September 2020 - wlug - list.wlug.org.nz

“LokiBot,” the malware that steals your most sensitive data, is on the rise
by Peter Reutemann 24 Sep '20

24 Sep '20

'Federal and state officials are seeing a big uptick in infections coming from LokiBot, an open source DIY malware package for Windows that’s openly sold or traded for free in underground forums. It steals passwords and cryptocurrency wallets, and it can also download and install new malware. In an alert published on Tuesday, the Department of Homeland Security’s Cybersecurity and Infrastructure Agency and the Multi-State Information Sharing & Analysis Center said LokiBot activity has scaled up dramatically in the past two months. The increase was measured by “EINSTEIN,” an automated intrusion-detection system for collecting, correlating, analyzing, and sharing computer security information across the federal civilian departments and agencies. “CISA has observed a notable increase in the use of LokiBot malware by malicious cyber actors since July 2020,” Tuesday’s alert stated. “Throughout this period, CISA’s EINSTEIN Intrusion Detection System, which protects federal, civilian executive branch networks, has detected persistent malicious LokiBot activity.”' -- source: https://arstechnica.com/information-technology/2020/09/lokibot-the-malware-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Lenovo begins selling OEM Ubuntu PCs to the general public
by Peter Reutemann 24 Sep '20

24 Sep '20

'Beginning today, Lenovo is offering a greatly expanded selection of OEM Linux PCs to the general public. Earlier this year, Lenovo began offering Fedora Linux pre-installed on laptop systems including Thinkpad P1 Gen 2, Thinkpad P53, and Thinkpad X1 Gen 8. Today's announcement makes Ubuntu Linux available on a considerably broader swath of both desktop and laptop PCs.' -- source: https://arstechnica.com/gadgets/2020/09/lenovo-launches-new-oem-linux-think… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox usage is down 85% despite Mozilla's top exec pay going up 400%
by Peter Reutemann 24 Sep '20

24 Sep '20

'Mozilla recently announced that they would be dismissing 250 people. That's a quarter of their workforce so there are some deep cuts to their work too. The victims include: the MDN docs (those are the web standards docs everyone likes better than w3schools), the Rust compiler and even some cuts to Firefox development. Like most people I want to see Mozilla do well but those three projects comprise pretty much what I think of as the whole point of Mozilla, so this news is a a big let down. The stated reason for the cuts is falling income. Mozilla largely relies on "royalties" for funding. In return for payment, Mozilla allows big technology companies to choose the default search engine in Firefox - the technology companies are ultimately paying to increase the number of searches Firefox users make with them. Mozilla haven't been particularly transparent about why these royalties are being reduced, except to blame the coronavirus. I'm sure the coronavirus is not a great help but I suspect the bigger problem is that Firefox's market share is now a tiny fraction of its previous size and so the royalties will be smaller too - fewer users, so fewer searches and therefore less money for Mozilla. The real problem is not the royalty cuts, though. Mozilla has already received more than enough money to set themselves up for financial independence. Mozilla received up to half a billion dollars a year (each year!) for many years. The real problem is that Mozilla didn't use that money to achieve financial independence and instead just spent it each year, doing the organisational equivalent of living hand-to-mouth. Despite their slightly contrived legal structure as a non-profit that owns a for-profit, Mozilla are an NGO just like any other. In this article I want to apply the traditional measures that are applied to other NGOs to Mozilla in order to show what's wrong.' -- source: http://calpaterson.com/mozilla.html Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Buy Them Up, Shut Them Down
by Lawrence D'Oliveiro 23 Sep '20

23 Sep '20

The latest in a long line of IoT devices being bricked or crippled because their essential servers are being shut down is the Libra “smart” weighing scale from Adidas <https://www.theregister.com/2020/09/22/adidas_libra_scale/>. This product was originally created by a small startup, which was later acquired by the big company ... with the usual all-too-frequent consequences. The article includes a catalogue of similar examples, including a “lifetime subscription” that turned out to be anything but, and an attempt to impose subscription fees on users who thought they were getting a fixed-price product. I wonder how long the customers will continue to get taken in ...

