April 2021 - wlug - list.wlug.org.nz

List Of IPTV Resources
by Lawrence D'Oliveiro 22 Sep '24

22 Sep '24

This user <https://github.com/iptv-org> just popped up in my GitHub feed. One repo <https://github.com/iptv-org/iptv> claims to be a list of links to over 8000 streaming TV channels from nations all over the world, while the other is a list of tools*, providers and other resources. Do be aware it’s a bit of a mixed bag: yes, there are legitimate channels (no encryption so far that I have noticed), but also some dubious-looking links. *Oddly, FFmpeg and youtube-dl aren’t in the list.

2 5

Outlawing Dark Patterns
by Lawrence D'Oliveiro 05 Nov '22

05 Nov '22

“Dark patterns” is a term coined to describe user interfaces designed to manipulate people into giving up time, money or personal data that they didn’t intend to. A common example is the obstacle course you often have to go through to cancel a subscription to something online. Another example is the use of countdown timers to rush buyers into hasty decisions. They may not be out-and-out deceptive, but they do come close. Now, the US states of California and Washington are looking to pass laws to restrict this practice. <https://arstechnica.com/tech-policy/2021/01/lawmakers-take-aim-at-insidious…>

2 2

Apple’s Windows 10
by Lawrence D'Oliveiro 19 Jul '22

19 Jul '22

Fred Brooks predicted long ago that complex pieces of software would eventually reach the point of irreducible entropy, where any attempt to fix a bug would simply introduce a new one. Microsoft’s Windows 10 seems to be about there, and it’s now clear that Apple’s macOS 10.15 “Catalina” has also joined that elite group <https://www.theregister.co.uk/2020/05/27/apple_catalina_update/>: The first spin of Catalina, officially released in October 2019, was a mess. ... The biggest issue was that all kinds of apps simply stopped working. ... Peripherals like mice, keyboards and printers stopped working. Email went missing; iCloud backups failed; users were constantly harassed by login requests; updates didn’t update ... ... So came for the first update to its new system one week after the main launch which fixed some, but not all, of the issues. ... Version two came in December 2019 and fixed some of those issues, but not all. ... More bug fixes came with version three in January 2020, but the OS seemed to have finally stabilized; something that was then spectacularly undone with version .4. ... Then we had the “supplemental update” to version 10.15.4, which fixed some, but not all, of the problems – most significantly the problem with Finder and transferring large files. And, amazingly, appeared to undo the good work that had been done with website security and broke SSH for some users. But now, with version point-five this week, that problem appears to have been sorted and, of course, your battery might last longer too.

1 1

Linux On Mars: NASA’s Ingenuity Helicopter Flies
by Lawrence D'Oliveiro 10 May '22

10 May '22

The first powered aircraft on Mars <https://www.theregister.com/2021/04/19/perseverance_computing_feature/> has proved its concept, taken flight for a few seconds, and made a controlled landing again. The control system is running Linux on a Qualcomm Snapdragon 801 chip, not because NASA considered it the best tool for the job, but because it was the easiest solution available. The hardware “is tuned for use on Earth, not Mars”, so it is only planned to make brief flights of no more than 90 seconds at a time, always landing back at the same spot, and it is not expected to endure beyond the initial 30 days of the Perseverance mission.

1 3

More On The NZ Reserve Bank Breach
by Lawrence D'Oliveiro 15 Sep '21

15 Sep '21

Seems hackers broke into a secure file-sharing service called Accellion, based in California. The RBNZ was using that to exchange documents with the likes of banks and insurance companies. <https://www.stuff.co.nz/business/123911764/reserve-bank-reveals-more-detail…>

2 5

How Facebook Architects Around Silent Data Corruption
by Lawrence D'Oliveiro 04 Jun '21

04 Jun '21

Seems like Facebook’s computation facilities have become so massive that it is starting to see intermittent errors in places you wouldn’t expect <https://www.nextplatform.com/2021/03/01/facebook-architects-around-silent-d…>: Engineers found that many of the cascading errors are the result of CPUs in production but not always due to the “soft errors” of radiation or synthetic fault injection. Rather, they find these can happen randomly on CPUs in repeatable ways. Although ECC is useful, this is focused on problems in SRAM but other elements are susceptible. The Facebook engineering team that reported on these problems finds that CPU silent data corruptions are actually orders of magnitude higher than soft-errors due to a lack of error correction in other blocks. The article mentions examples like a computation of 2×3 sometimes returning an answer other than 6, or a file size intermittently (and incorrectly) being computed as zero, leading to the file data not being copied. Such occurrences may be extremely rare, but when you are doing things on the scale that Facebook does, they start to become all too common. Facebook has published a paper (linked in the report) on their research into the problem. They have worked out some techniques to try to mitigate these issues, but of course they come at a cost.

1 1

72 Hours From Patch To Exploit
by Lawrence D'Oliveiro 20 May '21

20 May '21

This report <https://www.theregister.com/2021/04/06/sap_patch_attacks/> from software company SAP and security company Onapsis says that, from the moment SAP releases a security patch for its products, it only takes about 72 hours until bad hats have reverse-engineered the patch, figured out the security vulnerability it is meant to fix, and started releasing an exploit to take advantage of that vulnerability. Actually, proof-of-concept code can appear quicker than that. Which leaves customers in a dilemma: continue running patches through their regular QA procedures before deployment, widening the window for exploits to get in, or forego those QA procedures and deploy patches quickly to plug holes while risking breaking production systems? And of course this wouldn’t be unique to SAP ...

