October 2020 - wlug - list.wlug.org.nz

WHO To Grant Wikipedia Free Use of Its Published Material To Combat Covid Misinformation
by Peter Reutemann 23 Oct '20

23 Oct '20

'As part of efforts to stop the spread of false information about the coronavirus pandemic, Wikipedia and the World Health Organization announced a collaboration on Thursday: The health agency will grant the online encyclopedia free use of its published information, graphics and videos. The collaboration is the first between Wikipedia and a health agency. From a report: "We all consult just a few apps in our daily life, and this puts W.H.O. content right there in your language, in your town, in a way that relates to your geography," said Andrew Pattison, a digital content manager for the health agency who helped negotiate the contract. "Getting good content out quickly disarms the misinformation." Since its start in 2001, Wikipedia has become one of the world's 10 most consulted sites; it is frequently viewed for health information. The agreement puts much of the W.H.O.'s material into the Wikimedia "commons," meaning it can be reproduced or retranslated anywhere, without the need to seek permission -- as long as the material is identified as coming from the W.H.O. and a link to the original is included. "Equitable access to trusted health information is critical to keeping people safe and informed," said Tedros Adhanom Ghebreyesus, the W.H.O.'s director general. His agency translates its work into six official languages, which do not include, for example, Hindi, Bengali, German or Portuguese, so billions of people cannot read its documents in their native or even second language. Wikipedia articles, by contrast, are translated into about 175 languages. The first W.H.O. items used under the agreement are its "Mythbusters" infographics, which debunk more than two dozen false notions about Covid-19. Future additions could include, for example, treatment guidelines for doctors, said Ryan Merkley, chief of staff at the Wikimedia Foundation, which produces Wikipedia. If the arrangement works out, it could be extended to counter misinformation regarding AIDS, Ebola, influenza, polio and dozens of other diseases, Mr. Merkley said, "But this was something that just had to happen now." Eventually, live links will be established that would, for example, update global case and death numbers on Wikipedia as soon as the W.H.O. posts them, Mr. Pattison said.' -- source: https://news.slashdot.org/story/20/10/22/1833243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 5

Firefox 'Site Isolation' Feature Enters User Testing, Expected Next Year
by Peter Reutemann 23 Oct '20

23 Oct '20

'Site Isolation is a modern browser security feature that works by separating each web page and web iframes in their own operating system process in order to prevent sites from tampering or stealing with each other's data. The feature was first deployed with Google Chrome in mid-2018, with the release of Chrome 67. Although initially, Site Isolation was meant to be deployed as a general improvement to Chrome's security posture, the feature came just in time to serve as a protective measure against the Spectre vulnerability impacting modern CPUs. Seeing the feature's success, Mozilla also announced plans to support it with the Firefox browser in February 2019, as part of an internal project codenamed Fission. For both Google and Mozilla, implementing Site Isolation was a time-consuming operation, requiring engineers to re-write large chunks of their browsers' internal architecture. The process took about two years for both Google and Mozilla. While Site Isolation is now a stable feature inside Chrome, this work is now nearing its completion inside Firefox. According to an update to the Project Fission wiki page, Site Isolation can now be enabled inside versions of Firefox Nightly, the Firefox version where new features are tested.' -- source: https://news.slashdot.org/story/20/10/22/1717203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu Linux 20.10 'Groovy Gorilla' is Here With Renewed Raspberry Pi Focus
by Peter Reutemann 23 Oct '20

23 Oct '20

'As stated earlier, new Ubuntu versions come April and October, and wouldn't you know it, we are at the end of the latter. With Halloween a bit more than a week away, Canonical today releases Ubuntu 20.10. Ubuntu's version numbering scheme is based on year (YY), a period, and the month (MM). For instance, the previous stable version was released this past April and it is numbered as 20.04. In addition, Canonical (the operating system's owner) assigns names -- sequentially and alphabetically. The alphanumeric code name is always based on two words starting with the same sequential letter -- an adjective followed by an animal name. The aforementioned 20.04 is named "Focal Fossa." This time, the operating system will be called Ubuntu 20.10 "Groovy Gorilla." This new version of the desktop operating system is loaded with fixes, new features, and a renewed focus on the now-iconic Raspberry Pi. Yes, folks, with a compatible Pi (models with 4GB or 8GB of RAM), you can now have the full Ubuntu desktop experience.' -- source: https://news.slashdot.org/story/20/10/22/1737224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Vector Instructions: Everything Old Is New Again
by Lawrence D'Oliveiro 22 Oct '20

