January 2021 - wlug - list.wlug.org.nz

List Of IPTV Resources
by Lawrence D'Oliveiro 22 Sep '24

22 Sep '24

This user <https://github.com/iptv-org> just popped up in my GitHub feed. One repo <https://github.com/iptv-org/iptv> claims to be a list of links to over 8000 streaming TV channels from nations all over the world, while the other is a list of tools*, providers and other resources. Do be aware it’s a bit of a mixed bag: yes, there are legitimate channels (no encryption so far that I have noticed), but also some dubious-looking links. *Oddly, FFmpeg and youtube-dl aren’t in the list.

2 5

Outlawing Dark Patterns
by Lawrence D'Oliveiro 05 Nov '22

05 Nov '22

“Dark patterns” is a term coined to describe user interfaces designed to manipulate people into giving up time, money or personal data that they didn’t intend to. A common example is the obstacle course you often have to go through to cancel a subscription to something online. Another example is the use of countdown timers to rush buyers into hasty decisions. They may not be out-and-out deceptive, but they do come close. Now, the US states of California and Washington are looking to pass laws to restrict this practice. <https://arstechnica.com/tech-policy/2021/01/lawmakers-take-aim-at-insidious…>

2 2

Apple’s Windows 10
by Lawrence D'Oliveiro 19 Jul '22

19 Jul '22

Fred Brooks predicted long ago that complex pieces of software would eventually reach the point of irreducible entropy, where any attempt to fix a bug would simply introduce a new one. Microsoft’s Windows 10 seems to be about there, and it’s now clear that Apple’s macOS 10.15 “Catalina” has also joined that elite group <https://www.theregister.co.uk/2020/05/27/apple_catalina_update/>: The first spin of Catalina, officially released in October 2019, was a mess. ... The biggest issue was that all kinds of apps simply stopped working. ... Peripherals like mice, keyboards and printers stopped working. Email went missing; iCloud backups failed; users were constantly harassed by login requests; updates didn’t update ... ... So came for the first update to its new system one week after the main launch which fixed some, but not all, of the issues. ... Version two came in December 2019 and fixed some of those issues, but not all. ... More bug fixes came with version three in January 2020, but the OS seemed to have finally stabilized; something that was then spectacularly undone with version .4. ... Then we had the “supplemental update” to version 10.15.4, which fixed some, but not all, of the problems – most significantly the problem with Finder and transferring large files. And, amazingly, appeared to undo the good work that had been done with website security and broke SSH for some users. But now, with version point-five this week, that problem appears to have been sorted and, of course, your battery might last longer too.

1 1

More On The NZ Reserve Bank Breach
by Lawrence D'Oliveiro 15 Sep '21

15 Sep '21

Seems hackers broke into a secure file-sharing service called Accellion, based in California. The RBNZ was using that to exchange documents with the likes of banks and insurance companies. <https://www.stuff.co.nz/business/123911764/reserve-bank-reveals-more-detail…>

2 5

Raspberry Pi Foundation Launches $4 Microcontroller With Custom Chip
by Peter Reutemann 14 Mar '21

14 Mar '21

'Meet the Raspberry Pi Pico, a tiny little microcontroller that lets you build hardware projects with some code running on the microcontroller. Even more interesting, the Raspberry Pi Foundation is using its own RP2040 chip, which means that the foundation is now making its own silicon. From a report: If you're not familiar with microcontrollers, those devices let you control other parts or other devices. You might think that you can already do this kind of stuff with a regular Raspberry Pi. But microcontrollers are specifically designed to interact with other things. They're cheap, they're small and they draw very little power. You can start developing your project with a breadboard to avoid soldering. You can pair it with a small battery and it can run for weeks or even months. Unlike computers, microcontrollers don't run traditional operating systems. Your code runs directly on the chip. Like other microcontrollers, the Raspberry Pi Pico has dozens of input and output pins on the sides of the device. Those pins are important as they act as the interface with other components. For instance, you can make your microcontroller interact with an LED light, get data from various sensors, show some information on a display, etc. The Raspberry Pi Pico uses the RP2040 chip. It has a dual-core Arm processor (running at 133MHz), 264KB of RAM, 26 GPIO pins including 3 analog inputs, a micro-USB port and a temperature sensor. It doesn't come with Wi-Fi or Bluetooth. And it costs $4.' -- source: https://hardware.slashdot.org/story/21/01/21/1258214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 4

CentOS Is Gone -- But RHEL Is Now Free For Up To 16 Production Servers
by Peter Reutemann 06 Mar '21

06 Mar '21

'Ars Technica: Last month, Red Hat caused a lot of consternation in the enthusiast and small business Linux world when it announced the discontinuation of CentOS Linux. Long-standing tradition -- and ambiguity in Red Hat's posted terms -- led users to believe that CentOS 8 would be available until 2029, just like the RHEL 8 it was based on. Red Hat's early termination of CentOS 8 in 2021 cut eight of those 10 years away, leaving thousands of users stranded. Red Hat's December announcement of CentOS Stream -- which it initially billed as a "replacement" for CentOS Linux -- left many users confused about its role in the updated Red Hat ecosystem. As of February 1, 2021, Red Hat will make RHEL available at no cost for small-production workloads -- with "small" defined as 16 systems or fewer. This access to no-cost production RHEL is by way of the newly expanded Red Hat Developer Subscription program, and it comes with no strings -- in Red Hat's words, "this isn't a sales program, and no sales representative will follow up." Red Hat is also expanding the availability of developer subscriptions to teams, as well as individual users. Moving forward, subscribing RHEL customers can add entire dev teams to the developer subscription program at no cost. This allows the entire team to use Red Hat Cloud Access for simplified deployment and maintenance of RHEL on well-known cloud providers, including AWS, Google Cloud, and Microsoft Azure.' -- source: https://linux.slashdot.org/story/21/01/20/2016202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

Firefox 85 Hammers the Final Nail Into the Adobe Flash Coffin
by Peter Reutemann 03 Feb '21

03 Feb '21

'With Mozilla's release of Firefox 85 on Tuesday, Adobe's once ubiquitous Flash technology is really gone for good. The software had been widely used to expand gaming, video and animation on the web, though Adobe stopped supporting it at the end of 2020. Firefox was the last major browser to support Flash. From a report: Apple, whose late boss Steve Jobs helped sink Flash by banning it from iPhones and iPads, ditched Flash with Safari 14 in September 2020. Google Chrome, the most widely used browser, completely excised it on Jan. 19 with version 88. Microsoft's Edge 88 followed suit on Jan. 21. The schedule of removals shows just how hard it is to advance technology foundations as widely used as the web. Browser makers for years wanted to remove Flash, replacing it with more advanced standards built directly into the web. Jobs' "Thoughts on Flash" letter in 2010 solidified the opposition, and Adobe started recognizing the software's doom by scrapping the Android version of Flash in 2011. It's taken years of effort to drop Flash completely. Adobe took until 2017 to announce that Flash would be completely unsupported at the end of 2020, and still some are willing to jump through lots of hoops to keep Flash around a little longer.' -- source: https://it.slashdot.org/story/21/01/26/1618254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Google Threatens To Remove Search in Australia as Spat Escalates
by Peter Reutemann 01 Feb '21

01 Feb '21

'Google has threatened to disable its search engine in Australia if it's forced to pay local publishers for news, a dramatic escalation of a months-long standoff with the government. From a report: The proposed law, intended to compensate publishers for the value their stories generate for the company, is "unworkable," Mel Silva, managing director for Australia and New Zealand, told a parliamentary hearing Friday. She specifically opposed the requirement that Google pay media companies for displaying snippets of articles in search results. The threat is Google's most potent yet as the digital giant tries to stem a flow of regulatory action worldwide. At least 94% of online searches in Australia go through the Alphabet unit, according to the local competition regulator. "We don't respond to threats," Australia Prime Minister Scott Morrison said Friday. "Australia makes our rules for things you can do in Australia. That's done in our parliament. It's done by our government. And that's how things work here in Australia."' -- source: https://tech.slashdot.org/story/21/01/22/0339236 However, in related news: "Google Agrees To Pay French News Sites To Send Them Traffic" -- source: https://tech.slashdot.org/story/21/01/21/2316209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

TinyPilot KVM Over IP
by Lawrence D'Oliveiro 31 Jan '21

31 Jan '21

Just been watching this review <https://www.youtube.com/watch?v=CyEpshm16HY> of the TinyPilot KVM-over-IP box. It’s purchasable from the maker’s website for US$300-plus, which is a fraction of the price of most other KVM-over-IP products. It’s built around a Raspberry π 4, using the camera adapter for HDMI in (no use made of the GPIO connector at all). Of course this means it can only support a connection to a single server machine. The source code is on GitHub if you want to build that yourself. The base product offers insecure HTTP-only access; if you want HTTPS, you have to pay extra for the TinyPilot Pro software licence. For comparison, some reader comments mention an alternative “PiKVM” product -- has anyone heard of this?

2 2

CERN Gets Its Open Hardware Licence Approved By OSI
by Lawrence D'Oliveiro 31 Jan '21

31 Jan '21

CERN wanted to come up with the hardware equivalent of open-source software licences. Such licences don’t really work well with hardware, because they use terms (like “linking” and “system libraries”) that aren’t applicable to hardware. So they worked with the Open Source Initiative (the custodians of the Open Source Definition) to come up with a selection of three licences, allowing for a choice of strong copyleft (GPL-equivalent), weak copyleft (LGPL-equivalent, I guess) and no copyleft at all. It seems these licences could actually be used for a combination of both hardware and software. <https://www.theregister.com/2021/01/29/cern_ohl_approved/>

1 0

Cloning SSD's
by Ian Stewart 31 Jan '21

31 Jan '21

FWIW: My recent experiences with copying SSD's... I recently installed Ubuntu Mate from USB stick to a 120GB SSD. I then updated with all the latest patches. This took about 30 minutes. I then tailored my preferences of Firefox, Terminal, Pluma, etc. Created a Guest account. Installed the NZ dictionary, and added some applications. This took me another 30 minutes. I then needed to do this to 5 more computers. So, to prepare six computers would have taken me a total of about 6 hours. I considered using the utility "dd" to copy a clone of my master disk. Looking through stackoverflow<https://unix.stackexchange.com/questions/144172/full-dd-copy-from-hdd-to-hdd> I found the suggestion to use "cat". I.e. Boot Ubuntu from a USB stick and assuming sda is my master disk and sdb is the clone, then issue the command... $ sudo sh -c 'cat /dev/sda >/dev/sdb' I found this copying took about 15 minutes. However, it didn't give me any progress report during the copying sequence. I then... $ sudo apt install pv ...pv stands for "Pipe Viewer". For the next SSD drive to be cloned I issued the command... $ sudo sh -c 'pv /dev/sda >/dev/sdb' ...which then provided a progress bar that updated every second. With Samsung SSD 120GB drives I found the operation took 13 minutes 13 seconds with a transfer rate of 153MB/s. I later had built another master SSD on a Kingston 120GB SSD and cloned this to another Kingston 120GB SSD which took 10 minutes and had a transfer rate of 200MB/s. I found with the system still powered on, I could unplug the cloned SSD and plug in another blank SSD and start another cloning. Probably not a recommended practice. After booting the clone, I edited /etc/hostname to make each clone unique. Maybe there's something else I should change??? In summary, allowing for a bit of time to physically move the SSD's between machines, I was effectively completing the installation/updating/tailoring at a rate of three PC's an hour. I dunno if this was the right way or the best way, but, so far, the masters and all the clones seem to be working OK. cheers, Ian.

