April 2020 - wlug - list.wlug.org.nz

distro showdown for virtual meeting in May?
by Peter Reutemann 26 Apr '20

26 Apr '20

Hi everyone What about a distro showdown for our (virtual) WLUG meeting in May? For instance: - GhostBSD - Ubuntu 20.04 - Manjaro - Arch - Gentoo - ... People can just demo a single distro for a few minutes via BigBlueButton (you can share your screen real easy with BBB). Thoughts? Volunteers? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Virtual meetings?
by Peter Reutemann 24 Apr '20

24 Apr '20

Hi everyone Our last meeting moved to virtual Google Hangout on short notice, which probably explained the low turnout. My question is, whether speakers and attendees would be willing to move to virtual ones, to keep our little community together and going? The last meeting was done with Google Hangouts, as it allows sharing the screen as well. Doesn't have to be Hangouts, it was simply convenient as a lot of people have gmail accounts. Open to viable alternatives. Stay safe! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

4 7

Why You Need A Bigger OS Partition
by Lawrence D'Oliveiro 24 Apr '20

24 Apr '20

root(a)theon:~ # apt-get install games-all Reading package lists... Done Building dependency tree Reading state information... Done The following additional packages will be installed: 0ad 0ad-data 0ad-data-common 7kaa 7kaa-data a7xpg a7xpg-data abe abe-data ace-of-penguins alex4 alex4-data armagetronad armagetronad-common asc asc-data asc-music atomix atomix-data bastet beep berusky berusky-data biniax2 biniax2-data blobby blobby-data bloboats blobwars blobwars-data blockattack bsdgames btanks btanks-data burgerspace bzflag-client bzflag-data caveexpress caveexpress-data cgoban chromium-bsu chromium-bsu-data cultivation darkplaces dreamchess dreamchess-data empire enigma enigma-data enigma-doc epiphany epiphany-data extremetuxracer extremetuxracer-data famfamfam-flag-png flare-engine flare-game flightgear flightgear-data-ai flightgear-data-all flightgear-data-base flightgear-data-models flightgear-phi ... ufoai-sound ufoai-textures unknown-horizons warmux warmux-data warzone2100 warzone2100-data warzone2100-music wesnoth wesnoth-1.14 wesnoth-1.14-aoi wesnoth-1.14-core wesnoth-1.14-data wesnoth-1.14-did wesnoth-1.14-dm wesnoth-1.14-dw wesnoth-1.14-ei wesnoth-1.14-httt wesnoth-1.14-l wesnoth-1.14-low wesnoth-1.14-music wesnoth-1.14-nr wesnoth-1.14-sof wesnoth-1.14-sota wesnoth-1.14-sotbe wesnoth-1.14-thot wesnoth-1.14-trow wesnoth-1.14-tsg wesnoth-1.14-ttb wesnoth-1.14-utbs widelands widelands-data xmoto xmoto-data Suggested packages: 7kaa-music bzflag-server freeciv-client-extras freeciv-sound-standard fretsonfire-game games-adventure games-arcade games-board games-c++-dev games-card games-chess games-console games-content-dev games-education games-emulator games-fps games-java-dev games-minesweeper games-mud games-perl-dev games-platform games-programming games-puzzle games-python3-dev games-racing games-rogue games-rpg games-shootemup games-simulation games-sport games-strategy games-tetris games-toys games-typing libopenal0a libsimage-dev libbullet2 libjs-jquery-flot-docs libjs-angularjs libswt-gtk-4-java minissdpd mumble minetest-mod-moreblocks minetest-mod-moreores minetest-mod-pipeworks minetest-server minetestmapper xqf openttd-opensfx pioneers-metaserver freecell-solver-bin pysolfc-cardsets python3-pil.imagetk-dbg python-pygame-doc spring-javaai teeworlds-server ufoai-server ufoai-uforadiant Recommended packages: fretsonfire The following NEW packages will be installed: ... 0 upgraded, 327 newly installed, 0 to remove and 86 not upgraded. Need to get 9,962 MB of archives. After this operation, 14.7 GB of additional disk space will be used. Do you want to continue? [Y/n] Time was when 30-40GB was sufficient for an OS partition. But not any more. This is why, when I upgraded my boot drive a few weeks ago, I allocated 100GB for the OS.