22 Oct '20

This article <https://www.sigarch.org/simd-instructions-considered-harmful/> (linked from <https://www.theregister.com/2020/10/21/sifive_vector_cpu_core/>) goes into how RISC-V implements vector instructions, and how this differs from the conventional SIMD approach taken by existing architectures like x86, ARM and MIPS. These CPUs add instructions that can operate on two, four or eight operands at once, in parallel. One drawback is that every new data type (and every new extension to dealing with greater parallelism) requires a new set of instructions, and so we a massive growth in the size of instruction sets for these machines over time. And then there is the trickiness of generating code using these instructions: even though you mostly leave it to the compiler to worry about this sort of thing nowadays, it still involves the generation of complicated sequences to set up a loop and deal with odd numbers of operands that don’t fit into the exact multiples that the instructions can deal with. So you wonder why a small sequence of source code can generate a whole lot of machine code. RISC-V, on the other hand, hearkens back to the grand-daddy of vector machines, the original Cray supercomputer family from the 1970s and 1980s. Here you have a vector-length register, which tells the CPU how many operands you have. You then set up operand pointer registers and write basically one instruction that operates on a single set of operands, and leave it to the hardware to automatically repeat this operation the required number of times, batching the iterations up to whatever size a particular implementation can handle in parallel. So the same code can run unchanged on future hardware with more parallel function units, and automatically take advantage of the greater performance.

1 0

TrueNAS R-series hyperconverged appliances blend storage and compute
by Peter Reutemann 22 Oct '20

22 Oct '20

'Today, storage vendor iXsystems is launching a new R-series hyperconverged infrastructure appliance for its TrueNAS product line—and the first alpha release of TrueNAS SCALE, a Debian Linux-based version of the TrueNAS storage distribution. The new R-series appliances are designed to run either traditional, FreeBSD-based TrueNAS, or the new Debian-based TrueNAS SCALE. The series launches with four models—all rack-mounted—ranging from the 1U, 16-bay TrueNAS R10 to the up to 12U, 52 bay TrueNAS R50. All four models offer Ethernet connectivity up to dual 100GbE, as well as optional dual 32Gb Fibre Channel and Intel Xeon CPUs. The three larger models are expandable via separate JBOD shelves as well. TrueNAS itself is an OpenZFS-based storage distribution, which can be purchased preinstalled on NAS hardware or installed by users on their own generic PC equipment. It offers users the rich feature set of the ZFS filesystem—including block-level checksums and data healing, advanced storage topologies, atomic COW snapshots, rapid asymmetric replication, and more—along with a broad range of network sharing protocols, including SMB, NFS, sFTP, and iSCSI.' -- source: https://arstechnica.com/gadgets/2020/10/ixsystems-launches-new-hyperconverg… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Fears 'Collateral Damage' in Google Antitrust Case
by Peter Reutemann 22 Oct '20

22 Oct '20

'Mozilla has responded to the U.S. Department of Justice's antitrust lawsuit against Google, but rather than commending the DOJ's action, the Firefox browser maker has voiced concerns that its commercial partnership could make it "collateral damage" in the fight against Google's alleged monopolistic practices. From a report: The DOJ, with support from 11 U.S. states, confirmed yesterday that it is suing Google for allegedly violating anti-competition laws by crowding out rivals in the internet search and advertising markets. "Small and independent companies such as Mozilla thrive by innovating, disrupting, and providing users with industry-leading features and services in areas like search," Mozilla chief legal officer Amy Keating wrote in a blog post. "The ultimate outcomes of an antitrust lawsuit should not cause collateral damage to the very organizations -- like Mozilla -- best positioned to drive competition and protect the interests of consumers on the web." Mozilla has a long and complicated history with Google. In recent years, Mozilla has launched countless privacy campaigns against the internet giant's various online properties, and just last month it introduced a new browser add-on to crowdsource research into YouTube's opaque recommendation algorithm. On the other hand, Mozilla relies heavily on royalties from a search engine partnership with Google. The duo recently extended their deal to make Google the default search engine inside Firefox in the U.S. and other markets, which will reportedly secure Mozilla up to $450 million over the next three years.' -- source: https://news.slashdot.org/story/20/10/21/1633207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Releases Chromium-Based Edge Preview For Linux
by Peter Reutemann 21 Oct '20