2 1

Intel Iris Xe Video Cards Now Shipping To OEMs: DG1 Lands In Desktops
by Peter Reutemann 29 Jan '21

29 Jan '21

'Ryan Smith, writing at AnandTech: Following plans first unveiled last year during the launch of their DG1 GPU, Intel sends word this morning that the first Iris Xe video cards have finally begun shipping to OEMs. Based on the DG1 discrete GPU that's already being used in Intel's Iris Xe MAX laptop accelerators, the Iris Xe family of video cards are their desktop counterpart, implementing the GPU on a traditional video card. Overall, with specifications almost identical to Xe MAX, Intel is similarly positioning these cards for the entry-level market, where they are being released as an OEM-only part. As a quick refresher, the DG1 GPU is based on the same Xe-LP graphics architecture as Tiger Lake's integrated GPU. In fact, in broad terms the DG1 can be thought of as a nearly 1-to-1 discrete version of that iGPU, containing the same 96 EUs and 128-bit LPDDR4X memory interface as Tiger Lake itself. Consequently, while DG1 is a big first step for Intel -- marking the launch of their first discrete GPU of the modern era -- the company is planning very modestly for this generation of parts. The first DG1 GPUs were shipped in the fall as part of Intel's Iris Xe MAX graphics solution for laptops. At the time, Intel also indicated that a desktop card for OEMs would also be coming in 2021, and now, right on schedule, those desktop cards have begun shipping out.' -- source: https://hardware.slashdot.org/story/21/01/28/1649204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ProtonMail, Threema, Tresorit and Tutanota Warn EU Lawmakers Over 'Anti-Encryption' Push
by Peter Reutemann 29 Jan '21

29 Jan '21

'Four European apps which secure user data via end-to-end encryption, ProtonMail, Threema, Tresorit and Tutanota, have issued a joint-statement warning over recent moves by EU institutions that they say are setting lawmakers on a dangerous path to backdooring encryption. From a report: Last month the EU Council passed a resolution on encryption that's riven with contradiction -- calling for "security through encryption and security despite encryption" -- which the four e2e app makers believe is a thinly veiled call to backdoor encryption. The European Commission has also talked about seeking "improved access" to encrypted information, writing in a wide-ranging counter-terrorism agenda also published in December that it will "work with Member States to identify possible legal, operational, and technical solutions for lawful access." Simultaneously, the Commission has said it will "promote an approach which both maintains the effectiveness of encryption in protecting privacy and security of communications, while providing an effective response to crime and terrorism." And it has made it clear there will be no 'one silver bullet' as regards the e2e encryption security 'challenge.' But such caveats are doing nothing to alleviate the concerns of e2e encrypted app makers -- who are convinced proposals from the Council of the EU, which is involved in adopting the bloc's laws (though the Commission usually drafts legislation), sums to an push toward backdoors. "While it's not explicitly stated in the resolution, it's widely understood that the proposal seeks to allow law enforcement access to encrypted platforms via backdoors," the four app makers write, going on to warn that such a move would fatally underline the security EU institutions also claim to want to maintain. "The resolution makes a fundamental misunderstanding: Encryption is an absolute, data is either encrypted or it isn't, users have privacy or they don't," they go on. "The desire to give law enforcement more tools to fight crime is obviously understandable. But the proposals are the digital equivalent of giving law enforcement a key to every citizen's home and might begin a slippery slope towards greater violations of personal privacy."' -- source: https://yro.slashdot.org/story/21/01/28/1724250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Rocky Linux gets a parent company, with $4m Series A funding
by Peter Reutemann 29 Jan '21

29 Jan '21

'Gregory Kurtzer, co-founder of the now-defunct CentOS Linux distribution, has founded a new startup company called Ctrl IQ, which will serve in part as a sponsoring company for the upcoming Rocky Linux distribution. Rocky Linux is to be a beneficiary of Ctrl IQ's revenue, not its source—the company describes itself in its announcement as the suppliers of a "full technology stack integrating key capabilities of enterprise, hyper-scale, cloud and high-performance computing."' -- source: https://arstechnica.com/gadgets/2021/01/rocky-linux-gets-a-parent-company-w… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GitLab Reshuffles Its Paid Subscription Plans, Drops Its Bronze/Starter Tier
by Peter Reutemann 28 Jan '21

28 Jan '21

'GitLab, the increasingly popular DevOps platform, today announced a major update to its subscription model. The company is doing away with its $4/month Bronze/Starter package. Current users will be able to renew one more time at the existing price or move to a higher tier (and receive a significant discount for the first three years after they do so). The company's free tier, it is worth noting, is not going away and GitLab argues that it includes "89% of the features in Bronze/Starter." To ease the pain, Bronze users will be able to renew their existing subscription before January 26, 2022 for an additional year at the existing price. They can also opt to move to the Premium tier at a discounted price for the next three years, starting at $6/user/month in Year 1, but that price then goes up to $9/user/month and $15/user/month in Year 2 and 3 respectively. For new users, the Bronze package is no longer available, starting now. With this change, GitLab now offers three tiers: Free, Premium and Ultimate (it's also doing away with the "Silver/Premium" and "Gold/Ultimate" naming). "The Bronze tier, we were selling at a loss," GitLab founder and CEO Sid Sijbrandij told TechCrunch. "We were just losing money every time we sold it -- just on hosting and support. To be a sustainable business, this was a move we had to make. It's a big transition for our customers but we want to make sure we're a sustainable company and we can keep investing."' -- source: https://tech.slashdot.org/story/21/01/27/215226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Reddit 1: Wall Street 0
by Lawrence D'Oliveiro 28 Jan '21

28 Jan '21

Something very peculiar happened last week: a group of small-time stock traders who hang out on Reddit took on a well-funded Wall Street money manager, and won. What happened was, a company called Melvin Capital took out a “short position” on shares in GameStop--that is, they put money on a bet that the stock value would go down. The Redditors (part of a subreddit called “wallstreetbets”) figured out that this position was vulnerable, and bet against it by buying up GameStop shares. This drove up the price, forcing Melvin to either put up or shut up--put up a bunch of money to back up their position, or give up and lose an even bigger bunch of money. In other words, Melvin was caught in a “short squeeze”, which drove it to the verge of bankruptcy. A good, clear intro to the whole story is here <https://arstechnica.com/gaming/2021/01/the-complete-morons-guide-to-gamesto…>. A less-easy-to-understand analysis, with links to further articles, is here <https://www.aljazeera.com/economy/2021/1/27/bbgamestop-how-day-trader-reddi…>.

1 0

10-year-old Sudo Bug Lets Linux Users Gain Root-Level Access
by Peter Reutemann 28 Jan '21

28 Jan '21

'A major vulnerability impacting a large chunk of the Linux ecosystem has been patched today in Sudo, an app that allows admins to delegate limited root access to other users. From a report: The vulnerability, which received a CVE identifier of CVE-2021-3156, but is more commonly known as "Baron Samedit," was discovered by security auditing firm Qualys two weeks ago and was patched earlier today with the release of Sudo v1.9.5p2. In a simple explanation provided by the Sudo team today, the Baron Samedit bug can be exploited by an attacker who has gained access to a low-privileged account to gain root access, even if the account isn't listed in /etc/sudoers -- a config file that controls which users are allowed access to su or sudo commands in the first place.' -- source: https://linux.slashdot.org/story/21/01/27/1820205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Play Bans Video App For Standard “.ass” Subtitle Support
by Lawrence D'Oliveiro 27 Jan '21

27 Jan '21

libass <https://github.com/libass/libass> is an open-source library for decoding the .ass/.ssa subtitle formats for video files. However, the automated censor-bot in the Google Play Store decided that an app supporting this format was violating the “Sexual Content and Profanity Policy”, and suspended it. The app was only reinstated after an appeal. <https://arstechnica.com/gadgets/2021/01/googles-bots-decide-ass-subtitle-su…>

1 0

Browser Makers Launch New Project For Writing Documentation For Web APIs
by Peter Reutemann 26 Jan '21

26 Jan '21

'A coalition of tech companies announced today the launch of Open Web Docs, a new initiative to help write documentation for Web APIs, JavaScript, and other web tooling and platforms. From a report: The new project does not view itself as a replacement for MDN Web Docs, a website hosted by Mozilla, where all browser makers agreed to move the official Web API documentation back in October 2017, and stop developing their own, often diverging, documentation sites. Instead, in a press release and FAQ today, the Open Web Docs team said their role is to fund, coordinate, and contribute to MDN Docs going forward. The new initiative comes after Mozilla laid off 250 employees last summer, including many of its MDN Web Docs staff. Open Web Docs comes to fill this void and provide the labor force needed to continue updating the MDN Web Docs portal.' -- source: https://tech.slashdot.org/story/21/01/25/216208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hacker Leaks Data of 2.28 Million Dating Site Users
by Peter Reutemann 26 Jan '21

26 Jan '21

'ZDNet: A well-known hacker has leaked the details of more than 2.28 million users registered on MeetMindful.com, a dating website founded in 2014, ZDNet has learned this week from a security researcher. The dating site's data has been shared as a free download on a publicly accessible hacking forum known for its trade in hacked databases. The leaked data, a 1.2 GB file, appears to be a dump of the site's users database. The content of this file includes a wealth of information that users provided when they set up profiles on the MeetMindful site and mobile apps. Some of the most sensitive data points included in the file include: Real names; Email addresses; City, state, and ZIP details; Body details; Dating preferences; Marital status; Birth dates; Latitude and longitude; IP addresses; Bcrypt-hashed account passwords; Facebook user IDs; and Facebook authentication tokens. Messages exchanged by users were not included in the leaked file; however, this does not make the entire incident less sensitive. The data leak, which is still available for download, was released by a threat actor who goes by the name of ShinyHunters. They also were responsible for leaking the details of millions of users registered on Teespring. ' -- source: https://yro.slashdot.org/story/21/01/25/2124226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fedora’s Chromium Maintainer Suggests Switching To Firefox
by Lawrence D'Oliveiro 26 Jan '21

26 Jan '21

Google is withdrawing access to certain of its service APIs that were formerly available to open-source Chromium builds, reserving them for its own proprietary Chrome product. In response, the maintainer for Fedora’s Chromium package says he is no longer sure of the value of Chromium, and is recommending users switch to Firefox instead. But then again, some are seeing the removal of Google APIs as an improvement. <https://www.theregister.com/2021/01/25/use_firefox_fedora_chromium_maintain…>

1 0

AGM minutes
by Peter Reutemann 26 Jan '21

26 Jan '21

Hi everyone The minutes of last night's AGM are now available: http://wiki.wlug.org.nz/MeetingTopics.2021-01-25 Thanks everyone for attending and the lively discussions. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Back To School: Technology, Stationery Costs Can Leave Parents In Debt
by Lawrence D'Oliveiro 26 Jan '21

26 Jan '21

Time was, you just needed to make sure your child had exercise books for school. Now they have to have a Chromebook, or maybe an Apple Mac or Ipad if that’s what their school uses. <https://www.nzherald.co.nz/nz/back-to-school-technology-stationery-costs-ca…>

1 0

When Adobe Stopped Flash Content, It Also Stopped A Chinese Railroad
by Peter Reutemann 25 Jan '21

25 Jan '21

'Jalopnik shares a story for our times: Adobe's Flash, the web browser plug-in that powered so very many crappy games, confusing interfaces, and animated icons of the early web like Homestar Runner is now finally gone, after a long, slow, protracted death. For most of us, this just means that some goofy webgame you searched for out of misplaced nostalgia will no longer run. For a select few in China, though, the death of Flash meant being late to work, because the city of Dalian in northern China was running their railroad system on it. Yes, a railroad, run on Flash, the same thing used to run "free online casinos" and knockoff Breakout games in mortgage re-fi ads... Hell, YouTube used to run on Flash until 2015. It wasn't all stupid little web games but, that said, I can't for the life of me fathom why anyone would want to run a freaking railroad network on it, with physical, multi-ton moving railcars full of human beings on it. So, when Adobe finally killed Flash-based content from running, this Tuesday Dalian's railroad network found itself ground to a halt for 20 hours. The railroad's technicians did get everything back up and running, but the way they did this is fascinating, too. They didn't switch the rail management system to some other, more modern codebase or software installation; instead, they installed a pirated version of Flash that was still operational. The knockoff version seems to be known as "Ghost Version." This, along with installing an older version of the Flash player to work with the knockoff Flash server setup, "solved" the problem, and the railroad was back up and running.' -- source: https://tech.slashdot.org/story/21/01/24/189207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome 88 Released, Removing Adobe Flash -- and FTP
by Peter Reutemann 24 Jan '21

