copy of an update may allow hackers to reverse engineer it and learn precisely how to exploit the hole it's patching. The key may also allow parties other than Intel -- say a malicious hacker or a hobbyist -- to update chips with their own microcode, although that customized version wouldn't survive a reboot. "At the moment, it is quite difficult to assess the security impact," independent researcher Maxim Goryachy said in a direct message. "But in any case, this is the first time in the history of Intel processors when you can execute your microcode inside and analyze the updates." Goryachy and two other researchers -- Dmitry Sklyarov and Mark Ermolov, both with security firm Positive Technologies -- worked jointly on the project. The key can be extracted for any chip -- be it a Celeron, Pentium, or Atom -- that's based on Intel's Goldmont architecture. In a statement, Intel officials wrote: "The issue described does not represent security exposure to customers, and we do not rely on obfuscation of information behind red unlock as a security measure. In addition to the INTEL-SA-00086 mitigation, OEMs following Intel's manufacturing guidance have mitigated the OEM specific unlock capabilities required for this research. The private key used to authenticate microcode does not reside in the silicon, and an attacker cannot load an unauthenticated patch on a remote system."' -- source: https://developers.slashdot.org/story/20/10/28/217212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Wikimedia Is Moving To GitLab
by Peter Reutemann 29 Oct '20

29 Oct '20

'The Wikimedia Foundation, the American non-profit organization that owns the internet domain names of many movement projects and hosts sites like Wikipedia, has decided to migrate their code repositories from Gerrit to Gitlab. Slashdot reader nfrankel shares the announcement: For the past two years, our developer satisfaction survey has shown that there is some level of dissatisfaction with Gerrit, our code review system. This dissatisfaction is particularly evident for our volunteer communities. The evident dissatisfaction with code review, coupled with an internal review of our CI tooling and practice makes this an opportune moment to revisit our code review choices. While Gerrit's workflow is in many respects best-in-class, its interface suffers from usability deficits, and its workflow differs from mainstream industry practices. This creates barriers to entry for the community and slows onboarding for WMF technical staff. In addition, there are a growing number of individuals and teams (both staff and non-staff) who are opting to forgo the use of Gerrit and instead use a third-party hosted option such as GitHub. Reasons vary for the choice to use third-party hosting but, based on informal communication, there are 3 main groupings: lower friction to create new repositories; easier setup and self-service of Continuous Integration configuration; and more familiarity with pull-request style workflows. All these explanations point to friction in our existing code-review system slowing development rather than fostering it. The choice to use third-party code-hosting hurts our collaboration (both internal and external), adds to the confusion of onboarding, and makes it more difficult to maintain code standards across repositories. At the same time, there is a requirement that all software which is deployed to Wikimedia production is hosted and deployed from Gerrit. If we fail to address the real usability problems that users have with Gerrit, people will continue to launch and build projects on whatever system it is they prefer -- Wikimedia's GitHub already contains 152 projects, the Research team has 127 projects. This raises the question: if Gerrit has identifiable problems, why can't we solve those problems in Gerrit? Gerrit is open source (Apache licensed) software; modifications are a simple matter of programming. [...] Upstream has improved the UI in recent releases, and releases have become more frequent; however, upgrade path documentation is often lacking. The migration from Gerrit 2 to Gerrit 3, for example, required several upstream patchsets to avoid the recommended path of several days of downtime. This is the effort required to maintain the status quo. Even small improvements require effort and time as, often, our use-case is very different from the remainder of the Gerrit community. ' -- source: https://news.slashdot.org/story/20/10/28/2114259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

RIAA's YouTube-DL Takedown Ticks Off Developers and GitHub's CEO
by Peter Reutemann 28 Oct '20

28 Oct '20

'An RIAA takedown request, which removed the YouTube-DL repository from GitHub, has ticked off developers and GitHub's CEO. Numerous people responded by copying and republishing the contested code, including in some quite clever ways. Meanwhile, GitHub's CEO is "annoyed" as well, offering help to get the repo reinstated. TorrentFreak reports: Soon after the RIAA notice took YouTube-DL offline many developers spoke out in protest. They believe that the music industry group went too far and started to republish copies of the code everywhere. Over the past several days, we have seen hundreds of new forks and copies appear online. These were also posted to GitHub, where YouTube-DL forks remain easy to find and continue to be uploaded. The code was also posted in some places one wouldn't expect. For example, there's still a copy in GitHub's DMCA notice repository, which some people find quite amusing. And the list of pull requests can be quite entertaining in themselves. One of the most creative responses we've seen was posted to Twitter by @GalacticFurball who encoded YouTube-DL into images that can be easily shared, encouraging others to share these as well. "I would also suggest that you save and repost the images, as one single source kind of defeats the point. Maybe start a hashtag trend or something. Make songs, and poetry. Get that data out there." This triggered even more creativity, with people finding alternative means to share the code online, all to counter the RIAA's takedown request. Meanwhile, GitHub's CEO Nat Friedman wasn't sitting still either. While the Microsoft-owned developer platform had to respond to the takedown notice, Friedman himself actively reached out to YouTube-DL's developers to help them get their project reinstated. The CEO joined YouTube-DL's IRC channel hoping to connect with the owner of the repository so he can help to get it unsuspended. "GitHub exists to help developers. We never want to interfere with their work. We want to help the youtube-dl maintainers defeat the DMCA claim so that we can restore the repo," Friedman told TorrentFreak, explaining his actions. GitHub's CEO suggested that YouTube-DL won't be reinstated in its original form. But, the software may be able to return without the rolling cipher circumvention code and the examples of how to download copyrighted material. ' -- source: https://news.slashdot.org/story/20/10/27/2230218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Facebook Further Borgs Its Oculus Acquisition
by Lawrence D'Oliveiro 27 Oct '20

27 Oct '20

When Facebook first acquired VR headset company Oculus back in 2014, the CEO of the latter claimed “I guarantee that you won't need to log into your Facebook account every time you wanna use the Oculus Rift.” That statement, to reuse an old phrase from the Vietnam War, is no longer operative <https://www.theregister.com/2020/10/27/facebook_oculus_accounts/>. They have also threatened to ban accounts that try to share more than one headset, but have resiled from that by popular demand, at least temporarily. Candidate for quote of the week: “While I do completely understand your concerns, we do need to have you comply with the Facebook TOS.”

1 0

Chrome OS May Finally Be Getting a Dark Mode
by Peter Reutemann 27 Oct '20

27 Oct '20

'The Verge: Chrome OS may finally be getting a dark mode, but so far it's only been spotted in its experimental Canary channel, Android Central reported. Before you go tinkering with Canary just be advised: Canary is Google's "bleeding edge" Chrome OS path, which receives daily updates of features before they've been widely tested. It can only be accessed from Chromebooks switched into a special developer mode (not to be confused with the Chrome OS Developer channel). Google warns that Canary can be "unstable." But at the moment, to activate dark mode on your Chromebook, you need to have the Canary channel installed. Once you've done that, Android Central says you just open Chrome and type in chrome://flags/#enable-force-dark and chrome://flags/#enable-webui-dark-mode into the URL bar. I should note I tried this on my older Chromebook and wasn't able to get it to work. But here's the view Android Police captured. Android Central says the dark mode has some bugs, but notes it seems to apply across the UI, not just as darker backgrounds. ' -- source: https://tech.slashdot.org/story/20/10/26/2047207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Study shows which messengers leak your data, drain your battery, and more
by Peter Reutemann 27 Oct '20

27 Oct '20

'Link previews are a ubiquitous feature found in just about every chat and messaging app, and with good reason. They make online conversations easier by providing images and text associated with the file that’s being linked. Unfortunately, they can also leak our sensitive data, consume our limited bandwidth, drain our batteries, and, in one case, expose links in chats that are supposed to be end-to-end encrypted. Among the worst offenders, according to research published on Monday, were messengers from Facebook, Instagram, LinkedIn, and Line.' -- source: https://arstechnica.com/information-technology/2020/10/study-shows-which-me… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Flying Your Plane!?
by Lawrence D'Oliveiro 27 Oct '20

27 Oct '20

Linux hardware guru Greg Kroah-Hartman on the use of Linux in safety-critical systems <https://www.theregister.com/2020/10/26/linux_kernel_intel/>: What does he think about using Linux in a safety-critical environment? “Anyone who’s ever flown in a plane, it’s been controlled by Linux, for the past decade, so it’s in safety-critical environments today,” he said, grinning. “It runs telecoms systems, it runs stock markets, it runs satellites, it keeps mega yachts from tipping over, it’s been in automotive as well, in the head units for a long time … nobody wants to write an operating system, they just want to write applications to solve their problems.” He also has a warning for those trying to selectively backport security fixes to older kernel versions.