21 Oct '20

'Last month, Microsoft officials said they'd release a preview of the new Chromium-based Edge browser for Linux some time in October. On October 20, Microsoft made good on the promise, making available the Edge Dev Channel build for Linux. ZDNet reports: The new release supports Ubuntu, Debian, Fedora and openSUSE Linux distributions. Microsoft is planning to release weekly builds, like it does with the Dev Channel builds for other platforms. To get started, users can download and install a .deb or .rpm package directly from the Edge Insider site, which will configure a system to get future automatic updates. Or users can install Edge from Microsoft's Linux Software Repository. More detailed instructions are available on Microsoft's Chredge-on-Linux blog post. ' -- source: https://linux.slashdot.org/story/20/10/20/2144234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Seven Mobile Browsers Vulnerable To Address Bar Spoofing Attacks
by Peter Reutemann 21 Oct '20

21 Oct '20

'In a report published today by cyber-security firm Rapid7, the company said it worked with Pakistani security researcher Rafay Baloch to disclose ten new address bar spoofing vulnerabilities across seven mobile browser apps. From a report: Impacted browsers include big names like Apple Safari, Opera Touch, and Opera Mini, but also niche apps like Bolt, RITS, UC Browser, and Yandex Browser. The issues were discovered earlier this year and reported to browser makers in August. The big vendors patched the issues right away, while the smaller vendors didn't even bother replying to the researchers, leaving their browsers vulnerable to attacks. "Exploitation all comes down to 'JavaScript shenanigans'," said Rapid7's Research Director, Tod Beardsley. The Rapid7 exec says that by messing with the timing between when the page loads and when the browser gets a chance to refresh the address bar URL, a malicious site could force the browser to show the wrong address.' -- source: https://tech.slashdot.org/story/20/10/20/1850252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Backblaze Hard Drive Stats Q3 2020
by Peter Reutemann 21 Oct '20

21 Oct '20

'Backblaze's Q3 2020 hard drive stats: As of September 30, 2020, Backblaze had 153,727 spinning hard drives in our cloud storage ecosystem spread across four data centers. Of that number, there were 2,780 boot drives and 150,947 data drives. This review looks at the Q3 2020 and lifetime hard drive failure rates of the data drive models currently in operation in our data centers and provides a handful of insights and observations along the way. [...] There are several models with zero drive failures in the quarter. That's great, but when we dig in a little we get different stories for each of the drives. The 18TB Seagate model (ST18000NM000J) has 300 drive days and they've been in service for about 12 days. There were no out of the box failures which is a good start, but that's all you can say. The 16TB Seagate model (ST16000NM001G) has 5,428 drive days which is low, but they've been around for nearly 10 months on average. Still, I wouldn't try to draw any conclusions yet, but a quarter or two more like this and we might have something to say. The 4TB Toshiba model (MD04ABA400V) has only 9,108 drive days, but they have been putting up zeros for seven quarters straight. That has to count for something. The 14TB Seagate model (ST14000NM001G) has 21,120 drive days with 2,400 drives, but they have only been operational for less than one month. Next quarter will give us a better picture. The 4TB HGST (model: HMS5C4040ALE640) has 274,923 drive days with no failures this quarter.' -- source: https://hardware.slashdot.org/story/20/10/20/1927247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Adblockers Installed 300,000 Times Are Malicious and Should Be Removed Now
by Peter Reutemann 21 Oct '20

