March 2020 - wlug - list.wlug.org.nz

Intel CPUs Vulnerable To New LVI Attacks
by Peter Reutemann 11 Mar '20

11 Mar '20

'A team of academics from universities across the world, along with vulnerability researchers from Bitdefender, today disclosed a new security flaw in Intel processors. From a report: Named Load Value Injection, or LVI for short, this is a new class of theoretical attacks against Intel CPUs. While the attack has been deemed only a theoretical threat, Intel has released firmware patches to mitigate attacks against current CPUs, and fixes will be deployed at the hardware (silicon design) level in future generations.' -- source: https://it.slashdot.org/story/20/03/10/176200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DuckDuckGo is Good Enough For Regular Use
by Peter Reutemann 10 Mar '20

10 Mar '20

'Jake Voytko, who previously worked at Google, writing in a blog post: [...] Let's move away from Google's competitive advantages. How does DuckDuckGo perform for most of my search traffic? DuckDuckGo does a good job. I haven't found a reason to switch back to Google. I combed through my browser's history of DuckDuckGo searches. I compared it to my Google search history. When I fell back to Google, I often didn't find what I wanted on Google either. Most of my searches relate to my job, which means that most of my searches are technical queries. DuckDuckGo serves good results for my searches. I'll admit that I'm a paranoid searcher: I reformat error strings, remove identifiers that are unique to my code, and remove quotes before searching. I'm not sure how well DuckDuckGo would handle copy/pasted error strings with lots of quotes and unique identifiers. This means that I don't know if DuckDuckGo handles all technical searches well. But it does a good job for me. There are many domains where Google outperforms DuckDuckGo. Product search and local search are some examples. I recently made a window plug. It was much easier to find which big-box hardware stores had the materials I need with Google. I also recently bought a pair of ANC headphones. I got much better comparison information starting at Google. Google also shines with sparse results like rare programming error messages. If you're a programmer, you know what I'm talking about: imagine a Google search page with three results. One is a page in Chinese that has the English error string, one is a forum post that gives you the first hint that you need to solve the problem, and one is the error string in the original source code in Github. DuckDuckGo often returns nothing for these kinds of searches. Even though Google is better for some specific domains, I am confident that DuckDuckGo can find what I need. When it doesn't, Google often doesn't help either.' -- source: https://search.slashdot.org/story/20/03/09/1554252 I've been using DuckDuckGo for a number of years exclusively now and I agree with the author that when I can't find it with DDG, I can't find it with Google either. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

How Wikipedia's Volunteers Became the Web's Best Weapon Against Misinformation
by Peter Reutemann 10 Mar '20

10 Mar '20

'Fast Company just published a 4,000 appreciation of Wikipedia's volunteer editors: [W]hile places like Facebook, YouTube, and Twitter struggle to fend off a barrage of false content, with their scattershot mix of policies, fact-checkers, and algorithms, one of the web's most robust weapons against misinformation is an archaic-looking website written by anyone with an internet connection, and moderated by a largely anonymous crew of volunteers. "I think there's a part of that that is encouraging, that says that a radically open, collaborative worldwide project can build one of the most trusted sites on the internet," says Ryan Merkley, the chief of staff at the Wikimedia Foundation, the 400-person nonprofit that provides support to Wikipedia's community of editors. "There's another piece of that that is quite sad," he adds, "because it's clear that part of being one of the most trusted sites on the internet is because everything else has collapsed around us...." [U]nlike parts of the web where toxic information tends to spread, the encyclopedia has one big advantage: Its goal is not to "scale." It's not selling anything, not incentivizing engagement, not trying to get you to spend more time on it. Thanks to donations from thousands of donors around the world, there are no advertisers or investors to please, no algorithms to gather data or stir up emotions or personalize pages; everyone sees the same thing. That philanthropic spirit drives Wikipedia's volunteers, too, who come to the website not to share memes or jokes or even discuss the news but, marvelously, to build a reliable account of reality.... Despite the trolls and propagandists, the majority of errors, especially on controversial and highly trafficked pages, go away within minutes or hours, thanks to its phalanx of devoted volunteers. (Out of Wikipedia's 138 million registered users, about 138,000 have actively edited in the past month.) The site is self-governed according to a Byzantine body of rules that aim for courtesy and a "show your work" journalistic ethics built on accurate and balanced reporting. Vigilant community-built bots can alert Wikipedians to some basic suspicious behavior, and administrators can use restrictions to temporarily lock down the most vulnerable pages, keeping them safe from fly-by editors who are not logged in. "Most of these edits are small improvements to phrasing or content," says a 73-year-old retired physicist from Massachusetts who's done hundreds of edits himself. He adds that "a few are masterpieces, and some are vandalism."' -- source: https://news.slashdot.org/story/20/03/09/0346251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Brave Says it Will Generate Random Browser Fingerprints To Preserve User Privacy
by Peter Reutemann 10 Mar '20

