November 2020 - wlug - list.wlug.org.nz

Chrome 87 Released With Fix for NAT Slipstream Attacks, Broader FTP Deprecation
by Peter Reutemann 18 Nov '20

18 Nov '20

'Google has released today version 87 of its Chrome browser, a release that comes with a security fix for the NAT Slipstream attack technique and a broader deprecation of the FTP protocol. From a report: Todays' release is available for Windows, Mac, Linux, Chrome OS, Android, and iOS. Users can update to the new version via Chrome's built-in update utility. While in previous versions, Google has shipped some changes to Chrome settings and UI elements, almost all the major new Chrome 87 features are aimed at web developers. In Chrome 87, we have new APIs and updates to Chrome's built-in Developer Tools, such as: Support for the new Cookie Store API; new features to allow easier modification of web fonts via CSS; a new feature to let websites enumerate all the locally installed fonts; support for pan, tilt, and zoom controls on webcam streams; and, support for debugging WebAuthn operations via the Chrome DevTools.' -- source: https://slashdot.org/story/20/11/17/1810248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday
by Peter Reutemann 18 Nov '20

18 Nov '20

Hi everyone We have a meeting coming up next Monday: "Introduction to the LISP programming language will be presented by Jake Waas and Ian Stewart. They will focus on the open source CLISP and SBCL dialects of the LISP language and the use of functions in the COMMON-LISP package. By the end of the presentation you will be able to write simple LISP programs." -- details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/266792044/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Interview With KDE Developers
by Lawrence D'Oliveiro 17 Nov '20

17 Nov '20

Talk with a couple of the KDE “maintainers” (?) <https://www.theregister.com/2020/11/16/kde_maintainers_speak_on_why/> on the origins of KDE and where it stands today. The fact that it is built on Qt, which is heavily used in many commercial projects, means “Qt has to work well with a small footprint because of embedded systems, and that means KDE’s Plasma desktop has had a fundamental change since the mindset of KDE 3 days, when it was considered bloated and heavy,” said Riddell. “Now it’s a really fast, lightweight desktop.” Some other worthwhile info there, including discussions of working with Wayland and systemd.

1 0

GitHub Reinstates YouTube-dl Library After EFF Intervention
by Peter Reutemann 17 Nov '20

17 Nov '20

'GitHub has reinstated today the youtube-dl open-source project, a Python library that lets users download the source audio and video files behind YouTube videos. From a report: GitHub, a code-hosting repository, had previously removed the library from its portal after it received a controversial DMCA takedown request from the Recording Industry Association of America (RIAA) on October 23. In a DMCA takedown letter, RIAA argued that the library was being used to "circumvent the technological protection measures used by authorized streaming services such as YouTube" and to allow users to "reproduce and distribute music videos and sound recordings [...] without authorization." RIAA also noted that the project's source code "expressly suggests its use to copy and/or distribute the following copyrighted works." More specifically, RIAA used Section 1201 of the Digital Millennium Copyright Act (DMCA) to claim that the youtube-dl library was breaking copyright by providing a tool to circumvent copyrighted material -- even if the youtube-dl library didn't contain copyright-infringing code itself. But in a blog post today, GitHub said the library did not actually break Section 1201 of the DMCA, citing a letter it received from Electronic Frontier Foundation lawyers, who to take up the youtube-dl project's case. In the letter, the EFF team explained that Google does not have any technical measures in place to prevent the download of its videos -- all of which need to be made freely available to all kinds of apps, browsers, smart TVs, and more. Hence, EFF lawyers argued that the library could never be taken down under Section 1201 of the DMCA since the library doesn't actually circumvent any sort of copyright protection system in the first place.' -- source: https://yro.slashdot.org/story/20/11/16/1730250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ok Google: Please Publish Your DKIM Secret Keys
by Peter Reutemann 17 Nov '20

17 Nov '20

'Matthew Green, a cryptographer and professor at Johns Hopkins University, writes: The Internet is a dangerous place in the best of times. Sometimes Internet engineers find ways to mitigate the worst of these threats, and sometimes they fail. Every now and then, however, a major Internet company finds a solution that actually makes the situation worse for just about everyone. Today I want to talk about one of those cases, and how a big company like Google might be able to lead the way in fixing it. This post is about the situation with Domain Keys Identified Mail (DKIM), a harmless little spam protocol that has somehow become a monster. My request is simple and can be summarized as follows: Dear Google: would you mind rotating and publishing your DKIM secret keys on a periodic basis? This would make the entire Internet quite a bit more secure, by removing a strong incentive for criminals to steal and leak emails. The fix would cost you basically nothing, and would remove a powerful tool from hands of thieves.' -- source: https://tech.slashdot.org/story/20/11/16/1932234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

There’s Open Source, And There’s Open Source
by Lawrence D'Oliveiro 13 Nov '20

13 Nov '20

Vendors open-sourcing a bunch of code isn’t enough, if that code remains under the de-facto control of the vendor. It needs to be possible for a community to influence its development direction, rather than passively waiting for the next code drop from the vendor, according to Dave Airlie <https://www.theregister.com/2020/11/12/intel_igc_mesa/>. He says: “A warning then to anyone wishing for more vendor code sharing between OSes it generally doesn't end with Linux being better off, it ends up with Linux being more fragmented, harder to support and in the long run unsustainable.”