1 0

Vint Cerf Is Working on an Internet for Outer Space
by Peter Reutemann 27 Oct '20

27 Oct '20

'"TCP/IP doesn't work at interplanetary distances," 77-year-old Vinton Cerf tells Quanta magazine. "So we designed a set of protocols that do." Specifically, bundle protocols: a disruption/delay-tolerant networking (DTN) protocol with nodes that can also store information: A data packet traveling from Earth to Jupiter might, for example, go through a relay on Mars, Cerf explained. However, when the packet arrives at the relay, some 40 million miles into the 400-million-mile journey, Mars may not be oriented properly to send the packet on to Jupiter. "Why throw the information away, instead of hanging on to it until Jupiter shows up?" Cerf said. This store-and-forward feature allows bundles to navigate toward their destinations one hop at a time, despite large disruptions and delays... So, a couple decades after conceiving of bundle protocols, is the interplanetary internet up and running? We don't have to build the whole thing and then hope somebody uses it. We sought to get standards in place, as we have for the internet; offer those standards freely; and then achieve interoperability so that the various spacefaring nations could help each other. We're taking the next obvious step for multi-mission infrastructure: designing the capability for an interplanetary backbone network. You build what's needed for the next mission. As spacecraft get built and deployed, they carry the standard protocols that become part of the interplanetary backbone. Then, when they finish their primary scientific mission, they get repurposed as nodes in the backbone network. We accrete an interplanetary backbone over time. In 2004, the Mars rovers were supposed to transmit data back to Earth directly through the deep space network — three big 70-meter antennas in Australia, Spain and California. However, the channel's available data rate was 28 kilobits per second, which isn't much. When they turned the radios on, they overheated. They had to back off, which meant less data would come back. That made the scientists grumpy. One of the JPL engineers used prototype software — this is so cool! — to reprogram the rovers and orbiters from hundreds of millions of miles away. We built a small store-and-forward interplanetary internet with essentially three nodes: the rovers on the surface of Mars, the orbiters and the deep space network on Earth. That's been running ever since. We've been refining the design of those protocols, implementing and testing them. The latest protocols are running back-and-forth relays between Earth and the International Space Station... We did another test at the ISS where the astronauts were controlling a little robot vehicle in Germany.' -- source: https://science.slashdot.org/story/20/10/25/2329239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

So How Good Is Edge on Linux?
by Peter Reutemann 26 Oct '20

26 Oct '20

'"No one asked Microsoft to port its Edge browser to Linux," writes Steven J. Vaughan-Nichols at ZDNet, adding "Indeed, very few people asked for Edge on Windows. "But, here it is. So, how good — or not — is it..?" The new release comes ready to run on Ubuntu, Debian, Fedora, and openSUSE Linux distributions... Since I've been benchmarking web browsers since Mosaic rolled off the bit assembly line, I benchmarked the first Edge browser and Chrome 86 and Firefox 81 on my main Linux production PC.... First up: JetStream 2.0, which is made up of 64 smaller tests. This JavaScript and WebAssembly benchmark suite focuses on advanced web applications. It rewards browsers that start up quickly, execute code quickly, and run smoothly. Higher scores are better on this benchmark. JetStream's top-scorer — drumroll please — was Edge with 136.971. But, right behind it within the margin of error, was Chrome with a score of 132.413. This isn't too surprising. They are, after all, built on the same platform. Back in the back was Firefox with 102.131. Next up: Kraken 1.1. This benchmark, which is based on the long-obsolete SunSpider, measures JavaScript performance. To this basic JavaScript testing, it added typical use-case scenarios. Mozilla, Firefox's parent organization, created Kraken. With this benchmark, the lower the score, the better the result. To no great surprise, Firefox took first place here with 810.1 milliseconds (ms). Following it was Chrome with 904.5ms and then Edge with 958.8ms. The latest version of WebXPRT is today's best browser benchmark. It's produced by the benchmark professionals at Principled Technology. This company's executives were the founders of the Ziff Davis Benchmark Operation, the gold-standard of PC benchmarking. WebXPRT uses scenarios created to mirror everyday tasks. These include Photo Enhancement, Organize Album, Stock Option Pricing, Local Notes, Sales Graphs, and DNA Sequencing. Here, the higher the score, the better the browser. On this benchmark, Firefox shines. It was an easy winner with a score of 272. Chrome edges out Edge 233 to 230. The article concludes that "Oddly, Edge, which turned in a poor performance when I recently benchmarked it on Windows, did well on Linux. Who'd have guessed...? Edge is a good, fast browser on Linux. If you're a Windows user coming over to Linux or you're doing development work aimed at Edge, then by all means try Edge on Linux. It works and it works well." Yet Vaughan-Nichols admits he's still not going to switch to Edge. "Chrome is more than fast enough for my purposes and I don't want my information tied into the Microsoft ecosystem. For better or worse, mine's already locked into the Googleverse and I can live with that."' -- source: https://linux.slashdot.org/story/20/10/25/0118218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Snopes.com Exposes 4chan Campaign to 'Kindle Mistrust in Snopes'
by Peter Reutemann 26 Oct '20

26 Oct '20

'"This is the perfect moment to do this. This is an age of conspiracies for boomers... Let's kindle their mistrust in Snopes and other fact checkers," wrote one 4chan poster. Snopes.com later reported: In October 2020, a series of threads was posted to the anonymous internet forum 4Chan as part of operation "Snopes-Piercer," a smear campaign with the stated goal of "red-pilling some normies" — internet slang for a propaganda technique in which distorted, fabricated, or skewed information is used to further a self-determined "truth." In order to "red-pill" these people (one thread noted that "boomers" were the primary target), the plan was to create and circulate doctored screenshots of Snopes fact checks to make it appear as if Snopes fact-checkers addressed claims that we had not. Over the next few days, users created and shared these fake Snopes screenshots in a number of additional 4chan threads. These images were also posted on social media sites, like Twitter.... Some were humorous (we did not actually address the claim that CNN reporter Chris Cuomo was actually Fredo from "The Godfather"), some were insidious (we did not really publish a fact check questioning the Holocaust), and some were political (we did not publish a fact check questioning the results of the 2020 election before the election happened)... These red pill campaigns all follow a basic formula. The user decides what they want to be true and then they set out to find, or manufacture, the evidence to support that truth. A concerted effort is then made to spread these false narratives to as wide an audience as possible in order to "red-pill" the general population. In this formula, the desired "truth" comes first. The "evidence" comes second. It goes without saying that this method is antithetical to the mission of Snopes, fact-checkers in general, journalists, and anyone seeking an objective view of reality.' -- source: https://news.slashdot.org/story/20/10/24/1952242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Apple, Google and a Deal That Controls the Internet'
by Peter Reutemann 26 Oct '20

26 Oct '20

'The New York Times' looks at "a deal that controls the internet" — Apple's agreement to feature Google as the preselected search engine for iPhones, saying America's Justice Department views it "as a prime example of what prosecutors say are Google's illegal tactics to protect its monopoly and choke off competition..." The scrutiny of the pact, which was first inked 15 years ago and has rarely been discussed by either company, has highlighted the special relationship between Silicon Valley's two most valuable companies — an unlikely union of rivals that regulators say is unfairly preventing smaller companies from flourishing. "We have this sort of strange term in Silicon Valley: co-opetition," said Bruce Sewell, Apple's general counsel from 2009 to 2017. "You have brutal competition, but at the same time, you have necessary cooperation." Apple and Google are joined at the hip even though Mr. Cook has said internet advertising, Google's bread and butter, engages in "surveillance" of consumers and even though Steve Jobs, Apple's co-founder, once promised "thermonuclear war" on his Silicon Valley neighbor when he learned it was working on a rival to the iPhone. Apple and Google's parent company, Alphabet, worth more than $3 trillion combined, do compete on plenty of fronts, like smartphones, digital maps and laptops. But they also know how to make nice when it suits their interests. And few deals have been nicer to both sides of the table than the iPhone search deal. Nearly half of Google's search traffic now comes from Apple devices, according to the Justice Department, and the prospect of losing the Apple deal has been described as a "code red" scenario inside the company. When iPhone users search on Google, they see the search ads that drive Google's business. They can also find their way to other Google products, like YouTube. A former Google executive, who asked not to be identified because he was not permitted to talk about the deal, said the prospect of losing Apple's traffic was "terrifying" to the company. The Justice Department, which is asking for a court injunction preventing Google from entering into deals like the one it made with Apple, argues that the arrangement has unfairly helped make Google, which handles 92 percent of the world's internet searches, the center of consumers' online lives... [C]ompetitors like DuckDuckGo, a small search engine that sells itself as a privacy-focused alternative to Google, could never match Google's tab with Apple. Apple now receives an estimated $8 billion to $12 billion in annual payments — up from $1 billion a year in 2014 — in exchange for building Google's search engine into its products. It is probably the single biggest payment that Google makes to anyone and accounts for 14 to 21 percent of Apple's annual profits. That's not money Apple would be eager to walk away from. In fact, Mr. Cook and Mr. Pichai met again in 2018 to discuss how they could increase revenue from search. After the meeting, a senior Apple employee wrote to a Google counterpart that "our vision is that we work as if we are one company," according to the Justice Department's complaint. The article remembers Steve Jobs unveiling the iPhone in 2007 — and then inviting Google CEO Eric Schmidt onto the stage. Schmidt, who was also on Apple's board of directors, joked "If we just sort of merged the two companies, we could just call them AppleGoo." He'd also added that with Google search on the iPhone, "you can actually merge without merging."' -- source: https://apple.slashdot.org/story/20/10/25/180214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Slashdot Asks: How Do You Feel About Btrfs?
by Peter Reutemann 25 Oct '20