10 Mar '20

'The Brave browser is working on a feature that will randomize its "fingerprint" every time a user visits a website in an attempt to preserve the user's privacy. From a report: Brave's decision comes as online advertisers and analytics firms are moving away from tracking users via cookies to using fingerprints. [...] "The unfortunate truth about all these approaches is that, despite being well-intentioned, none of them are very effective in preventing fingerprinting," the Brave team said of other browser makers' approaches. "The enormous diversity of fingerprinting surface in modern browsers makes these 'block', 'lie' or 'permission' approaches somewhere between insufficient and useless, unfortunately," they added. "Brave's new approach aims to make every browser look completely unique, both between websites and between browsing sessions," Brave developers said.' -- source: https://yro.slashdot.org/story/20/03/09/1822258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FSF Plans to Launch 'Forge', a Code-Hosting/Collaboration Platform
by Peter Reutemann 09 Mar '20

09 Mar '20

'The Free Software Foundation (FSF) announced plans to launch a public code hosting and collaboration platform ("forge") this year. Members of the FSF tech team are currently reviewing ethical web-based software that will help teams work on their projects, with features like merge requests, bug tracking, and other common tools. "Infrastructure is very important for free software, and it's unfortunate that so much free software development currently relies on sites that don't publish their source code, and require or encourage the use of proprietary software," FSF wrote in a blog post. "Our GNU ethical repository criteria aim to set a high standard for free software code hosting, and we hope to meet that with our new forge." As of now, the team said it has been researching a list of candidate programs and analyzing them in terms of ethical and practical criteria. The FSF blog post adds that "We plan on contributing improvements upstream for the new forge software we choose, to boost its score on those criteria... "We'll communicate with the upstream developers to request improvements and help clarify any questions related to the ethical repository criteria."' -- source: https://developers.slashdot.org/story/20/03/08/0323217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Blu-ray discs on Linux
by Ian Young 08 Mar '20

08 Mar '20

Hello all, Having acquired a laptop with a Blu-ray drive and then a Blu-ray disc I had a go at playing the disc with various live Linux versions. The closest was having the disc recognised and opening a player window (VLC iirc) but alas with no sound or vision. Other attempts failed with messages about no AACs being available or being unable to recognise the disc. A cursory survey of various web sources indicates that the best plan is to give up or use Windows. Anyone managed to get anywhere with this in Linux? The disc in question is by the band King Crimson live in Mexico titled Meltdown. Described as NTSC, Zone ABC, LPCM playable in all B-R players and drives. Thanks ~ Ian Y

2 1

FreeNAS and TrueNAS Are Merging
by Peter Reutemann 08 Mar '20

08 Mar '20

'FreeNAS is a free and open source operating system designed for network-attached storage (NAS) devices. For much of the past decade, the project has been led by the folks at iXsystems, which has also produced an enterprise version of the software called TrueNAS. Now iXsystems has announced that FreeNAS and TrueNAS are merging. Moving forward there will be a single operating system called TrueNAS rather than two different, but closely related operating systems. According to the company, the latest versions of the operating systems (FreeNAS 11.3 and TrueNAS 11.3) already share about 95-percent of the same source code. Starting with TrueNAS 12, there will only be a single OS image. But the company will offer two editions: TrueNAS CORE: open source edition TrueNAS Enterprise: commercial version with enterprise management and support.' -- source: https://news.slashdot.org/story/20/03/06/234216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

EFF: .Org Sale 'Threatens Instability and Dysfunction'
by Peter Reutemann 08 Mar '20