1 0

When in Doubt: Hang Up, Look Up, and Call Back
by Peter Reutemann 24 Apr '20

24 Apr '20

'Many security-conscious people probably think they'd never fall for a phone-based phishing scam. But if your response to such a scam involves anything other than hanging up and calling back the entity that claims to be calling, you may be in for a rude awakening. Brian Krebs: Here's how one security and tech-savvy reader got taken for more than $10,000 in an elaborate, weeks-long ruse. Today's lesson in how not to get scammed comes from "Mitch," the pseudonym I picked for a reader in California who shared his harrowing tale on condition of anonymity. Mitch is a veteran of the tech industry -- having worked in security for several years at a fairly major cloud-based service -- so he's understandably embarrassed that he got taken in by this confidence scheme. On Friday, April 17, Mitch received a call from what he thought was his financial institution, warning him that fraud had been detected on his account. Mitch said the caller ID for that incoming call displayed the same phone number that was printed on the back of his debit card. But Mitch knew enough of scams to understand that fraudsters can and often do spoof phone numbers. So while still on the phone with the caller, he quickly logged into his account and saw that there were indeed multiple unauthorized transactions going back several weeks. Most were relatively small charges -- under $100 apiece -- but there were also two very recent $800 ATM withdrawals from cash machines in Florida. If the caller had been a fraudster, he reasoned at the time, they would have asked for personal information. But the nice lady on the phone didn't ask Mitch for any personal details. Instead, she calmly assured him the bank would reverse the fraudulent charges and said they'd be sending him a new debit card via express mail. After making sure the representative knew which transactions were not his, Mitch thanked the woman for notifying him, and hung up. The following day, Mitch received another call about suspected fraud on his bank account. Something about that conversation didn't seem right, and so Mitch decided to use another phone to place a call to his bank's customer service department -- while keeping the first caller on hold. "When the representative finally answered my call, I asked them to confirm that I was on the phone with them on the other line in the call they initiated toward me, and so the rep somehow checked and saw that there was another active call with Mitch," he said. "But as it turned out, that other call was the attackers also talking to my bank pretending to be me."' -- source: https://it.slashdot.org/story/20/04/23/1933254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

NordVPN Unveils First Mainstream WireGuard Virtual Private Network
by Peter Reutemann 23 Apr '20

23 Apr '20

'One of the largest VPN companies, NordVPN, is rolling out NordLynx -- it's first mainstream WireGuard virtual private network for its Windows, Mac, Android and iOS client-software applications. ZDNet reports: NordVPN's own tests have shown NordLynx easily outperforms the other protocols, IKEv2/IPsec and OpenVPN. How much faster? According to NordVPN's 256,886 speed tests, "When a user connects to a nearby VPN server and downloads content that's served from a content delivery network (CDN) within a few thousand miles/kilometers, they can expect up to twice higher download and upload speed." While speed is what customers will notice, security experts like WireGuard for its code's simplicity. With only about 4,000 lines of code, WireGuard's code can be comprehensively reviewed by a single individual. Besides WireGuard, NordVPN adds in its double Network Address Translation (NAT) system to protect users' privacy. This enables users to establish a secure VPN connection while storing no identifiable user data on a server. You're assigned a dynamic local IP address that remains assigned only while the session is active. User authentication is done with the help of a secure external database. To switch to NordLynx, users need to update their NordVPN app to the latest version. The NordLynx protocol can be chosen manually from the Settings menu. ' -- source: https://tech.slashdot.org/story/20/04/22/2029227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

From The “Too Much Time On Their Hands” Department ...
by Lawrence D'Oliveiro 23 Apr '20

23 Apr '20

... comes this pure-CSS recreation <https://www.theregister.co.uk/2020/04/22/windows_98_css/> of the “Windows-98” look for your web pages. Personally, I can relate to this comment of the author: “Buttons just don't look like buttons anymore, it's so sad”. Basically, UI experts nowadays seem to be concentrating more on fashion, and the whole concept of “usability testing” has gone out the window.

1 0

Stripe Is Silently Recording Your Movements On Its Customers' Websites
by Peter Reutemann 23 Apr '20