25 Oct '20

'Linux Journal re-visiting the saga of the btrfs file system (initially designed at Oracle in 2007): The btrfs filesystem has taunted the Linux community for years, offering a stunning array of features and capability, but never earning universal acclaim. Btrfs is perhaps more deserving of patience, as its promised capabilities dwarf all peers, earning it vocal proponents with great influence. Still, [while] none can argue that btrfs is unfinished, many features are very new, and stability concerns remain for common functions. Most of the intended goals of btrfs have been met. However, Red Hat famously cut continued btrfs support from their 7.4 release, and has allowed the code to stagnate in their backported kernel since that time. The Fedora project announced their intention to adopt btrfs as the default filesystem for variants of their distribution, in a seeming juxtaposition. SUSE has maintained btrfs support for their own distribution and the greater community for many years. For users, the most desirable features of btrfs are transparent compression and snapshots; these features are stable, and relatively easy to add as a veneer to stock CentOS (and its peers). Administrators are further compelled by adjustable checksums, scrubs, and the ability to enlarge as well as (surprisingly) shrink filesystem images, while some advanced btrfs topics (i.e. deduplication, RAID, ext4 conversion) aren't really germane for minimal loopback usage. The systemd init package also has dependencies upon btrfs, among them machinectl and systemd-nspawn . Despite these features, there are many usage patterns that are not directly appropriate for use with btrfs. It is hostile to most databases and many other programs with incompatible I/O, and should be approached with some care. The original submission drew reactions from three disgruntled btrfs users. But the article goes on to explore providers of CentOS-compatible btrfs-enabled kernels, ultimately opining that "There are many 'rough edges' that are uncovered above with btrfs capabilities and implementations, especially with the measures taken to enable it for CentOS. Still, this is far better than ext2/3/4 and XFS, discarding all the desirable btrfs features, in that errors can be known because all filesystem content is checksummed." It would be helpful if the developers of btrfs and ZFS could work together to create a single kernel module, with maximal sharing of "cleanroom" code, that implemented both filesystems... Oracle is itself unwilling to settle these questions with either a GPL or BSD license release of ZFS. Oracle also delivers a btrfs implementation that is lacking in features, with inapplicable documentation, and out-of-date support tools (for CentOS 8 conversion). Oracle is the impediment, and a community effort to purge ZFS source of Oracle's contributions and unify it with btrfs seems the most straightforward option... It would also be helpful if other parties refrained from new filesystem efforts that lack the extensive btrfs functionality and feature set (i.e. Microsoft ReFS). Until such a day that an advanced filesystem becomes a ubiquitous commodity as Linux is as an OS, the user community will continue to be torn between questionable support, lack of features, and workarounds in a fragmented btrfs community. This is an uncomfortable place to be, and we would do well to remember the parties responsible for keeping us here. So how do Slashdot's readers feel about btrfs?' -- source: https://linux.slashdot.org/story/20/10/24/0146258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Patched an Actively-Exploited Zero-Day Bug in Chrome
by Peter Reutemann 25 Oct '20

25 Oct '20

'"Google released an update to its Chrome browser that patches a zero-day vulnerability in the software's FreeType font rendering library that was actively being exploited in the wild, Threatpost reported this week: Security researcher Sergei Glazunov of Google Project Zero discovered the bug which is classified as a type of memory-corruption flaw called a heap buffer overflow in FreeType. Glazunov informed Google of the vulnerability on Monday. Project Zero is an internal security team at the company aimed at finding zero-day vulnerabilities. By Tuesday, Google already had released a stable channel update, Chrome version 86.0.4240.111, that deploys five security fixes for Windows, Mac & Linux — among them a fix for the zero-day, which is being tracked as CVE-2020-15999 and is rated as high risk. "Google is aware of reports that an exploit for CVE-2020-15999 exists in the wild," Prudhvikumar Bommana of the Google Chrome team wrote in a blog post announcing the update Tuesday... "The fix is also in today's stable release of FreeType 2.10.4," Ben Hawkes, technical lead for the Project Zero team, tweeted. Meanwhile, security researchers took to Twitter to encourage people to update their Chrome browsers immediately to avoid falling victim to attackers aiming to exploit the flaw... In addition to the FreeType zero day, Google patched four other bugs — three of high risk and one of medium risk — in the Chrome update released this week... So far in the last 12 months Google has patched three zero-day vulnerabilities in its Chrome browser.' -- source: https://it.slashdot.org/story/20/10/25/029202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome Caught Exempting Google Sites From User Requests To Delete Data
by Peter Reutemann 25 Oct '20

25 Oct '20

'This week the Verge reported: If you ask Chrome to delete all cookies and site data whenever you quit the browser, it's reasonable to expect that this policy applies to all websites. Recently, though, a bug in the browser meant data wasn't being removed for two sites in particular: Google and YouTube. This problem was first documented by iOS developer Jeff Johnson on his blog. Johnson found that in Chrome version 86.0.4240.75, "local storage" data for Google.com and YouTube.com stuck around even after restarting the browser. We've been able to replicate similar behavior... The Register notes that Chrome's behavior could allow Google to stash cookie-style data as site data, allowing it to track users even when they think they're being careful by deleting their cookie and site data every time they close the browser. In a statement, Google said it was aware of the issue and was working on a fix... At least one of the affected sites, YouTube, appears to have already been fixed. After we upgraded the Chrome browser to version 86.0.4240.111, YouTube's local storage data seems to successfully purge after a restart, although the data from Google.com still sticks around.' -- source: https://tech.slashdot.org/story/20/10/25/0155246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Options For ps
by Lawrence D'Oliveiro 25 Oct '20

25 Oct '20

One look at the man page for ps(1) <https://man7.org/linux/man-pages/man1/ps.1.html> and you see all the different traditional option syntaxes it tries to be compatible with. The BSD style doesn’t even prefix options with dashes, which can lead to ambiguities and is best avoided. If this is what you’re used to, try to wean yourself off it. To list some useful info about all processes, you can do ps -ef or, for even more info, try ps -eF One thing I find annoying about this it reports less precision in process start times for long-running processes. To get around this, you can use a custom format. For example ps -eo pid,ppid,lstart,tty,etime,cmd shows some similar info to the default “-f” format, but always includes start time and elapsed time to the nearest second, regardless of how long the process has been running. Another useful command to use with ps is pgrep(1) <https://man7.org/linux/man-pages/man1/pgrep.1.html>, which lets you filter processes to get information for according to various criteria. Or you could just use grep(1) on the output from ps, as I suspect a lot of people do. ;)

1 1

Debian Donates 10,000 Euros to Fund Free and Decentralized Livestreaming
by Peter Reutemann 25 Oct '20

