May 2020 - wlug - list.wlug.org.nz

Source Code For Contact-Tracing Apps
by Lawrence D'Oliveiro 10 May '20

10 May '20

The UK and Australia have both published the source code for their contact-tracing apps on GitHub <https://www.theregister.co.uk/2020/05/09/coronavirus_tracing_app_source_cod…>. And of course a lot of people are going over them with a fine-toothed comb. Some are even suggesting that one for Apple’s platform, for example, might be violating the company’s rules on using Bluetooth while running in the background. It’s hard to see how these apps won’t be a big battery drain anyway. Maybe the NZ government is wise not to make this sort of thing a priority for now.

1 0

Do Working-From-Home Developers Risk Burning Out?
by Peter Reutemann 10 May '20

10 May '20

'"Software developers, like everyone else, have had to transition to a work-from-home world," writes InfoWorld. For the users of GitHub, the COVID-19 pandemic has meant changes in work cadence and collaboration, along with an increased risk of burnout, a GitHub study of usage patterns on the Microsoft-owned code sharing site has found." In an "Octoverse spotlight" analysis published May 6, 2020, GitHub compared the first three months of 2020 with the first three months of 2019... GitHub said its analysis shows that developers have been resilient to the change wrought by COVID-19, with activity holding consistent or increasing through the crisis. But their analysis also found: - Developers are working longer, by "up to an hour per day," seven days a week. - Slightly more pushes, pull requests, reviewed pull requests, and commented issues. - More collaboration on open source projects, and less time to merge pull requests into open source projects.' -- source: https://news.slashdot.org/story/20/05/09/0158217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

3D Printed N95 Montana Mask Design Released Under GPLv3
by Peter Reutemann 10 May '20

10 May '20

'Since the COVID-19 pandemic has made Personal Protective Equipment worth it's weight in gold, Makers have been trying to help bridge the gap. While sewn masks have been the most common solution, the 3D printing community has been pitching in as well. The Montana Mask has been one of the most popular designs... Thursday, the group Make the Masks announced that the design files and STLs to print the mask have been released under the GNU General Public License v3, allowing anyone to print, sell, remix or improve the design, as long as they conform to the license. Importantly, the GPLv3 includes an international non-exclusive patent grant, meaning that even if the inventors decide to apply for a patent, it will not restrict anyone from using the design.' -- source: https://science.slashdot.org/story/20/05/09/1859238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Where Does Ad Money Go?
by Lawrence D'Oliveiro 08 May '20

08 May '20

The accounting firm PwC (does that still stand for “Price Waterhouse Coopers”?) has done a study <https://www.theregister.co.uk/2020/05/07/ad_tech_fees_sucked/> of the online ad market, to see where all the money is going. Turns out only about half the money spent by advertisers makes it all the way to the publishers, with the rest siphoned off by various intermediaries along the way (not all of them legitimate), and 15% could not be accounted for at all. Much of this trading is now done “programmatically”, between automated systems, rather than by direct agreements between humans. And these systems are more complex (i.e. “having more stages where a percentage cut can be taken”) than they need to be.

1 0

Inkscape Approaches Version 1.0
by Lawrence D'Oliveiro 08 May '20

08 May '20

Inkscape v1.0 is tentatively due to be released on May 1st. Here <https://www.theregister.co.uk/2020/04/14/16_years_inkscape_v1/> is a backgrounder on how development has been progressing. There seems to be this assumption that Apple users are important: Mac support is hugely important, thanks to the wide use of Macs in the artistic and designer community. while on the other hand, They know that macOS usage has been very small. The new version is using GTK+3, and the UI is more customizable than before. The command shell has also been improved. Finally: Is the open-source business model, or lack of it, holding back Inkscape? "We would advance much faster with even one or two full-time people," said Jeanmougin. "That has been some frustration because we only rely on donations. We get much less than what we would need to hire people."

1 2

MPA and Amazon Ask GitHub To Suspend Kodi Add-On Developer's Account
by Peter Reutemann 08 May '20