24 Jan '21

'Google released Chrome 88 this week — and besides improving its dark mode support, they removed support for both Adobe Flash and FTP. PC World calls it "the end of two eras." The most noteworthy change in this update is what's not included. Chrome 88 lays Adobe Flash and the FTP protocol to rest. RIP circa-2000 Internet. Neither comes as a surprise, though it's poetic that they're being buried together. Adobe halted Flash Player downloads at the end of 2020, making good on a promise made years before, and began blocking Flash content altogether a couple weeks later. Removing Flash from Chrome 88 is just Google's way of flushing the toilet. On the other hand, FTP isn't dead, but it is now for Chrome users. The File Transport Protocol has helped users send files across the Internet for decades, but in an era of prolific cloud storage services and other sharing methods, its use has waned. Google started slowly disabling FTP support in Chrome 86, per ZDNet, and now you'll no longer be able to access FTP links in the browser. Look for standalone FTP software instead if you need it, such as FileZilla. That's not all. Mac users should be aware that Chrome 88 drops support for OS X 10.10 (OS X Yosemite). Yosemite released in 2014 and received its last update in 2017... But Google killing Flash and FTP might be the footnotes that hit old-school web users in the feels. Chrome 88 will also block non-encrypted downloads originating from an encrypted page, the article reports. And the Verge notes Chrome also offers less intrusive website permission requests (as an experimental feature enabled from chrome://flags/#permission-chip ), while Bleeping Computer describes Chrome 88's new experimental feature for searching through all your open tabs. And Chrome's blog points out some additional features under the hood: Chrome 88 will heavily throttle chained JavaScript timers for hidden pages in particular conditions. This will reduce CPU usage, which will also reduce battery usage. There are some edge cases where this will change behavior, but timers are often used where a different API would be more efficient, and more reliable.' -- source: https://slashdot.org/story/21/01/23/2018224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Why AWS Is Forking Elasticsearch and Kibana
by Peter Reutemann 24 Jan '21

24 Jan '21

'Steven J. Vaughan-Nichols writes at ZDNet: When Elastic, makers of the open-source search and analytic engine Elasticsearch, went after Amazon Web Services (AWS) by changing its license from the open-source Apache 2.0-license ALv2) to the non-open-source friendly Server Side Public License, I predicted "we'd soon see AWS-sponsored Elasticsearch and Kibana forks." The next day, AWS tweeted it "will launch new forks of both Elasticsearch and Kibana based on the latest Apache 2.0 licensed codebases." Well, that didn't take long! In a blog post, AWS explained that since Elastic is no longer making its search and analytic engine Elasticsearch and its companion data visualization dashboard Kibana available as open source, AWS is taking action. "In order to ensure open source versions of both packages remain available and well supported, including in our own offerings, we are announcing today that AWS will step up to create and maintain an ALv2-licensed fork of open-source Elasticsearch and Kibana.... AWS brings years of experience working with these codebases, as well as making upstream code contributions to both Elasticsearch and Apache Lucene, the core search library that Elasticsearch is built on — with more than 230 Lucene contributions in 2020 alone... We're in this for the long haul, and will work in a way that fosters healthy and sustainable open source practices — including implementing shared project governance with a community of contributors..." Yet another company, Logz.io, a cloud-monitoring company, and some partners have announced that it will launch a "true" open source distribution for Elasticsearch and Kibana.' -- source: https://news.slashdot.org/story/21/01/23/0245229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Brad Cox, Creator of Objective-C Programming Language, Dies At 76
by Peter Reutemann 24 Jan '21

24 Jan '21

'We have learned that Brad Cox, computer scientist known mostly for creating the Objective-C programming language with his business partner Tom Love, died on January 2, 2021 at his residence. He was 76. >From a Legacy.com post: Brad was born on May 2, 1944 in Fort Benning, Georgia, to the late Nancy Hinson Cox and Dewey McBride Cox of Lake City, South Carolina. Brad grew up on the family's dairy farm in South Carolina but found himself most interested in science. After graduating from Lake City High School, he received his Bachelor of Science Degree in Organic Chemistry and Mathematics from Furman University, and his Ph.D. from the Department of Mathematical Biology at the University of Chicago, and worked on an early form of neural networks. He soon found himself more interested in computers and got a job at International Telephone and Telegraph (ITT) and later joined Schlumbeger -- Doll Research Labs, and ultimately formed his own Connecticut startup, Productivity Products International (PPI) later named Stepstone. Among his first known software projects, he wrote a PDP-8 program for simulating clusters of neurons. He worked at the National Institutes of Health and Woods Hole Oceanographic Institute before moving into the software profession. Dr. Cox was an entrepreneur, having founded the Stepstone Company together with Tom Love for releasing the first Objective-C implementation. Stepstone hoped to sell "ICPaks" and Dr. Cox focused on building his ICPak libraries and hired a team to continue work on Objective-C, including Steve Naroff. The late Steve Jobs', NeXT, licensed the Objective-C language for it's new operating system, NEXTSTEP. NeXT eventually acquired Objective- C from Stepstone. Objective-C continued to be the primary programming language for writing software for Apple's OS X and iOS. ' -- source: https://developers.slashdot.org/story/21/01/23/0446216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

DDoSers are abusing Microsoft RDP to make attacks more powerful
by Peter Reutemann 24 Jan '21

24 Jan '21

'DDoS-for-hire services are abusing the Microsoft Remote Desktop Protocol to increase the firepower of distributed denial-of-service attacks that paralyze websites and other online services, a security firm said this week. Typically abbreviated as RDP, Remote Desktop Protocol is the underpinning for a Microsoft Windows feature that allows one device to log into another device over the Internet. RDP is mostly used by businesses to save employees the cost or hassle of having to be physically present when accessing a computer. As is typical with many authenticated systems, RDP responds to login requests with a much longer sequence of bits that establish a connection between the two parties. So-called booter/stresser services, which for a fee will bombard Internet addresses with enough data to take them offline, have recently embraced RDP as a means to amplify their attacks, security firm Netscout said. The amplification allows attackers with only modest resources to strengthen the size of the data they direct at targets. The technique works by bouncing a relatively small amount of data at the amplifying service, which in turn reflects a much larger amount of data at the final target. With an amplification factor of 85.9 to 1, 10 gigabytes-per-second of requests directed at an RDP server will deliver roughly 860Gbps to the target. “Observed attack sizes range from ~20 Gbps – ~750 Gbps,” Netscout researchers wrote. “As is routinely the case with newer DDoS attack vectors, it appears that after an initial period of employment by advanced attackers with access to bespoke DDoS attack infrastructure, RDP reflection/amplification has been weaponized and added to the arsenals of so-called booter/stresser DDoS-for-hire services, placing it within the reach of the general attacker population.”' -- source: https://arstechnica.com/information-technology/2021/01/ddosers-are-abusing-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How DNSpooq Attacks Could Poison DNS Cache Records
by Peter Reutemann 24 Jan '21

24 Jan '21

'Earlier this week security experts disclosed details on seven vulnerabilities impacting Dnsmasq, "a popular DNS software package that is commonly deployed in networking equipment, such as routers and access points," reports ZDNet. "The vulnerabilities tracked as DNSpooq, impact Dnsmasq, a DNS forwarding client for *NIX-based operating systems." Slashdot reader Joe2020 shared Help Net Security's quote from Shlomi Oberman, CEO and researcher at JSOF. "Some of the bigger users of Dnsmasq are Android/Google, Comcast, Cisco, Red Hat, Netgear, and Ubiquiti, but there are many more. All major Linux distributions offer Dnsmasq as a package, but some use it more than others, e.g., in OpenWRT it is used a lot, Red Hat use it as part of their virtualization platforms, Google uses it for Android hotspots (and maybe other things), while, for example Ubuntu just has it as an optional package." More from ZDNet: Dnsmasq is usually included inside the firmware of various networking devices to provide DNS forwarding capabilities by taking DNS requests made by local users, forwarding the request to an upstream DNS server, and then caching the results once they arrive, making the same results readily available for other clients without needing to make a new DNS query upstream. While their role seems banal and insignificant, they play a crucial role in accelerating internet speeds by avoiding recursive traffic... Today, the DNSpooq software has made its way in millions of devices sold worldwide [including] all sorts of networking gear like routers, access points, firewalls, and VPNs from companies like ZTE, Aruba, Redhat, Belden, Ubiquiti, D-Link, Huawei, Linksys, Zyxel, Juniper, Netgear, HPE, IBM, Siemens, Xiaomi, and others. The DNSpooq vulnerabilities, disclosed today by security experts from JSOF, are dangerous because they can be combined to poison DNS cache entries recorded by Dnsmasq servers. Poisoning DNS cache records is a big problem for network administrators because it allows attackers to redirect users to clones of legitimate websites... In total, seven DNSpooq vulnerabilities have been disclosed today. Four are buffer overflows in the Dnsmasq code that can lead to remote code execution scenarios, while the other three bugs allow DNS cache poisoning. On their own, the danger from each is limited, but researchers argue they can be combined to attack any device with older versions of the Dnsmasq software... The JSOF exec told ZDNet that his company has worked with both the Dnsmasq project author and multiple industry partners to make sure patches were made available to device vendors by Tuesday's public disclosure.' -- source: https://it.slashdot.org/story/21/01/23/0412253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Alphabet Shuts Down Loon Internet Balloon Company
by Peter Reutemann 23 Jan '21

23 Jan '21

'Google's parent firm, Alphabet, is done exploring the idea of using a fleet of balloons to beam high-speed internet in remote parts of the world. From a report: The firm said on Thursday evening that it was winding down Loon, a nine-year-old project and a two-and-a-half-year-old spin off firm, after failing to find a sustainable business model and partners for one of its most prominent moonshot projects. The demise of Loon, which assumed spotlight after the project helped restore cell services knocked out by a hurricane in Puerto Rico, comes a year after the Android-maker ended Google Station, its other major connectivity effort to bring internet to the next billion users.' -- source: https://tech.slashdot.org/story/21/01/22/1418212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel Talks With TSMC, Samsung To Outsource Some Chip Production
by Peter Reutemann 22 Jan '21

22 Jan '21

'Intel has talked with TSMC and Samsung about the Asian companies making some of its best chips, but the Silicon Valley pioneer is still holding out hope for last-minute improvements in its own production capabilities. Bloomberg reports: After successive delays in its chip fabrication processes, Santa Clara, California-based Intel has yet to make a final decision less than two weeks ahead of a scheduled announcement of its plans, according to people familiar with the deliberations. Any components that Intel might source from Taiwan wouldn't come to market until 2023 at the earliest and would be based on established manufacturing processes already in use by other TSMC customers, said the people, asking not to be identified because the plans are private. Talks with Samsung, whose foundry capabilities trail TSMC's, are at a more preliminary stage, the people said. An Intel spokesperson referred to previous comments by Bob Swan, the company's chief executive officer. Swan has promised investors he'll set out his plans for outsourcing and get Intel's production technology back on track when the company reports earnings Jan. 21. [...] TSMC, the largest maker of semiconductors for other companies, is preparing to offer Intel chips manufactured using a 4-nanometer process, with initial testing using an older 5-nanometer process, according to the people. The company has said it will make test production of 4-nanometer chips available in the fourth quarter of 2021 and volume shipments the following year. The Taiwanese company expects to have a new facility in Baoshan operational by the end of this year, which can be converted to production for Intel if required, one of the people said. TSMC executives previously said the new Baoshan unit would house a research center with 8,000 engineers. While Intel has outsourced production of lower-end chips before, it has kept the manufacturing of its best semiconductors in-house, considering it a competitive strength. Its engineers have historically tailored their designs to the company's manufacturing processes, making a shift to outsourcing of flagship products unthinkable in the past. As the provider of 80% of personal computer and server processors globally, Intel produces hundreds of millions of chips each year. That scale dictates that any potential supplier must create new capacity to accommodate Intel.' -- source: https://hardware.slashdot.org/story/21/01/08/2215226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

“When Elephants Fight, The Grass Gets Trampled”
by Lawrence D'Oliveiro 22 Jan '21

22 Jan '21

When big news organizations tussle with big Web search engines and social media outfits over who is stealing revenue from whom, how do you decide who is right and who is wrong? The Aussie Government is trying to protect one lot of multinational companies from the encroachments of another lot; where does fair competition end and protectionism or exploitation begin? <https://www.nzherald.co.nz/business/google-threatens-to-ban-search-button-i…> (By the way, in that old African proverb, the “grass” is the ordinary people who are the inevitable victims in any conflict between major powers.)