25 Oct '20

'PeerTube (developed by Framasoft) is "the free and decentralized alternative to video platforms, providing you over 400,000 videos published by 60,000 users and viewed over 15 million times," according to its web site. But now they're exploring livestreaming, writes Debian developer Phil Hands (Slashdot reader #2,365): Holding DebConf20 online this year highlighted the effort involved in setting up Live Streaming using Free Software — something that is beyond the reach of many smaller events which is where PeerTube with Live Streaming should be a perfect fit. In June PeerTube had posted a roadmap with a humble request for donations in lieu of a crowdfunding campaign: At a time when no one knows what the future holds, we deem it inappropriate to start a crowdfunding campaign and threaten not to do our best on PeerTube if we don't get the necessary funds. We believe in the public utility of PeerTube, so much so that we commit to working on it for six months to make this v3 happen, even if we must do it with our own funds (which we had already done for v2). We still hope that by sharing this roadmap as widely as possible, some of you will support us in our approach with a donation that will allow us to fund this project. And this week PeerTube's official Twitter feed announced that "Thanks to Debian's €10,000 donation we've just reached the 4th step of our PeerTube fundraising" — livestreaming. "Many thanks to all those who donated. And it's not too late to contribute." "We hope this unconventional gesture from the Debian project will help us make this year somewhat less terrible," added the Debian blog, "and give us, and thus humanity, better Free Software tooling to approach the future." It describes their donation as "a strong sign of recognition from an international project — one of the pillars of the Free Software world — towards a small French association which offers tools to liberate users from the clutches of the web's giant monopolies." And secondly, "it's a substantial amount of help in these difficult times, supporting the development of a tool which equally belongs to and is useful to everyone. The strength of Debian's gesture proves, once again, that solidarity, mutual aid and collaboration are values which allow our communities to create tools to help us strive towards Utopia."' -- source: https://linux.slashdot.org/story/20/10/24/010213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

WHO To Grant Wikipedia Free Use of Its Published Material To Combat Covid Misinformation
by Peter Reutemann 23 Oct '20

23 Oct '20

'As part of efforts to stop the spread of false information about the coronavirus pandemic, Wikipedia and the World Health Organization announced a collaboration on Thursday: The health agency will grant the online encyclopedia free use of its published information, graphics and videos. The collaboration is the first between Wikipedia and a health agency. From a report: "We all consult just a few apps in our daily life, and this puts W.H.O. content right there in your language, in your town, in a way that relates to your geography," said Andrew Pattison, a digital content manager for the health agency who helped negotiate the contract. "Getting good content out quickly disarms the misinformation." Since its start in 2001, Wikipedia has become one of the world's 10 most consulted sites; it is frequently viewed for health information. The agreement puts much of the W.H.O.'s material into the Wikimedia "commons," meaning it can be reproduced or retranslated anywhere, without the need to seek permission -- as long as the material is identified as coming from the W.H.O. and a link to the original is included. "Equitable access to trusted health information is critical to keeping people safe and informed," said Tedros Adhanom Ghebreyesus, the W.H.O.'s director general. His agency translates its work into six official languages, which do not include, for example, Hindi, Bengali, German or Portuguese, so billions of people cannot read its documents in their native or even second language. Wikipedia articles, by contrast, are translated into about 175 languages. The first W.H.O. items used under the agreement are its "Mythbusters" infographics, which debunk more than two dozen false notions about Covid-19. Future additions could include, for example, treatment guidelines for doctors, said Ryan Merkley, chief of staff at the Wikimedia Foundation, which produces Wikipedia. If the arrangement works out, it could be extended to counter misinformation regarding AIDS, Ebola, influenza, polio and dozens of other diseases, Mr. Merkley said, "But this was something that just had to happen now." Eventually, live links will be established that would, for example, update global case and death numbers on Wikipedia as soon as the W.H.O. posts them, Mr. Pattison said.' -- source: https://news.slashdot.org/story/20/10/22/1833243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 5

Firefox 'Site Isolation' Feature Enters User Testing, Expected Next Year
by Peter Reutemann 23 Oct '20

23 Oct '20

'Site Isolation is a modern browser security feature that works by separating each web page and web iframes in their own operating system process in order to prevent sites from tampering or stealing with each other's data. The feature was first deployed with Google Chrome in mid-2018, with the release of Chrome 67. Although initially, Site Isolation was meant to be deployed as a general improvement to Chrome's security posture, the feature came just in time to serve as a protective measure against the Spectre vulnerability impacting modern CPUs. Seeing the feature's success, Mozilla also announced plans to support it with the Firefox browser in February 2019, as part of an internal project codenamed Fission. For both Google and Mozilla, implementing Site Isolation was a time-consuming operation, requiring engineers to re-write large chunks of their browsers' internal architecture. The process took about two years for both Google and Mozilla. While Site Isolation is now a stable feature inside Chrome, this work is now nearing its completion inside Firefox. According to an update to the Project Fission wiki page, Site Isolation can now be enabled inside versions of Firefox Nightly, the Firefox version where new features are tested.' -- source: https://news.slashdot.org/story/20/10/22/1717203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu Linux 20.10 'Groovy Gorilla' is Here With Renewed Raspberry Pi Focus
by Peter Reutemann 23 Oct '20

23 Oct '20

'As stated earlier, new Ubuntu versions come April and October, and wouldn't you know it, we are at the end of the latter. With Halloween a bit more than a week away, Canonical today releases Ubuntu 20.10. Ubuntu's version numbering scheme is based on year (YY), a period, and the month (MM). For instance, the previous stable version was released this past April and it is numbered as 20.04. In addition, Canonical (the operating system's owner) assigns names -- sequentially and alphabetically. The alphanumeric code name is always based on two words starting with the same sequential letter -- an adjective followed by an animal name. The aforementioned 20.04 is named "Focal Fossa." This time, the operating system will be called Ubuntu 20.10 "Groovy Gorilla." This new version of the desktop operating system is loaded with fixes, new features, and a renewed focus on the now-iconic Raspberry Pi. Yes, folks, with a compatible Pi (models with 4GB or 8GB of RAM), you can now have the full Ubuntu desktop experience.' -- source: https://news.slashdot.org/story/20/10/22/1737224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Vector Instructions: Everything Old Is New Again
by Lawrence D'Oliveiro 22 Oct '20

22 Oct '20

This article <https://www.sigarch.org/simd-instructions-considered-harmful/> (linked from <https://www.theregister.com/2020/10/21/sifive_vector_cpu_core/>) goes into how RISC-V implements vector instructions, and how this differs from the conventional SIMD approach taken by existing architectures like x86, ARM and MIPS. These CPUs add instructions that can operate on two, four or eight operands at once, in parallel. One drawback is that every new data type (and every new extension to dealing with greater parallelism) requires a new set of instructions, and so we a massive growth in the size of instruction sets for these machines over time. And then there is the trickiness of generating code using these instructions: even though you mostly leave it to the compiler to worry about this sort of thing nowadays, it still involves the generation of complicated sequences to set up a loop and deal with odd numbers of operands that don’t fit into the exact multiples that the instructions can deal with. So you wonder why a small sequence of source code can generate a whole lot of machine code. RISC-V, on the other hand, hearkens back to the grand-daddy of vector machines, the original Cray supercomputer family from the 1970s and 1980s. Here you have a vector-length register, which tells the CPU how many operands you have. You then set up operand pointer registers and write basically one instruction that operates on a single set of operands, and leave it to the hardware to automatically repeat this operation the required number of times, batching the iterations up to whatever size a particular implementation can handle in parallel. So the same code can run unchanged on future hardware with more parallel function units, and automatically take advantage of the greater performance.

1 0

TrueNAS R-series hyperconverged appliances blend storage and compute
by Peter Reutemann 22 Oct '20

22 Oct '20

'Today, storage vendor iXsystems is launching a new R-series hyperconverged infrastructure appliance for its TrueNAS product line—and the first alpha release of TrueNAS SCALE, a Debian Linux-based version of the TrueNAS storage distribution. The new R-series appliances are designed to run either traditional, FreeBSD-based TrueNAS, or the new Debian-based TrueNAS SCALE. The series launches with four models—all rack-mounted—ranging from the 1U, 16-bay TrueNAS R10 to the up to 12U, 52 bay TrueNAS R50. All four models offer Ethernet connectivity up to dual 100GbE, as well as optional dual 32Gb Fibre Channel and Intel Xeon CPUs. The three larger models are expandable via separate JBOD shelves as well. TrueNAS itself is an OpenZFS-based storage distribution, which can be purchased preinstalled on NAS hardware or installed by users on their own generic PC equipment. It offers users the rich feature set of the ZFS filesystem—including block-level checksums and data healing, advanced storage topologies, atomic COW snapshots, rapid asymmetric replication, and more—along with a broad range of network sharing protocols, including SMB, NFS, sFTP, and iSCSI.' -- source: https://arstechnica.com/gadgets/2020/10/ixsystems-launches-new-hyperconverg… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Fears 'Collateral Damage' in Google Antitrust Case
by Peter Reutemann 22 Oct '20

