June 2020 - wlug - list.wlug.org.nz

Windows 10 Is Hostile To Open Source
by Lawrence D'Oliveiro 06 Jun '20

06 Jun '20

From <https://www.theregister.com/2020/06/05/windows_10_microsoft_defender_smarts…>: A developer of a Windows utility has protested that "Microsoft Defender SmartScreen is hurting independent developers" because of the number of warnings and obstacles placed in front of users who download installers that are not signed or sufficiently well known. In the absence of a “Let’s Encrypt” equivalent for them, code-signing certificates cost money. And on top of that, SmartScreen’s warnings will not go away until that certificate has built up some (unspecified) minimum level of “reputation”. Because of this, many projects, like Ardour and Inkscape, don’t bother with signing, and rely on their users to negotiate the obstacle course of download and installation warnings.

1 0

Follow-up to the EFF .ORG petition
by Ian Stewart 06 Jun '20

06 Jun '20

You may remember, from over a month ago, there was circulation on WLUG email of a request to sign a petition<https://act.eff.org/action/help-stop-the-sale-of-public-interest-registry-t…> of Electronic Frontier Foundation to "Help Stop the Sale of Public Interest Registry to a Private Equity Firm"... "This month [November 2019] it was suddenly announced that the nonprofit that owns the .ORG domain registry was planning to sell it to a private equity firm, Ethos Capital. This could impact the millions of individuals and organizations that have a .ORG website, subjecting them to potential censorship and leaving the door open for price increases on domain registration and renewals." You may be wondering what happened. I've just looked at the wikipedia entry for .ORG, and it contains the following paragraph based on this article from the The Verge<https://www.theverge.com/2020/4/30/21241946/icann-dot-org-isoc-ethos-capita…>: "In November 2019, the Public Interest Registry (PIR) was to be sold by the Internet Society to shell company Ethos Capital for US$1.135 billion. The PIR also announced it would abandon its non-profit status to become a B Corporation. However, this move was criticized by non-profits and various digital rights groups on concerns that Ethos Capital, a private equity firm, would raise fees or censor the domain. The sale was blocked by Internet Corporation for Assigned Names and Numbers (ICANN) in April 2020 on the basis that transfer of control of the domain to the private equity firm would create "unacceptable uncertainty" for non-profits that relied on the .org domain." While Wikipedia's entry on .ORG<https://en.wikipedia.org/wiki/.org> has a brief history section, more details can be found at Wikipedias Public Interest Registry webpage<https://en.wikipedia.org/wiki/Public_Interest_Registry>. In case you find its TL;DR here are some snippets... the Internet Society proposed creating the Public Interest Registry as a separate 501(c)3 non-profit to manage .ORG when the Public Interest Registry was established, “our aim was to promote the non-commercial use of the internet" Public Interest Registry released an open letter on 1 May 2019, stating, “The .ORG Community always is considered in every decision we make here at Public Interest Registry. Rest assured, we will not raise prices unreasonably. In fact, we currently have no specific plans for any price increases for .ORG.” On 13 May 2019, ICANN announced that they would remove the price cap on .ORG registrations. ...former ICANN CEO Fadi Chehadé registered the domain name EthosCapital.com. On 14 May 2019, Ethos Capital was incorporated in Delaware On 13 November 2019 the Internet Society announced that it was divesting of the Public Interest Registry, and that Ethos Capital would be acquiring its assets Ethos Capital stated on their website, "Our plan is to live within the spirit of historic practice when it comes to pricing," which they later clarified to mean raising prices by an average of 10% per year. People who came out in opposition to the sale included Tim Berners-Lee... On 29 November 2019, it was revealed that the purchase price is $1.135 billion. On 30 April 2020, the ICANN Board, saying it was "the right thing to do," withheld its consent to the transfer of control of the Public Internet Registry to Ethos Capital, effectively killing the proposed deal. In Summary The .ORG remains in the hands of the "Public Interest Registry" which seems to sometimes get called the "Public Internet Registry"? The "Public Interest Registry" pir.org link takes you to https://thenew.org/org-people/ where, among other things, you can download the PIR 2018 Annual Report<https://thenew.org/app/uploads/2019/09/PIR-2018-Annual-Report.pdf> or their 2018 Form 990<https://thenew.org/app/uploads/2019/09/PIR-2017_2018-990.zip> "Return of Organization Exempt From Tax". For 2018 you will see their total revenue was $93 million. cheers, Ian.

1 0

Linux not Windows: Why Munich is shifting back from Microsoft to open source – again
by Peter Reutemann 05 Jun '20

05 Jun '20

'In a notable U-turn for the city, newly elected politicians in Munich have decided that its administration needs to use open-source software, instead of proprietary products like Microsoft Office. "Where it is technologically and financially possible, the city will put emphasis on open standards and free open-source licensed software," a new coalition agreement negotiated between the recently elected Green party and the Social Democrats says. The agreement was finalized Sunday and the parties will be in power until 2026. "We will adhere to the principle of 'public money, public code'. That means that as long as there is no confidential or personal data involved, the source code of the city's software will also be made public," the agreement states.' -- source: https://www.zdnet.com/article/linux-not-windows-why-munich-is-shifting-back… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Signal Launches Face-Blurring Tool as US Protesters Embrace Encrypted Messaging
by Peter Reutemann 05 Jun '20