1 0

Ubuntu Now Runs On Apple Silicon, Devs Say It's 'Completely Usable'
by Peter Reutemann 22 Jan '21

22 Jan '21

'Developers at ARM virtualisation company Corellium have managed to get Ubuntu 20.04 up and running on the new Apple Silicon Mac Mini. And we're not talking 'it boots and prints a load of text' running here. No, this is the full Ubuntu desktop experience -- and it's already being described as "completely usable!" Pretty impressive, right? Even Linus Torvalds wasn't convinced that Linux M1 support was likely to appear anytime soon. He told ZDnet's Steven J. Vaughan-Nichols that: "...the main problem with the M1 for me is the GPU and other devices around it, because that's likely what would hold me off using it because it wouldn't have any Linux support unless Apple opens up." Not that he was entirely wrong, mind. GPU support is indeed a current sticking point in Correllium's Linux for M1 effort. It doesn't (yet) include M1 GPU support meaning 'graphics' handling is done via software rendering.' -- source: https://news.slashdot.org/story/21/01/21/1329258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

NSA Urges System Administrators To Replace Obsolete TLS Protocols
by Peter Reutemann 22 Jan '21

22 Jan '21

'The US National Security Agency has issued a security advisory this month urging system administrators in federal agencies and beyond to stop using old and obsolete TLS protocols. From a report: "NSA recommends that only TLS 1.2 or TLS 1.3 be used; and that SSL 2.0, SSL 3.0, TLS 1.0, and TLS 1.1 not be used," the agency said. "Using obsolete encryption provides a false sense of security because it seems as though sensitive data is protected, even though it really is not," the agency added. Even if TLS 1.2 and TLS 1.3 are deployed, the NSA warns against configuring these two protocols with weak cryptographic parameters and cipher suites.' -- source: https://tech.slashdot.org/story/21/01/21/1646211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Leave.EU Stays In The EU
by Lawrence D'Oliveiro 21 Jan '21

21 Jan '21

The domain that was registered by Brexiteers to promote their campaign for the UK to leave the EU has been re-domiciled to an address in the EU <https://www.theregister.com/2021/01/08/leave_eu_domain_name_hilarity/>. This is because of rule changes that mean UK-based entities are no longer entitled to register .eu names. So if the site wants to stay up under that name, it cannot, contrary to its own name, leave the EU. Just to add to the fun, the individual in the Republic of Ireland who is named on the domain registration claims to know nothing about it, and says he “will be looking into the matter”.

3 3

Stopping Alert Volume Going To 100%
by Lawrence D'Oliveiro 20 Jan '21

20 Jan '21

For quite a while now, I’ve been annoyed by the system notification volume going to 100% on my Debian systems, regardless of my attempts to set it to a lower level. For example, when I open the KDE System Settings app, change something, then try to close the window, the sound that accompanies the save/discard/cancel alert is always startlingly loud. I think I have finally found a fix: in your /etc/pulse/daemon.conf, put in a line saying flat-volumes = no (You should find an existing comment “; flat-volumes = yes” that indicates the default.) You can make this new setting take effect in the current session immediately without having to logout or reboot, by executing the following as the currently-logged-in user: pulseaudio -k (This kills and restarts the PulseAudio daemon for your user session.) There are several discussions of the pros and cons of this issue online, going back some years. For example, here <https://bugzilla.redhat.com/show_bug.cgi?id=1265267>. Also a mention about the “flat-volumes” setting in the ever-reliable Arch Linux Wiki here <https://wiki.archlinux.org/index.php/PulseAudio>.

1 1

Wine 6.0 Released
by Peter Reutemann 20 Jan '21

20 Jan '21

'Wine 6.0 has been released today and contains over 8,300 changes, according to its full release notes. Windows Central reports: The new release of version 6.0 has thousands of changes, but Wine's website highlights some of the biggest improvements: Core modules in PE format; Vulkan backend for WineD3D; DirectShow and Media Foundation support; and Text console redesign. The full release notes for Wine 6.0 explain that the core DLLs, which include NTDLL, KERNEL32, GDI32, and USER32 are now built in the Portable Executable (PE) format. As a result, people should see improvements for certain copy protection schemes. The update also includes a new mechanism to associate a Unix library with the PE module. This change makes it so systems can call Unix libraries from PE when trying to perform a function that can't be handled by Win32 APIs. Wine 6.0 also includes an experimental Vulkan rendered that translates Direct3D shaders to SPIR-V shaders. In another change related to Direct3D, the Direct3D graphics card database now recognizes more graphics cards and includes updated driver versions. ' -- source: https://tech.slashdot.org/story/21/01/19/039257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Brave Becomes First Browser To Add Native Support For the IPFS Protocol
by Peter Reutemann 20 Jan '21

20 Jan '21

'With the release of Brave 1.19 today, Brave has become the first major browser maker to support IPFS, a peer-to-peer protocol meant for accessing decentralized or censored content. From a report: Released in 2015, IPFS stands for InterPlanetary File System. It is a classic peer-to-peer protocol similar to BitTorrent and designed to work as a decentralized storage system. IPFS allows users to host content distributed across hundreds or thousands of systems, which can be public IPFS gateways or private IPFS nodes. Users who want to access any of this content must enter an URL in the form of ipfs://{content_hash_ID}. Under normal circumstances, users would download this content from the nearest nodes or gateways rather than a central server. However, this only works if users have installed an IPFS desktop app or a browser extension. Brave says that with version 1.19, users will be able to access URLs that start with ipfs://, directly from the browser, with no extension needed, and that Brave will natively support ipfs:// links going forward. Since some major websites like Wikipedia have IPFS versions, users in oppressive countries can now use Brave's new IPFS support to go around national firewalls and access content that might be blocked inside their country for political reasons and is available via IPFS.' -- source: https://it.slashdot.org/story/21/01/19/2015252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FireEye Releases Tool For Auditing Networks for Techniques Used by SolarWinds Hackers
by Peter Reutemann 20 Jan '21

20 Jan '21

'Cybersecurity firm FireEye has released today a report detailing the techniques used by the SolarWinds hackers inside the networks of companies they breached. From a report: Together with the report, FireEye researchers have also released a free tool on GitHub named Azure AD Investigator that they say can help companies determine if the SolarWinds hackers (also known as UNC2452) used any of these techniques inside their networks. Today's FireEye report comes as the security firm has spearheaded investigations into the SolarWinds supply chain compromise, together with Microsoft and CrowdStrike. The SolarWinds hack came to light on December 13, 2020, when FireEye and Microsoft confirmed that a threat actor broke into the network of IT software provider SolarWinds and poisoned updates for the Orion app with malware.' -- source: https://tech.slashdot.org/story/21/01/19/2023209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The NSA warns enterprises to beware of third-party DNS resolvers
by Peter Reutemann 19 Jan '21

19 Jan '21

'DNS over HTTPS is a new protocol that protects domain-lookup traffic from eavesdropping and manipulation by malicious parties. Rather than an end-user device communicating with a DNS server over a plaintext channel—as DNS has done for more than three decades—DoH, as DNS over HTTPS is known, encrypts requests and responses using the same encryption websites rely on to send and receive HTTPS traffic. Using DoH or a similar protocol known as DoT—short for DNS over TLS—is a no brainer in 2021, since DNS traffic can be every bit as sensitive as any other data sent over the Internet. On Thursday, however, the National Security Agency said in some cases Fortune 500 companies, large government agencies, and other enterprise users are better off not using it. The reason: the same encryption that thwarts malicious third parties can hamper engineers’ efforts to secure their networks. “DoH provides the benefit of encrypted DNS transactions, but it can also bring issues to enterprises, including a false sense of security, bypassing of DNS monitoring and protections, concerns for internal network configurations and information, and exploitation of upstream DNS traffic,” NSA officials wrote in published recommendations. “In some cases, individual client applications may enable DoH using external resolvers, causing some of these issues automatically.”' -- source: https://arstechnica.com/information-technology/2021/01/the-nsa-warns-enterp… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Cryptocat Author Gets Insanely Fast Backing To Build P2P Tech For Social Media
by Peter Reutemann 19 Jan '21

19 Jan '21

'TechCrunch: The idea for Capsule started with a tweet about reinventing social media. A day later cryptography researcher, Nadim Kobeissi -- best known for authoring the open-source E2E-encrypted desktop chat app Cryptocat (now discontinued) -- had pulled in a pre-seed investment of $100,000 for his lightweight mesh-networked microservices concept, with support coming from angel investor and former Coinbase CTO Balaji Srinivasan, William J. Pulte and Wamda Capital. The nascent startup has a post-money valuation on paper of $10 million, according to Kobeissi, who is working on the prototype -- hoping to launch an MVP of Capsule in March (as a web app), after which he intends to raise a seed round (targeting $1 million-$1.5 million) to build out a team and start developing mobile apps. For now there's nothing to see beyond Capsule's landing page and a pitch deck (which he shared with TechCrunch for review). But Kobeissi says he was startled by the level of interest in the concept. "I posted that tweet and the expectation that I had was that basically 60 people max would retweet it and then maybe I'll set up a Kickstarter," he tells us. Instead the tweet "just completely exploded" and he found himself raising $100,000 "in a single day" -- with $50,000 paid in there and then. "I'm not a startup guy. I've been running a business based on consulting and based on academic R&D services," he continues. "But by the end of the day -- last Sunday, eight days ago -- I was running a Delaware corporation valued at $10 million with $100,000 in pre-seed funding, which is insane. Completely insane."' -- source: https://news.slashdot.org/story/21/01/18/2144252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

OpenWRT Forum User Data Stolen In Weekend Data Breach
by Peter Reutemann 19 Jan '21

19 Jan '21

'The OpenWRT forum, a large community of enthusiasts of alternative, open-source operating systems for routers, announced a data breach over the weekend. Bleeping Computer reports: The attack occurred on Saturday, around 04:00 (GMT), when an unauthorized third party gained admin access to and copied a list with details about forum users and related statistical information. The intruder used the account of an OpenWRT administrator. Although the account had "a good password," additional security provided by two-factor authentication (2FA) was not active. Email addresses and handles of the forum users have been stolen, the moderators say. They add that they believe the attacker was not able to download the forum database, meaning that passwords should be safe. However, they reset all the passwords on the forum just to be on the safe side and invalidated all the API keys used for project development processes. Users have to set the new password manually from the login menu by providing their user name and following the "get a new password" instructions. Those logging in using GitHub credentials are advised to reset or refresh it. The OpenWRT forum credentials are separate from the Wiki. Currently, there is no suspicion that the Wiki credentials have been compromised in any way. OpenWRT forum administrators warn that since this breach exposed email addresses, users may become targets of credible phishing attempts. ' -- source: https://it.slashdot.org/story/21/01/18/2148210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DuckDuckGo Surpasses 100 Million Daily Search Queries For the First Time
by Peter Reutemann 19 Jan '21

