May 2020 - wlug - list.wlug.org.nz

Firefox 76 Arrives With Password Management and Zoom Improvements
by Peter Reutemann 06 May '20

06 May '20

'Mozilla today launched Firefox 76 for Windows, Mac, and Linux. Firefox 76 includes new Firefox Lockwise password functionality, Zoom improvements, and a handful of developer features. From a report: Lockwise, the password management service formerly known as Firefox Lockbox, is getting smarter. The Firefox feature already lets you generate, manage, and protect all those passwords for streaming services, grocery deliveries, and anything else that helps during the pandemic. If you share your device with family or roommates, Lockwise in Firefox 76 can now protect your saved passwords. When you try to view or copy a password from your "Logins and Passwords" page, you will be prompted for your device's account password. [...] Firefox 76 adds support for Audio Worklets, which run custom JavaScript audio processing code for applications like VR and gaming on the web. Unlike their predecessor, ScriptProcessorNode, worklets run off the main thread in a similar way to web workers. Mozilla also notes Audio Worklets are "being adopted by some of your favorite software programs." The company specifically called out Zoom, which has become a phenomenon of its own during the pandemic. In short, you now join Zoom calls in Firefox without having to download or install the Zoom client.' -- source: https://news.slashdot.org/story/20/05/05/160252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Xiaomi Releases Browser Update Amid Accusations It Collects Private Browsing Data
by Peter Reutemann 06 May '20

06 May '20

'Xiaomi released software updates for its browser apps on Monday amid fresh accusations it's been collecting private data from people who use its phones and browser apps. CNET reports: In a blog post, Xiaomi said the update will allow you to switch off aggregated data collection while on incognito mode in its three browser apps: Mi Browser, Mi Browser Pro, and Mint Browser. The software update was rolled out on Google Play. "We believe this functionality, in combination with our approach of maintaining aggregated data in non-identifiable form, goes beyond any legal requirements and demonstrates our company's commitment to user privacy," the company said in its post. The release of the software update comes after a Forbes report published last Thursday raised concerns about the Chinese phone-maker's use of private data. It suggested Xiaomi may be collecting data on the websites users visit as well as granular information about apps used and files opened on devices. In response to the report, Xiaomi defended its practices last week saying it's "fully compliant with user privacy protection laws and regulations in the countries and regions we operate in.' -- source: https://yro.slashdot.org/story/20/05/05/2013244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu 20.04: Welcome to the future, Linux LTS disciples
by Peter Reutemann 05 May '20

05 May '20

'This is most definitely the strangest spring in a very long time, with all sorts of event and hardware delays or outright cancellations. But one thing that has arrived right on schedule? The latest version of Ubuntu Linux. Ubuntu 20.04 (Focal Fossa, as this release is known) is a Long Term Support (LTS) release, which means Ubuntu's parent company, Canonical, will provide support through 2025. The LTS releases are what Canonical calls "enterprise grade," and these tend to be conservative when it comes to adopting new technologies. The interim releases, like last year's Ubuntu 19.10, are instead where the company tends to experiment. Perhaps not surprisingly, Canonical estimates that 95 percent of all Ubuntu installations are LTS releases. Which is to say, this is a big update that the bulk of Ubuntu's user base will be upgrading to eventually. The good news for Ubuntu fans is that 20.04 has been a fantastic release in our testing. This update has been very solid in day-to-day use, and it still manages to (optionally!) include support for some cutting-edge new features, like the beginnings of a tool to manage ZFS snapshots. There's also a major kernel bump, and considerable work has gone into improving and polishing the default Yaru theme. That's a running theme in Ubuntu, where much of what makes it great are small changes and new features that individually might not be remarkable but all together create a system that is fast, stable, and hard to beat. The security improvements offered this time around almost alone make Ubuntu 20.04 a must-have upgrade. But the Ubuntu 20.04 update has plenty of new stuff for all the various Ubuntu flavors as well. So even if the default GNOME desktop doesn't excite you, there's big news in Kubuntu, Lubuntu, Ubuntu Mate, and more. There's also some good news for Raspberry Pi users, who get first-class support for the Pi 4 platform out of the box (and when I say first class, I mean, frankly, better than the official Pi distro, Raspian).' -- source: https://arstechnica.com/information-technology/2020/05/ubuntu-20-04-welcome… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Academics Turn PC Power Units Into Speakers To Leak Secrets From Air-Gapped Systems
by Peter Reutemann 05 May '20