21 Oct '20

'Adblocking extensions with more than 300,000 active users have been surreptitiously uploading user browsing data and tampering with users' social media accounts thanks to malware its new owner introduced a few weeks ago, according to technical analyses and posts on Github. Hugo Xu, developer of the Nano Adblocker and Nano Defender extensions, said 17 days ago that he no longer had the time to maintain the project and had sold the rights to the versions available in Google's Chrome Web Store. Xu told me that Nano Adblocker and Nano Defender, which often are installed together, have about 300,000 installations total. Four days ago, Raymond Hill, maker of the uBlock Origin extension upon which Nano Adblocker is based, revealed that the new developers had rolled out updates that added malicious code. The first thing Hill noticed the new extension doing was checking if the user had opened the developer console. If it was opened, the extension sent a file titled "report" to a server at https://def.dev-nano.com/. "In simple words, the extension remotely checks whether you are using the extension dev tools -- which is what you would do if you wanted to find out what the extension is doing," he wrote. The most obvious change end users noticed was that infected browsers were automatically issuing likes for large numbers of Instagram posts, with no input from users. Cyril Gorlla, an artificial intelligence and machine learning researcher at the University of California in San Diego, told me that his browser liked more than 200 images from an Instagram account that didn't follow anyone. The screenshot to the right shows some of the photos involved.' -- source: https://it.slashdot.org/story/20/10/20/2116228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Surface Duo review—Orphaned Windows hardware makes a poor Android device
by Peter Reutemann 20 Oct '20

20 Oct '20

'After one of the strangest run-ups to launch in smartphone history, the Microsoft Surface Duo is here. Microsoft's first-ever Android phone (sorry, we're not counting the Nokia X) was announced and demoed an entire year before its release, hinting at what a long and winding road the Surface Duo took from inception to shipping. The hardware apparently dates back to plans to revitalize Windows for phones, but after that plan fell through, the hardware was upcycled into the most head-scratching Android phone of the year. The Surface Duo sales pitch is that foldable display technology isn't ready yet, so try this best-we-can-do-right-now version that features two rigid, 5.6-inch OLED displays attached together with a 360 hinge. Microsoft is calling this a "productivity" device thanks to it having the side-by-side app capability of a tablet-style foldable smartphone without any of the janky display technology. Microsoft's website also says the Duo was designed to "inspire people to rethink how they want to use the device in their pocket," indicating that the company definitely sees this as a primary device. I bring up Microsoft's sales pitch because, boy, is the Surface Duo bad at doing the things Microsoft says it's supposed to be good at. The phone feels like it was made without any respect to ergonomics, hand size, pocket-size, or anything that makes a good Android phone. It has crippling productivity problems that negate any benefit you could get from the two-screen design, it's extremely awkward in day-to-day use, and it's very buggy. The phone is missing a whole host of features you would expect for the stratospheric $1400 asking price, and even the hardware that is here seems like it's a least a year old. The Surface Duo feels like a phone that was slapped together without a plan, and the reports of the phone's history indicate that's what actually happened. We would like to gently welcome Microsoft to the Android ecosystem, but we are not grading $1400 smartphones on a curve. Microsoft needed to knock this out of the park. Instead, the company turned in a borderline incompetent smartphone that I really had to force myself to use during the review period.' -- source: https://arstechnica.com/gadgets/2020/10/surface-duo-review-orphaned-windows… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Chat goes free in 2021, while Hangouts loses features this month
by Peter Reutemann 20 Oct '20

20 Oct '20

'With the rise of Google Chat, Google Hangouts is going to die. Google initially announced this all the way back in 2018, and now we're getting more details about the service's slow shutdown and transition plans for the services that rely on it. We've already seen Hangouts lose location sharing and SMS support, and in the blog post, Google announced that phone calls, Google Fi support, and Google Voice support will soon be stripped away from the service.' -- source: https://arstechnica.com/gadgets/2020/10/google-chat-goes-free-in-2021-while… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fancy Bear imposters are on a hacking extortion spree
by Peter Reutemann 20 Oct '20

20 Oct '20

'Ransomware attacks that tear through corporate networks can bring massive organizations to their knees. But even as these hacks reach new popularity highs—and new ethical lows—among attackers, it's not the only technique criminals are using to shake down corporate victims. A new wave of attacks relies instead on digital extortion—with a side of impersonation. On Wednesday, the Web security firm Radware published extortion notes that had been sent to a variety of companies around the world. In each of them, the senders purport to be from the North Korean government hackers Lazarus Group, or APT38, and Russian state-backed hackers Fancy Bear, or APT28. The communications threaten that if the target doesn’t send a set number of bitcoin—typically equivalent to tens or even hundreds of thousands of dollars—the group will launch powerful distributed denial of service attacks against the victim, walloping the organization with a fire hose of junk traffic strategically directed to knock it offline. This type of digital extortion—give us what we’re asking for and we won’t attack you—has resurfaced repeatedly throughout the last decade. But in recent months, criminals have attempted to capitalize on fear about high-profile nation-state attacks, combined with anxieties related to rising ransomware attacks, to try to make some extra money.' -- source: https://arstechnica.com/information-technology/2020/10/fancy-bear-imposters… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers are using a severe Windows bug to backdoor unpatched servers
by Peter Reutemann 20 Oct '20

