November 2021 - wlug - list.wlug.org.nz

Addressing 'Bus Factor', PHP Gets a Foundation
by Peter Reutemann 29 Nov '21

29 Nov '21

'How many members of your team are so irreplaceable that if they were hit by a bus, your project would grind to a halt? For PHP, that number is: two. (According to a post by PHP contributor Joe Watkins earlier this year that's now being cited in Mike Melanson's "This Week in Programming" column.) "Maybe as few as two people would have to wake up this morning and decide they want to do something different with their lives in order for the PHP project to lack the expertise and resources to move it forward in its current form, and at current pace," Watkins wrote at the time, naming Dmitry Stogov and Nikita Popov as those two. Well, last week, Nikita Popov was thankfully not hit by a bus, but he did decide to move on from his role with PHP to instead focus his activities on LLVM. Also thankfully, Watkins' article earlier this year opened some eyes to the situation at hand and, as he writes in a follow-up article this week, JetBrains (Popov's employer) reached out to him at the time regarding starting a PHP Foundation. This week, with Popov's departure, the PHP Foundation was officially launched with the goal of funding part/full-time developers to work on the PHP core in 2022. At launch, the PHP Foundation will count 10 companies — Automattic, Laravel, Acquia, Zend, Private Packagist, Symfony, Craft CMS, Tideways, PrestaShop, and JetBrains — among its backers, with an expectation to raise $300,000 per year, and with JetBrains contributing $100,000 annually. Alongside that, the foundation is being launched using foundation-as-a-service provider Open Collective, and just under 700 contributors have already raised more than $40,000 for the foundation. One of the key benefits to creating a foundation, rather than sticking with the status quo, goes beyond increasing the bus factor — it diversifies the influences on PHP. Watkins points out that, for much of the history of PHP, Zend, the employer of Dmitry Stogov, has been a primary financial backer, and as such has had some amount of influence on the language's direction. Similarly, JetBrains had increased influence during its time employing Popov on PHP."To say they have not influenced the direction of the language as a whole would just not be true...." While Watkins says that everything has been above board and gone through standard processes to ensure so, influence is nonetheless indisputable, and that "The Foundation represents a new way to push the language forward..." The current RFC process, JetBrains writes, "will not change, and language decisions will always be left to the PHP Internals community." And in addition, Watkins adds, "It provides us the mechanism by which to raise the bus factor, so that we never face the problems we face today, and have faced in the past."' -- source: https://developers.slashdot.org/story/21/11/27/0225217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Computation-Intensive Research And The Quest For Scientific Reproducibility
by Lawrence D'Oliveiro 26 Nov '21

26 Nov '21

The fruits of scientific research are supposed to be open to all. A key part of this is the need for reproducibility -- the idea that somebody else can repeat the same experiments and analysis and (hopefully) come to the same conclusions. It has long been a common expectation that researchers will make their raw data available to others for this purpose, but nowadays even that is likely no longer enough. The analysis of the data usually requires some particular piece of computer software, even if this was just some in-house scripting done on top of a commonly-available toolkit or package. Two different reports on this subject have come out recently, this one <https://www.theregister.com/2021/11/25/research_software_inquiry/> from the UK and this <https://arstechnica.com/science/2021/11/keeping-science-reproducible-in-a-w…> with examples from the US and elsewhere. The latter goes into a lot more detail, including good news (the rise of publicly-available data sets which get heavily used for many different analyses), and bad: From 2017 through 2019, Tsuyoshi Miyakawa, the editor-in-chief of the journal Molecular Brain, replied to 41 article submissions by requesting that the authors provide their complete source data for review, as per the stated policy of the journal. Only one author did so. ... Based on his efforts to replicate papers from other statisticians, Thomas Lumley, a professor of biostatistics at the University of Auckland in New Zealand, says of the phrase data available upon request: "When people put it in their papers, what they typically mean is 'data not available.'" As for making code available, that has its own challenges: often the scripts/programs are hastily thrown together, and the creators may be embarrassed to have others see it in this state. Or it’s not likely to work properly anyway, outside of the original systems where it was developed. The good news is, bodies that fund the research and the journals that publish the results are becoming more aware of such issues, and increasingly trying to ensure that procedures for dealing with them are built into the projects from the beginning.

