June 2021 - wlug - list.wlug.org.nz

meeting next Monday
by Peter Reutemann 21 Jun '21

21 Jun '21

Hi everyone 'New to the version control system git or wanting to share some handy tricks? Lawrence D'Oliveiro will give an introduction to the git command-line and how to manage files with it. After the intro, we will look into how to use github (e.g., forks, pull requests) and github alternatives.' Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/274861060/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Open Standard But Not Open Access: Schematron Author Complains About ISO Paywall
by Lawrence D'Oliveiro 19 Jun '21

19 Jun '21

Not the first time this has happened <https://www.theregister.com/2021/06/18/schematron_standard_paywall/>: a group volunteers to create an open standard, giving freely of their time, get it widely adopted, hand it over to a standards body like ISO to make it “official”, and the latter starts charging for copies of the spec. Note this response from ISO: "Unfortunately, the ISO Central Secretariat does not provide free copies of standards. All ISO Publications derive from the work and contributions of ISO and ISO Members that contain intellectual property of demonstrable economic value.” And how much did ISO pay those contributors for that “intellectual property”? Not a penny.

1 0

Microsoft’s Linux repositories were down for 18+ hours
by Peter Reutemann 19 Jun '21

19 Jun '21

'Yesterday, packages.microsoft.com—the repository from which Microsoft serves software installers for Linux distributions including CentOS, Debian, Fedora, OpenSUSE, and more—went down hard, and it stayed down for around 18 hours. The outage impacted users trying to install .NET Core, Microsoft Teams, Microsoft SQL Server for Linux (yes, that's a thing) and more—as well as Azure's own devops pipelines. We first became aware of the problem Wednesday evening when we saw 404 errors in the output of apt update on an Ubuntu workstation with Microsoft Teams installed. The outage is somewhat better-documented at this .NET Core issue report on Github, with many users from all around the world sharing their experiences and theories. The short version is that the entire repository cluster that serves all Linux packages for Microsoft was completely down—issuing a range of HTTP 404 (content not found) and 500 (Internal Server Error) messages for any URL—for roughly 18 hours. Microsoft engineer Rahul Bhandari confirmed the outage roughly five hours after it was initially reported, with a cryptic comment about the infrastructure team "running into some space issues." Eighteen hours after the issue was detailed, Bhandari said that the mirrors were once again available—although with temporarily degraded performance, likely due to cold caches. In this update, Bhandari said that the original cause of the outage was "a regression in [apt repositories] during some feature migration work that resulted in those packages becoming unavailable on the mirrors." We're still waiting for a comprehensive incident report, since Bhandari's status updates provide clues but no real explanations. The good news: We can confirm that packages.microsoft.com is indeed up once again, and it is serving packages as it should.' -- source: https://arstechnica.com/gadgets/2021/06/microsofts-linux-repositories-were-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Code Trainspotting
by Lawrence D'Oliveiro 18 Jun '21

18 Jun '21

The item on One News this evening about difficulties bringing in families of skilled workers showed some brief screenshots of some source code. I noticed the identifier “nsown_capable”, and doing a search for this reveals it’s from the Linux kernel <https://elixir.bootlin.com/linux/v3.7/ident/nsown_capable>. Apologies to those bored to tears by this ...

1 0

Smart Contract: Computer Says No
by Lawrence D'Oliveiro 18 Jun '21

18 Jun '21

Another day, another tale of cryptocurrency failure <https://www.theregister.com/2021/06/17/iron_cryptocoin_titan/>. What’s different about this one is that it involved a “stablecoin”, which is some kind of attempt to reduce the volatility of a cryptocurrency by tying it in part to an actual currency. Note this linkage was only partial, and also involved a “smart contract”. This is a piece of autonomous code that, once let loose, makes its own decisions on what actions are and aren’t allowed. There is a suspicion that the smart contract involved had this line in it: require(_share_price > 0, "Invalid share price"); when it should have been require(_share_price >= 0, "Invalid share price"); and, depending on rounding errors, this could have caused all attempts at redemption to fail if the price fell too low to be distinguished from zero. And unlike regular legal contracts between carbon-based life forms, no court can overrule the operation of a smart contract†. Once it is put into effect, there is no reining it in. If the code is bug-free, you are fine (Do I hear sardonic laughter?). How many dozens of sci-fi stories and movies (both good and bad) have gone over this basic scenario? Do people learn nothing from pulp fiction!? But then again, the company did say "We already queued the fix for this, so people can redeem again at 5pm UTC." so maybe this wasn’t the issue at all. †Probably. None has yet tried.