20 Oct '20

'One of the most critical Windows vulnerabilities disclosed this year is under active attack by hackers who are trying to backdoor servers that store credentials for every user and administrative account on a network, a researcher said on Friday. Zerologon, as the vulnerability has been dubbed, gained widespread attention last month when the firm that discovered it said it could give attackers instant access to active directories, which admins use to create, delete, and manage network accounts. Active directories and the domain controllers they run on are among the most coveted prizes in hacking, because once hijacked, they allow attackers to execute code in unison on all connected machines. Microsoft patched CVE-2020-1472, as the security flaw is indexed, in August. On Friday, Kevin Beaumont, working in his capacity as an independent researcher, said in a blog post that he had detected attacks on the honeypot he uses to keep abreast of attacks hackers are using in the wild. When his lure server was unpatched, the attackers were able to use a powershell script to successfully change an admin password and backdoor the server.' -- source: https://arstechnica.com/information-technology/2020/10/hackers-are-using-a-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi Foundation Launches Compute Module 4 for Industrial Users
by Peter Reutemann 20 Oct '20

20 Oct '20

'The Raspberry Pi Foundation is launching a new product today -- the Compute Module 4. From a report: If you've been keeping an eye on the Raspberry Pi releases, you know that the flagship Raspberry Pi 4 was released in June 2019. The Compute Module 4 features the same processor, but packed in a compute module for industrial use cases. A traditional Raspberry Pi is a single-board computer with a ton of ports sticking out. Compute Modules are somewhat different. Those system-on-module variants are more compact single-board computers without any traditional port. It lets you create a prototype using a traditional Raspberry Pi, and then order a bunch of Compute Modules to embed in your commercial products. "Over half of the seven million Raspberry Pi units we sell each year go into industrial and commercial applications, from digital signage to thin clients to process automation," Eben Upton wrote on the Raspberry Pi blog. Some things are strictly similar between the Raspberry Pi 4 and the Compute Module 4, such as the 64-bit ARM-based processor with VideoCore VI graphics. This is going to represent a huge upgrade for previous Compute Module customers. In particular, you get much better video performance with 4Kp60 hardware decode for H.265 videos, 1080p60 hardware decode for H.264 videos, 1080p30 hardware encode of H.264 videos. You can also take advantage of the dual HDMI interfaces to connect up to two 4K displays at 60 frames per second.' -- source: https://tech.slashdot.org/story/20/10/19/175255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Three npm Packages Opened Remote-Access Shells on Linux and Windows Systems
by Peter Reutemann 19 Oct '20

19 Oct '20

'"Three JavaScript packages have been removed from the npm portal on Thursday for containing malicious code," reports ZDNet. "According to advisories from the npm security team, the three JavaScript libraries opened shells on the computers of developers who imported the packages into their projects." The shells, a technical term used by cyber-security researchers, allowed threat actors to connect remotely to the infected computer and execute malicious operations. The npm security team said the shells could work on both Windows and *nix operating systems, such as Linux, FreeBSD, OpenBSD, and others. All three packages were uploaded on the npm portal in May (first) and September 2018 (last two). Each package had hundreds of downloads since being uploaded on the npm portal. The packages names were: plutov-slack-client nodetest199 nodetest1010 "Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer," the npm security team said.' -- source: https://it.slashdot.org/story/20/10/18/2321208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 5.10 Solves the Year 2038 Problem Until 2486
by Peter Reutemann 19 Oct '20