1 0

Russia Wants To Ban the Use of Secure Protocols Such As TLS 1.3, DoH, DoT, ESNI
by Peter Reutemann 23 Sep '20

23 Sep '20

'The Russian government is working on updating its technology laws so it can ban the use of modern internet protocols that can hinder its surveillance and censorship capabilities. According to a copy of the proposed law amendments and an explanatory note, the ban targets internet protocols and technologies such as TLS 1.3, DoH, DoT, and ESNI. Moscow officials aren't looking to ban HTTPS and encrypted communications as a whole, as these are essential to modern-day financial transactions, communications, military, and critical infrastructure. Instead, the government wants to ban the use of internet protocols that hide "the name (identifier) of a web page" inside HTTPS traffic.' -- source: https://tech.slashdot.org/story/20/09/22/157245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Is Bringing Edge To Linux
by Peter Reutemann 23 Sep '20

23 Sep '20

'Edge is finally coming to Linux. At Ignite 2020 today, Microsoft announced that Edge for Linux will be available in the Dev preview channel starting in October. Linux users will be able to download the preview from the Microsoft Edge Insider website or from their native Linux package manager. Microsoft will start with the Ubuntu and Debian distributions, with support for Fedora and openSUSE coming afterwards. "Linux stands out in that, while it has a relatively small desktop population in terms of what you might call typical consumer or end user, developers are often overrepresented in that population, and especially in areas like test automation, or CI/CD workloads for their web apps," Edge program manager Kyle Pflug told VentureBeat. "Edge on Linux is a natural part of our strategy to reduce fragmentation and test overhead for web developers. By providing the same rendering behavior and tools across platforms, developers can build and test sites and web apps in their preferred environment and be confident in the experience their customers will have."' -- source: https://linux.slashdot.org/story/20/09/22/1924237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Journal Is Back
by Peter Reutemann 23 Sep '20

23 Sep '20

'On August 7, 2019, Linux Journal laid off all staff members and was left with no operating funds to continue in any capacity. Today, the technology magazine announced that they've secured a deal to keep the site alive indefinitely under the ownership of Slashdot Media. Linux Journal writes: We will begin publishing digital content again as soon as we can. If you're a former Linux Journal contributor or a Linux enthusiast that would like to get involved, please contact us and let us know the capacity in which you'd like to contribute. We're looking for people to cover Linux news, create Linux guides, and moderate the community and comments. We'd also appreciate any other ideas or feedback you might have. Right now, we don't have any immediate plans to resurrect the subscription/issue model, and will be publishing exclusively on LinuxJournal.com free of charge. Our immediate goal is to familiarize ourself with the Linux Journal website and ensure it doesn't ever get shut down again. We're ecstatic to be able to take the helm at Linux Journal, and ensure that this legendary Linux resource and community not only stays alive forever, but continues to grow and improve. Reach out if you'd like to get involved!' -- source: https://linux.slashdot.org/story/20/09/22/2243209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

NZ Govt Unveils “Algorithm Charter”
by Lawrence D'Oliveiro 22 Sep '20

22 Sep '20

The Charter <https://www.theregister.com/2020/07/28/new_zealand_algorithm_charter/> requires Government departments who sign on to it to “maintain transparency” about the algorithms they use, but does not make them reveal the actual details of these algorithms. Nor does it explain what it means by an “algorithm”.

2 3

Automated Unit Testing: Quis Custodiet Ipsos Custodes?
by Lawrence D'Oliveiro 22 Sep '20

22 Sep '20

A company called Diffblue has a product that uses AI techniques to automatically generate unit tests for your code <https://www.theregister.com/2020/09/21/diffblue_let_ai_code_unit_tests/>. Only problem is, it doesn’t actually know what the intent of your code is, so it assumes it is correct to begin with, and generates tests on that basis. So who tests the test code? It falls back to a human to ensure the tests make sense. But doesn’t that defeat the point of having them done automatically? Unless you only use the system to catch regressions--things that were previously working, but get broken by newer changes to the code. Even then, it seems to me there is a likelihood of false positives, caused by refactoring of functionality between different modules; too many of these, and the humans are going to start ignoring the test results.

1 0

GNOME Gets New Versioning Scheme
by Peter Reutemann 22 Sep '20

22 Sep '20

'The GNOME 3 desktop environment was officially released in 2011, and in 2020 we are still on version 3.x. Yeah, despite many massive changes over the last (almost) decade, we have been stuck with point releases for GNOME 3. For instance, just last week, GNOME 3.38 was released. Historically, the stable releases all ended in even numbers, with pre-release versions ending in odd. For fans of the DE, such as yours truly, we have simply learned to live with this odd versioning scheme. Well, folks, with the next version of GNOME, the developers have finally decided to move on from version 3.x. You are probably thinking the new version will be 4.0, but you'd be very wrong. Actually, following GNOME3.38 will be GNOME 40. "After nearly 10 years of 3.x releases, the minor version number is getting unwieldy. It is also exceedingly clear that we're not going to bump the major version because of technological changes in the core platform, like we did for GNOME 2 and 3, and then piling on a major UX change on top of that. Radical technological and design changes are too disruptive for maintainers, users, and developers; we have become pretty good at iterating design and technologies, to the point that the current GNOME platform, UI, and UX are fairly different from what was released with GNOME 3.0, while still following the same design tenets," says Emmanuele Bassi, The GNOME Foundation.' -- source: https://linux.slashdot.org/story/20/09/21/1652221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1