February 2020 - wlug - list.wlug.org.nz

Gopher's Rise and Fall Shows How Much We Lost When Monopolists Stole the Net
by Peter Reutemann 23 Feb '20

23 Feb '20

'Science-fiction writer, journalist and longtime Slashdot reader, Cory Doctorow, a.k.a. mouthbeef, writes: The Electronic Frontier Foundation (EFF) just published the latest installment in my case histories of "adversarial interoperability" -- once the main force that kept tech competitive. Today, I tell the story of Gopher, the web's immediate predecessor, which burrowed under the mainframe systems' guardians and created a menu-driven interface to campus resources, then the whole internet. Gopher ruled until browser vendors swallowed Gopherspace whole, incorporating it by turning gopher:// into a way to access anything on any Gopher server. Gopher served as the booster rocket that helped the web attain a stable orbit. But the tools that Gopher used to crack open the silos, and the moves that the web pulled to crack open Gopher, are radioactively illegal today. If you wanted do to Facebook what Gopher did to the mainframes, you would be pulverized by the relentless grinding of software patents, terms of service, anticircumvention law, bullshit theories about APIs being copyrightable. Big Tech blames "network effects" for its monopolies -- but that's a counsel of despair. If impersonal forces (and not anticompetitive bullying) are what keeps tech big then there's no point in trying to make it small. Big Tech's critics swallow this line, demanding that Big Tech be given state-like duties to police user conduct -- duties that require billions and total control to perform, guaranteeing tech monopolists perpetual dominance. But the lesson of Gopher is that adversarial interoperability is judo for network effects.' -- source: https://tech.slashdot.org/story/20/02/21/2240222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Dongle!!
by john 21 Feb '20

21 Feb '20

Hi All, Anyone care to help me with this issue please?? I just bought a USB Bluetooth adapter the icon on the desktop states ' standard: Detected Distance:255;Current State:gone; Status:No bluetooth device configured... Simulation mode (locking disabled)' Output from terminal. lsusb. Bus 003 Device 002: ID 0a12:0001 Cambridge Silicon Radio, Ltd Bluetooth Dongle (HCI mode) Output from "dmesg" 15.616762] Bluetooth: Core ver 2.22 [ 15.616785] NET: Registered protocol family 31 [ 15.616786] Bluetooth: HCI device and connection manager initialized [ 15.616790] Bluetooth: HCI socket layer initialized [ 15.616793] Bluetooth: L2CAP socket layer initialized [ 15.616800] Bluetooth: SCO socket layer initialized [ 18.714533] Bluetooth: BNEP (Ethernet Emulation) ver 1.3stan [ 18.714536] Bluetooth: BNEP filters: protocol multicast [ 18.714542] Bluetooth: BNEP socket layer initialized [ 20.153867] IPv6: ADDRCONF(NETDEV_UP): enp1s0: link is not ready [ 20.246093] r8169 0000:01:00.0 enp1s0: link down [ 20.246348] IPv6: ADDRCONF(NETDEV_UP): enp1s0: link is not ready [ 20.258191] IPv6: ADDRCONF(NETDEV_UP): wlx0019e08c5078: link is not ready [ 20.289093] IPv6: ADDRCONF(NETDEV_UP): wlx0019e08c5078: link is not ready [ 20.548998] IPv6: ADDRCONF(NETDEV_UP): wlx0019e08c5078: link is not ready [ 21.932491] wlx0019e08c5078: authenticate with 18:f1:45:96:63:4b [ 21.937373] wlx0019e08c5078: send auth to 18:f1:45:96:63:4b (try 1/3) [ 21.939214] wlx0019e08c5078: authenticated [ 21.939962] wlx0019e08c5078: associate with 18:f1:45:96:63:4b (try 1/3) [ 21.942561] wlx0019e08c5078: RX AssocResp from 18:f1:45:96:63:4b (capab=0x431 status=0 aid=1) [ 21.943456] wlx0019e08c5078: associated [ 21.981876] IPv6: ADDRCONF(NETDEV_CHANGE): wlx0019e08c5078: link becomes ready [ 26.871648] Bluetooth: RFCOMM TTY layer initialized [ 26.871656] Bluetooth: RFCOMM socket layer initialized [ 26.871663] Bluetooth: RFCOMM ver 1.11

