November 2020 - wlug - list.wlug.org.nz

Fearing Drama, Mozilla Opens Public Consultation Before Worldwide Firefox DoH Rollout
by Peter Reutemann 20 Nov '20

20 Nov '20

'Mozilla has opened today a public comment and consultation period about the ways it could enable support for the controversial privacy-centric DNS-over-HTTPS (DoH) protocol inside Firefox. From a report: The browser maker's decision to open a rare public consultation period comes after the organization faced criticism last year in the UK for its plans to support DoH inside Firefox. UK government officials, law enforcement agencies, and local internet service providers criticized Mozilla for developing and wanting to roll out DoH, a feature they said could have helped suspects bypass enterprise firewalls and parental controls blocklists -- even earning the browser maker a nomination for an "Internet Villain" award from a local ISP. All last year's hoopla was caused by DoH, a web protocol developed as an alternative to the classic DNS (Domain Name System). DoH works by encrypting DNS queries (which are normally sent out in clear text) and hiding them inside normal-looking HTTPS web traffic.' -- source: https://tech.slashdot.org/story/20/11/19/1711200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

OpenStreetMap is Having a Moment
by Peter Reutemann 20 Nov '20

20 Nov '20

'Joe Morrison: The first time I spoke with Jennings Anderson, I couldn't believe what he was telling me. I mean that genuinely -- I did not believe him. He was a little incredulous about it himself. I felt like he was sharing an important secret with me that the world didn't yet know. The open secret Jennings filled me in on is that OpenStreetMap (OSM) is now at the center of an unholy alliance of the world's largest and wealthiest technology companies. The most valuable companies in the world are treating OSM as critical infrastructure for some of the most-used software ever written. The four companies in the inner circle -- Facebook, Apple, Amazon, and Microsoft -- have a combined market capitalization of over six trillion dollars. In almost every other setting, they are mortal enemies fighting expensive digital wars of attrition. Yet they now find themselves eagerly investing in and collaborating on OSM at an unprecedented scale (more on the scale later). What likely started as a conversation in a British pub between grad students in 2004 has spiraled out of control into an invaluable, strategic, voluntarily-maintained data asset the wealthiest companies in the world can't afford to replicate. I will admit that I used to think of OSM as little more than a virtuous hobby for over-educated Europeans living abroad -- a cutesy internet collectivist experiment somewhere on the spectrum between eBird and Linux. It's most commonly summarized with a variant of this analogy: OSM is to an atlas as Wikipedia is to an encyclopedia. OSM acolytes hate this comparison in the much same way baseball players resent when people describe the sport as "cricket for fat people." While vaguely truthful, it doesn't quite get to the spirit of the thing. OSM is incomparable. Over 1.5M individuals have contributed data to it. It averages 4.5M changes per day. The stats page on the OSM Wiki is a collection of hockey sticks. [...] ' -- source: https://slashdot.org/story/20/11/19/1935221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google is Rolling Out End-To-End Encryption for RCS in Android Messages Beta
by Peter Reutemann 20 Nov '20

20 Nov '20

'After two long, complicated years, every Android user worldwide (outside China) now has access to the next-gen texting standard that is replacing SMS. Google is directly offering RCS chat services through its Android Messages app to anybody who installs it and uses it as their default texting app, which partly bypasses a carrier rollout that, at times, has ranged from sluggish to incoherent to broken. From a report Just as importantly, Google has announced that it's finally beginning to enable a key privacy feature: end-to-end encryption. For Android users who use Android Messages, one-on-one chats will eventually be end-to-end encrypted by default, meaning neither carriers nor Google will be able to read the content of those messages. Even though encryption is only beginning to roll out to people who sign up for the public beta for Android Messages, turning on encryption for RCS is a very big deal. It's a massive privacy win, as it could mean that the de facto replacement for SMS will, by default, be private on the smartphone platform used by the vast majority of people worldwide. As for the people who use that other smartphone platform -- the iPhone -- we have no word on whether Apple intends to adopt the RCS standard. But as every carrier worldwide gets on board, and now that there is a clearer path to ensuring private communication with RCS, the pressure on Apple to participate is likely to build. Unfortunately, SMS becoming fully deprecated and replaced by RCS will only happen if all goes to plan for Google. Since initially announcing plans to transition to RCS as the primary texting platform for Android, the standard's rollout has been mired in confusion. In attempting to be neutral and make Android's texting a standard shared by carriers worldwide, Google set itself up with the job of herding multibillion-dollar cats -- with sadly predictable results.' -- source: https://tech.slashdot.org/story/20/11/19/1528230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

