June 2020 - wlug - list.wlug.org.nz

Brave Browser Mistake Adds Its Referrer Code For Cryptocurrency Sites
by Peter Reutemann 08 Jun '20

08 Jun '20

'The following report appeared on Yahoo! Finance: Privacy-focused browser Brave was found to autocomplete several websites and keywords in its address bar with an affiliate code. Shortly after a user published his findings, Brave CEO and co-founder Brendan Eich addressed the incident and called it "a mistake we're correcting." Eich said that while Brave is a Binance affiliate [a cryptocurrency exchange], the browser's autocompleting feature should not have added any new affiliate codes. "The autocomplete default was inspired by search query clientid attribution that all browsers do, but unlike keyword queries, a typed-in URL should go to the domain named, without any additions," Eich wrote in the thread. "Sorry for this mistake — we are clearly not perfect, but we correct course quickly," he added. Android Police reports the mistake occured more than 10 weeks ago — and that referrer codes were also included for other cryptocurrency-related sites: The browser's GitHub repository reveals the functionality was first added on March 25th, and the current list of sites includes Binance, Coinbase, Ledger, and Trezor. Brave Software receives a kickback for purchases/accounts made with those services — for example, Coinbase says that when you refer a new customer to the service, you can earn 50% of their fees for the first three months. The nature of these affiliate programs also allows the referrer — in this case, Brave Software — to view some amount of data about the customers who sign up with the code. Coinbase's program provides "direct access to your campaign's performance data," while Trezor offers a "detailed overview of purchases." Brave CEO and co-founder Brendan Eich (who also created the JavaScript programming language) tweeted, "For what it's worth there's a setting to disable the autocomplete defaults that add affiliate codes, in brave://settings first page. Current plan is to flip default to off as shown here. You can disable ahead of our release schedule if you want to. "Good to hear from supporters who'll enable it."' -- source: https://it.slashdot.org/story/20/06/07/2217224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ars Technica: We put Western Digital’s dreaded SMR Red drive to the test
by Peter Reutemann 08 Jun '20

08 Jun '20

'Western Digital has been receiving a storm of bad press—and even lawsuits—concerning their attempt to sneak SMR disk technology into their "Red" line of NAS disks. To get a better handle on the situation, Ars purchased a Western Digital 4TB Red EFAX model SMR drive and put it to the test ourselves.' -- source: https://arstechnica.com/gadgets/2020/06/western-digitals-smr-disks-arent-gr… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Java-Based Ransomware Targets Linux and Windows Systems
by Peter Reutemann 08 Jun '20

08 Jun '20

'"A newly uncovered form of ransomware is going after Windows and Linux systems," reports ZDNet, "in what appears to be a targeted campaign." Named Tycoon after references in the code, this ransomware has been active since December 2019 and looks to be the work of cyber criminals who are highly selective in their targeting. The malware also uses an uncommon deployment technique that helps stay hidden on compromised networks. The main targets of Tycoon are organisations in the education and software industries. Tycoon has been uncovered and detailed by researchers at BlackBerry working with security analysts at KPMG. It's an unusual form of ransomware because it's written in Java, deployed as a trojanised Java Runtime Environment and is compiled in a Java image file (Jimage) to hide the malicious intentions... [T]he first stage of Tycoon ransomware attacks is less uncommon, with the initial intrusion coming via insecure internet-facing Remote Desktop Protocol servers. This is a common attack vector for malware campaigns and it often exploits servers with weak or previously compromised passwords. Once inside the network, the attackers maintain persistence by using Image File Execution Options (IFEO) injection settings that more often provide developers with the ability to debug software. The attackers also use privileges to disable anti-malware software using ProcessHacker in order to stop removal of their attack... After execution, the ransomware encrypts the network with files encrypted by Tycoon given extensions including .redrum, .grinch and .thanos — and the attackers demand a ransom in exchange for the decryption key. The attackers ask for payment in bitcoin and claim the price depends on how quickly the victim gets in touch via email. The fact the campaign is still ongoing suggests that those behind it are finding success extorting payments from victims. ' -- source: https://linux.slashdot.org/story/20/06/06/0445235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Dropped for Open Source Again in Germany: Hamburg Follows Munich's Lead
by Peter Reutemann 08 Jun '20