1 0

Newly discovered Vigilante malware outs software pirates and blocks them
by Peter Reutemann 18 Jun '21

18 Jun '21

'A researcher has uncovered one of the more unusual finds in the annals of malware: booby-trapped files that rat out downloaders and try to prevent unauthorized downloading in the future. The files are available on sites frequented by software pirates. Vigilante, as SophosLabs Principal Researcher Andrew Brandt is calling the malware, gets installed when victims download and execute what they think is pirated software or games. Behind the scenes, the malware reports the file name that was executed to an attacker-controlled server, along with the IP address of the victims’ computers. As a finishing touch, Vigilante tries to modify the victims’ computers so they can no longer access thepiratebay.com and as many as 1,000 other pirate sites.' -- source: https://arstechnica.com/gadgets/2021/06/newly-discovered-vigilante-malware-… Didn't see that one coming... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Backs Linux Project To Make Android, Chrome OS Harder To Hack
by Peter Reutemann 18 Jun '21

18 Jun '21

'Google said Thursday it's funding a project to increase Linux security by writing parts of the operating system's core in the Rust programming language, a modernization effort that could bolster the security of the internet and smartphones. From a report: If the project succeeds, it'll be possible to add new elements written in Rust into the heart of Linux, called the kernel. Such a change would mark a major technological and cultural shift for an open-source software project that's become foundational to Google's Android and Chrome operating systems as well as vast swaths of the internet. Miguel Ojeda, who's written software used by the Large Hadron Collider particle accelerator and worked on programming language security, is being contracted to write software in Rust for the Linux kernel. Google is paying for the contract, which is being extended through the Internet Security Research Group, a nonprofit that's also made it easier to secure website communications through the Let's Encrypt effort. Adding Rust modules to the Linux kernel would improve security by closing some avenues for hackers can use to attack phones, computers or servers. Since it was launched in 1991, Linux has been written solely in the powerful but old C programming language. The language was developed in 1972 and is more vulnerable to hacks than contemporary programming languages.' -- source: https://linux.slashdot.org/story/21/06/17/185239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Report Finds Phone Network Encryption Was Deliberately Weakened
by Peter Reutemann 18 Jun '21

18 Jun '21

'A weakness in the algorithm used to encrypt cellphone data in the 1990s and 2000s allowed hackers to spy on some internet traffic, according to a new research paper. Motherboard: The paper has sent shockwaves through the encryption community because of what it implies: The researchers believe that the mathematical probability of the weakness being introduced on accident is extremely low. Thus, they speculate that a weakness was intentionally put into the algorithm. After the paper was published, the group that designed the algorithm confirmed this was the case. Researchers from several universities in Europe found that the encryption algorithm GEA-1, which was used in cellphones when the industry adopted GPRS standards in 2G networks, was intentionally designed to include a weakness that at least one cryptography expert sees as a backdoor. The researchers said they obtained two encryption algorithms, GEA-1 and GEA-2, which are proprietary and thus not public, "from a source." They then analyzed them and realized they were vulnerable to attacks that allowed for decryption of all traffic. When trying to reverse-engineer the algorithm, the researchers wrote that (to simplify), they tried to design a similar encryption algorithm using a random number generator often used in cryptography and never came close to creating an encryption scheme as weak as the one actually used: "In a million tries we never even got close to such a weak instance," they wrote. "This implies that the weakness in GEA-1 is unlikely to occur by chance, indicating that the security level of 40 bits is due to export regulations." Researchers dubbed the attack "divide-and-conquer," and said it was "rather straightforward." In short, the attack allows someone who can intercept cellphone data traffic to recover the key used to encrypt the data and then decrypt all traffic. The weakness in GEA-1, the oldest algorithm developed in 1998, is that it provides only 40-bit security. That's what allows an attacker to get the key and decrypt all traffic, according to the researchers.' -- source: https://it.slashdot.org/story/21/06/17/206213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ZFS fans, rejoice—RAIDz expansion will be a thing very soon
by Peter Reutemann 16 Jun '21

16 Jun '21

'OpenZFS founding developer Matthew Ahrens opened a PR for one of the most sought-after features in ZFS history—RAIDz expansion—last week. The new feature allows a ZFS user to expand the size of a single RAIDz vdev. For example, you can use the new feature to turn a three-disk RAIDz1 into a four, five, or six RAIDz1.' -- source: https://arstechnica.com/gadgets/2021/06/raidz-expansion-code-lands-in-openz… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting June 28th
by Peter Reutemann 15 Jun '21

15 Jun '21

Hi everyone I'm still looking for a topic for the next WLUG meeting (June 28). After chatting with Lawrence and Ian last night, we were thinking of having a "git" (as in version control) theme: - git basics - Lawrence? - using github (forking, pull requests, etc) - github alternatives How does that sound? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1