November 2020 - wlug - list.wlug.org.nz

2FA Bypass Discovered In Web Hosting Software cPanel
by Peter Reutemann 26 Nov '20

26 Nov '20

'ZDNet: Security researchers have discovered a major security flaw in cPanel, a popular software suite used by web hosting companies to manage websites for their customers. The bug, discovered by security researchers from Digital Defense, allows attackers to bypass two-factor authentication (2FA) for cPanel accounts. These accounts are used by website owners to access and manage their websites and underlying server settings. Access to these accounts is critical, as once compromised, they grant threat actors full control over a victim's site. On its website, cPanel boasts that its software is currently used by hundreds of web hosting companies to manage more than 70 million domains across the world. But in a press release today, Digital Defense says that the 2FA implementation on older cPanel & WebHost Manager (WHM) software was vulnerable to brute-force attacks that allowed threat actors to guess URL parameters and bypass 2FA -- if 2FA was enabled for an account. While brute-forcing attacks, in general, usually take hours or days to execute, in this particular case, the attack required only a few minutes, Digital Defense said today. Exploiting this bug also requires that attackers have valid credentials for a targeted account, but these can be obtained from phishing the website owner. The good news is that Digital Defense has privately reported the bug, tracked as SEC-575, to the cPanel team, which has already released patches last week.' -- source: https://it.slashdot.org/story/20/11/25/2227200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

WireGuard for Windows 0.3.1 is the release you’ve been waiting for
by Peter Reutemann 26 Nov '20

26 Nov '20

'This Monday, WireGuard founder and lead developer Jason Donenfeld announced a new WireGuard release for the Windows platform. The release is something of a godsend for administrators hoping to implement WireGuard as a replacement for more traditional end-user VPNs in a business environment, adding several new features that will make their lives easier—or simply make its implementation possible, in environments where it otherwise would not. If you haven't heard about WireGuard yet, it's a relatively new VPN protocol featuring advanced cryptography. It's implemented from the ground up as an exercise in cleanly written, minimalist, maximally secure and performant code—and it succeeded at those goals well enough to get Linus Torvalds' own rarely-seen stamp of approval. ' -- source: https://arstechnica.com/gadgets/2020/11/wireguard-for-windows-0-3-1-is-the-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linus Torvalds Would Like To Use An M1 Mac For Linux, But...
by Peter Reutemann 25 Nov '20

25 Nov '20

'Yes, Torvalds said he'd love to have one of the new M1-powered Apple laptops, but it won't run Linux and, in an exclusive interview he explains why getting Linux to run well on it isn't worth the trouble. Steven J. Vaughan-Nichols writes via ZDNet: Recently, on the Real World Technologies forum, Linux's creator Linus Torvalds was asked what he thought of the new M1-powered Apple laptops. Torvalds replied, "I'd absolutely love to have one if it just ran Linux." You may think, "what's the problem? Doesn't Linux run on practically every processor on the planet from 80386s to IBM s390x to the ARM family of which Apple's M1 chip is a child?" Well, yes, yes it does. But it takes more than a processor to run a computer. Torvalds would like to run Linux on these next-generation Macs. As he said, "I've been waiting for an ARM laptop that can run Linux for a long time. The new Air would be almost perfect, except for the OS. And I don't have the time to tinker with it, or the inclination to fight companies that don't want to help." Aye, there's the rub. In an exclusive interview, Torvalds expanded on why he can't see porting Linux to the M1-based Macs. "The main problem with the M1 for me is the GPU and other devices around it, because that's likely what would hold me off using it because it wouldn't have any Linux support unless Apple opens up." Still, while Torvalds knows Apple opening up their chipsets "seems unlikely, but hey, you can always hope." Even if that "wasn't an issue," Torvalds continued, "My personal hope would be more cores. Even in a laptop, I don't care about 20-hour battery life (and I wouldn't get it building kernels anyway). I'd rather plug it in a bit more often, and have 8 big cores." As for the Mac's limited RAM -- no more than 16GBs on current models -- he can live with that. "16GBs is actually ok by me because I don't tend to do things that require a lot more RAM. All I do is read email, do git and kernel compiles. And yes, I have 64GB in my desktop, but that's because I have 32 cores and 64 threads, and I do hugely parallel builds. Honestly, even then 32GB would be sufficient for my loads." That said, other developers and power users may want more from the new Macs, Torvalds thinks. "The people who really want tons of memory are the ones doing multiple VMs or huge RAW file photography and video." ' -- source: https://hardware.slashdot.org/story/20/11/24/2225209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fwd: [NZLUG] CFP: LCA2021 Systems Administration Miniconf
by Peter Reutemann 25 Nov '20