19 Oct '20

'The Linux 5.10 kernel's XFS file-system will have two new on-disk meta-data capabilities, reports Phoronix: 1. The size of inode btrees in the allocation group is now recorded. This is for increasing redundancy checks and also allowing faster mount times. 2. Support for timestamps now until the year 2486. This "big timestamps" feature is the refactoring of their timestamp and inode encoding functions to handle timestamps as a 64-bit nanosecond counter and bit shifting to increase the effective size. This now allows XFS to run well past the Year 2038 problem (where storing the time since 1970 in seconds will no longer fit in a signed 32-bit integer and thus wraparound) to now the Year 2486. Making a new XFS file-system with bigtime enabled allows a timestamp range from December 1901 to July 2486 rather than December 1901 to January 2038. For preserving backwards compatibility, the big timestamps feature is not currently enabled by default. ' -- source: https://linux.slashdot.org/story/20/10/17/2237236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bash Hackers’ Wiki
by Lawrence D'Oliveiro 18 Oct '20

18 Oct '20

Found this useful collection of Bash tips and tricks. May not be all that well maintained, but I found some handy pages, like this list <https://wiki.bash-hackers.org/scripting/bashchanges> of the more interesting features that were introduced in the various versions of Bash. I was looking for something like this because the Bash version in my Debian Unstable installations was just upgraded to 5.1.

1 0

Need A New Computer For Homeschooling? How About a 2007-Vintage MacBook?
by Lawrence D'Oliveiro 17 Oct '20

17 Oct '20

PC sales have been given a boost by, among other things, the need for schooling the young ones from home, but there’s no reason why they need the latest and greatest hardware for this. How about something from over a decade ago? Here a long-time collector of same <https://www.theregister.com/2020/10/16/need_a_new_computer_for/> reports how Apple-branded gear from that era can be obtained quite cheaply, is a lot easier to service and upgrade than the current stuff, and while it is not supported by current versions of Apple’s own OS, something like Linux will work just fine. That way you get a modern web browser, and enough grunt to stream video. What more could you ask for?

1 0

Quote Of The Week: The State Of Microsoft
by Lawrence D'Oliveiro 16 Oct '20

16 Oct '20

>From this <https://forums.theregister.com/forum/all/2020/10/15/microsoft_adopting_goog…> reader comment: ... today's Microsoft users really are left with best guesses [as to what their software is doing]. It's sad that web searches reveal that everybody's first concern on [Macs]/Linux is installing 3rd party things, but the first concern for everybody on Windows is uninstalling 1st party things. Ironically, nobody on Windows seems to use the term "jailbreak” ... ... yet.

1 0

Should Windows Move To A Linux Kernel?
by Lawrence D'Oliveiro 16 Oct '20

16 Oct '20

An engineer at Canonical has poured cold water <https://www.theregister.com/2020/10/15/even_2020_cannot_bring_forth/> over the suggestion by Eric Raymond that Microsoft might move to substituting a Linux kernel over its own in the Windows OS. Sure, the idea seems complicated and expensive, and very likely troublesome, too. But since when have Windows upgrades not been troublesome? Even updates between different versions of what is ostensibly all the same OS, Windows 10, have been far from smooth lately. Attempting the level of compatibility needed for every Win32 API and syscall would be a huge undertaking. Consider that the WINE folks have already provided a usable fraction of this, with resources that are only a drop in the bucket compared to those available to Microsoft. And as for the vast array of drivers enjoyed by the NT kernel, Barnes reckoned that shunting them into Linux would cost millions. Sure. But would it cost as much as having to continue maintaining them? Particularly since most of those drivers would not be needed, because Linux already has its own native ones. Furthermore, rebasing Windows on Linux could have the ironic effect of stifling competition should a kernel monoculture take hold. Interesting to discuss this use of the term “monoculture”. Linux is already adaptable to a wider range of platforms and applications than Windows can manage. This in spite of the fact that the Windows NT kernel has been fragmented into a number of different versions, including about 5 or 6 different ones for ARM, with little or no compatibility between them. Linux is able to manager better interoperability than that, even between versions for entirely different architectures.