08 Jun '20

'"The trend towards open-source software on government computers is gathering pace in Germany," reports ZDNet: In the latest development, during coalition negotiations in the city-state of Hamburg, politicians have declared they are ready to start moving its civil service software away from Microsoft and towards open-source alternatives. The declaration comes as part of a 200-page coalition agreement between the Social Democratic and Green parties, which will define how Hamburg is run for the next five years. It was presented on Tuesday but has yet to be signed off. The political parties in charge in Hamburg are the same as those in Munich, who recently agreed to revert back to that city's own open-source software. "With this decision, Hamburg joins a growing number of German states and municipalities that have already embarked on this path," said Peter Ganten, chairman of the Open Source Business Alliance, or OSBA, based in Stuttgart. He's referring to similar decisions made in Schleswig-Holstein, Thuringia, Bremen, Dortmund, and Munich. But, he adds: "The Hamburg decision is nevertheless remarkable because the city has always been more aggressively oriented towards Microsoft. "In the future we will aim to have more open-source software in digital management [systems] and we also want to develop our own code, which will remain open," the head of the local Hamburg-Mitte branch of the Greens, Farid Mueller, wrote on his website. Hamburg wants to be a leading example of digital independence, he stated. The article also adds a final interesting detail. A Microsoft spokeperson told a Germany technology site "that the company didn't see the desire for more open-source software as an attack on itself. Microsoft now also uses and develops a lot of open source and welcomed fair competition, the spokesperson added."' -- source: https://linux.slashdot.org/story/20/06/07/0147255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Eyes Decentralized Web-Based Videoconferencing Platform 'Meething'
by Peter Reutemann 08 Jun '20

08 Jun '20

'Last month Techcrunch reported that Mozilla had gone "full incubator" by holding a startup lab called Fix the Internet, followed by "a formal program dangling $75,000 investments in front of early-stage companies..." Fix the Internet had many key themes, including collaboration and decentralization (as well as user-controlled data and privacy-protecting social networks). That event "drew the interest of some 1,500 people in 520 projects, and 25 were chosen to receive the full package and stipend during the development of their minimum viable product (MVP). Below that, as far as pecuniary commitment goes, is the 'MVP Lab,' similar to the spring program but offering a total of $16,000 per team." And one of those MVP Lab teams is Meething, a new video conferencing and collaboration platform from the innovation lab ERA. Meething "aims to be more secure than existing video conferencing tools and run on a decentralized database engine and leverage peer-to-peer networking" according to ZDNet. In their video interview with CEO Mark Nadal, he outlined the following selling points: - Browser based video conferencing gives customers better options for security as well as branding. - Open source architecture is a win and the peer-to-peer networking is more efficient on compute costs. - Meething doesn't require downloads or apps that increase the security attack surface. The total addressable market for video conferencing is large and can support multiple players. Their press release quotes Mark Mayo, a former Chief Product Officer at Mozilla who served as Meething's mentor, arguing that video conferencing on the web "has long promised to enable a whole new world of online collaboration. Frankly, it hasn't delivered. It's been way too hard to build cool products with video and Meething aims to be the zero-barrier-to-entry platform that realizes this future. Soon, video conferencing won't suck!"' -- source: https://tech.slashdot.org/story/20/06/07/1739228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How SpaceX Uses Linux, Chromium, C++ and Open Source Libraries
by Peter Reutemann 07 Jun '20