05 May '20

'Academics from an Israeli university have published new research last week showing how an attacker could turn a computer's power supply unit into a rudimentary speaker that can secretly transmit data from an infected host using audio waves. From a report: The technique, named POWER-SUPPLaY, is the work of Mordechai Guri, the head of R&D at the Ben-Gurion University of the Negev, in Israel. Over the last half-decade, Guri has been pioneering research into new covert data exfiltration channels. The techniques Guri has been developing can be used for stealing data through unconventional means. Guri has been developing these techniques specifically for extracting data from air-gapped systems -- computers isolated on local networks with no internet access. Such computers are often used on government or corporate networks to store sensitive data, such as classified files or intellectual property. Air-gapped systems are protected by several layers of defenses, on top of the "air gap," and you need novel data transmission techniques to go around these defenses. For example, some air-gapped systems don't have speakers, because it's been proven in the past that speakers could be abused to leak information from a secure system using inaudible sound waves.' -- source: https://it.slashdot.org/story/20/05/04/176208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Purged Almost 1,000 Abusive 'Creeperware' Apps. Now Some Are Coming Back.
by Peter Reutemann 05 May '20

05 May '20

'In June 2019, a group of cybersecurity researchers notified Google of more than 1,000 potentially malicious apps on the company's Play Store that can be used to surveil, monitor, and harass users. Their findings, which have not previously been reported, eventually led to one of the largest ever mass removals of Android apps. Less than a year later, there are signs that the "creeperware," as the researchers called it, is returning. From a report: The label comprises a broad category of abusable apps, including tools for spying, spoofing phone numbers, and secretly recording video and audio. Some of those programs banned by Google have now rebranded or added disclaimers and returned to the Play Store. Meanwhile, new programs with overtly abusive purposes have slipped through the company's automated monitoring systems. The initial 1,095 apps flagged by researchers came in a variety of forms. Catch Cheating Spouse and its ilk offered stalkerware packages: Once installed on a victim's phone, the user could track the device's location, read messages, listen to calls, remotely record through the microphone, or log passwords. Many of the programs had innocuous names but hostile purposes. Spoof Text Message, for example, advertised itself with a video using the tagline "Don't like your buddy's girlfriend? Well, break them up!" Others, like GirlFriend Cell Tracker, were more explicit in their motivation. "When we reported these apps to Google initially, it felt like they didn't really know what to do with them," said Kevin Roundy, the technical director of NortonLifeLock's research group, and one of the lead members of the team that uncovered the malicious apps last June.' -- source: https://tech.slashdot.org/story/20/05/04/1528219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers Breach LineageOS Servers Via Unpatched Vulnerability
by Peter Reutemann 05 May '20

05 May '20

'Hackers have gained access to the core infrastructure of LineageOS, a mobile operating system based on Android, used for smartphones, tablets, and set-top boxes. The intrusion took place on Saturday night at around 8 pm (US Pacific coast), and was detected before the attackers could do any harm, the LineageOS team said in a statement published less than three hours after the incident. The LineageOS team said the operating system's source code was unaffected, and so were any operating system builds, which had been already paused since April 30, because of an unrelated issue. Signing keys, used to authenticate official OS distributions, were also unaffected, as these hosts were stored separately from the LineageOS main infrastructure. LineageOS developers said the hack took place after the attacker used an unpatched vulnerability to breach its Salt installation.' -- source: https://it.slashdot.org/story/20/05/04/0341202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

What Keeps Developers Happy? Contributing to Open Source
by Peter Reutemann 04 May '20