19 Jan '21

'Privacy-focused search engine DuckDuckGo reached a major milestone in its 12-year-old history last week when it recorded on Monday its first-ever day with more than 100 million user search queries. From a report: The achievement comes after a period of sustained growth the company has been seeing for the past two years, and especially since August 2020, when the search engine began seeing more than 2 billion search queries a month on a regular basis. The numbers are small in comparison to Google's 5 billion daily search queries but it's a positive sign that users are looking for alternatives. DuckDuckGo's popularity comes after the search engine has expanded beyond its own site and now currently offers mobile apps for Android and iOS, but also a dedicated Chrome extension. More than 4 million users installed these apps and extension, the company said in a tweet in September 2020.' -- source: https://tech.slashdot.org/story/21/01/18/1450258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AGM next week
by Peter Reutemann 18 Jan '21

18 Jan '21

Hi everyone Just a reminder that our AGM is coming up next week: https://www.meetup.com/WaikatoLinuxUsersGroup/events/274861121/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How Tim Berners-Lee Will Fix the Internet
by Peter Reutemann 18 Jan '21

18 Jan '21

'"Sir Tim Berners-Lee, the British computer scientist who was knighted for inventing the internet navigation system known as the World Wide Web, wants to re-make cyberspace once again," reports Reuters: With a new startup called Inrupt, Berners-Lee aims to fix some of the problems that have handicapped the so-called open web in an age of huge, closed platforms such as Facebook. Building on ideas developed by an open-source software project called Solid, Inrupt promises a web where people can use a single sign-on for any service and personal data is stored in "pods," or personal online data stores, controlled by the user. "People are fed up with the lack of controls, the silos," said Berners-Lee, co-founder and chief technology officer of Inrupt, in an interview at the Reuters Next conference... John Bruce, a veteran technology executive who is CEO of Inrupt, said the company had signed up Britain's National Health Service, the BBC and the government of Flanders in Belgium as pilot customers, and hoped to announce many more by April... A key aim for Inrupt is to get software developers to write programs for the platform. Inrupt, like the original web, is at its core mostly a set of protocols for how machines talk to one another, meaning that specific applications bring it to life. "The use cases are so broad, it's like a do-over for the web," Berners-Lee said. In a video interview, Berners-Lee tells Reuters that what people are worried about isn't privacy per se but "the lack of empowerment" — for example, to collaborate with people. And then he acknowledges that the worldwide web does suffer from limited access control. "I wanted it to be a collaborative space, but in a way that was naive, because collaborative spaces you need to be private. You need to start off with just a limited sharing, and then you allow the sharing to increase." Social networks provided some features like a unique login and identity. But unfortunately, then "The large social networks will tend to get larger" — and ultimately without a single global signon, users then become trapped in separate silos.' -- source: https://tech.slashdot.org/story/21/01/16/2336244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Jamie Zawinski Calls Cinnamon Screensaver Lock-Bypass Bug 'Unconscionable'
by Peter Reutemann 18 Jan '21

18 Jan '21

'Legendary programmer Jamie Zawinski has worked on everything from the earliest releases of the Netscape Navigator browser to XEmacs, Mozilla, and, of course, the XScreenSaver project. Now Slashdot reader e432776 writes: JWZ continues to track issues with screensavers on Linux (since 2004!), and discusses a new bug in cinnamon-screensaver. Long-standing topics like X11, developer interaction, and code licensing all feature. Solutions to these long-standing issues remain elusive. Jamie titled his blog post "I told you so, 2021 edition": You will recall that in 2004 , which is now seventeen years ago, I wrote a document explaining why I made the design trade-offs that I did in XScreenSaver, and in that document I predicted this exact bug as my example of, "this is what will happen if you don't do it this way." And they went and made that happen. Repeatedly. Every time this bug is re-introduced, someone pipes up and says something like, "So what, it was a bug, they've fixed it." That's really missing the point. The point is not that such a bug existed, but that such a bug was even possible. The real bug here is that the design of the system even permits this class of bug. It is unconscionable that someone designing a critical piece of security infrastructure would design the system in such a way that it does not fail safe . Especially when I have given them nearly 30 years of prior art demonstrating how to do it right, and a two-decades-old document clearly explaining What Not To Do that coincidentally used this very bug as its illustrative strawman! These bugs are a shameful embarrassment of design -- as opposed to merely bad code... ZDNet reports that Linux Mint has issued a patch for Cinnamon that fixes the screensaver bug. But HotHardware notes that it was discovered when "one Dad let the kids play with the keyboard. This button-mashing actually crashed the machine's screensaver by sheer luck, allowing them onto the desktop, ultimately leading to the discovery of a high priority security vulnerability for the Linux Mint team." But that's not the only thing bothering Jamie Zawinski: Just to add insult to injury, it has recently come to my attention that not only are Gnome-screensaver, Mint-screensaver and Cinnamon-screensaver buggy and insecure dumpster fires, but they are also in violation of my license and infringing my copyright. XScreenSaver was released under the BSD license, one of the oldest and most permissive of the free software licenses. It turns out, the Gnome-screensaver authors copied large parts of XScreenSaver into their program, removed the BSD license and slapped a GPL license on my code instead -- and also removed my name. Rude... Mint-screensaver and Cinnamon-screensaver, being forks and descendants of Gnome-screensaver, have inherited this license violation and continue to perpetuate it. Every Linux distro is shipping this copyright- and license-infringing code. I eagerly await hearing how they're going to make this right.' -- source: https://tech.slashdot.org/story/21/01/17/0024243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Interview With Jon “maddog” Hall
by Lawrence D'Oliveiro 17 Jan '21

17 Jan '21

Been watching this nearly-hour-long conversation <https://www.youtube.com/watch?v=EZMA3Ge144U> with Jon “maddog” Hall, who if you don’t know him, was very likely the inspiration for the famous Dilbert cartoon featuring the Unix-using neckbeard telling the corporate jobsworth to “get a better computer” <https://dilbert.com/strip/1995-06-24>. Seems that there were several round-number anniversaries related to Unix coming due in 2019 (the year after the video was made), including the 50th anniversary of its creation at Bell Labs. After an early career on IBM mainframe equipment, maddog got a job as a sysadmin at Bell Labs, where he was introduced to Unix. Then he did various different jobs over many years at DEC. At about the half-hour mark, he talks about how he met Linus Torvalds, and asked the latter about porting his still-only-32-bit x86-only fledgling Linux kernel onto the 64-bit Alpha architecture. Linus wanted to do this, but he couldn’t get an Alpha machine from the Helsinki DEC office. So maddog went to bat, pulled a few strings, and got one for him. And it took just 9 months to take Linux from being x86-only and 32-bit-only to being cross-platform and 64-bit-native.

1 0

Windows 10 Bug Corrupts Your Hard Drive On Seeing This File's Icon
by Peter Reutemann 15 Jan '21

15 Jan '21

'An unpatched zero-day in Microsoft Windows 10 allows attackers to corrupt an NTFS-formatted hard drive with a one-line command. Bleeping Computer reports: In August 2020, October 2020, and finally this week, infosec researcher Jonas L drew attention to an NTFS vulnerability impacting Windows 10 that has not been fixed. When exploited, this vulnerability can be triggered by a single-line command to instantly corrupt an NTFS-formatted hard drive, with Windows prompting the user to restart their computer to repair the corrupted disk records. The researcher told BleepingComputer that the flaw became exploitable starting around Windows 10 build 1803, the Windows 10 April 2018 Update, and continues to work in the latest version. What's worse is, the vulnerability can be triggered by standard and low privileged user accounts on Windows 10 systems. [...] It is unclear why accessing this attribute corrupts the drive, and Jonas told BleepingComputer that a Registry key that would help diagnose the issue doesn't work. One striking finding shared by Jonas with us was that a crafted Windows shortcut file (.url) that had its icon location set to C:\:$i30:$bitmap would trigger the vulnerability even if the user never opened the file! As observed by BleepingComputer, as soon as this shortcut file is downloaded on a Windows 10 PC, and the user views the folder it is present in, Windows Explorer will attempt to display the file's icon. To do this, Windows Explorer would attempt to access the crafted icon path inside the file in the background, thereby corrupting the NTFS hard drive in the process. Next, "restart to repair hard drive" notifications start popping up on the Windows PC -- all this without the user even having opened or double-clicked on the shortcut file. ' -- source: https://hardware.slashdot.org/story/21/01/14/232238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

BeagleV is a $150 RISC-V Computer Designed To Run Linux
by Peter Reutemann 15 Jan '21

15 Jan '21

'Seeed Studios -- the makers of the Odyssey mini-PC -- have teamed up with well-known SBC vendor BeagleBoard to produce an affordable RISC-V system designed to run Linux. The new BeagleV (pronounced "Beagle Five") system features a dual-core, 1GHz RISC-V CPU made by StarFive -- one of a network of RISC-V startups created by better-known RISC-V vendor SiFive. The CPU is based on two of SiFive's U74 Standard Cores -- and unlike simpler microcontroller-only designs, it features a MMU and all the other trimmings necessary to run full-fledged modern operating systems such as Linux distributions. StarFive's VIC7100 processor design is aimed at edge AI tasks as well as general-purpose computing. In addition to the two RISC-V CPU cores, it features a Tensilica Vision VP6 DSP for machine-vision applications, a Neural Network Engine, and a single-core NVDLA (Nvidia Deep Learning Accelerator) engine.' -- source: https://hardware.slashdot.org/story/21/01/13/1928249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Google Reveals Sophisticated Windows and Android Hacking Operation
by Peter Reutemann 15 Jan '21

15 Jan '21

'Google published a six-part report this week detailing a sophisticated hacking operation that the company detected in early 2020 and which targeted owners of both Android and Windows devices. >From a report: The attacks were carried out via two exploit servers delivering different exploit chains via watering hole attacks, Google said. "One server targeted Windows users, the other targeted Android," Project Zero, one of Google's security teams, said in the first of six blog posts. Google said that both exploit servers used Google Chrome vulnerabilities to gain an initial foothold on victim devices. Once an initial entry point was established in the user's browsers, attackers deployed an OS-level exploit to gain more control of the victim's devices. The exploit chains included a combination of both zero-day and n-day vulnerabilities, where zero-day refers to bugs unknown to the software makers, and n-day refers to bugs that have been patched but are still being exploited in the wild.' -- source: https://tech.slashdot.org/story/21/01/14/1610220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Windows 10X for Single Screens Leaks
by Peter Reutemann 15 Jan '21

15 Jan '21

'Just ahead of its launch for commercial PC-like devices, an install image of Windows 10X for single screens has leaked, giving us an early peek at Microsoft's new OS. And yes, it's just like Chrome OS. From a report: Let's just get that out of the way. Microsoft has been working for years on a Chromebook competitor, but it has been largely unsuccessful. Windows 10 S, which was originally called Windows 10 Cloud, was Terry Myerson's approach, and that, of course, crashed and burned, in part because it looked identical to Windows 10 but couldn't run downloaded Windows 10 desktop applications. And now we have Windows 10X. Microsoft tried to hide its true intent with this product by pretending last year that it was aimed at a new generation of dual-display PCs, but the software giant really created 10X to compete with Chrome OS on inexpensive single-display PCs. So after failing to get its container-based Windows desktop application compatibility solution to work, Microsoft scaled back and repositioned Windows 10X as was originally intended: It will now ship only on new traditional PCs aimed at education and other commercial markets.' -- source: https://tech.slashdot.org/story/21/01/14/1657218 Wouldn't be surprised if they got bitten again by not having separate kernel/window manager architecture in Windows... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Linux Foundation Now Offers a Suite of Open-Source Management Classes
by Peter Reutemann 14 Jan '21