1 0

E-Cycle
by john 12 Nov '20

12 Nov '20

Hi All. Service industries now has a receiving warehouse offering all computers and paraphernalia can be dumped for free. Similarly any stuff that is salvageable is given away. Email ewasterecyclers(a)gmail.com Keily 021-526-4825 Adrian 020-256-2289 5 Johnson Street Dinsdale. Cheers John

1 0

Ubuntu fixes bugs that standard users could use to become root
by Peter Reutemann 12 Nov '20

12 Nov '20

'Ubuntu developers have fixed a series of vulnerabilities that made it easy for standard users to gain coveted root privileges. “This blog post is about an astonishingly straightforward way to escalate privileges on Ubuntu,” Kevin Backhouse, a researcher at GitHub, wrote in a post published on Tuesday. “With a few simple commands in the terminal, and a few mouse clicks, a standard user can create an administrator account for themselves.” The first series of commands triggered a denial-of-service bug in a daemon called accountsservice, which as its name suggests is used to manage user accounts on the computer. To do this, Backhouse created a Symlink that linked a file named .pam_environment to /dev/zero, changed the regional language setting, and sent accountsservice a SIGSTOP. With the help of a few extra commands, Backhouse was able to set a timer that gave him just enough time to log out of the account before accountsservice crashed. When done correctly, Ubuntu would restart and open a window that allowed the user to create a new account that—you guessed it—had root privileges.' -- source: https://arstechnica.com/information-technology/2020/11/ubuntu-fixes-bugs-th… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

No, the New MacBook Air is Not Faster Than 98% of PC Laptops
by Peter Reutemann 12 Nov '20

12 Nov '20

'Gordon Mah Ung, writing at PC World: Let me just say it outloud, OK? Apple is full of it. I'm referring to Apple's claim that its fanless, Arm-based MacBook Air is "faster than 98 percent of PC laptops." Yes, you read that correctly: Apple officials literally claimed that the new MacBook Air using Apple's custom M1 chip is faster than 98 percent of all PC laptops sold this year. Typically, when a company makes such a claim, it publishes a benchmark, a performance test or actual details on what it's basing that marketing claim on. This to prevent lawyers from launching out of missile silos across the world. Apple's website restates the claim by stating: "M1 is faster than the chips in 98 percent of PC laptops sold in the past year." The site also includes a detail note that states: "Testing conducted by Apple in October 2020 using preproduction 13-inch MacBook Pro systems with Apple M1 chip and 16GB of RAM. Performance measured using select industry-standard benchmarks. PC configurations from publicly available sales data over the last 12 months. Performance tests are conducted using specific computer systems and reflect approximate performance of MacBook Pro." So, not only does Apple not say what tests it's basing its claims on, it doesn't even say where it sources the comparable laptops. Does that mean the new fanless MacBook Air is faster than, say, Asus' stupidly fast Ryzen 4000 based, GeForce RTX 2060-based Zephyrus G14? Does it mean the MacBook Air is faster than Alienware's updated Area 51M? The answer, I'm going to guess is "no." Not at all. Is it faster than the miniLED-based MSI Creator 17? Probably not, either. And what is that "performance" claim hinged on? CPU performance? GPU performance? Performance running Windows? Is it using the same application running on both platforms? Is it experiential? Is this running Red Dead Redemption II or Call of Duty: Black Ops Cold War? Is it running CyberLink's PowerDirector? Is it running Fortnite? While I have absolutely no idea what Apple is basing its claims on, I can tell you that I am 98 percent sure that any of the above laptops listed will wreck the MacBook Air doing any of the tasks I just named. When Apple makes its claims, my guess is they are comparing the new M1 to Intel-based processors ranging from Atom to Celeron N to Core i3 and up, all with integrated graphics. But by not defining the word "performance," all this becomes just pure marketing spin. And is it really fair to compare a $999 MacBook to one that costs $150? Because $150 PCs are included in the 98 percent of laptops sold. Maybe Apple should compare its own $150 MacBook Air against a $150 Chromebook or Windows-based laptop. Of course, that would mean Apple would have to sell a product that most people can afford. I have no doubt the M1 will be impressive, but do I think it's going to compare to 8-cores of Ryzen 4000 performance or a GeForce RTX 2060? No.' -- source: https://apple.slashdot.org/story/20/11/11/2114225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome To Block Tab-Nabbing Attacks
by Peter Reutemann 12 Nov '20

12 Nov '20

'Google will deploy a new security feature in Chrome next year to prevent tab-nabbing, a type of web attack that allows newly opened tabs to hijack the original tab from where they were opened. From a report: The new feature is scheduled to go live with Chrome 88, to be released in January 2021. While the term "tab-nabbing" refers to a broad class of tab hijacking attacks [see OWASP, Wikipedia], Google is addressing a particular scenario. This scenario refers to situations when users click on a link, and the link opens in a new tab (via the "target=_blank" attribute). These new tabs have access to the original page that opened the new link. Via the JavaScript "window.opener" function, the newly opened tabs can modify the original page and redirect users to malicious sites. This type of attack has powered quite a few phishing campaigns across the years. To mitigate this threat, browser makers like Apple, Google, and Mozilla have created the rel="noopener" attribute.' -- source: https://tech.slashdot.org/story/20/11/11/1558242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0