1 1

Greg Kroah-Hartman Rejects Apology from University of Minnesota Researchers
by Peter Reutemann 26 Apr '21

26 Apr '21

'Saturday University of Minnesota researchers emailed the Linux kernel mailing list apologizing for submitting buggy code as part of a research project to see whether it would be accepted. Late Saturday night, the kernel team's Greg Kroah-Hartman replied: Thank you for your response. As you know, the Linux Foundation and the Linux Foundation's Technical Advisory Board submitted a letter on Friday to your University outlining the specific actions which need to happen in order for your group, and your University, to be able to work to regain the trust of the Linux kernel community. Until those actions are taken, we do not have anything further to discuss about this issue. thanks' -- source: https://linux.slashdot.org/story/21/04/25/216257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Security Researcher Dan Kaminsky Has Died
by Peter Reutemann 25 Apr '21

25 Apr '21

'Security researcher Marc Rogers (also a BBC contributor) tweeted this morning "I guess theres no hiding it now. We lost Dan Kaminsky yesterday. One of the brightest lights in infosec and probably the kindest soul I knew. The vacuum he leaves behind is impossible to measure. Please keep speculation to yourself and be respectful of his family and friends." In later tweets, Rogers says he was proud that Kaminsky was his friend, adding "I could literally wrote a book of Dan Kaminsky tales. >From shenanigans at events all over the world, to parties and just crazy stuff that happened at the spur of a moment. But most about his crazy brilliant kind generous ideas and offers of help and support. He was one of a kind." Even the stories in Kaminsky's Wikipedia entry are impressive: He is known among computer security experts for his work on DNS cache poisoning, and for showing that the Sony Rootkit had infected at least 568,200 computers and for his talks at the Black Hat Briefings. In June 2010, Kaminsky released Interpolique, a beta framework for addressing injection attacks such as SQL injection and cross-site scripting in a manner comfortable to developers. On June 16, 2010, he was named by ICANN as one of the Trusted Community Representatives for the DNSSEC root. "Dan was a force of nature," adds Marc Rogers on Twitter. "A hacker who saw not just 1 or 2 moves ahead but so many you sometimes wondered if he was playing the same game: I asked him for a demo. He brought a record turntable he used to move a VM forwards & backwards in time like a DJ scratching." ' -- source: https://it.slashdot.org/story/21/04/24/1645214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

University of Minnesota Researchers Send Apology to Linux Kernel Mailing List
by Peter Reutemann 25 Apr '21

25 Apr '21

'Earlier this week Greg Kroah-Hartman of the Linux kernel development team banned the University of Minnesota from contributing after researchers there submitted what he called "obviously-incorrect patches" believed to be part of a research project into whether buggy code would be accepted. Today the professor in charge of that project, as well as two of its researchers, sent an email to the Linux kernel mailing list saying they "sincerely apologize for any harm our research group did to the Linux kernel community." Our goal was to identify issues with the patching process and ways to address them, and we are very sorry that the method used in the "hypocrite commits" paper was inappropriate. As many observers have pointed out to us, we made a mistake by not finding a way to consult with the community and obtain permission before running this study; we did that because we knew we could not ask the maintainers of Linux for permission, or they would be on the lookout for the hypocrite patches. While our goal was to improve the security of Linux, we now understand that it was hurtful to the community to make it a subject of our research, and to waste its effort reviewing these patches without its knowledge or permission. We just want you to know that we would never intentionally hurt the Linux kernel community and never introduce security vulnerabilities. Our work was conducted with the best of intentions and is all about finding and fixing security vulnerabilities... We are a research group whose members devote their careers to improving the Linux kernel. We have been working on finding and patching vulnerabilities in Linux for the past five years... This current incident has caused a great deal of anger in the Linux community toward us, the research group, and the University of Minnesota. We apologize unconditionally for what we now recognize was a breach of the shared trust in the open source community and seek forgiveness for our missteps. We seek to rebuild the relationship with the Linux Foundation and the Linux community from a place of humility to create a foundation from which, we hope, we can once again contribute to our shared goal of improving the quality and security of Linux software... We are committed to following best practices for collaborative research by consulting with community leaders and members about the nature of our research projects, and ensuring that our work meets not only the requirements of the Institutional Review Board but also the expectations that the community has articulated to us in the wake of this incident. While this issue has been painful for us as well, and we are genuinely sorry for the extra work that the Linux kernel community has undertaken, we have learned some important lessons about research with the open source community from this incident. We can and will do better, and we believe we have much to contribute in the future, and will work hard to regain your trust. Their email also says their work did not introduce vulnerabilities into the Linux code. ("The three incorrect patches were discussed and stopped during exchanges in a Linux message board, and never committed to the code.") And the email also clarifies that their research was only done in August of 2020, and "All the other 190 patches being reverted and re-evaluated were submitted as part of other projects and as a service to the community; they are not related to the 'hypocrite commits' paper. These 190 patches were in response to real bugs in the code and all correct — as far as we can discern — when we submitted them... Our recent patches in April 2021 are not part of the 'hypocrite commits' paper either."' -- source: https://linux.slashdot.org/story/21/04/25/0243259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0