14 Jan '21

'The Linux Foundation has new courses to help you manage open-source projects and technical staff within your organization. Steven J. Vaughan-Nichols writes via ZDNet: Previously, if you want to know how to run open-source well in your company, you had to work with OASIS Open or the TODO Group. Both are non-profit organizations supporting best open source and open standards practices. But, to work with either group, effectively, you already had to know a lot about open source. [...] This 7-module course series is designed to help executives, managers, software developers, and engineers understand the basic concepts for building effective open-source practices. It's also helpful to those in the C suite who want to set up effective open-source program management, including how to create an Open Source Program Office (OSPO). The program builds on the accumulated wisdom of many previous training modules on open-source best practices while adding fresh and updated content to explain all of the critical elements of working effectively with open source in enterprises. The courses are designed to be self-paced, and reasonably high-level, but with enough detail to get new open-source practitioners up and running quickly. Guy Martin, OASIS Open's executive director, developed these courses. Martin knows his way around open source. He has a unique blend of over 25 years' experience both as a software engineer and open-source strategist. Marin has helped build open-source programs at Red Hat, Samsung, and Autodesk. He was also instrumental in founding the Academy Software Foundation, the Open Connectivity Foundation, and has contributed to TODO Group's best practices and learning guides. The "Open Source Management & Strategy program" costs $499 and is available to begin immediately. A certificate is awarded upon completion.' -- source: https://news.slashdot.org/story/21/01/13/2023236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Debian Discusses Vendoring -- Again
by Peter Reutemann 14 Jan '21

14 Jan '21

'Jake Edge, writing at LWN: The problems with "vendoring" in packages -- bundling dependencies rather than getting them from other packages -- seems to crop up frequently these days. We looked at Debian's concerns about packaging Kubernetes and its myriad of Go dependencies back in October. A more recent discussion in that distribution's community looks at another famously dependency-heavy ecosystem: JavaScript libraries from the npm repository. Even C-based ecosystems are not immune to the problem, as we saw with iproute2 and libbpf back in November; the discussion of vendoring seems likely to recur over the coming years. Many application projects, particularly those written in languages like JavaScript, PHP, and Go, tend to have a rather large pile of dependencies. These projects typically simply download specific versions of the needed dependencies at build time. This works well for fast-moving projects using collections of fast-moving libraries and frameworks, but it works rather less well for traditional Linux distributions. So distribution projects have been trying to figure out how best to incorporate these types of applications. This time around, Raphael Hertzog raised the issue with regard to the Greenbone Security Assistant (gsa), which provides a web front-end to the OpenVAS vulnerability scanner (which is now known as Greenbone Vulnerability Management or gvm). "the version currently in Debian no longer works with the latest gvm so we have to update it to the latest upstream release... but the latest upstream release has significant changes, in particular it now relies on yarn or npm from the node ecosystem to download all the node modules that it needs (and there are many of them, and there's no way that we will package them individually). The Debian policy forbids download during the build so we can't run the upstream build system as is." Hertzog suggested three possible solutions: collecting all of the dependencies into the Debian source package (though there would be problems creating the copyright file), moving the package to the contrib repository and adding a post-install step to download the dependencies, or removing gsa from Debian entirely. He is working on updating gsa as part of his work on Kali Linux, which is a Debian derivative that is focused on penetration testing and security auditing. Kali Linux does not have the same restrictions on downloading during builds that Debian has, so the Kali gsa package can simply use the upstream build process. He would prefer to keep gsa in Debian, "but there's only so much busy-work that I'm willing to do to achieve this goal". He wondered if it made more sense for Debian to consider relaxing its requirements. But Jonas Smedegaard offered another possible approach: analyzing what packages are needed by gsa and then either using existing Debian packages for those dependencies or creating new ones for those that are not available. Hertzog was convinced that wouldn't be done, but Smedegaard said that the JavaScript team is already working on that process for multiple projects.' -- source: https://linux.slashdot.org/story/21/01/13/1744228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

WhatsApp Clarifies It's Not Giving All Your Data To Facebook
by Peter Reutemann 14 Jan '21

14 Jan '21

'The Verge: WhatsApp has published a new FAQ page to its website outlining its stances on user privacy in response to widespread backlash over an upcoming privacy policy update. The core issue relates to WhatsApp's data-sharing procedures with Facebook, with many users concerned an updated privacy policy going into effect on February 8th will mandate sharing of sensitive profile information with WhatsApp's parent company. That isn't true -- the update has nothing to do with consumer chats or profile data, and instead the change is designed to outline how businesses who use WhatsApp for customer service may store logs of its chats on Facebook servers. That's something the company feels it is required to disclose in its privacy policy, which it's now doing after previewing the upcoming changes to business chats back in October. But a wave of misinformation on social media, not helped by Facebook's abysmal track record on privacy and its reputation for obfuscating changes to its various terms of service agreements, has resulted in a full-blown WhatsApp backlash that has users fleeing to competitors like Signal and Telegram. [...] WhatsApp executives, as well as Instagram chief Adam Mosseri and Facebook AR / VR head Andrew "Boz" Bosworth, are now trying to set the record straight, perhaps to little avail at this point. "We want to be clear that the policy update does not affect the privacy of your messages with friends or family in any way. Instead, this update includes changes related to messaging a business on WhatsApp, which is optional, and provides further transparency about how we collect and use data," the company writes on the new FAQ page. It also stresses in the FAQ that neither Facebook nor WhatsApp read users' message logs or listen to their calls, and that WhatsApp doesn't store user location data or share contact information with Facebook. (It's also worth noting that data sharing with Facebook is extremely limited for European users due to stronger user privacy protections in the EU.) WhatsApp chief Will Cathcart also took to Twitter a few days ago to post a thread (later shared by Bosworth in the tweet above) trying to cut through the confusion and explain what's actually going on. "With end-to-end encryption, we cannot see your private chats or calls and neither can Facebook. We're committed to this technology and committed to defending it globally," Cathcart wrote. "It's important for us to be clear this update describes business communication and does not change WhatsApp's data sharing practices with Facebook. It does not impact how people communicate privately with friends or family wherever they are in the world." ' -- source: https://it.slashdot.org/story/21/01/13/065219 In the meantime, people are moving to Telegram and Signal... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers steal Mimecast certificate used to encrypt customers’ M365 traffic
by Peter Reutemann 13 Jan '21

13 Jan '21

'Email management provider Mimecast said that hackers have compromised a digital certificate it issued and used it to target select customers who use it to encrypt data they sent and received through the company’s cloud-based service. In a post published on Tuesday, the company said that the certificate was used by about 10 percent of its customer base, which—according to the company—numbers about 36,100. The “sophisticated threat actor” then likely used the certificate to target “a low single digit number” of customers using the certificate to encrypt Microsoft 365 data. Mimecast said it learned of the compromise from Microsoft. Certificate compromises allow hackers to read and modify encrypted data as it travels over the Internet. For that to happen, a hacker must first gain the ability to monitor the connection going into and out of a target’s network. Typically, certificate compromises require access to highly fortified storage devices that store private encryption keys. That access usually requires deep-level hacking or insider access. The Mimecast post didn’t describe what type of certificate was compromised, and a company spokesman declined to elaborate. This post, however, discusses how customers can use a certificate provided by Mimecast to connect their Microsoft 365 servers to the company’s service. Mimecast provides seven different certificates based on the geographic region of the customer.' -- source: https://arstechnica.com/information-technology/2021/01/mimecast-says-hacker… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Quote Of The Week
by Lawrence D'Oliveiro 13 Jan '21

13 Jan '21

“The “S” in “IoT” stands for “security”.” (Copied from <https://forums.theregister.com/forum/all/2021/01/12/flash_is_dead/#c_4185268>.)

1 0

Keeping Flash Player Going A Little Longer
by Lawrence D'Oliveiro 13 Jan '21

13 Jan '21

Adobe Flash Player has officially stopped working, since apparently Adobe included a logic bomb a few releases back with an expiry date in it <https://www.theregister.com/2021/01/12/flash_is_dead/>. However, for those who really, really need it, this article <https://charleswilkinson.co.uk/2021/01/12/how-to-use-flash-in-2021/> describes a workaround to re-enable it for certain sites (e.g. corporate intranet ones), by editing certain .cfg files. Those .cfg files don’t exist on a Linux installation -- not by default, anyway. However, doing a “strings” on libflashplayer.so finds (among other things) a reference to “/etc/adobe” and “/opt/adobe” directories. So perhaps you could create one of these and put files with the right names in it? Anyway, I’m just throwing this out there for anyone who wants to play with it. ;)

1 0

The Impractical but Indisputable Rise of Retrocomputing
by Peter Reutemann 13 Jan '21

13 Jan '21

'For all the personal technology introduced and popularized in 2020 -- upscale fitness bikes, at-home Covid tests, game consoles new and old -- the personal computer lands on the list with a bit of a thud. PCs lack the novelty of other gadgets, but they're practical, essential even, in a year when work, school and social life have come to rely heavily upon them. From a report: While modern, ever more efficient computers are selling better than they have in years, vintage computers -- impractical old devices in need of repairs and out-of-production parts -- are also in demand on sites like eBay. Collectors also flock to message boards, subreddits and Discord servers to buy, sell and trade parts. People are buying these PCs not necessarily for daily use, but for the satisfaction they get from rebuilding them. It's a trend one might chalk up to quarantine boredom, though it's been gaining traction for years. Retrocomputing, the hobby is called, is hardly just a way to pass the time. Instead, as enthusiasts see it, it's a means of communing with the past. "You get into this mind-set of what it must've been like to be somebody in the late '70s, having spent thousands of dollars on this thing that barely does anything more than a calculator," said Clint Basinger, 34, who runs the YouTube channel Lazy Game Reviews. (The devices do allow retrocomputers to make art and music using software unavailable on new computers and to play 8-bit games, but not much else beyond that.) "It's like a time machine to me," Mr. Basinger added. Before the pandemic, there were several vintage computing conventions located around the United States, to which collectors brought their computers to show off. Attendees bought and traded hardware at these events, as well as meet the friends they've made online.' -- source: https://it.slashdot.org/story/21/01/12/1910218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AMD Shows Off Impressive Ryzen 5000 Mobile Processors and 3rd Gen Epyc Server Chips
by Peter Reutemann 13 Jan '21

13 Jan '21

'Advanced Micro Devices showed off some impressive Ryzen 5000 mobile processors today and teased the performance of its 3rd Gen Epyc server chips. From a report: Those chips are aimed at keeping AMD's performance lead over its rival Intel in the mobile and server markets. AMD CEO Lisa Su showed off the new chips in a keynote speech at CES 2021, the online-only tech trade show. AMD is launching its Ryzen 5000 Series mobile processors for gaming laptops and thin-and-light notebooks. These eight-core x86 chips are built with a 7-nanometer manufacturing process (where the circuits are 7 billionths of a meter apart). They are also based on the Zen3 design for processor cores, which can process instructions 19% faster per clock cycle than Zen2 cores. The H-Series focuses on top performance in laptops for gamers and content creators, while the U-Series focuses on thin-and-light notebooks with great battery life. The chips have four to eight cores and they range in power consumption from 15 watts to 45 watts. AMD said the 5000 Series will be available in PCs in February, and we'll see more than 150 systems using it. That compares to 100 systems for the Ryzen 4000 Series and 70 for the Ryzen 3000.' -- source: https://hardware.slashdot.org/story/21/01/12/1826233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Kernel Developers Discuss Dropping a Bunch of Old CPUs
by Peter Reutemann 12 Jan '21

12 Jan '21

'Charlotte Web writes: With Linux 5.10 having shipped as the latest Long Term Support (LTS) release to be maintained for at least the next five years, a discussion has begun over dropping a number of old and obsolete CPU platform support currently found within the mainline kernel. For many of the architectures being considered for removal they haven't seen any new commits in years but as is the case once proposals are made for them to be removed there are often passionate users wanting the support to be kept.' -- source: https://linux.slashdot.org/story/21/01/11/187220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Firefox To Block Backspace Key From Working as 'Back' Button
by Peter Reutemann 12 Jan '21