3 2

Bye-Bye MIPS
by Lawrence D'Oliveiro 26 Nov '21

26 Nov '21

You know a CPU architecture is really dead when the Linux kernel drops support for it. I just learned that MIPS64 has joined this club as of the 5.15 kernel, according to <https://www.theregister.com/2021/11/25/alpine_3_15/> (presumably “MIPS32” vanished some time before?). Even the company formerly known as “MIPS” is now rebranding (at least its parent) as “Wave”, and is going to base its future products on the RISC-V architecture instead.

1 0

Mozilla Is Ending Support For Its Firefox Password Manager Sync App
by Peter Reutemann 24 Nov '21

24 Nov '21

'Mozilla announced last week via a support article that its Firefox Lockwise password manager app will reach end-of-life on December 13th. The final release versions are 1.8.1 (iOS) and 4.0.3 (Android) and will no longer be available to download or reinstall after that date. The Verge reports: What started in 2018 as a small experimental mobile app called Lockbox ended up bringing a way to access saved passwords and perform autofills on iOS, Android, and desktop devices to a small but enthusiastic following of Firefox fans. The app was also later adapted as a Firefox extension. It seemed like it was apt to stick around for the long run. The support article recommends that users continue accessing passwords using the native Firefox browsers on desktop and mobile. In an added note on the support site, Mozilla suggests that later in December, the Firefox iOS app will gain the ability to manage Firefox passwords systemwide. The note alludes to Mozilla adopting the features of Lockwise and eventually integrating them into the Firefox browser apps natively on all platforms. ' -- source: https://tech.slashdot.org/story/21/11/23/2157244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Trying To Reclaim The Word “Crypto”
by Lawrence D'Oliveiro 24 Nov '21

24 Nov '21

For decades, the word “crypto” has been synonymous with “cryptography”. But increasingly now, some are using it to mean “cryptocurrency” instead. Naturally this is annoying some who have been working in the crypto field for years, and they are demanding that this new (mis)usage be stopped. What do you think? <https://www.theregister.com/2021/11/23/crypto_graphy_or_currency/>

2 2

Attackers Don't Bother Brute-forcing Long Passwords, Microsoft Engineer Says
by Peter Reutemann 23 Nov '21

23 Nov '21

'According to data collected by Microsoft's network of honeypot servers, most brute-force attackers primarily attempt to guess short passwords, with very few attacks targeting credentials that are either long or contain complex characters. From a report: "I analysed the credentials entered from over -- million brute force attacks against SSH. This is around 30 days of data in Microsoft's sensor network," said Ross Bevington, a security researcher at Microsoft. "77% of attempts used a password between 1 and 7 characters. A password over 10 characters was only seen in 6% of cases," said Bevington, who works as Head of Deception at Microsoft, a position in which he's tasked with creating legitimate-looking honeypot systems in order to study attacker trends.' -- source: https://it.slashdot.org/story/21/11/22/2036243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

GoDaddy Security Breach Exposes WordPress Users' Data
by Peter Reutemann 23 Nov '21

23 Nov '21

'Web hosting company GoDaddy said on Monday email addresses of up to 1.2 million active and inactive Managed WordPress customers had been exposed in an unauthorized third-party access. From a report: The company said the incident was discovered on Sept. 6 and the third-party accessed the system using a compromised password.' -- source: https://it.slashdot.org/story/21/11/22/1523234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A German State is Switching Its 25,000 Computers From Windows to Linux
by Peter Reutemann 22 Nov '21