22 Oct '20

'Mozilla has responded to the U.S. Department of Justice's antitrust lawsuit against Google, but rather than commending the DOJ's action, the Firefox browser maker has voiced concerns that its commercial partnership could make it "collateral damage" in the fight against Google's alleged monopolistic practices. From a report: The DOJ, with support from 11 U.S. states, confirmed yesterday that it is suing Google for allegedly violating anti-competition laws by crowding out rivals in the internet search and advertising markets. "Small and independent companies such as Mozilla thrive by innovating, disrupting, and providing users with industry-leading features and services in areas like search," Mozilla chief legal officer Amy Keating wrote in a blog post. "The ultimate outcomes of an antitrust lawsuit should not cause collateral damage to the very organizations -- like Mozilla -- best positioned to drive competition and protect the interests of consumers on the web." Mozilla has a long and complicated history with Google. In recent years, Mozilla has launched countless privacy campaigns against the internet giant's various online properties, and just last month it introduced a new browser add-on to crowdsource research into YouTube's opaque recommendation algorithm. On the other hand, Mozilla relies heavily on royalties from a search engine partnership with Google. The duo recently extended their deal to make Google the default search engine inside Firefox in the U.S. and other markets, which will reportedly secure Mozilla up to $450 million over the next three years.' -- source: https://news.slashdot.org/story/20/10/21/1633207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Releases Chromium-Based Edge Preview For Linux
by Peter Reutemann 21 Oct '20

21 Oct '20

'Last month, Microsoft officials said they'd release a preview of the new Chromium-based Edge browser for Linux some time in October. On October 20, Microsoft made good on the promise, making available the Edge Dev Channel build for Linux. ZDNet reports: The new release supports Ubuntu, Debian, Fedora and openSUSE Linux distributions. Microsoft is planning to release weekly builds, like it does with the Dev Channel builds for other platforms. To get started, users can download and install a .deb or .rpm package directly from the Edge Insider site, which will configure a system to get future automatic updates. Or users can install Edge from Microsoft's Linux Software Repository. More detailed instructions are available on Microsoft's Chredge-on-Linux blog post. ' -- source: https://linux.slashdot.org/story/20/10/20/2144234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Seven Mobile Browsers Vulnerable To Address Bar Spoofing Attacks
by Peter Reutemann 21 Oct '20

21 Oct '20

'In a report published today by cyber-security firm Rapid7, the company said it worked with Pakistani security researcher Rafay Baloch to disclose ten new address bar spoofing vulnerabilities across seven mobile browser apps. From a report: Impacted browsers include big names like Apple Safari, Opera Touch, and Opera Mini, but also niche apps like Bolt, RITS, UC Browser, and Yandex Browser. The issues were discovered earlier this year and reported to browser makers in August. The big vendors patched the issues right away, while the smaller vendors didn't even bother replying to the researchers, leaving their browsers vulnerable to attacks. "Exploitation all comes down to 'JavaScript shenanigans'," said Rapid7's Research Director, Tod Beardsley. The Rapid7 exec says that by messing with the timing between when the page loads and when the browser gets a chance to refresh the address bar URL, a malicious site could force the browser to show the wrong address.' -- source: https://tech.slashdot.org/story/20/10/20/1850252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Backblaze Hard Drive Stats Q3 2020
by Peter Reutemann 21 Oct '20

21 Oct '20

'Backblaze's Q3 2020 hard drive stats: As of September 30, 2020, Backblaze had 153,727 spinning hard drives in our cloud storage ecosystem spread across four data centers. Of that number, there were 2,780 boot drives and 150,947 data drives. This review looks at the Q3 2020 and lifetime hard drive failure rates of the data drive models currently in operation in our data centers and provides a handful of insights and observations along the way. [...] There are several models with zero drive failures in the quarter. That's great, but when we dig in a little we get different stories for each of the drives. The 18TB Seagate model (ST18000NM000J) has 300 drive days and they've been in service for about 12 days. There were no out of the box failures which is a good start, but that's all you can say. The 16TB Seagate model (ST16000NM001G) has 5,428 drive days which is low, but they've been around for nearly 10 months on average. Still, I wouldn't try to draw any conclusions yet, but a quarter or two more like this and we might have something to say. The 4TB Toshiba model (MD04ABA400V) has only 9,108 drive days, but they have been putting up zeros for seven quarters straight. That has to count for something. The 14TB Seagate model (ST14000NM001G) has 21,120 drive days with 2,400 drives, but they have only been operational for less than one month. Next quarter will give us a better picture. The 4TB HGST (model: HMS5C4040ALE640) has 274,923 drive days with no failures this quarter.' -- source: https://hardware.slashdot.org/story/20/10/20/1927247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Adblockers Installed 300,000 Times Are Malicious and Should Be Removed Now
by Peter Reutemann 21 Oct '20

21 Oct '20

'Adblocking extensions with more than 300,000 active users have been surreptitiously uploading user browsing data and tampering with users' social media accounts thanks to malware its new owner introduced a few weeks ago, according to technical analyses and posts on Github. Hugo Xu, developer of the Nano Adblocker and Nano Defender extensions, said 17 days ago that he no longer had the time to maintain the project and had sold the rights to the versions available in Google's Chrome Web Store. Xu told me that Nano Adblocker and Nano Defender, which often are installed together, have about 300,000 installations total. Four days ago, Raymond Hill, maker of the uBlock Origin extension upon which Nano Adblocker is based, revealed that the new developers had rolled out updates that added malicious code. The first thing Hill noticed the new extension doing was checking if the user had opened the developer console. If it was opened, the extension sent a file titled "report" to a server at https://def.dev-nano.com/. "In simple words, the extension remotely checks whether you are using the extension dev tools -- which is what you would do if you wanted to find out what the extension is doing," he wrote. The most obvious change end users noticed was that infected browsers were automatically issuing likes for large numbers of Instagram posts, with no input from users. Cyril Gorlla, an artificial intelligence and machine learning researcher at the University of California in San Diego, told me that his browser liked more than 200 images from an Instagram account that didn't follow anyone. The screenshot to the right shows some of the photos involved.' -- source: https://it.slashdot.org/story/20/10/20/2116228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Surface Duo review—Orphaned Windows hardware makes a poor Android device
by Peter Reutemann 20 Oct '20

20 Oct '20

'After one of the strangest run-ups to launch in smartphone history, the Microsoft Surface Duo is here. Microsoft's first-ever Android phone (sorry, we're not counting the Nokia X) was announced and demoed an entire year before its release, hinting at what a long and winding road the Surface Duo took from inception to shipping. The hardware apparently dates back to plans to revitalize Windows for phones, but after that plan fell through, the hardware was upcycled into the most head-scratching Android phone of the year. The Surface Duo sales pitch is that foldable display technology isn't ready yet, so try this best-we-can-do-right-now version that features two rigid, 5.6-inch OLED displays attached together with a 360 hinge. Microsoft is calling this a "productivity" device thanks to it having the side-by-side app capability of a tablet-style foldable smartphone without any of the janky display technology. Microsoft's website also says the Duo was designed to "inspire people to rethink how they want to use the device in their pocket," indicating that the company definitely sees this as a primary device. I bring up Microsoft's sales pitch because, boy, is the Surface Duo bad at doing the things Microsoft says it's supposed to be good at. The phone feels like it was made without any respect to ergonomics, hand size, pocket-size, or anything that makes a good Android phone. It has crippling productivity problems that negate any benefit you could get from the two-screen design, it's extremely awkward in day-to-day use, and it's very buggy. The phone is missing a whole host of features you would expect for the stratospheric $1400 asking price, and even the hardware that is here seems like it's a least a year old. The Surface Duo feels like a phone that was slapped together without a plan, and the reports of the phone's history indicate that's what actually happened. We would like to gently welcome Microsoft to the Android ecosystem, but we are not grading $1400 smartphones on a curve. Microsoft needed to knock this out of the park. Instead, the company turned in a borderline incompetent smartphone that I really had to force myself to use during the review period.' -- source: https://arstechnica.com/gadgets/2020/10/surface-duo-review-orphaned-windows… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Chat goes free in 2021, while Hangouts loses features this month
by Peter Reutemann 20 Oct '20

20 Oct '20

'With the rise of Google Chat, Google Hangouts is going to die. Google initially announced this all the way back in 2018, and now we're getting more details about the service's slow shutdown and transition plans for the services that rely on it. We've already seen Hangouts lose location sharing and SMS support, and in the blog post, Google announced that phone calls, Google Fi support, and Google Voice support will soon be stripped away from the service.' -- source: https://arstechnica.com/gadgets/2020/10/google-chat-goes-free-in-2021-while… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fancy Bear imposters are on a hacking extortion spree
by Peter Reutemann 20 Oct '20