25 Nov '20

Apologies for cross-posting, but since the event is down-under/online some people on this list might want to present/attend. Cheers, Peter ---------- Forwarded message --------- From: Ewen McNeill Date: Wed, Nov 25, 2020 at 11:33 AM Subject: [NZLUG] CFP: LCA2021 Systems Administration Miniconf To: NZ Linux Users Group <nzlug(a)lists.nzoss.org.nz> linux.conf.au 2021 is being held in an "Online Only" format from 23-25 January 2021 (Saturday through Monday!), starting with a Miniconf day on Saturday 2021-01-23. Based in UTC+11 (AEDT), it makes for a "sleep in" schedule for attending from New Zealand! Tickets are extra affordable this year (AU $125/$70/$30), and on sale now: https://lca2021.linux.org.au/attend/tickets/ (Sadly NZers don't get the electronic badge option :-( ) The Systems Administration Miniconf is one of four Miniconfs being held on Saturday 2021-01-23, and would welcome your presentation proposals now (closes 2020-12-18 AoE). For details see: https://sysadmin.miniconf.org/cfp21.html or read on, as the CFP is repeated below for your convenience. Ewen -=- cut here -=- LCA2021 Systems Administration Miniconf: Call for Presentations Saturday 2021-01-23 10:45-17:30 UTC+11 at Linux.conf.au 2021, Online Virtualisation has won! As of 2021, they have even virtualised our Systems Administration Miniconf! TL;DR: If you know our Miniconf, and know online presenting, you can propose your 15-20 minute Linux-related operations talk via the LCA2021 Dashboard *before* 2020-12-18: https://linux.conf.au/dashboard We'd particularly love your 2020 War Stories! Read on to find out more :-) Introduction ============ The linux.conf.au Systems Administration Miniconf returns for the 15th time as part of the very online linux.conf.au 2021, to be held without a venue (Venueless!), online on Saturday 2021-01-23, based in UTC+11 (AEDT -- Australian Eastern Daylight Time). The Systems Administration Miniconf focuses on tips, tricks, tools, and best practices used to manage real-world Linux environments both large and small. From single small servers through to 2,000 node Kubernetes Clusters. The organisers of the Systems Administration Miniconf would like to invite proposals for presentations to be delivered at the Miniconf. Please forward this CFP to your colleagues, peers, social networks, and other relevant mailing lists. Please help by encouraging submissions from people you would like to hear present at this Miniconf. We are open to presentations from speakers anywhere in the world, but please be mindful of the need to present during daytime in UTC+11 which may not be daytime in your local timezone (presenting late at night or very early in your morning is tricky!). More information and details of previous presentations at the Miniconf can be found at the website: https://sysadmin.miniconf.org/ Presentation Topics =================== 2020 has been a surprising year, and not the least for systems administration -- remote *everything* came with a rush, leaving many officeless, and dependent on the Internet and video conferencing. We would be particularly interested in talks about how 2020 has gone for your systems, how you dealt with the rapid changes in operating environment, and what your plans look like for a world where touching physical hardware frequently seems increasingly unlikely. Tell us your war stories :-) We would be very interested in retrospectives and "lessons learned" from the past year. We of course also welcome the usual range of talks on systems technology, automation, monitoring, troubleshooting, best current practices and so on. Presentations should be of a technical nature and speakers should assume that members of the audience have at least a couple of years experience in professional Linux administration (many in the audience will have decades of experience). Format of Presentations ======================= Due to the online only format, and its increased demands on the AV team, we have to fit into a more fixed structure within the LCA2021 Miniconf day. So we have less flexibility in our choice of presentations, that usual. We have openings for 15 and 20 minute short presentations (ie, each approximately half of a 45-minute "session", with a 10 minute gap in between). LCA2021 have indicated they have a strong preference for presentations to be given live, which will be easier if your local time zone is close to UTC+11 and you have an Internet connection with good upload speeds. For accepted Miniconf speakers the LCA2021 AV Team will want to check in with you *early* January 2021 to help ensure your presentation audio and visuals come across as well as possible. You may wish to watch the AV Team advice from PyConline AU 2020 to get some advanced hints on small changes you could make to help your presentation look and sound great: https://www.youtube.com/watch?v=C1TBqdULp4E Submitting talks ================ Please note that in order to give a presentation or attend the Miniconf you must be registered (and paid up by the time the conference happens) for the main linux.conf.au conference. Either for the full conference (Sat/Sun/Mon), or at least for the Miniconf day (Saturday 2021-01-23). As a one off "online only, LCA2021 only" special we have access to a small pool of "Miniconf Speaker" tickets, so if your employer will not pay for your ticket and the conference cost makes it difficult for you to attend/present please get in touch and we will see if we can help. To submit a talk to the LCA2021 Sysadmin Miniconf, create an account on the LCA2021 website: https://linux.conf.au/dashboard create a speaker profile, and then select "Systems Administration Miniconf Talk" (in the "New Proposal" section of the Dashboard), or while logged into the LCA2021 site, go directly to: https://linux.conf.au/proposals/submit/sysadmin-miniconf/ Questions should be sent to: lca2021 at sysadmin.miniconf.org Dates and Deadlines =================== To encourage early submissions, priority (both of inclusion and scheduling) will be given to presentations submitted by 23:59 (AoE -- ie any time zone) on Sunday 6 December 2020. If you have a good presentation idea, please let us know early, even if you need time to finalise the presentation abstract. 2020-12-06 - Deadline for early submissions 2020-12-11 - early acceptances 2020-12-18 - Deadline for all submissions 2020-12-21 - final acceptances 2020-12-24 - LCA2021 Sysadmin Miniconf initial programme published 2021-01-21 - LCA2021 Sysadmin Miniconf held (Online, UTC+11) Contact and Questions ===================== Please see our website at https://sysadmin.miniconf.org for more information on the miniconf, past presentations and presenting at it. If you have any questions please feel free to email the organisers at: lca2021 at sysadmin.miniconf.org -=- cut here -=- _______________________________________________ NZLUG mailing list NZLUG(a)lists.nzoss.org.nz http://lists.nzoss.org.nz/mailman/listinfo/nzlug -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