2 1

Google launches the Android 11 Developer Preview today
by Peter Reutemann 21 Feb '20

21 Feb '20

'It's a bit earlier than the usual March release, but today Google is launching the first Android 11 Developer Preview. This first OS preview is coming to the Pixel 2, 3, 3a, and 4, along with generic system images for Project Treble devices. It also has a new name. Typically these releases have been denoted by a letter—Android 10 was the "Android Q Preview"—and while Android 11 is still called "Android R" internally, publicly this is the "Android 11 Developer Preview" to all us non-Googlers. True to form, Google has already started with the Spinal Tap references and starts the blog post with a dial that goes to 11. For now we're just working off a giant blog post with lots of bullet points, and nearly zero screenshots, so we're not sure what the scope of this release is really like. We'll have a hands-on later, but for now, here are some highlights. Android 10—The Ars Technica Review One of the most-used features of Android 11 will probably be a new "one-time permission" option for apps that want to access location, microphone, and camera data. In Android 10, Google added the ability to grant a permission to an app only when it was running in the foreground, and now users will be able to grant access to a permission a single time. This is already in iOS, and it makes a lot of sense for certain apps.' -- source: https://arstechnica.com/gadgets/2020/02/google-launches-the-android-11-deve… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

The Linux Foundation Identifies Most Important Open-Source Software Components and Their Problems
by Peter Reutemann 21 Feb '20

21 Feb '20

'The Linux Foundation's Core Infrastructure Initiative (CII) and the Laboratory for Innovation Science at Harvard (LISH) have revealed -- in "Vulnerabilities in the Core, a preliminary report and Census II of open-source software" -- the most frequently used components and the vulnerabilities they share. From a report: This Census II analysis and report is the first major study of its kind but isn't a final analysis. It takes important first steps and lays out a methodology for understanding and addressing open-source software structural and security complexities. Specifically, it also identifies the most commonly used free and open-source software (FOSS) components in production applications and examines them for potential vulnerabilities. To create this work, CII and LISH partnered with Software Composition Analysis (SCAs) and application security companies such as Snyk and Synopsys Cybersecurity Research Center. They combined private usage data with publicly available datasets for identifying over 200 of the most used open-source software projects. These are not the programs -- Apache, MySQL, Linux -- that probably spring to your mind. For all their foundational importance, it's the small building block programs that are most widely used. They may be small, sometimes less than a hundred lines of code (LoC), but they're vital. As Frank Nagle, a professor at Harvard Business School and co-director of the Census II project, said: "FOSS was long seen as the domain of hobbyists and tinkerers. However, it has now become an integral component of the modern economy and is a fundamental building block of everyday technologies like smart phones, cars, the Internet of Things, and numerous pieces of critical infrastructure. Understanding which components are most widely used and most vulnerable will allow us to help ensure the continued health of the ecosystem and the digital economy."' -- source: https://news.slashdot.org/story/20/02/20/1349241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft To Bring Its Defender Antivirus Software To iOS and Android
by Peter Reutemann 21 Feb '20

21 Feb '20

'Microsoft said today it plans to bring its antivirus software, Defender Advanced Threat Protection, to phones and other devices running Apple's iOS and Google's Android. From a report: The software, also called Defender ATP, is already available on Windows and MacOS. It offers features like preventive protection, post-breach detection and automated investigation and response, according to Microsoft. When it comes to mobile devices, Microsoft's Rob Lefferts said that the Defender software could help companies protect employees from things like malware and phishing attacks. Apple's and Google's app stores are "pretty safe," Lefferts said, but "malware does happen on those platforms."' -- source: https://it.slashdot.org/story/20/02/20/1928225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

VPN
by john 20 Feb '20

20 Feb '20

Are any of the Mozilla add-ons listed in the attachment a good thing to add to Firefox? Cheers John...