20 Oct '20

'Ransomware attacks that tear through corporate networks can bring massive organizations to their knees. But even as these hacks reach new popularity highs—and new ethical lows—among attackers, it's not the only technique criminals are using to shake down corporate victims. A new wave of attacks relies instead on digital extortion—with a side of impersonation. On Wednesday, the Web security firm Radware published extortion notes that had been sent to a variety of companies around the world. In each of them, the senders purport to be from the North Korean government hackers Lazarus Group, or APT38, and Russian state-backed hackers Fancy Bear, or APT28. The communications threaten that if the target doesn’t send a set number of bitcoin—typically equivalent to tens or even hundreds of thousands of dollars—the group will launch powerful distributed denial of service attacks against the victim, walloping the organization with a fire hose of junk traffic strategically directed to knock it offline. This type of digital extortion—give us what we’re asking for and we won’t attack you—has resurfaced repeatedly throughout the last decade. But in recent months, criminals have attempted to capitalize on fear about high-profile nation-state attacks, combined with anxieties related to rising ransomware attacks, to try to make some extra money.' -- source: https://arstechnica.com/information-technology/2020/10/fancy-bear-imposters… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers are using a severe Windows bug to backdoor unpatched servers
by Peter Reutemann 20 Oct '20

20 Oct '20

'One of the most critical Windows vulnerabilities disclosed this year is under active attack by hackers who are trying to backdoor servers that store credentials for every user and administrative account on a network, a researcher said on Friday. Zerologon, as the vulnerability has been dubbed, gained widespread attention last month when the firm that discovered it said it could give attackers instant access to active directories, which admins use to create, delete, and manage network accounts. Active directories and the domain controllers they run on are among the most coveted prizes in hacking, because once hijacked, they allow attackers to execute code in unison on all connected machines. Microsoft patched CVE-2020-1472, as the security flaw is indexed, in August. On Friday, Kevin Beaumont, working in his capacity as an independent researcher, said in a blog post that he had detected attacks on the honeypot he uses to keep abreast of attacks hackers are using in the wild. When his lure server was unpatched, the attackers were able to use a powershell script to successfully change an admin password and backdoor the server.' -- source: https://arstechnica.com/information-technology/2020/10/hackers-are-using-a-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi Foundation Launches Compute Module 4 for Industrial Users
by Peter Reutemann 20 Oct '20

20 Oct '20

'The Raspberry Pi Foundation is launching a new product today -- the Compute Module 4. From a report: If you've been keeping an eye on the Raspberry Pi releases, you know that the flagship Raspberry Pi 4 was released in June 2019. The Compute Module 4 features the same processor, but packed in a compute module for industrial use cases. A traditional Raspberry Pi is a single-board computer with a ton of ports sticking out. Compute Modules are somewhat different. Those system-on-module variants are more compact single-board computers without any traditional port. It lets you create a prototype using a traditional Raspberry Pi, and then order a bunch of Compute Modules to embed in your commercial products. "Over half of the seven million Raspberry Pi units we sell each year go into industrial and commercial applications, from digital signage to thin clients to process automation," Eben Upton wrote on the Raspberry Pi blog. Some things are strictly similar between the Raspberry Pi 4 and the Compute Module 4, such as the 64-bit ARM-based processor with VideoCore VI graphics. This is going to represent a huge upgrade for previous Compute Module customers. In particular, you get much better video performance with 4Kp60 hardware decode for H.265 videos, 1080p60 hardware decode for H.264 videos, 1080p30 hardware encode of H.264 videos. You can also take advantage of the dual HDMI interfaces to connect up to two 4K displays at 60 frames per second.' -- source: https://tech.slashdot.org/story/20/10/19/175255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Three npm Packages Opened Remote-Access Shells on Linux and Windows Systems
by Peter Reutemann 19 Oct '20

19 Oct '20

'"Three JavaScript packages have been removed from the npm portal on Thursday for containing malicious code," reports ZDNet. "According to advisories from the npm security team, the three JavaScript libraries opened shells on the computers of developers who imported the packages into their projects." The shells, a technical term used by cyber-security researchers, allowed threat actors to connect remotely to the infected computer and execute malicious operations. The npm security team said the shells could work on both Windows and *nix operating systems, such as Linux, FreeBSD, OpenBSD, and others. All three packages were uploaded on the npm portal in May (first) and September 2018 (last two). Each package had hundreds of downloads since being uploaded on the npm portal. The packages names were: plutov-slack-client nodetest199 nodetest1010 "Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer," the npm security team said.' -- source: https://it.slashdot.org/story/20/10/18/2321208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 5.10 Solves the Year 2038 Problem Until 2486
by Peter Reutemann 19 Oct '20

19 Oct '20

'The Linux 5.10 kernel's XFS file-system will have two new on-disk meta-data capabilities, reports Phoronix: 1. The size of inode btrees in the allocation group is now recorded. This is for increasing redundancy checks and also allowing faster mount times. 2. Support for timestamps now until the year 2486. This "big timestamps" feature is the refactoring of their timestamp and inode encoding functions to handle timestamps as a 64-bit nanosecond counter and bit shifting to increase the effective size. This now allows XFS to run well past the Year 2038 problem (where storing the time since 1970 in seconds will no longer fit in a signed 32-bit integer and thus wraparound) to now the Year 2486. Making a new XFS file-system with bigtime enabled allows a timestamp range from December 1901 to July 2486 rather than December 1901 to January 2038. For preserving backwards compatibility, the big timestamps feature is not currently enabled by default. ' -- source: https://linux.slashdot.org/story/20/10/17/2237236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bash Hackers’ Wiki
by Lawrence D'Oliveiro 18 Oct '20

18 Oct '20

Found this useful collection of Bash tips and tricks. May not be all that well maintained, but I found some handy pages, like this list <https://wiki.bash-hackers.org/scripting/bashchanges> of the more interesting features that were introduced in the various versions of Bash. I was looking for something like this because the Bash version in my Debian Unstable installations was just upgraded to 5.1.

1 0

Need A New Computer For Homeschooling? How About a 2007-Vintage MacBook?
by Lawrence D'Oliveiro 17 Oct '20

17 Oct '20

PC sales have been given a boost by, among other things, the need for schooling the young ones from home, but there’s no reason why they need the latest and greatest hardware for this. How about something from over a decade ago? Here a long-time collector of same <https://www.theregister.com/2020/10/16/need_a_new_computer_for/> reports how Apple-branded gear from that era can be obtained quite cheaply, is a lot easier to service and upgrade than the current stuff, and while it is not supported by current versions of Apple’s own OS, something like Linux will work just fine. That way you get a modern web browser, and enough grunt to stream video. What more could you ask for?

1 0

Quote Of The Week: The State Of Microsoft
by Lawrence D'Oliveiro 16 Oct '20

16 Oct '20

>From this <https://forums.theregister.com/forum/all/2020/10/15/microsoft_adopting_goog…> reader comment: ... today's Microsoft users really are left with best guesses [as to what their software is doing]. It's sad that web searches reveal that everybody's first concern on [Macs]/Linux is installing 3rd party things, but the first concern for everybody on Windows is uninstalling 1st party things. Ironically, nobody on Windows seems to use the term "jailbreak” ... ... yet.

1 0

Should Windows Move To A Linux Kernel?
by Lawrence D'Oliveiro 16 Oct '20

16 Oct '20

An engineer at Canonical has poured cold water <https://www.theregister.com/2020/10/15/even_2020_cannot_bring_forth/> over the suggestion by Eric Raymond that Microsoft might move to substituting a Linux kernel over its own in the Windows OS. Sure, the idea seems complicated and expensive, and very likely troublesome, too. But since when have Windows upgrades not been troublesome? Even updates between different versions of what is ostensibly all the same OS, Windows 10, have been far from smooth lately. Attempting the level of compatibility needed for every Win32 API and syscall would be a huge undertaking. Consider that the WINE folks have already provided a usable fraction of this, with resources that are only a drop in the bucket compared to those available to Microsoft. And as for the vast array of drivers enjoyed by the NT kernel, Barnes reckoned that shunting them into Linux would cost millions. Sure. But would it cost as much as having to continue maintaining them? Particularly since most of those drivers would not be needed, because Linux already has its own native ones. Furthermore, rebasing Windows on Linux could have the ironic effect of stifling competition should a kernel monoculture take hold. Interesting to discuss this use of the term “monoculture”. Linux is already adaptable to a wider range of platforms and applications than Windows can manage. This in spite of the fact that the Windows NT kernel has been fragmented into a number of different versions, including about 5 or 6 different ones for ARM, with little or no compatibility between them. Linux is able to manager better interoperability than that, even between versions for entirely different architectures.