BBC Releases Doctor-Who-Themed RISC-V-Based Programming Kit
by Lawrence D'Oliveiro 20 Nov '20

20 Nov '20

The BBC has created a miniature computer, the “Doctor Who HiFive Inventor”, aimed at young ’uns trying to learn programming <https://www.theregister.com/2020/11/19/bbc_doctor_who_sifive/>. This uses a RISC-V processor from SiFive, includes quite a range of I/O interfaces, and comes with lessons narrated by Jodie “Thirteenth Doctor” Whittaker. Pricing looks comparable to Raspberry-π-based products, too.

1 0

Apple Silicon Performance
by Lawrence D'Oliveiro 20 Nov '20

20 Nov '20

You may have seen reports popping up everywhere as Apple’s new Macs running its ARM-based “Apple Silicon” chips get into the hands of the first buyers. They seem to offer remarkable performance while still managing good battery life, even while a lot of the software they are running is still written for x86 processors and being translated on the fly through the “Rosetta 2” emulator layer. One of the secrets to that performance is that the system RAM is integrated into the CPU chipset <https://www.theregister.com/2020/11/19/apple_m1_high_bandwidth_memory_perfo…>. Yup, that means RAM is not upgradeable on these machines.

1 0

Microsoft’s “Project Reunion” Leads To More Fragmentation
by Lawrence D'Oliveiro 20 Nov '20

20 Nov '20

If you thought the Microsoft Windows development landscape was already confusing enough, consider this update <https://www.theregister.com/2020/11/19/microsoft_winui_windows/> on “Project Reunion” ... which [Windows Developer VP] Gallo described as “a common platform for new apps and APIs so that they will work down-level across supported versions of Windows.” A developer asked: “For a new desktop app what is your recommendation, UWP? WinUI, WPF or WinForm?” To which there was no simple answer. Indeed, while the presentation introduced WinUI version 3, it appears WinUI 2.x will also continue to be developed. Instead, Gallo talked about no longer having binary choices, but being able to mix and match in the brave new Reunion world. I wonder if anybody at Microsoft really understands what “Reunion” means ...

1 0

Google's Native Version of Chrome For Apple's ARM Macs Is Out Now
by Peter Reutemann 19 Nov '20

19 Nov '20

'According to Chrome product manager Mark Chang, Google's version of Chrome that support ARM Macs is now available to download. The Verge reports: In theory, a native version of the notoriously resource-hungry browser might run more efficiently on Apple's Arm-based computers. In our reviews of the MacBook Air, MacBook Pro, and Mac mini equipped with the new M1 chip, though, we found that the version of Chrome built for Intel chips already runs well on Apple's new Macs, so hopefully this native version runs even better. You'll be able to pick which version of Chrome to download from the browser's website. Google began rolling out a new version of Chrome on Tuesday, touting the "the largest gain in Chrome performance in years" thanks to some under-the-hood changes. The company's blog about the new release didn't mention anything about a version optimized for Apple's Arm-based Macs.' -- source: https://apple.slashdot.org/story/20/11/18/2239226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Massive, China-State-Funded Hack Hits Companies Around the World, Report Says
by Peter Reutemann 19 Nov '20