LISP presentation uploaded to WLUG github.
by Ian Stewart 25 Nov '20

25 Nov '20

Hi Folks, For last night's LISP presentation, the slide show file and the LISP demonstration programs have been uploaded to: https://github.com/WLUG/meetings/tree/master/2020/2020-11-23 The slide show is available in both .odp and .pdf formats. The demonstration programs all have shebangs for CLISP, but these may be changed to be for SBCL. The programs have been tested to work under both CLISP and SBCL. Note that SBCL seems to be fussier than CLISP and, for example, requires (defvar) functions before the variable could be loaded via a (setf) function. At the meeting Jake demonstrated the apropos function to help with finding symbols. An appendix slide has been added to the presentation to show this function. I have also added my first attempt at something resembling a real a LISP program, package-symbols.lisp. This program will list packages that are available to either SBCL or CLISP. Upon selecting a package, it will display all the symbols the package has. If the command line argument "function" is used (E.g., $ sbcl --script package-symbols function) then the symbols displayed will be filtered to only displaying symbols that are functions. cheers, Ian.

1 1

Gimp Turns 25
by Peter Reutemann 24 Nov '20

24 Nov '20

'The General Image Manipulation Program, GIMP, has turned 25. A brief celebration post detailed how the package started life as a July 1995 Usenet thought bubble by then-student Peter Mattis, who posted the following to several newsgroups: Suppose someone decided to write a graphical image manipulation program (akin to photoshop). Out of curiosity (and maybe something else), I have a few (2) questions: What kind of features should it have? (tools, selections, filters, etc.) What file formats should it support? (jpeg, gif, tiff, etc.)" Four months later, Mattis and fellow University of California Berkeley student Spencer Kimball delivered what they described as software "designed to provide an intuitive graphical interface to a variety of image editing operations." The software ran on Linux 1.2.13, Solaris 2.4, HPUX 9.05, and SGI IRIX. The answer to the file format support question turned out to be GIF, JPEG, PNG, TIFF, and XPM. The rest is history. Richard Stallman gave Mattis and Kimball permission to change the "General" in its name to "GNU", reflecting its open-source status. Today the program is released under the GNU General Public License. As the program added features such as layers, it grew more popular and eventually became a byword for offering a FOSS alternative to Photoshop even though the project pushes back against that description. The project's celebration page says volunteers did their "best to provide a sensible workflow to users by using common user interface patterns. That gave us a few questionable monikers like 'Photoshop for Linux', 'free Photoshop', and 'that ugly piece of software'. We still can wholeheartedly agree with the latter one only!"' -- source: https://it.slashdot.org/story/20/11/23/1946252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Mass-Produced, Librem 5 Linux Smartphone Begins Shipping to Customers
by Peter Reutemann 23 Nov '20