2 1

Mozilla's Standalone Firefox VPN is Now Available in Beta
by Peter Reutemann 20 Feb '20

20 Feb '20

'Mozilla has a new virtual private network service and if you have a Chromebook, a Windows 10 computer or an Android device in the US, you can start using a beta version now. From a report: Called Firefox Private Network, the new service is designed to function as a full-device VPN and give better protection when surfing the web or when using public Wi-Fi networks. The company offers two options: a free browser-extension version, which it launched in beta last year, that provides 12 one-hour VPN passes when using the Firefox browser and a Firefox account; and a second, $4.99-a-month option that provides a more complete VPN service across your whole device. The new paid option, which runs off of servers provided by Swedish open-source VPN company Mullvad, can protect up to five devices with one account. It allows for faster browsing and streaming, and gives you the ability to tap into servers located in "30-plus countries" for masking your location data.' -- source: https://news.slashdot.org/story/20/02/19/1910233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Why fixing security vulnerabilities in medical devices, IoT is so hard
by Peter Reutemann 20 Feb '20

20 Feb '20

'When your family opened up that brand-new computer when you were a kid, you didn’t think of all of the third-party work that made typing in that first BASIC program possible. There once was a time when we didn't have to worry about which companies produced all the bits of licensed software or hardware that underpinned our computing experience. But recent malware attacks and other security events have shown just how much we need to care about the supply chain behind the technology we use every day. The URGENT/11 vulnerability, the subject of a Cybersecurity and Infrastructure Security Agency advisory issued last July, is one of those events. It forces us to care because it affects multiple medical devices. And it serves as a demonstration of how the software component supply chain and availability of support can affect the ability of organizations to update devices to fix security bugs—especially in the embedded computing space. URGENT/11 is a vulnerability in the Interpeak Networks TCP/IP stack (IPNet), which was licensed out to multiple vendors of embedded operating systems. IPNet also became the main networking stack in Wind River VxWorks, until Wind River acquired Interpeak in 2006 and stopped supporting IPNet. (Wind River itself was acquired by Intel in 2009 and spun off in 2018.) But the end of support didn’t stop several other manufacturers from continuing to use IPNet. When critical bugs were discovered in IPNet, it set off a scare among the numerous medical device manufacturers that run it as part of their product build.' -- source: https://arstechnica.com/information-technology/2020/02/medical-device-vulne… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 73 Attack Dog
by Lawrence D'Oliveiro 19 Feb '20

19 Feb '20

Did my roughly-monthly update of Debian Unstable yesterday, and got yet another new version of Firefox. Quite sobering to see the extra protections being triggered now, on sites that I regularly visit. I got a warning earlier today about fingerprinters on aljazeera.com, though on revisiting the site a minute ago these no longer show up. Still an amazing number of cross-site tracking cookies, also present on arstechnica.com. The report for the latter shows a couple of fingerprinters currently being blocked, even though I got no explicit warning about that. It also says that “cryptominers” are blocked by default, but when I visited a certain well-known torrent-search site which has a policy of mining bitcoins on users’ machines, it didn’t show any present on that site, even though I could still hear my machine’s fans cranking up from the increased CPU load (which went away when I closed that tab).

1 0

Google Confirms It Again Removed Alleged Spying Tool ToTok From Google Play
by Peter Reutemann 18 Feb '20

18 Feb '20

'Google has confirmed that the popular messaging app ToTok, which is actually a spying tool used by the United Arab Emirates to track the activities of those who download it, has again been removed from the Play Store. But this time they declined to comment as to why. TechCrunch reports: Reached for comment, Google confirmed to TechCrunch that it removed the app from Google Play. In addition, Google noted the enforcement was not done in response to any external direction or request. That means the U.S. government did not get involved here, rather that Google chose to remove the app itself -- likely for a policy violation. According to The NYT's original report, ToTok had been downloaded millions of times from both Apple and Google's app stores by customers across the Middle East, Europe, Asia, Africa and North America in the few months since its launch. Citing unnamed U.S. intelligence sources, the report claimed the app had been used to track its users' "every conversation, movement, relationship, appointment, sound, and image." At the time of the app's removal, Google said the app had violated unspecified Google Play policies. The app had over 10 million installs by then, app intelligence firm Sensor Tower says. In January, ToTok's website announced the app was again available for download. The updated version submitted to Google Play included a new dialog that requested authorization to access and sync users' contact list, Vice reported. Oddly, this updated version of ToTok never ranked on Google Play's charts again.' -- source: https://yro.slashdot.org/story/20/02/17/2136251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0