05 Jun '20

'Law enforcement officials across the U.S. have already revealed that they will leverage facial recognition technology to retroactively target protesters following the killing of George Floyd, with police asking the public for footage and photos. Against this backdrop, Signal is introducing a new feature that can automatically obfuscate faces shared within the encrypted messaging app, as the company says it's "working hard to keep up with the increased traffic" from protesters. From a report: Moving forward, Signal users will be able to activate a feature in the main photo editing toolbox that will automatically blur all faces it identifies in an image. As with many automated computer vision tools, Signal doesn't claim that its face-blurring smarts are 100% effective. It may not identify all faces in a photo, which is why users can manually obscure faces by drawing the blur brush across each face with their finger.' -- source: https://it.slashdot.org/story/20/06/04/1621201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Does Ringing Room Use BBB?
by Lawrence D'Oliveiro 04 Jun '20

04 Jun '20

Came across this site <https://ringingroom.com/> mentioned on the TV news this evening. It’s a “virtual bell tower” where fans of bell-ringing can gather to scratch their itch during lockdown in the UK and US. The thing that strikes me is, it look remarkably similar, at least in concept, to Web conferencing software BigBlueButton <https://bigbluebutton.org/>. I wonder if it’s an application/customization of the latter?

1 0

Zoom Won't Encrypt Free Calls Because it Wants To Comply With Law Enforcement
by Peter Reutemann 04 Jun '20

04 Jun '20

'If you're a free Zoom user, and waiting for the company to roll out end-to-end encryption for better protection of your calls, you're out of luck. From a report: Free calls won't be encrypted, and law enforcement will be able to access your information in case of 'misuse' of the platform. Zoom CEO Eric Yuan today said that the video conferencing app's upcoming end-to-end encryption feature will be available to only paid users.' -- source: https://yro.slashdot.org/story/20/06/03/1150245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

6 9

TrueNAS isn’t abandoning BSD—but it is adopting Linux
by Peter Reutemann 04 Jun '20

04 Jun '20

'To the surprise—and likely consternation—of BSD fans everywhere, FreeNAS vendor iXsystems is building a new version of its core product, TrueNAS, on top of Debian Linux. This week's TrueNAS Scale announcement builds on the company's March announcement that its commercial project TrueNAS and its community project FreeNAS would be merging into a common base. Effectively, all the NAS projects from iXsystems will be TrueNAS variants moving forward, with the free-to-use version being TrueNAS Core, the new Debian-based project becoming TrueNAS Scale, and the commercial project remaining simply TrueNAS.' -- source: https://arstechnica.com/gadgets/2020/06/truenas-isnt-abandoning-bsd-but-it-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

New Cold Boot Attack Affects Seven Years of LG Android Smartphones
by Peter Reutemann 04 Jun '20

04 Jun '20

'South Korean phone manufacturer LG has released a security update last month to fix a vulnerability that impacts its Android smartphones sold over the past seven years. From a report: The vulnerability, tracked under the identifier of CVE-2020-12753, impacts the bootloader component that ships with LG smartphones. In March this year, US software engineer Max Thomas discovered a vulnerability in the bootloader component that had been added to LG smartphones starting with the LG Nexus 5 series. In a technical breakdown of the vulnerability published on Tuesday, Thomas says the bootloader component's graphics package contains a bug that lets attackers sneak in their own code to run alongside the bootloader's graphics under certain conditions, such as when the battery dies out and when the device is in the bootloader's Download Mode. Thomas says that threat actors who perfectly time an attack can gain the ability to run their own custom code, which could allow them to take over the bootloader, and inherently the entire device.' -- source: https://mobile.slashdot.org/story/20/06/03/1830216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google fixes Android flaws that allow code execution with high system rights
by Peter Reutemann 03 Jun '20

03 Jun '20

'Google has shipped security patches for dozens of vulnerabilities in its Android mobile operating system, two of which could allow hackers to remotely execute malicious code with extremely high system rights. In some cases, the malware could run with highly elevated privileges, a possibility that raises the severity of the bugs. That’s because the bugs, located in the Android System component, could enable a specially crafted transmission to execute arbitrary code within the context of a privileged process. In all, Google released patches for at least 34 security flaws, although some of the vulnerabilities were present only in devices available from manufacturer Qualcomm.' -- source: https://arstechnica.com/information-technology/2020/06/google-fixes-android… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DOD's Third Attempt To Implement IPv6 Isn't Going Well
by Peter Reutemann 03 Jun '20

03 Jun '20

'The US Department of Defense is woefully behind on its plan to upgrade its IT infrastructure to support the newer IPv6 protocol, according to a government report published on Monday. From a report: This current effort is the third time the DOD attempts to upgrade its infrastructure to support IPv6 over in the past 17 years. The first two attempts took place in 2003 and 2010, respectively. The 2003 effort was abandoned with the DOD citing security risks and a lack of personnel trained in IPv6, while the second attempt was also abandoned, similarly on the grounds that IPv6 was not yet secure enough for the DOD's sensitive networks. On Monday, the Government Accountability Office (GAO), the auditing agency of the US government, said that the DOD's third attempt isn't doing any better either. GAO officials said the DOD failed to follow four basic requirements that were set out by the White House Office of Management and Budget (OMB) in 2006. The four requirements were part of an OMB guideline sent to all federal agencies detailing the proper procedure for upgrading networks from IPv4 to IPv6. "For its current [third] initiative, DOD has not completed three of four longstanding OMB requirements," GAO auditors said in a report published on Monday.' -- source: https://news.slashdot.org/story/20/06/02/1447254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0