23 Nov '20

'This week Purism began shipping its mass-produced Librem 5 phone to customers, according to announcement from the company: The Librem 5 is a one-of-a-kind general-purpose computer in a phone form-factor that Purism has designed and built from scratch following a successful crowdfunding campaign that raised over $2.2 million. Both the hardware and software design is focused on respecting the end user's freedom and giving them control over their privacy and security. The Librem 5 doesn't run Android nor iOS but instead runs the same PureOS operating system as Purism's laptops and mini PC. The Librem 5 has unique hardware features including a user-removable cellular modem, WiFi card, and battery. Like with Librem laptops, the Librem 5 also features external hardware kill switches that cut power to the cellular modem, WiFi/Bluetooth, and front and back cameras and microphone so that the user can control when these devices are in use. All hardware switches can also be triggered together to enable "lockdown mode" which also disables the GPS, accelerometer and all other sensors... Another unique feature of the Librem 5 is convergence: the ability to connect the Librem 5 to a monitor or laptop dock and use it as a desktop computer running the same full-sized desktop applications as on Librem laptops. When in a phone form-factor, applications behave much like "responsive websites" and change their appearance for the smaller screen. This allows you to use the Librem 5 as a phone, a desktop, or a laptop with the same applications and same files. Their announcement notes their work on software making desktop applications "adaptive" to phone form factors, adding "This suite of software has now become the most popular software stack to use on other handheld Linux hardware." And they close with an appreciative comment from Purism's founder and CEO Todd Weaver: "Shipping the Librem 5 has been an immense multi-year developmental effort. It is the culmination of people's desire to see an alternative to Android and iOS and fund it, coupled with dedication from a team of experts addressing hardware, kernel, operating system, and applications that has turned a lofty near-impossible goal into reality. We have built a strong foundation and with the continued support of customers, the community, and developers, we will continue to deliver revolutionary products like the Librem 5 running PureOS."' -- source: https://mobile.slashdot.org/story/20/11/23/025228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Ubuntu Web Remix' Distro Offers Firefox-Based Chrome OS Alternative
by Peter Reutemann 23 Nov '20

23 Nov '20

'Rudra Saraswat is the creator of the Ubuntu Unity distro (which uses the Unity interface in place of Ubuntu's GNOME shell). But this week they released Ubuntu Web Remix, "a privacy-focused, open source alternative to Google Chrome OS/Chromium OS" using Firefox instead of Google Chrome/Chromium. Liliputing reports: If the name didn't give it away, this operating system is based on Ubuntu, but it's designed to offer a Chrome OS-like experience thanks to a simplified user interface and a set of pre-installed apps including the Firefox web browser, some web apps from /e/, and Anbox, a tool that allows you to run Android apps in Linux... You don't get the long battery life, cloud backup, and many other features that make Chromebooks different from other laptops (especially other cheap laptops). But if you're looking for a simple, web-centric operating system that isn't made by a corporate giant? Then I guess it's nice to have the option. Rudra Saraswat writes: An easy web-app (wapp) format has been created to package web-apps for the desktop. You can now create your own web apps using web technologies, package them for the desktop and install them easily. An experimental wapp store can be found at store.ubuntuweb.co, for distributing web apps. Developers and packagers can do pull requests at gitlab.com/ubuntu-web/ubuntu-web.gitlab.io to contribute wapps. ' -- source: https://news.slashdot.org/story/20/11/22/0226213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How Firefox Boosted Its JavaScript Performance
by Peter Reutemann 23 Nov '20

23 Nov '20

'InfoWorld reports: Firefox users can expect improved JavaScript performance in the Firefox 83 browser, with the Warp update to the SpiderMonkey JavaScript engine enabled by default. Also called WarpBuilder, Warp improves responsiveness and memory usage and speeds up page loads by making changes to JiT (just-in-time) compilers... Warp has been shown to be faster than Ion, SpiderMonkey's previous optimizing JiT, including a 20 percent improvement on Google Docs load time. Other JavaScript-intensive websites such as Netflix and Reddit also have shown improvement... Warp has replaced the front end — the MIR building phase — of the IonMonkey JiT... Mozilla also will continue to incrementally optimize the back end of the IonMonkey JiT, as Mozilla believes there is still room for improvement for JavaScript-intensive workloads.' -- source: https://news.slashdot.org/story/20/11/22/0412232 I agree, 83 feels snappier when browsing. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

After Restoring YouTube-dl, GitHub Revamps Its Copyright Takedown Policy
by Peter Reutemann 22 Nov '20

22 Nov '20

'On October 23rd GitHub initially complied with a takedown request for the open-source project youtube-dl — and then after 24 days, reinstated it. "If there's a silver lining to the episode, it's that GitHub is implementing new policies to avoid a repeat of a repeat situation moving forward," reports Engadget: First, it says a team of both technical and legal experts will manually evaluate every single section 1201 claim. In instances where there's any ambiguity to a claim, the company says it will err on the side of developers and leave their repository online. If the company's technical and legal teams ultimately find any issues with a project, GitHub will give its owners the chance to address those problems before it takes down their work. Following a takedown, it will continue to give people the chance to recover their data — provided it doesn't include any offending code. GitHub is also establishing a $1 million defense fund to provide legal aid to developers against suspect section 1201 claims, as well as doubling down on its lobbying work to amend the DMCA and other similar copyright laws across the world. ' -- source: https://yro.slashdot.org/story/20/11/21/0554250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0