1 0

Google and Intel Warn of High-Severity Bluetooth Security Bug In Linux
by Peter Reutemann 15 Oct '20

15 Oct '20

'An anonymous reader quotes a report from Ars Technica: Google and Intel are warning of a high-severity Bluetooth flaw in all but the most recent version of the Linux Kernel. While a Google researcher said the bug allows seamless code execution by attackers within Bluetooth range, Intel is characterizing the flaw as providing an escalation of privileges or the disclosure of information. The flaw resides in BlueZ, the software stack that by default implements all Bluetooth core protocols and layers for Linux. Besides Linux laptops, it's used in many consumer or industrial Internet-of-things devices. It works with Linux versions 2.4.6 and later. So far, little is known about BleedingTooth, the name given by Google engineer Andy Nguyen, who said that a blog post will be published "soon." A Twitter thread and a YouTube video provide the most detail and give the impression that the bug provides a reliable way for nearby attackers to execute malicious code of their choice on vulnerable Linux devices that use BlueZ for Bluetooth. Intel, meanwhile, has issued this bare-bones advisory that categorizes the flaw as privilege-escalation or information-disclosure vulnerability. The advisory assigned a severity score of 8.3 out of a possible 10 to CVE-2020-12351, one of three distinct bugs that comprise BleedingTooth. "Potential security vulnerabilities in BlueZ may allow escalation of privilege or information disclosure," the advisory states. "BlueZ is releasing Linux kernel fixes to address these potential vulnerabilities." Intel, which is a primary contributor to the BlueZ open source project, said that the most effective way to patch the vulnerabilities is to update to Linux kernel version 5.9, which was published on Sunday. Those who can't upgrade to version 5.9 can install a series of kernel patches the advisory links to. Maintainers of BlueZ didn't immediately respond to emails asking for additional details about this vulnerability. Ars Technica points out that since BleedingTooth requires proximity to a vulnerable device, there's not much reason for people to worry about this vulnerability. "It also requires highly specialized knowledge and works on only a tiny fraction of the world's Bluetooth devices," it adds.' -- source: https://it.slashdot.org/story/20/10/15/0043232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

KDE Plasma 5.20 Released
by Peter Reutemann 15 Oct '20

15 Oct '20

'KDE's Plasma 5.20 is now available, bringing a bunch of refinements as well as some larger features. Some of the KDE Plasma 5.20 highlights include (via Phoronix): - Numerous fixes to the KWin window manager / compositor including a number of Wayland fixes. Among the Wayland work in Plasma 5.20 includes Klipper support and middle-click paste, mouse and touchpad support nearly on par to X11, window thumbnails in the task manager, crash fixes, and more. - Improved notifications. - Different redesigns and additions to the KDE System Settings from SMART monitoring to better looking interfaces. - Redesigned on-screen displays. - Various tack manager and system tray improvements. ' -- source: https://tech.slashdot.org/story/20/10/14/0058213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Zoom To Roll Out End-to-End Encrypted (E2EE) Calls
by Peter Reutemann 15 Oct '20

15 Oct '20

'Video conferencing platform Zoom announced today plans to roll out end-to-end encryption (E2EE) capabilities starting next week. From a report: E2EE will allow Zoom users to generate individual encryption keys that will be used to encrypt voice or video calls between them and other conference participants. These keys will be stored locally and will not be shared with Zoom servers, meaning the software company won't be able to access or intercept any ongoing E2EE meetings. Support for E2EE calls will first be part of Zoom clients to be released next week. To use the new feature, users must update theri clients next week and enable support for E2EE calls at the account level. This green shield will contain a lock if E2EE is active. If the lock is absent, Zoom will use its default AES 256-bit GCM encryption scheme, which the company uses to secure current communications, but which the company can also intercept.' -- source: https://yro.slashdot.org/story/20/10/14/1722237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

WordPress Versus Jamstack
by Lawrence D'Oliveiro 14 Oct '20

14 Oct '20

Welcome to a new buzzword: “Jamstack”, which stands for “JavaScript, APIs and HTML Markup”. Or, in other words, websites made up of static pages, with all the dynamism implemented by JavaScript running on the browser. Hmm, maybe not quite all--that “APIs” part does still imply server-side dynamism of some sort. Seems the founder of WordPress is less than keen on the idea. WordPress, of course, is built very heavily around PHP code doing dynamic things (like reading and writing databases) server-side. Maybe the difference between the two is more one of degree and centralization rather than anything hard-and-fast. <https://www.theregister.com/2020/10/13/wordpress_matt_vs_netlify_matt/>

1 0