22 Nov '21

'The north-German state of Schleswig-Holstein plans to switch to open source software..." reports Mike Saunders from LibreOffice. "By the end of 2026, Microsoft Office is to be replaced by LibreOffice on all 25,000 computers used by civil servants and employees (including teachers), and the Windows operating system is to be replaced by GNU/Linux." The tech site Foss Force writes: This seems to be a done deal, as the steps for the transition from proprietary to open have already been codified by the Schleswig-Holstein state parliament, and explained in plain language in an interview with Jan Philipp Albrecht, the state's digital minister, that was published in c't, a German language computer magazine (Google Translate version here). In the interview, Albrecht said that part of the transition to open source is already in the works, and pointed out that 90% of state administration conferencing is conducted using the open source video conferencing platform Jitsi. "We have been testing LibreOffice in our IT department for two years, and our experience is clear: it works," he said. "This also applies, for example, when editing Microsoft Word documents with comments... No Linux distribution has been chosen yet to use as a standard, although Albrecht said they're currently looking at five distributions that suit their purposes.' -- source: https://linux.slashdot.org/story/21/11/21/0231218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Thousands of Firefox Users Accidentally Commit Login Cookies On GitHub
by Peter Reutemann 19 Nov '21

19 Nov '21

'Thousands of Firefox cookie databases containing sensitive data are available on request from GitHub repositories, data potentially usable for hijacking authenticated sessions. The Register reports: These cookies.sqlite databases normally reside in the Firefox profiles folder. They're used to store cookies between browsing sessions. And they're findable by searching GitHub with specific query parameters, what's known as a search "dork." Aidan Marlin, a security engineer at London-based rail travel service Trainline, alerted The Register to the public availability of these files after reporting his findings through HackerOne and being told by a GitHub representative that "credentials exposed by our users are not in scope for our Bug Bounty program." Marlin then asked whether he could make his findings public and was told he's free to do so. "I'm frustrated that GitHub isn't taking its users' security and privacy seriously," Marlin told The Register in an email. "The least it could do is prevent results coming up for this GitHub dork. If the individuals who uploaded these cookie databases were made aware of what they'd done, they'd s*** their pants." Marlin acknowledges that affected GitHub users deserve some blame for failing to prevent their cookies.sqlite databases from being included when they committed code and pushed it to their public repositories. "But there are nearly 4.5k hits for this dork, so I think GitHub has a duty of care as well," he said, adding that he's alerted the UK Information Commissioner's Office because personal information is at stake. Marlin speculates that the oversight is a consequence of committing code from one's Linux home directory. "I imagine in most of the cases, the individuals aren't aware that they've uploaded their cookie databases," he explained. "A common reason users do this is for a common environment across multiple machines."' -- source: https://news.slashdot.org/story/21/11/18/2227206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Has a Serious Security Problem That Once Again Enables DNS Cache Poisoning
by Peter Reutemann 18 Nov '21

18 Nov '21

'As much as 38 percent of the Internet's domain name lookup servers are vulnerable to a new attack that allows hackers to send victims to maliciously spoofed addresses masquerading as legitimate domains, like bankofamerica.com or gmail.com. The exploit, unveiled in research presented today, revives the DNS cache-poisoning attack that researcher Dan Kaminsky disclosed in 2008. He showed that, by masquerading as an authoritative DNS server and using it to flood a DNS resolver with fake lookup results for a trusted domain, an attacker could poison the resolver cache with the spoofed IP address. >From then on, anyone relying on the same resolver would be diverted to the same imposter site. The sleight of hand worked because DNS at the time relied on a transaction ID to prove the IP number returned came from an authoritative server rather than an imposter server attempting to send people to a malicious site. The transaction number had only 16 bits, which meant that there were only 65,536 possible transaction IDs. Kaminsky realized that hackers could exploit the lack of entropy by bombarding a DNS resolver with off-path responses that included each possible ID. Once the resolver received a response with the correct ID, the server would accept the malicious IP and store the result in cache so that everyone else using the same resolver -- which typically belongs to a corporation, organization, or ISP -- would also be sent to the same malicious server.' -- source: https://linux.slashdot.org/story/21/11/17/1856235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1