04 May '20

'This week long-time open source advocate Matt Asay warned employers that the best way to keep their developers happy was to let them contribute to open source projects: SlashData recently surveyed over 16,000 developers to see what makes them tick... what they care about. The data is collected in SlashData's State of the Developer Nation, though let me give you the tl;dr: 59% of developers contribute to open source software today. Why do they contribute? The top two reasons are: To improve coding skills and because they believe in open source. Want to keep those developers happy and employed with you? Let them contribute... [Y]our employees want to contribute both code and knowledge — they want to be part of something. Talking to Bert Hubert, founder of PowerDNS, a supplier of open source DNS software, services, and support, he stressed that an open source project must be "a fun place where people feel that they are learning things, that they're contributing things, that they're being valued." Perhaps not surprisingly, these are the same elements developers expect from their employers. By making open source a valued part of workplace expectations, employers tick both boxes. Is it an absolute requirement that you encourage your developers to contribute to open source projects? No. But many of your best developers will chafe at keeping their talents locked up behind the firewall, and other developers simply won't apply if you have a reputation for being an open source scrooge. The article was written by Matt Asay, a former COO of Canonical now working at AWS. (Right before becoming Canonical's COO, Matt answered questions from Slashdot readers). The survey he cites also found that out of 17,000 developers they talked to, just 3% said they were paid to contribute to open source. The other 97% contributed for free.' -- source: https://news.slashdot.org/story/20/05/03/1746244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Copyleft and the Cloud: Where Do We Go From Here?
by Peter Reutemann 04 May '20

04 May '20

'Free software evangelist Jeremy Allison - Sam (Slashdot reader #8,157) is a co-creator on the Samba project, a re-implementation of SMB/CIFS networking protocol, and he also works in Google's Open Source Programs Office. Now he shares his presentation at the Software Freedom Conservancy's "International Copyleft Conference." He writes: The Samba project has traditionally been one of the strongest proponents of Copyleft licensing and Free Software. However, in the Corporate Cloud-first world we find ourselves, traditional enforcement mechanisms have not been effective. How do we achieve the goals of the Free Software movement in this new world and how do we need to change what we're doing to be successful ? Traditional license enforcement doesn't seem to work well in the Cloud and for the modern software environment we find ourselves. In order to achieve the world of Free Software available for all I think we need to change our approach. Both GPLv3 and the AGPL have been rejected soundly by most developers. I would argue that we need a new way to inspire developers to adopt Free Software goals and principles, as depending on licensing has failed as licensing itself has fractured. Communication and collaboration are key to this. Stand-alone software is essentially useless. Software interoperability and published protocol and communication definitions are essential to build a freedom valuing software industry for the future The talk's title? "Copyleft and the Cloud: Where do we go from here?"' -- source: https://news.slashdot.org/story/20/05/02/180237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google's reCAPTCHA Is Being Used To Hide Phishing Pages
by Peter Reutemann 04 May '20

04 May '20

'New research from Barracuda Networks has revealed that cyber-criminals are increasingly using official reCAPTCHA walls to disguise malicious content from email security systems and trick unsuspecting users... [S]ophisticated scammers are beginning to use the Google-owned service to prevent automated URL analysis systems from accessing the actual content of phishing pages, and to make phishing sites more believable in the eyes of the victim, Barracuda Networks warned. In fact, the security solutions provider observed a single phishing campaign that sent out 128,000 emails to a variety of organizations and employees using reCAPTCHA walls to conceal fake Microsoft log-in pages. This campaign used the lure of a voicemail receipt to fool users into solving the reCAPTCHA wall before being redirected to the malicious page, with any log-in info entered then sent straight to the scammers.' -- source: https://tech.slashdot.org/story/20/05/03/1613229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Join me in taking action
by Roderick Aldridge 01 May '20

01 May '20

I just took part in an Electronic Frontier Foundation campaign titled "Help Stop the Sale of Public Interest Registry to a Private Equity Firm". Will you join me? Take action here: https://act.eff.org/action/help-stop-the-sale-of-public-interest-registry-t… In case you haven't seen this. I expect a lot of FOSS people and organisations are at risk. Roderick

5 6