23 Apr '20

'Michael Lynch, blogger and former software engineer at Microsoft and Google, discovered that the payment processing platform Stripe and its official JavaScript library records all browsing activity on its customers' websites and reports it back to the company. Lynch says this data includes the following: 1. Every URL the user visits on my site, including pages that never display Stripe payment forms 2. Telemetry about how the user moves their mouse cursor while browsing my site 3. Unique identifiers that allow Stripe to correlate visitors to my site against other sites that accept payment via Stripe In his blog post, Lynch shares what he found, who else it affects, and how you can limit Stripe's data collection in your web applications. Here's how he says he made the discovery: I discovered this by accident while adding paid plans to my portfolio rebalancer. As part of development, I was using an HTTP proxy that allows me to inspect HTTP traffic from my browser. After successfully implementing my app's payment flow with Stripe, I noticed that every page navigation generated a new HTTP POST request to a Stripe URL. This was strange because none of the pages I visited contained any calls to Stripe's library. In fact, my app doesn't collect payment information from users until they create an account, but Stripe was making HTTP requests when I landed on my app's homepage as a brand new user with no cookies or stored credentials. "I looked around for an official disclosure from Stripe about this behavior, but I couldn't find anything," adds Lynch. "The closest I found is this vague paragraph on their npm package description, which the Stripe support rep quoted to me: 'To best leverage Stripe's advanced fraud functionality, ensure that Stripe.js is loaded on every page, not just your checkout page. This allows Stripe to detect anomalous behavior that may be indicative of fraud as customers browse your website.'" "The privacy policy is a bit more specific about the data they collect, but it implies that they're collecting this data on stripe.com rather than on customer sites," writes Lynch. "Worryingly, the privacy policy also includes loose wording that allows Stripe to sell this data to advertisers: 'When you visit our Sites or online services, both we and certain third parties collect information about your online activities over time and across different sites to provide you with advertising about products and services tailored to your individual interests.'"' -- source: https://yro.slashdot.org/story/20/04/22/0023222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Vivaldi Browser Gets Built-in Tracking Blocker, Goes GA on Android
by Peter Reutemann 23 Apr '20

23 Apr '20

'Vivaldi, the browser launched by former Opera CEO Jon von Tetzchner, has long positioned itself as a highly customizable alternative to Chrome and Firefox for power users. Today, the team is launching version 3.0 of its desktop browser, with built-in tracker and ad blockers, and it's bringing its Android browser out of beta. From a report: I've long been a fan of Vivaldi, but the company was relatively late to the tracking protection game. Now it's doubling down by integrating a blocklist powered by DuckDuckGo's Tracker Radar. Like competing browsers, Vivaldi offers three blocking levels that users can easily toggle on and off for individual websites. Those blocking levels are relatively blunt, though, with the options to either block trackers, block trackers and ads, or disable blocking. Competitors like Edge offer slightly more nuanced options for blocking trackers, though I would expect Vivaldi to adopt a similar scheme over time.' -- source: https://slashdot.org/story/20/04/22/1550251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Edge TV Now Online-Only
by Lawrence D'Oliveiro 22 Apr '20

22 Apr '20

If there is anybody else besides me who wondered what happened to Edge TV, as of the beginning of this month it is no longer on Freeview, it can now only be viewed as an online stream <https://www.stuff.co.nz/entertainment/tv-radio/113928839/the-edge-tv-remove…>. In the last few days of June, there was a promo announcing that it was going HD, but I don’t recall it mentioning that it was leaving the broadcast airwaves. Quote: MediaWorks chief executive Michael Anderson says the move is in line with audience trends, which show people primarily consume music videos online. While that may be mostly true, personally I would go look for videos on YouTube after seeing them first on Edge TV.

6 12

Discord Switching From Go To Rust
by Lawrence D'Oliveiro 22 Apr '20

22 Apr '20

Came across this blog post <https://blog.discordapp.com/why-discord-is-switching-from-go-to-rust-a190bb…> explaining why Discord, which has been using Google’s Go language to implement its services, has now decided to rewrite them in Mozilla’s Rust. The problem was garbage collection. Go has a similar memory-allocation model to Java or LISP, where you can create objects and simply forget about them when you don’t need them any more, and a background process will automatically reclaim the storage at some point. The trouble is, that reclamation process (the “garbage collector”) tends to be the source of performance bottlenecks in the system. Not to mention that the memory usage of your program can grow to fill all available space, unless you impose arbitrary limits on it. Languages like Perl and Python use a hybrid model, where objects have reference counts attached to them, keeping track of how many other objects or variables still point to them, so they can be automatically freed when the count goes to zero. There are cases where this isn’t enough, and in those cases a full garbage-collection process kicks in. One benefit that I certainly observe with this is that memory usage for a program can remain reasonable, even after it has been running for a long time. Rust avoids the whole issue in a clever way, by having the compiler enforce memory-ownership restrictions in the language itself, so memory can be correctly allocated and freed without resorting to a garbage collector. The result is that Rust can achieve significantly higher performance than Go, while avoiding most of the attendant risks of dumping the whole responsibility for memory management on the programmer, as is done in languages like C++ and C.

1 1