08 Mar '20

'In a scathing editorial, EFF continues to oppose Ethos Capital's plan to buy the PIR's .org domain registry for $1.1 billion, arguing that "the current system is stable and functional, and changing it threatens to introduce instability and dysfunction with no countervailing benefit to the community..." "[W]hile there is nothing currently wrong with .ORG, there is a lot that could go wrong if this deal moves forward." Ethos and PIR have repeatedly defended the proposed deal by arguing that converting PIR to a privately owned, for-profit enterprise will allow it to offer "new products and services," but without explaining what those new offerings might be. On Thursday, they finally admitted that they actually don't know what additional products and services .ORG registrants want or need, citing a lack of market research... The for-profit PIR that Ethos envisions would be a fundamentally different organization than today's PIR, and we have serious concerns about its business model and financial stability. Nothing we've heard from PIR and Ethos has convinced us that PIR should be transformed from something that we all know works to something that's unproven. To the contrary, the Ethos deal raises concrete dangers of censorship, financial and technical instability, and price-gouging of non-commercial .ORG registrants. And despite making their case for months, proponents of the deal haven't identified any specific benefits it would impart to .ORG users. ICANN can, and should, reject this change to the .ORG registry. But that time is running out; ICANN's current deadline to make a decision is Friday, March 20. You can still speak out: the ICANN Board is holding a public forum next week, Monday March 9 at 10am-11:30am Eastern Daylight Time. Anyone can join by videoconference and address the Board.' -- source: https://yro.slashdot.org/story/20/03/07/0619231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Edge Browser Scores Worst in Test of Telemetry Privacy
by Peter Reutemann 08 Mar '20

08 Mar '20

'"New academic research published last month looked at the phone-home [telemetry] features of six of today's most popular browsers and found that the Brave browser sent the smallest amount of data about its users back to the browser maker's servers," reports ZDNet: The research, conducted by Douglas J. Leith, a professor at Trinity College at the University of Dublin, looked at Google Chrome, Mozilla Firefox, Apple Safari, Brave, Microsoft Edge (the new Chromium-based version), and the Yandex Browser. "In the first (most private) group lies Brave, in the second Chrome, Firefox, and Safari, and in the third (least private) group lie Edge and Yandex...." [T]he professor found evidence that Chrome, Firefox, and Safari all tagged telemetry data with identifiers that were linked to each browser instance. These identifiers allowed Google, Mozilla, and Apple to track users across browser restarts, but also across browser reinstalls... [T]he most intrusive phoning-home features were found in the new version of Microsoft Edge and the official Yandex Browser. According to Prof. Leith, both used unique identifiers that were linked to the device's hardware, rather than the browser installation. Tracking users by hardware allows Microsoft and Yandex to follow users across installations and potentially link browser installs with other apps and online identities. The professor said that Edge collected the hardware UUID of the user's computer, an identifier that cannot be easily changed or deleted without altering a computer's hardware. Similarly, Prof. Leith also found that Yandex transmitted a hash of the hardware serial number and MAC address to its backend servers. "As far as we can tell this behaviour [in Edge and Yandex] cannot be disabled by users," the professor said. The article also points out that Brave was the only browser that didn't use search autocomplete functionality to collect and send back information on a user's visited web pages. (Even though this can be disabled in Firefox, Chrome, and Safari, it's on by default.) But Edge and Yandex "also sent back information about visited web pages that did not appear to be related to the search autocomplete feature, suggesting the browsers had other ways to track users' browsing habits."' -- source: https://apple.slashdot.org/story/20/03/07/0054219 A couple of articles on how to turn off telemetry within Firefox: https://www.askvg.com/tip-disable-telemetry-and-data-collection-in-mozilla-… https://www.howtogeek.com/557929/how-to-see-and-disable-the-telemetry-data-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Could Have Fixed 2FA Code-Stealing Flaw in Authenticator App Years Ago
by Peter Reutemann 08 Mar '20

08 Mar '20

'Last month, a cybersecurity firm discovered the first-ever Android malware that came with the capability to steal the 2FA (two-factor authentication) codes generated by the Google Authenticator app. The malware, discovered by researchers from ThreatFabric, was named Cerberus, and its 2FA OTP code-stealing feature was still under development, yet to have been detected in a real-world attack. According to researchers, the malware was a hybrid between a banking trojan and a remote access trojan (RAT). Once an Android user got infected, the hacker would use the malware's banking trojan features to steal credentials for mobile banking apps. If an account was protected by 2FA, and namely by the Google Authenticator app, the malware was designed to allow the Cerberus gang to connect to a user's device manually, via its RAT features. Hackers would then open the Authenticator app, generate one-time passcodes, take a screenshot of the codes, and then access the user's account. [...] Nightwatch researchers said that Google could have fixed this issue as early as October 2014, when this misconfiguration was first brought to its attention by someone on GitHub.' -- source: https://tech.slashdot.org/story/20/03/07/0918212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0