1 0

Google and Intel Warn of High-Severity Bluetooth Security Bug In Linux
by Peter Reutemann 15 Oct '20

15 Oct '20

'An anonymous reader quotes a report from Ars Technica: Google and Intel are warning of a high-severity Bluetooth flaw in all but the most recent version of the Linux Kernel. While a Google researcher said the bug allows seamless code execution by attackers within Bluetooth range, Intel is characterizing the flaw as providing an escalation of privileges or the disclosure of information. The flaw resides in BlueZ, the software stack that by default implements all Bluetooth core protocols and layers for Linux. Besides Linux laptops, it's used in many consumer or industrial Internet-of-things devices. It works with Linux versions 2.4.6 and later. So far, little is known about BleedingTooth, the name given by Google engineer Andy Nguyen, who said that a blog post will be published "soon." A Twitter thread and a YouTube video provide the most detail and give the impression that the bug provides a reliable way for nearby attackers to execute malicious code of their choice on vulnerable Linux devices that use BlueZ for Bluetooth. Intel, meanwhile, has issued this bare-bones advisory that categorizes the flaw as privilege-escalation or information-disclosure vulnerability. The advisory assigned a severity score of 8.3 out of a possible 10 to CVE-2020-12351, one of three distinct bugs that comprise BleedingTooth. "Potential security vulnerabilities in BlueZ may allow escalation of privilege or information disclosure," the advisory states. "BlueZ is releasing Linux kernel fixes to address these potential vulnerabilities." Intel, which is a primary contributor to the BlueZ open source project, said that the most effective way to patch the vulnerabilities is to update to Linux kernel version 5.9, which was published on Sunday. Those who can't upgrade to version 5.9 can install a series of kernel patches the advisory links to. Maintainers of BlueZ didn't immediately respond to emails asking for additional details about this vulnerability. Ars Technica points out that since BleedingTooth requires proximity to a vulnerable device, there's not much reason for people to worry about this vulnerability. "It also requires highly specialized knowledge and works on only a tiny fraction of the world's Bluetooth devices," it adds.' -- source: https://it.slashdot.org/story/20/10/15/0043232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

KDE Plasma 5.20 Released
by Peter Reutemann 15 Oct '20

15 Oct '20

'KDE's Plasma 5.20 is now available, bringing a bunch of refinements as well as some larger features. Some of the KDE Plasma 5.20 highlights include (via Phoronix): - Numerous fixes to the KWin window manager / compositor including a number of Wayland fixes. Among the Wayland work in Plasma 5.20 includes Klipper support and middle-click paste, mouse and touchpad support nearly on par to X11, window thumbnails in the task manager, crash fixes, and more. - Improved notifications. - Different redesigns and additions to the KDE System Settings from SMART monitoring to better looking interfaces. - Redesigned on-screen displays. - Various tack manager and system tray improvements. ' -- source: https://tech.slashdot.org/story/20/10/14/0058213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Zoom To Roll Out End-to-End Encrypted (E2EE) Calls
by Peter Reutemann 15 Oct '20

15 Oct '20

'Video conferencing platform Zoom announced today plans to roll out end-to-end encryption (E2EE) capabilities starting next week. From a report: E2EE will allow Zoom users to generate individual encryption keys that will be used to encrypt voice or video calls between them and other conference participants. These keys will be stored locally and will not be shared with Zoom servers, meaning the software company won't be able to access or intercept any ongoing E2EE meetings. Support for E2EE calls will first be part of Zoom clients to be released next week. To use the new feature, users must update theri clients next week and enable support for E2EE calls at the account level. This green shield will contain a lock if E2EE is active. If the lock is absent, Zoom will use its default AES 256-bit GCM encryption scheme, which the company uses to secure current communications, but which the company can also intercept.' -- source: https://yro.slashdot.org/story/20/10/14/1722237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

WordPress Versus Jamstack
by Lawrence D'Oliveiro 14 Oct '20

14 Oct '20

Welcome to a new buzzword: “Jamstack”, which stands for “JavaScript, APIs and HTML Markup”. Or, in other words, websites made up of static pages, with all the dynamism implemented by JavaScript running on the browser. Hmm, maybe not quite all--that “APIs” part does still imply server-side dynamism of some sort. Seems the founder of WordPress is less than keen on the idea. WordPress, of course, is built very heavily around PHP code doing dynamic things (like reading and writing databases) server-side. Maybe the difference between the two is more one of degree and centralization rather than anything hard-and-fast. <https://www.theregister.com/2020/10/13/wordpress_matt_vs_netlify_matt/>

1 0

Oh, Those Lascivious Sinful Onions ...
by Lawrence D'Oliveiro 14 Oct '20

14 Oct '20

A seed company had one of its ads banned by Facebook after the image in it was deemed to contain “overtly sexual positioning”. To the normal human eye it just looks like a picture of some onions. Not even the most depraved imagination seems incapable of conjuring more than that out of it. Judge for yourself <https://www.theregister.com/2020/10/13/in_brief_ai/> ...

1 0

Meeting next Monday
by Peter Reutemann 13 Oct '20

13 Oct '20

Hi everyone Due to labour day, our next (and last meeting before the AGM) will be next Monday already. Ian will talk a few minutes about his experience upgrading his Ubuntu to 20.04.1. However, we could do with additional content. Suggestions? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Notepad++/Windows -> Notepadqq/Linux
by Peter Reutemann 13 Oct '20

13 Oct '20

Hi everyone Today, I was looking for a (graphical) text editor that could search through a directory structure and replace a particular string in lots of config files. Just using find in conjunction with sed wasn't gonna cut it, as I needed to inspect each individual file first (but then do a single subversion commit covering all the files). While searching on alternativeto.net for an alternative to Notepad++, using this URL: https://alternativeto.net/software/notepad-plus-plus/ I came across Notepadqq, which had the desired functionality: https://notepadqq.com/ Just like Notepad++, it also has syntax highlighting for lots of different file types. It's great to have such a wide variety of editors out there! :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Long-term WLUG member featured in a good-news article
by Eric Light 13 Oct '20

13 Oct '20

Hi everyone! I apologise if this isn't appropriate here (it does verge on a political post), but I noticed a familiar name in The Spinoff today. Most of you will know Roderick Aldridge from his membership in the WLUG over the years. It's been quite nice to see his writing on non-technical issues as well. https://thespinoff.co.nz/society/12-10-2020/im-80-years-old-ive-never-touch… Thanks Roderick :) E -------------------------------------------- Q: Why is this email five sentences or less? A: http://five.sentenc.es

2 1

Linux 5.9 Boosts CPU Performance With FSGSBASE Support
by Peter Reutemann 13 Oct '20

13 Oct '20

'FSGSBASE support in Linux "has the possibility of helping Intel/AMD CPU performance especially in areas like context switching that had been hurt badly by Spectre/Meltdown and other CPU vulnerability mitigations largely on the Intel side," Phoronix wrote back in August. As it started its journey into the kernel, they provided a preview on August 10: The FSGSBASE support that was finally mainlined a few days ago for Linux 5.9 is off to providing a nice performance boost for both Intel and AMD systems... FSGSBASE support for the Linux kernel has been around a half-decade in the making and finally carried over the finish line by one of Microsoft's Linux kernel engineers... FSGSBASE particularly helps out context switching heavy workloads like I/O and allowing user-space software to write to the x86_64 GSBASE without kernel interaction. That in turn has been of interest to Java and others...On Linux 5.9 where FSGSBASE is finally mainlined, it's enabled by default on supported CPUs. FSGSBASE can be disabled at kernel boot time via the "nofsgsbase" kernel option. Today on the Linux kernel mailing list, Linus Torvalds announced the release of Linux 5.9: Ok, so I'll be honest - I had hoped for quite a bit fewer changes this last week, but at the same time there doesn't really seem to be anything particularly scary in here. It's just more commits and more lines changed than I would have wished for. And Phoronix reported: Linux 5.9 has a number of exciting improvements including initial support for upcoming Radeon RX 6000 "RDNA 2" graphics cards, initial Intel Rocket Lake graphics, NVMe zoned namespaces (ZNS) support, various storage improvements, IBM's initial work on POWER10 CPU bring-up, the FSGSBASE instruction is now used, 32-bit x86 Clang build support, and more. See our Linux 5.9 feature overview for the whole scoop on the many changes to see with this kernel.' -- source: https://linux.slashdot.org/story/20/10/12/0029215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apple's T2 Security Chip Has an Unfixable Flaw
by Peter Reutemann 13 Oct '20