07 Jun '20

'Long-time Slashdot reader mrflash818 ("Linux geek since 1999") shared a ZDNet article pointing out that SpaceX's Falcon 9 rocket has an onboard operating system that's "a stripped-down Linux running on three ordinary dual-core x86 processors. The flight software itself runs separately on each processor and is written in C/C++." Interestingly, back in 2018 a Slashdot headline asked whether C++ was "a really terrible language," and Elon Musk replied on Twitter with his single-word answer. "Yes." ZDNet points out that "ordinary" processors are often needed because of the multi-year development time for the spacecraft they power. Their article notes that the International Space Station actually runs on 1988-vintage 20 MHz Intel 80386SX CPUs: Of course, while those ancient chips work for the station's command and control multiplexer/demultiplexer, they're not much good for anything else. For ordinary day-in and day-out work, astronauts use HP ZBook 15s running Debian Linux, Scientific Linux, and Windows 10. The Linux systems act as remote terminals to the control multiplexer/demultiplexer, while the Windows systems are used for email, the web, and fun. Usually, though, chips that go into space aren't ordinary chips. CPUs that stay in space must be radiation-hardened. Otherwise, they tend to fail due to the effects of ionizing radiation and cosmic rays. These customized processors undergo years of design work and then more years of testing before they are certified for spaceflight. For instance, NASA expects its next-generation, general-purpose processor, an ARM A53 variant you may know from the Raspberry Pi 3, to be ready to run in 2021... The Dragon spacecraft's touchscreen interface is rendered using Chromium and JavaScript. If something were to go wrong with the interface, the astronauts have physical buttons to control the spacecraft. Today the SpaceX software team answered questions on Reddit, revealing they use Chromium with a reactive library developed in-house, and that "All of our on-board computers either run Linux (with the PREEMPT_RT patch) or are microcontrollers that run bare-metal code...." Later they emphasized that for the Falcon 9 and Dragon software, "All of the application-level autonomous software is written in C++. We generally use object oriented programming techniques from C++, although we like to keep things as simple as possible. "We do use open source libraries, primarily the standard C++ library, plus some others. However, we limit our use of open source libraries to only extremely high quality ones, and often will opt to develop our own libraries when it is feasible so that we can control the code quality ourselves."' -- source: https://science.slashdot.org/story/20/06/06/2023249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linux Mint Dumps Ubuntu Snap
by Peter Reutemann 07 Jun '20

07 Jun '20

'ZDNet reports: Mint's programmers, led by lead developer, Clement "Clem" Lefebvre, has dropped support for Ubuntu's Snap software packing system. [...] So, what's not to like? Well, a lot, thinks Clem. As he wrote in July 2019, the idea is fine: "When snap was announced it was supposed to be a solution, not a problem. It was supposed to make it possible to run newer apps on top of older libraries and to let third-party editors publish their software easily towards multiple distributions, just like Flatpak and AppImage." But, he said, "What we didn't want it to be was for Canonical to control the distribution of software between distributions and third-party editors, to prevent direct distribution from editors, to make it so software worked better in Ubuntu than anywhere else and to make its store a requirement." Clem was worried then that Canonical was moving in that direction because: "Ubuntu is planning to replace the Chromium [Google's open-source browser and foundation for Chrome] repository package with an empty package, which installs the Chromium snap. In other words, as you install APT [Debian's program for installing and managing DEB files] updates, Snap becomes a requirement for you to continue to use Chromium and installs itself behind your back. This breaks one of the major worries many people had when Snap was announced and a promise from its developers that it would never replace APT. A self-installing Snap Store which overwrites part of our APT package base is a complete NO-NO. It's something we have to stop and it could mean the end of Chromium updates and access to the snap store in Linux Mint." Fast forward to now, and that's still the case with Chromium, and Clem has had enough: "In the Ubuntu 20.04 package base, the Chromium package is indeed empty and acting, without your consent, as a backdoor by connecting your computer to the Ubuntu Store. Applications in this store cannot be patched, or pinned. You can't audit them, hold them, modify them, or even point snap to a different store. You've as much empowerment with this as if you were using proprietary software, i.e. none. This is in effect similar to a commercial proprietary solution, but with two major differences: It runs as root, and it installs itself without asking you." ' -- source: https://news.slashdot.org/story/20/06/05/2148219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Lenovo Will Pre-load Ubuntu and Red Hat on All Its Workstations
by Peter Reutemann 07 Jun '20