12 Jan '21

'Mozilla developers plan to remove support for using the Backspace key as a Back button inside Firefox. From a report: The change is currently active in the Firefox Nightly version and is expected to go live in Firefox 86, scheduled to be released next month, in late February 2021. The removal of the Backspace key as a navigational element didn't come out of the blue. It was first proposed back in July 2014, in a bug report opened on Mozilla's bug tracker. At the time, Mozilla engineers argued that many users who press the Backspace key don't always mean to navigate to the previous page (the equivalent of pressing the Back button).' -- source: https://news.slashdot.org/story/21/01/11/1551224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Rediscovering RISC-V: Apple M1 Sparks Renewed Interest in Non-x86 Architecture
by Peter Reutemann 11 Jan '21

11 Jan '21

'"With the runaway success of the new ARM-based M1 Macs, non-x86 architectures are getting their closeup," explains a new article at ZDNet. "RISC-V is getting the most attention from system designers looking to horn-in on Apple's recipe for high performance. Here's why..." RISC-V is, like x86 and ARM, an instruction set architecture (ISA). Unlike x86 and ARM, it is a free and open standard that anyone can use without getting locked into someone else's processor designs or paying costly license fees... Reaching the end of Moore's Law, we can't just cram more transistors on a chip. Instead, as Apple's A and M series processors show, adding specialized co-processors — for codecs, encryption, AI — to fast general-purpose RISC CPUs can offer stunning application performance and power efficiency. But a proprietary ISA, like ARM, is expensive. Worse, they typically only allow you to use that ISA's hardware designs, unless, of course, you're one of the large companies — like Apple — that can afford a top-tier license and a design team to exploit it. A canned design means architects can't specify tweaks that cut costs and improve performance. An open and free ISA, like RISC-V, eliminates a lot of this cost, giving small companies the ability to optimize their hardware for their applications. As we move intelligence into ever more cost-sensitive applications, using processors that cost a dollar or less, the need for application and cost-optimized processors is greater than ever... While open operating systems, like Linux, get a lot of attention, ISAs are an even longer-lived foundational technology. The x86 ISA dates back 50 years and today exists as a layer that gets translated to a simpler — and faster — underlying hardware architecture. (I suspect this fact is key to the success of the macOS Rosetta 2 translation from x86 code to Apple's M1 code.) Of course, an open ISA is only part of the solution. Free standard hardware designs — with tools to design more — and smart compilers to generate optimized code are vital. That larger project is what Berkeley's Adept Lab is working on. As computing continues to permeate civilization, the cost of sub-optimal infrastructure will continue to rise. Optimizing for efficiency, long-life, and broad application is vital for humanity's progress in a cyber-enabled world. One RISC-V feature highlighted by the article: 128-bit addressing (in addition to 32 and 64 bit).' -- source: https://hardware.slashdot.org/story/21/01/10/2020208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 5

Wasmer 1.0 Can Run WebAssembly 'Universal Binaries' on Linux, MacOS, Windows, Android, and iOS
by Peter Reutemann 11 Jan '21

11 Jan '21

'The WebAssembly portable binary format will now have wider support from Wasmer, the server-side runtime which "allows universal binaries compiled from C++, Rust, Go, Python, and other languages to run on different operating systems and in web browsers without modification," reports InfoWorld: Wasmer can run lightweight containers based on WebAssembly on a variety of platforms — Linux, MacOS, Windows, Android, iOS — from the desktop to the cloud to IoT and mobile devices, while also allowing these containers to be embedded in any programming language. The Wasmer runtime also is able to run the Nginx web server and other WebAssembly modules... Wasmer was introduced in December 2018, with the stated goal of doing for WebAssembly what JavaScript did for Node.js: establish it server-side. By leveraging Wasmer for containerization, developers can create universal binaries that work anywhere without modification, including on Linux, MacOS, and Windows as well as web browsers. WebAssembly automatically sandboxes applications by default for secure execution, shielding the host environment from malicious code, bugs, and vulnerabilities in the software being run. Wasmer 1.0 reached "general availability status" with its release on January 5, and its developers are now claiming "out of this world" runtime and compiler performance. "We believe that WebAssembly will be a crucial component for the future of software execution and containerization (not only inside the browser but also outside)."' -- source: https://news.slashdot.org/story/21/01/10/0242244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Mint 20.1 Long-term Support Release Is Out
by Peter Reutemann 10 Jan '21

10 Jan '21

'gHacks: Linux Mint 20.1 is now available. The first stable release of Linux Mint in 2021 is available in the three flavors Cinnamon, MATE and Xfce. The new version of the Linux distribution is based on Ubuntu 20.04 LTS and Linux kernel 5.4... - Linux Mint 20.1 comes with a unified file system that sees certain directories being merged with their counterparts in /usr, e.g. /bin merged with /usr/bin, /lib merged with /usr/lib for compatibility purposes... - The developers have added an option to turn websites into desktop applications in the new version [using the new Web App manager]... Web apps behave like desktop programs for the most part; they start in their own window and use a custom icon, and you find them in the Alt-Tab interface when you use it. Web apps can be pinned and they are found in the application menu after they have been created. ' -- source: https://linux.slashdot.org/story/21/01/09/2147228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

NVIDIA Fixes High Severity Flaws Affecting Windows, Linux devices
by Peter Reutemann 10 Jan '21

10 Jan '21

'Bleeping Computer reports: NVIDIA has released security updates to address six security vulnerabilities found in Windows and Linux GPU display drivers, as well as ten additional flaws affecting the NVIDIA Virtual GPU (vGPU) management software. The vulnerabilities expose Windows and Linux machines to attacks leading to denial of service, escalation of privileges, data tampering, or information disclosure. All these security bugs require local user access, which means that potential attackers will first have to gain access to vulnerable devices using an additional attack vector. Following successful exploitation of one of the vulnerabilities patched today, attackers can easily escalate privileges to gain permissions above the default ones granted by the OS.' -- source: https://it.slashdot.org/story/21/01/09/2139217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox-based mobile browser: Iceraven
by Peter Reutemann 10 Jan '21

10 Jan '21

Hi everyone With the recent UI changes in the mobile Firefox browser, it unfortunately became pretty much unusable. I just came across the Iceraven browser: "Definitely not brought to you by Mozilla! Iceraven Browser is a web browser for Android, based on Mozilla's Fenix version of Firefox, GeckoView and Mozilla Android Components. Our goal is to be a close fork of the new Firefox for Android that seeks to provide users with more options, more opportunities to customize (including a broad extension library), and more information about the pages they visit and how their browsers are interacting with those pages." -- source: https://github.com/fork-maintainers/iceraven-browser At the moment, you have to download the .apk releases yourself and install them manually. >From an initial test, it looks promising! However, I'm still not able to have my bookmarks display on the homescreen... :-/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Side-Channel Attack Can Recover Encryption Keys From Google Titan Security Keys
by Peter Reutemann 09 Jan '21

09 Jan '21

'A duo of French security researchers has discovered a vulnerability impacting chips used inside Google Titan and YubiKey hardware security keys. From a report: The vulnerability allows threat actors to recover the primary encryption key used by the hardware security key to generate cryptographic tokens for two-factor authentication (2FA) operations. Once obtained, the two security researchers say the encryption key, an ECDSA private key, would allow threat actors to clone Titan, YubiKey, and other keys to bypass 2FA procedures. However, while the attack sounds disastrous for Google and Yubico security key owners, its severity is not what it seems. In a 60-page PDF report, Victor Lomne and Thomas Roche, researchers with Montpellier-based NinjaLab, explain the intricacies of the attack, also tracked as CVE-2021-3011. For starters, the attack won't work remotely against a device, over the internet, or over a local network. To exploit any Google Titan or Yubico security key, an attacker would first need to get their hands on a security key in the first place.' -- source: https://tech.slashdot.org/story/21/01/08/1814254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Crypto-Mining Botnet Is Now Stealing Docker and AWS Credentials
by Peter Reutemann 09 Jan '21

09 Jan '21

'ZDNet: Analysts from security firm Trend Micro said in a report today that they've spotted a malware botnet that collects and steals Docker and AWS credentials. Researchers have linked the botnet to a cybercrime operation known as TeamTNT; a group first spotted over the 2020 summer installing cryptocurrency-mining malware on misconfigured container platforms. Initial reports at the time said that TeamTNT was breaching container platforms by looking for Docker systems that were exposing their management API port online without a password. Researchers said the TeamTNT group would access exposed Docker containers, install a crypto-mining malware, but also steal credentials for Amazon Web Services (AWS) servers in order to pivot to a company's other IT systems to infect even more servers and deploy more crypto-miners. At the time, researchers said that TeamTNT was the first crypto-mining botnet that implemented a feature dedicated to collecting and stealing AWS credentials. But in a report today, Trend Micro researchers said that the TeamTNT gang's malware code had received considerable updates since it was first spotted last summer. TeamTNT has now also added a feature to collect Docker API credentials, on top of the AWS creds-stealing code. This feature is most likely used on container platforms where the botnet infects hosts using other entry points than its original Docker API port scanning feature.' -- source: https://it.slashdot.org/story/21/01/08/2132205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

First There Was GPT-3 For Fake Text, Now There Is DALL-E For Fake Images
by Lawrence D'Oliveiro 09 Jan '21

09 Jan '21

OpenAI, the company behind the GPT-3 neural network that is capable of generating plausible-sounding text passages on any given subject, have now extended it <https://www.theregister.com/2021/01/07/openai_dalle_impact/> to generating images based on any given caption. How will this impact content creators? Given that the net is trained on data copied off the Internet, what happens if/when it spews out something a little too close, copyright-wise, to some existing work of a human artist/writer?

1 0

WhatsApp Rival Signal Reports Growing Pains as New Users Surge
by Peter Reutemann 08 Jan '21

08 Jan '21

'Signal, an encrypted messaging app that competes with other services including Facebook's WhatsApp, said Thursday that verification codes used to create new accounts were delayed because of a flood of new users. From a report: "We are working with carriers to resolve this as quickly as possible," the non-profit foundation said in a tweet. "Hang in there." The surge came just hours after Elon Musk endorsed the service and amid reported changes to WhatsApp's terms of service.' -- source: https://tech.slashdot.org/story/21/01/07/1918206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mandatory WhatsApp Privacy Policy Update Allows User Data To be Shared With Facebook
by Peter Reutemann 07 Jan '21

07 Jan '21

'WhatsApp's latest terms and privacy policy allows the popular messaging app to share a significant amount of user data with Facebook. From a report: WhatsApp users are today receiving an in-app notice informing them about the app's updated terms of service and privacy policy. The notice gives an overview of the main three updates, covering how WhatsApp processes user data, how businesses can use Facebook-hosted services to store and manage their WhatsApp chats, and how WhatsApp will soon partner with Facebook to offer deeper integrations across all of the parent company's products. The changes, which are set to take effect on February 8, 2021, are mandatory and users will not be able to continue using WhatsApp unless they accept the terms.' -- source: https://yro.slashdot.org/story/21/01/06/1358228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

UK Watchdog Begins Investigating Nvidia's $40 Billion Takeover of Arm
by Peter Reutemann 07 Jan '21