19 Nov '20

'Ars Technica: Researchers have uncovered a massive hacking campaign that's using sophisticated tools and techniques to compromise the networks of companies around the world. The hackers, most likely from a well-known group that's funded by the Chinese government, are outfitted with both off-the-shelf and custom-made tools. One such tool exploits Zerologon, the name given to a Windows server vulnerability, patched in August, that can give attackers instant administrator privileges on vulnerable systems. Symantec uses the code name Cicada for the group, which is widely believed to be funded by the Chinese government and also carries the monikers of APT10, Stone Panda, and Cloud Hopper from other research organizations. The group has been active in espionage-style hacking since at least 2009 and almost exclusively targets companies linked to Japan. While the companies targeted in the recent campaign are located in the United States and other countries, all of them have links to Japan or Japanese companies. The attacks make extensive use of DLL side-loading, a technique that occurs when attackers replace a legitimate Windows dynamic-link library file with a malicious one. Attackers use DLL side-loading to inject malware into legitimate processes so they can keep the hack from being detected by security software. The campaign also makes use of a tool that's capable of exploiting Zerologon. Exploits work by sending a string of zeros in a series of messages that use the Netlogon protocol, which Windows servers use to let users log into networks. People with no authentication can use Zerologon to access an organization's crown jewels -- the Active Directory domain controllers that act as an all-powerful gatekeeper for all machines connected to a network. Microsoft patched the critical privilege-escalation vulnerability in August, but since then attackers have been using it to compromise organizations that have yet to install the update. Both the FBI and Department of Homeland Security have urged that systems be patched immediately. Among the machines compromised during attacks discovered by Symantec were domain controllers and file servers. Company researchers also uncovered evidence of files being exfiltrated from some of the compromised machines.' -- source: https://it.slashdot.org/story/20/11/19/0124204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

$6 Billion Linux Deal? SUSE IPO Rumored
by Peter Reutemann 18 Nov '20

18 Nov '20

'ZDNet: According to Bloomberg, EQT is planning an IPO for German Linux and enterprise software company SUSE. EQT is a Swedish-based private equity firm with 50 billion euros in raised capital. SUSE is the leading European Union (EU) Linux distributor. Over the years, SUSE has changed owners several times. First, it was acquired by Novell in 2004. Then, Attachmate, with some Microsoft funding, bought Novell and SUSE in 2010. This was followed in 2014 when Micro Focus purchased Attachmate and SUSE was spun off as an independent division. Then, EQT purchased SUSE from Micro Focus for $2.5 billion in March 2019. With an IPO of approximately $6 billion, EQT would do very well for itself in very little time. Bloomberg states that the IPO talks are in a very preliminary stage. Nothing may yet come of these conversations. As for SUSE, a company representative said, "As a company, we are constantly exploring ways to grow. But as a matter of corporate policy, we do not comment on rumor or speculation in the market."' -- source: https://linux.slashdot.org/story/20/11/17/2148202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 83 Arrives With HTTPS-Only Mode and Faster Performance
by Peter Reutemann 18 Nov '20

18 Nov '20

'Mozilla today launched Firefox 83 for Windows, Mac, and Linux. An anonymous reader shares a report: Firefox 83's highlight feature is HTTPS-Only Mode, in which the browser attempts to establish fully secure connections to every website (just like the EFF's HTTPS Everywhere). If it can't, Firefox asks for your permission before connecting to a website that doesn't support secure connections. To enable HTTPS-Only Mode, click on Firefox's menu button, hit Preferences, then Privacy & Security, scroll down to HTTPS-Only Mode, and choose "Enable HTTPS-Only Mode in all windows." [...] Firefox 83 also brings performance improvements (improved page load performance by up to 15%, page responsiveness by up to 12%, and reduced memory usage by up to 8%). Firefox 83 is also the penultimate version of the web browser that will run Flash software; Firefox 85 will completely disable it when it arrives on Jan. 12, 2021.' -- source: https://news.slashdot.org/story/20/11/17/1725230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0