07 Jun '20

'TechRepublic calls it "a tectonic shift in the landscape... a massive company showing serious support for both Ubuntu Linux and Red Hat Enterprise Linux." Forbes reports: Beginning this month, Lenovo will certify its ThinkStation PCs and ThinkPad P Series laptops for both Ubuntu LTS and Red Hat Enterprise Linux. Every single model, every single configuration across the entire workstation portfolio. [ZDNet adds that the two Linux distros will also be preloaded.] And it doesn't end there. "Going beyond the box, this also includes full web support, dedicated Linux forums, configuration guidance and more," says Rob Herman, General Manager, Executive Director Workstation & Client AI Group at Lenovo. We're not talking about just hardware certification, either. Lenovo will offer both Red Hat Enterprise Linux and Ubuntu LTS distributions pre-installed... "What's more, Lenovo will also upstream device drivers directly to the Linux kernel, to help maintain stability and compatibility throughout the life of the workstation," says Herman. Lenovo and Fedora are already working together to enable fingerprint sensor support on select ThinkPads, and send that support upstream to benefit all Linux distributions (including firmware being available through LVFS). When I spoke to Mark Pearson, the Senior Linux Software Engineer even mentioned porting certain Windows-only PC management tools to Linux to aid in the overall effort. TechRepublic notes the news "comes on the heels of a number of new Linux desktop support news. This year we've seen the rise of Purism, Tuxedo Computers, Pine64, Juno Computers, Vikings, Dell's continued support with the XPS Dev edition laptop and the Precision line, and now Lenovo." They also argue for continued support for the smaller vendors of Linux hardware. "Companies like System76 are a big reason why desktop Linux continued climbing up that steep mountain called 'Acceptance.'" But their article concludes that "No matter which path you take, you now (as a Linux user) have more options."' -- source: https://linux.slashdot.org/story/20/06/06/0113250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Will The Transition To IPv6 Take 5 to 10 Years?
by Peter Reutemann 07 Jun '20

07 Jun '20

'The Register: IPv4 is here to stay with us for a good few years yet, reckons the the Réseaux IP Européens Network Coordination Centre's (RIPE NCC) public policy manager, eight years after IPv6 was supposed to replace it. Marco Hogewoning, public policy for the Amsterdam, Netherlands-based European regional internet registry, told The Register that despite the best efforts of IPv6 proponents over the last eight years, it might take "five to 10 years" before the world starts to truly abandon the IPv4 address space. IPv6 was first defined in 1996, but with Friday marking the 8th anniversary of (the second) IPv6 "Launch" Day, RIPE NCC was keen to talk up the tech, whose chief benefit is that it provides a much greater pile of internet addresses for all the stuff humanity has dumped online in the last few decades...Musing that "little pockets of IPv4" and some government services hosted on IPv4 are two of the things holding the world back, Hogewoning told The Register: "It's impossible for me to file my taxes over IPv6. As much as I want, I can't get rid of IPv4 in the end because I need to file my taxes. That's a dialogue we try to have with the governments... It's an important step to go to, enabling IPv6 [instead of] IPv4 to make sure we don't force people to have that backwards compatibility."' -- source: https://tech.slashdot.org/story/20/06/06/0245248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

one week of arch
by Peter Reutemann 07 Jun '20

07 Jun '20

Hi everyone At last month's meeting, we also had a look at Manjaro, an Arch-based Linux distribution: https://www.meetup.com/WaikatoLinuxUsersGroup/events/266792009/ While preparing for the presentation, I played around with Manjaro and quite liked the arch package manager "pacman". Since then, Angus came across EndeavourOS, another Arch Linux distribution, which is a bit more up-to-date than Manjaro: https://endeavouros.com/ So, last weekend, I decided to bite the bullet and upgrade the aging LinuxMint 18.3 installation on my laptop at home. The EndeavourOS installer seemed less polished (showing lots of Space Shuttle Endeavour related imagery) than the likes of Mint or Ubuntu, but it did the job. Always glad that my home directory is on a separate partition. Makes the installation so much easier... :-) I've been using it now for a week and I must say, I quite like it. The MATE desktop, in contrast to Linux Mint, is far less polished, but it works absolutely fine. It feels really, really snappy (and that on a spinning drive!) and it doesn't seem to suffer from the same performance degradation over time like my old Mint installation did: as the days went by, the login screen would take longer and longer to show up after resuming from sleep, the Caja file browser would take longer to start up and everything just felt more and more sluggish. Last night, I flashed an old Samsung S4 with LineageOS (Android 9) and I didn't have to resort to compiling Heimdall myself, the Arch repositories already had packages built on the latest code from the repository. Nice! Only problem so far are the proprietary Brother printer drivers. Haven't been able to get printing working yet (the package for the printer in the arch repositories didn't do anything). Something to figure out on a rainy day... Anyway, looks like I'm sort of an Arch convert now. ;-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0