07 Jan '21

'Britain's competition watchdog has launched an investigation into the $40 billion takeover of the UK-based chip designer Arm by the US company Nvidia. From a report: The Competition and Markets Authority (CMA) has called for interested parties to submit views on the contentious deal before the launch of a formal investigation later this year. Arm Holdings, which employs 6,500 staff including 3,000 in the UK, is a global leader in designing chips for smartphones, computers and tablets. California-based Nvidia, a graphics chip specialist, announced its plan to buy the British tech group from Japan's SoftBank in September. SoftBank had acquired Arm for $32 billion in 2016, when the Japanese company took advantage of the fall in value of the pound after the Brexit vote. Arm is based in Cambridge but has operations in a number of UK towns and cities, including Manchester, Belfast and Warwick. Its chief executive, Simon Segars, acknowledged at the time of the Nvidia deal that it could take up to 18 months to win approval from regulators around the world.' -- source: https://news.slashdot.org/story/21/01/06/1945224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Telegram feature exposes your precise address to hackers
by Peter Reutemann 06 Jan '21

06 Jan '21

'If you’re using an Android device—or in some cases an iPhone—the Telegram messenger app makes it easy for hackers to find your precise location when you enable a feature that allows users who are geographically close to you to connect. The researcher who discovered the disclosure vulnerability and privately reported it to Telegram developers said they have no plans to fix it. The problem stems from a feature called People Nearby. By default, it’s turned off. When users enable it, their geographic distance is shown to other people who have it turned on and are in (or are spoofing) the same geographic region. When People Nearby is used as designed, it’s a useful feature with few if any privacy concerns. After all, a notification that someone is 1 kilometer or 600 meters away still leaves stalkers guessing where, precisely, you are. Independent researcher Ahmed Hassan, however, has shown how the feature can be abused to divulge exactly where you are. Using readily available software and a rooted Android device, he’s able to spoof the location his device reports to Telegram servers. By using just three different locations and measuring the corresponding distance reported by People Nearby, he is able to pinpoint a user’s precise location.' -- source: https://arstechnica.com/information-technology/2021/01/telegram-feature-exp… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Cryptocurrency stealer for Windows, macOS, and Linux went undetected for a year
by Peter Reutemann 06 Jan '21

06 Jan '21

'Soaring cryptocurrency valuations have broken record after record over the past few years, turning people with once-modest holdings into overnight millionaires. One determined ring of criminals has tried to join the party using a wide-ranging operation that for the past 12 months has used a full-fledged marketing campaign to push custom-made malware written from scratch for Windows, macOS, and Linux devices. The operation, which has been active since at least January 2020, has spared no effort in stealing the wallet addresses of unwitting cryptocurrency holders, according to a report published by security firm Intezer. The scheme includes three separate trojanized apps, each of which runs on Windows, macOS, and Linux. It also relies on a network of fake companies, websites, and social media profiles to win the confidence of potential victims. The apps pose as benign software that’s useful to cryptocurrency holders. Hidden inside is a remote access trojan that was written from scratch. Once an app is installed, ElectroRAT—as Intezer has dubbed the backdoor—then allows the crooks behind the operation to log keystrokes, take screenshots, upload, download, and install files, and execute commands on infected machines. In a testament to their stealth, the fake cryptocurrency apps went undetected by all major antivirus products.' -- source: https://arstechnica.com/information-technology/2021/01/cryptocurrency-steal… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers are exploiting a backdoor built into Zyxel devices. Are you patched?
by Peter Reutemann 06 Jan '21

06 Jan '21

'Hackers are attempting to exploit a recently discovered backdoor built into multiple Zyxel device models that hundreds of thousands of individuals and businesses use as VPNs, firewalls, and wireless access points. The backdoor comes in the form of an undocumented user account with full administrative rights that’s hardcoded into the device firmware, a researcher from Netherlands-based security firm Eye Control recently reported. The account, which uses the username zyfwp, can be accessed over either SSH or through a Web interface.' -- source: https://arstechnica.com/information-technology/2021/01/hackers-are-exploiti… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds Rails At Intel For 'Killing' the ECC Industry
by Peter Reutemann 06 Jan '21

06 Jan '21

'The Register: Linux creator Linus Torvalds has accused Intel of preventing widespread use of error-correcting memory and being "instrumental in killing the whole ECC industry with its horribly bad market segmentation." ECC stands for error-correcting code. ECC memory uses additional parity bits to verify that the data read from memory is the same as the data that was written. Without this check, memory is vulnerable to occasional corruption where a bit is flipped spontaneously, for example, by background radiation. Memory can also be attacked using a technique called Rowhammer, where rapid repeated reads of the same memory locations can cause adjacent locations to change their state. ECC memory solves these problems and has been available for over 50 years yet most personal computers do not use it. Cost is a factor but what riles Torvalds is that Intel has made ECC support a feature of its Xeon range, aimed at servers and high-end workstations, and does not support it in other ranges such as the Core series. The topic came up in a discussion about AMD's new Zen 3 Ryzen 9 5000 series processors on the Real World Tech forum site. AMD has semi-official ECC support in most of its processors. "I don't really see AMD's unofficial ECC support being a big deal," said an unwary contributor. "ECC absolutely matters," retorted Torvalds. "Intel has been detrimental to the whole industry and to users because of their bad and misguided policies wrt ECC. Seriously. And if you don't believe me, then just look at multiple generations of rowhammer, where each time Intel and memory manufacturers bleated about how it's going to be fixed next time... And yes, that was -- again -- entirely about the misguided and arse-backwards policy of 'consumers don't need ECC', which made the market for ECC memory go away." The accusation is significant particularly at a time when security issues are high on the agenda. The suggestion is that Intel's marketing decisions have held back adoption of a technology that makes users more secure -- though rowhammer is only one of many potential attack mechanisms -- as well as making PCs more stable. "The arguments against ECC were always complete and utter garbage. Now even the memory manufacturers are starting to do ECC internally because they finally owned up to the fact that they absolutely have to," said Torvalds. Torvalds said that Xeon prices deterred usage. "I used to look at the Xeon CPU's, and I could never really make the math work. The Intel math was basically that you get twice the CPU for five times the price. So for my personal workstations, I ended up using Intel consumer CPU's." Prices, he said, dropped last year "because of Ryzen and Threadripper... but it was a 'too little, much too late' situation." By way of mitigation, he added that "apart from their ECC stance I was perfectly happy with [Intel's] consumer offerings."' -- source: https://linux.slashdot.org/story/21/01/05/0318254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AGM reminder
by Peter Reutemann 05 Jan '21

05 Jan '21

Hi everyone Just a reminder that our AGM will be held on January 25th: https://www.meetup.com/WaikatoLinuxUsersGroup/events/274861121/ https://gettogether.community/events/8427/wlug-agm/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Splinternet Is Coming
by Lawrence D'Oliveiro 05 Jan '21

05 Jan '21

Countries like Russia, Iran and China are exerting more and more control over how Internet traffic crosses their borders. They are moving towards--or in some cases have already achieved--the ability to completely cut themselves off from the wider Internet and continue functioning with some autonomy. Also seems like China is promoting new protocol standards that will make this process even easier. I also learned of the existence of an organization called “Internet Sans Frontières”, which you would think is a tautology. But for how much longer? <https://www.theregister.com/2021/01/04/welcome_to_the_splinternet/>

1 0

Malware Uses WiFi BSSID for Victim Identification
by Peter Reutemann 05 Jan '21

05 Jan '21

'Malware operators who want to know the location of the victims they infect usually rely on a simple technique where they grab the victim's IP address and check it against an IP-to-geo database like MaxMind's GeoIP to get a victim's approximate geographical location. While the technique isn't very accurate, it is still the most reliable method of determining a user's actual physical location based on data found on their computer. However, in a blog post last month, Xavier Mertens, a security researcher with the SANS Internet Storm Center, said he discovered a new malware strain that is using a second technique on top of the first. This second technique relies on grabbing the infected user's BSSID. Known as a "Basic Service Set Identifier," the BSSID is basically the MAC physical address of the wireless router or access point the user is using to connect via WiFi. You can see the BSSID on Windows systems by running the command: netsh wlan show interfaces | find "BSSID" Mertens said the malware he discovered was collecting the BSSID and then checking it against a free BSSID-to-geo database maintained by Alexander Mylnikov.' -- source: https://it.slashdot.org/story/21/01/04/2042204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

free/open-source software...
by Peter Reutemann 04 Jan '21

04 Jan '21

Hi everyone Below are some free/open-source software projects that I've stumbled across over the Xmas break, which I hadn't heard of before but sound interesting: NATRON Open Source Compositing Software For VFX and Motion Graphics. https://natrongithub.github.io/ RawTherapee a free, cross-platform raw image processing program https://rawtherapee.com/ Lightworks For over 25 years Lightworks editor has been at the forefront of film editing, having been used on many of the finest films in cinema history: The Wolf of Wall Street, LA Confidential, Pulp Fiction, Heat, Road to Perdition, Hugo, The King’s Speech and many more! https://www.lwks.com/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Are We Experiencing a Great Software Stagnation?
by Peter Reutemann 04 Jan '21

04 Jan '21

'Long-time programmer/researcher/former MIT research fellow Jonathan Edwards writes a blog called "Alarming Development: Dispatches from the User Liberation Front." He began the new year by arguing that software "is eating the world. But progress in software technology itself largely stalled around 1996." Slashdot reader tonique summarizes Edwards' argument: In 1996 there were "LISP, Algol, Basic, APL, Unix, C, Oracle, Smalltalk, Windows, C++, LabView, HyperCard, Mathematica, Haskell, WWW, Python, Mosaic, Java, JavaScript, Ruby, Flash, Postgress [sic]". After that we're supposed to have achieved "IntelliJ, Eclipse, ASP, Spring, Rails, Scala, AWS, Clojure, Heroku, V8, Go, React, Docker, Kubernetes, Wasm". Edwards's main thesis is that the Internet boom around 1996 caused this slowdown because programmers could get rich quick. Then smart and ambitious people moved into Silicon Valley, and founded startups. But you can't do research at a startup due to time and money constraints. Today only "megacorps" like Google, Facebook, Apple and Microsoft are supposedly able to do relevant research because of their vast resources. Computer science wouldn't help, either, because "most of our software technology was built in companies" and because computer science "strongly disincentivizes risky long-range research". Further, according to Edwards, the aversion to risk and "hyper-professionalization of Computer Science" is part of a larger and worrisome trend throughout the whole field and all of western civilisation. Edwards' blog post argues that since 1996 "almost everything has been cleverly repackaging and re-engineering prior inventions. Or adding leaky layers to partially paper over problems below. Nothing is obsoleted, and the teetering stack grows ever higher..." "[M]aybe I'm imagining things. Maybe the reason progress stopped in 1996 is that we invented everything. Maybe there are no more radical breakthroughs possible, and all that's left is to tinker around the edges. This is as good as it gets: a 50 year old OS, 30 year old text editors, and 25 year old languages. "Bullshit. No technology has ever been permanent. We've just lost the will to improve."' -- source: https://developers.slashdot.org/story/21/01/03/0010225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

Mozilla Is Working On a Firefox Design Refresh
by Peter Reutemann 04 Jan '21

04 Jan '21

'Mozilla is "investigating" a design refresh for its Firefox browser. Ghacks reports that the refresh is referred to internally as "Photon." Information about the design refresh is limited at this point in time. Mozilla created a meta bug on Bugzilla as a reference to keep track of the changes. While there are not any mockups or screenshots posted on the site, the names of the bugs provide information on the elements that will get a refresh. These are: - The Firefox address bar and tabs bar. - The main Firefox menu. - Infobars. - Doorhangers. - Context Menus. - Modals. Most user interface elements are listed in the meta bug. Mozilla plans to release the new design in Firefox 89; the browser is scheduled for a mid-2021 release. Its release date is set to May 18, 2021... [Developer/Firefox extension author] Sören Hentzschel revealed that he saw some of the Firefox Proton mockups... He notes that Firefox will look more modern when the designs land and that Mozilla plans to introduce useful improvements, especially in regards to the user experience. Hentzschel mentions two examples of potential improvements to the user experience: a mockup that displays vertical tabs in a compact mode, and another that shows the grouping of tabs on the tab bar.' -- source: https://news.slashdot.org/story/21/01/03/0516247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0