08 May '20

'The MPA, MPA-Canada, and Amazon have filed a request with Github requesting that a Kodi add-on developer's account be deleted from the platform. Citing a copyright case and a permanent injunction handed down by Canada's Federal Court, the content companies claim that the account is still being used to infringe their rights. Github has left the account intact, however. TorrentFreak reports: In February 2018, a developer known online as 'Blamo' (aka 'Mr. Blamo') revealed that he, in common with several of his counterparts, had been threatened by content companies. From there the trail went cold but according to a complaint filed against Github this week, legal action in Canada followed. On September 7, 2018, a dozen companies including the studios of the MPA/MPA-Canada plus Amazon and Netflix launched a copyright infringement lawsuit at Canada's Federal Court against an individual "doing business" as Mr. Blamo. "In the context of that action, our clients alleged that [Blamo] notably developed, hosted, promoted and distributed infringing add-ons for the Kodi media center, which provided unauthorized access to motion pictures and television content for which the copyright is owned by our clients," the MPA writes. According to Federal Court records, Blamo did not mount any kind of defense so as a result, the matter was decided in his absence. On January 15, 2019, the Federal Court handed down a final judgment, including a declaration of infringement and a permanent injunction. "The permanent injunction enjoins and restrains [Blamo] from, inter alia, hosting, distributing or promoting infringing Kodi add-ons and their repositories, including notably the 'Blamo' repository and the "Chocolate Salty Balls' infringing add-ons," the MPA adds. The problem here is that, according to the MPA and associated companies, Blamo has a Github account where it is claimed he continues to "host and distribute infringing Kodi add-ons and their repository, including notably the Chocolate Salty Balls infringing add-on and the Blamo repository." This, the MPA says, amounts to contempt of court. What's particularly interesting here, however, is that the MPA isn't asking for the specified URLs to be deleted. Instead, it asks for Blamo's entire Github account to be deactivated instead.' -- source: https://yro.slashdot.org/story/20/05/07/2018227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apple IOS XML Bug
by Lawrence D'Oliveiro 08 May '20

08 May '20

>From <https://www.schneier.com/blog/archives/2020/05/ios_xml_bug.html>: So Siguza's exploit -- which granted an app full access to the entire file system, and more - uses malformed XML comments constructed in a way that one of iOS's XML parsers sees its declaration of entitlements one way, and another XML parser sees it another way. The XML parser used to check whether an application should be allowed to launch doesn't see the fishy entitlements because it thinks they're inside a comment. The XML parser used to determine whether an already running application has permission to do things that require entitlements sees the fishy entitlements and grants permission. Further: Implementing 4 different parsers is just asking for trouble, and the "fix" is of the crappiest sort, bolting on more crap to check they're doing the right thing in this single case. None of this is encouraging. Conway’s Law comes to mind: “any piece of software reflects the organizational structure that produced it”. 3 different XML parsers sounds like 3 different groups working on those parts of the OS, while the addition of a fourth to block the hole suggests that nobody with any responsibility for security was able to get through to any of those groups to fix their parsing.

1 0

Microsoft's GitHub Account Allegedly Hacked, 500GB Stolen
by Peter Reutemann 08 May '20

08 May '20

'A hacker claims to have stolen over 500GB of data from Microsoft's private GitHub repositories, BleepingComputer reports. From the report: This evening, a hacker going by the name Shiny Hunters contacted BleepingComputer to tell us they had hacked into the Microsoft GitHub account, gaining full access to the software giant's 'Private' repositories. The individual told us that they then downloaded 500GB of private projects and initially planned on selling it, but has now decided to leak it for free. Based on the file stamps in the leaked files, the breach may have occurred on March 28th, 2020.' -- source: https://developers.slashdot.org/story/20/05/07/1850248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Google Authenticator's First Android Update in Years Lets You Move Your Account Between Devices
by Peter Reutemann 08 May '20

08 May '20

'Google Authenticator, the company's code-based authentication app, has received its first update in three years, updating the app's interface for larger screens with more modern aspect ratios and delivering one of the platform's most-needed features. From a report: The Android version was last updated on August 22nd, 2017, while the iOS one was updated around a year ago to adjust it for iPhone X screens. Now, for the first time, Authenticator users will be able to easily transfer their account from one device to another without needing to manually transfer each code or disable and reenable two-factor authentication (2FA) on each account. The update introduces this feature through an import / export tool that lets you choose which accounts to include and transfer using a single QR code scan. It's a feature that competitor Authy has provided for quite some time, so it's refreshing to see it come to Authenticator, even if it's years late.' -- source: https://tech.slashdot.org/story/20/05/07/1450227 Finally... Could have used that a while ago... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Caddy offers TLS, HTTPS, and more in one dependency-free Go Web server
by Peter Reutemann 07 May '20

07 May '20

'Yesterday, the Caddy Web server reached an important milestone, with its 2.0.0 release. Caddy bills itself as "The Ultimate Server," with no dependencies, automatic TLS certificate obtainment and renewal, and much smaller configuration files than Apache or Nginx. Senior Technology Editor Lee Hutchinson expressed both curiosity about Caddy and his own personal inertia in the Ars slack: Caddy is an app where every time i see it or think of it i say “I should mess with it, it looks neat” and then I never do. I’ve gotten so enmeshed in my haproxy - varnish - nginx stack that breaking out feels like more trouble than it’s worth. I hadn't ever heard of Caddy until Lee mentioned it, but I know a call to action when I hear one.' -- source: https://arstechnica.com/gadgets/2020/05/caddy-offers-tls-https-and-more-in-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1