13 Oct '20

'A recently released tool is letting anyone exploit an unusual Mac vulnerability to bypass Apple's trusted T2 security chip and gain deep system access. The flaw is one researchers have also been using for more than a year to jailbreak older models of iPhones. But the fact that the T2 chip is vulnerable in the same way creates a new host of potential threats. Worst of all, while Apple may be able to slow down potential hackers, the flaw is ultimately unfixable in every Mac that has a T2 inside. From a report: In general, the jailbreak community haven't paid as much attention to macOS and OS X as it has iOS, because they don't have the same restrictions and walled gardens that are built into Apple's mobile ecosystem. But the T2 chip, launched in 2017, created some limitations and mysteries. Apple added the chip as a trusted mechanism for securing high-value features like encrypted data storage, Touch ID, and Activation Lock, which works with Apple's "Find My" services. But the T2 also contains a vulnerability, known as Checkm8, that jailbreakers have already been exploiting in Apple's A5 through A11 (2011 to 2017) mobile chipsets. Now Checkra1n, the same group that developed the tool for iOS, has released support for T2 bypass. On Macs, the jailbreak allows researchers to probe the T2 chip and explore its security features. It can even be used to run Linux on the T2 or play Doom on a MacBook Pro's Touch Bar. The jailbreak could also be weaponized by malicious hackers, though, to disable macOS security features like System Integrity Protection and Secure Boot and install malware. Combined with another T2 vulnerability that was publicly disclosed in July by the Chinese security research and jailbreaking group Pangu Team, the jailbreak could also potentially be used to obtain FileVault encryption keys and to decrypt user data. The vulnerability is unpatchable, because the flaw is in low-level, unchangeable code for hardware. "The T2 is meant to be this little secure black box in Macs -- a computer inside your computer, handling things like Lost Mode enforcement, integrity checking, and other privileged duties," says Will Strafach, a longtime iOS researcher and creator of the Guardian Firewall app for iOS. "So the significance is that this chip was supposed to be harder to compromise -- but now it's been done."' -- source: https://apple.slashdot.org/story/20/10/12/1854254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Five-Eyes Nations + Japan, India Ask Big Tech To Bake Backdoors Into Everything
by Lawrence D'Oliveiro 12 Oct '20

12 Oct '20

The abovementioned nations have issued a joint statement <https://www.theregister.com/2020/10/11/international_statementon_end_to_end…> where they “urge industry to address our serious concerns where encryption is applied in a way that wholly precludes any legal access to content”. One of the ways to do this is “Enable law enforcement access to content in a readable and usable format where an authorisation is lawfully issued, is necessary and proportionate, and is subject to strong safeguards and oversight”. To the extent that this is not calling for restrictions on strong encryption altogether, merely on its wide adoption by certain large companies, I can live with it. Just so long as we are not forced into using the products and services provided by these companies as an inescapable part of our daily lives.

1 0

The Unreasonable Effectiveness Of The Julia Programming Language
by Lawrence D'Oliveiro 10 Oct '20

10 Oct '20

A report from the recent JuliaCon <https://arstechnica.com/science/2020/10/the-unreasonable-effectiveness-of-t…>: Six years ago, I wrote in these pages about the enduring prominence of Fortran for scientific computing and compared it with several other languages. I ended that article with a prediction that, in 10 years, a new language called Julia stood a good chance of becoming the one that scientists would turn to when tackling large-scale numerical problems. My prediction was not very accurate, though. It actually only took Julia about half that time. He goes on to talk about the “two-language problem” and the “expression problem”, and how Julia solves these through its “multiple-dispatch” feature. A key point is that, even with all these advanced features, it manages to maintain program speed close to that of C++.

1 0

controlling network manager from the console
by Peter Reutemann 08 Oct '20

08 Oct '20

Hi everyone For a project at work, I'm working with a Nvidia Jetson Nano (https://www.nvidia.com/en-us/autonomous-machines/embedded-systems/jetson-na…) In order to get it hooked up to the wireless network, I came across the following tutorial: https://learn.sparkfun.com/tutorials/adding-wifi-to-the-nvidia-jetson/all The interesting tidbit in this article was the "nmcli" tool (https://linux.die.net/man/1/nmcli) to control the network manager from the console. Really neat! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

Botched Excel Import May Have Caused Loss Of 15,841 UK COVID-19 Cases
by Lawrence D'Oliveiro 07 Oct '20

07 Oct '20

Looks like someone tried to load a file of nationwide Coronavirus test results into Microsoft Excel, and exceeded its maximum-row limit <https://arstechnica.com/tech-policy/2020/10/excel-glitch-may-have-caused-uk…>. The omission has since been fixed.

1 2

Free Software Foundation Turns 35
by Lawrence D'Oliveiro 07 Oct '20

07 Oct '20

<https://www.theregister.com/2020/10/06/fsf_35/>: The FSF is keen that all should don their sandals and share in the celebration, perhaps by trying out an approved GNU/Linux distribution, or switching out a proprietary app like Microsoft Office for LibreOffice, or Adobe Photoshop for the GNU Image Manipulation Program. Heck, one could even have a crack at GNU Emacs and celebrate a keyboard shortcut or two.

1 0

Python 3.9 Is Out
by Lawrence D'Oliveiro 07 Oct '20

07 Oct '20

Worth noting from <https://devclass.com/2020/10/06/python-3_9/>: * Merging of dictionaries with “|” and “|=” operators * Generics in type hints * General expressions now allowed in decorators (I didn’t actually realize there were restrictions before) * New PEG parser, with option to revert to old parser for now (not that I expect to notice any difference between the two) * Deprecation of features for Python 2 backward compatibility (to be removed altogether in 3.10)

1 0

Oracle vs Google Goes To The US Supreme Court
by Lawrence D'Oliveiro 07 Oct '20

07 Oct '20

The US Supreme Court is due to hear Google’s appeal tomorrow <https://arstechnica.com/tech-policy/2020/10/google-asks-supreme-court-to-ov…> against the CAFC ruling that APIs are copyrightable and that Google infringed Oracle’s copyright on the Java APIs. A few companies (including GitHub) have filed “amicus curiae” briefs explaining why allowing the verdict against Google to stand will have unfortunate consequences for the entire software industry. The CAFC (Court of Appeals for the Federal Circuit) is a notoriously “intellectual-property-friendly” court, shall we say. They wouldn’t even have got the chance to rule on the original verdict by Judge Alsup, except that the suit initially included a patent claim (that was very quickly thrown out). Definite points to Oracle’s lawyers for doing this: like a chess strategy where you advance a seemingly unimportant pawn in the opening moves that is immediately sacrificed, but the long-term consequences for your opponent’s position only become apparent some time later in the game.

1 0

Developers Are Managing 100× More Code Than They Were 10 Years Ago
by Lawrence D'Oliveiro 05 Oct '20

05 Oct '20

This survey <https://arstechnica.com/gadgets/2020/10/sourcegraph-devs-are-managing-100x-…> reports on the explosion in typical source code bases that seems to have occurred over the past decade. I have a couple of concerns with this: * The obvious quantity-versus-quality issue. How much of this is due to things like node.js pulling in hundreds of dependencies for a comparatively small class library? Clearly, “managing” does not mean “writing” or even “maintaining”. * The use of “technology” as some kind of synonym for “information technology”. You mean it didn’t require “technology” to conduct insurance, retail, food and beverage businesses before? After all, pencil and paper are “technologies”, too. And if you think they are easy things to make, well ... try making them yourself. </rant>

1 0

What Operating Systems Keep Things Running In Space?
by Lawrence D'Oliveiro 05 Oct '20

05 Oct '20

Nice report <https://arstechnica.com/features/2020/10/the-space-operating-systems-bootin…> going into some details on the proprietary VxWorks (popular with NASA) and the open-source RTEMS (originating from the US military, now heavily used by ESA). Also mentions SpaceChain, which was developed in order to implement a BitCoin network in space. This is based on Sylix, which comes from the Chinese military, but is now open-source as well. And there is some use of Linux, but only in situations where hard-realtime constraints can be guaranteed by lower-level custom hardware. Summary: VxWorks and RTEMS are pretty much identical in basic features and maturity/reliability, but RTEMS does have an edge in configurability.

1 0

DigitalOcean’s “Hacktoberfest” Backfires
by Lawrence D'Oliveiro 03 Oct '20

03 Oct '20

Cloud company Digital Ocean has started its seventh annual “Hacktoberfest” <https://www.theregister.com/2020/10/01/digitalocean_hacktoberfest_pull_requ…>, promising free T-shirts to those who submit “quality” pull requests to online open-source repositories. Seems this year, the “quality” proviso is being roundly ignored. Many project maintainers are being deluged with trivial and pointless patches, many of whose submittors readily admit they are only doing it for the T-shirt. Choice quote: Imagine an arsonist declaring, "Only you can prevent forest fires," and you can get a sense of the frustration among open source maintainers. Actually, I’m surprised this hasn’t happened in previous years. But then again, maybe it has: "Hacktoberfest has never generated anything of value for open source ... It’s a marketing stunt which sends a deluge of low-effort contributions to maintainers, leaving them to clean up the spam." There’s also a link to a rather pungently-named Twitter account which is collecting examples of these useless patch submissions.

2 1