October 2022 - wlug - list.wlug.org.nz

“You must enable DRM to play some audio or video on this page.”
by Lawrence D'Oliveiro 28 Oct '22

28 Oct '22

I have seen Firefox give me this message that I need to “enable DRM” (i.e. install support for Encrypted Media Extensions) when I visit certain pages. One site that is currently triggering this for me is Metservice <https://www.metservice.com/towns-cities/locations/hamilton>. Yet I can’t see anything on that page that I might be blocked from playing. There is a Video Forecast clip, but I seem to be able to play that OK. Anybody else get this message?

3 2

'Old/Weird Laptops' Sought To Help Test Linux Kernel Backlight Drivers
by Peter Reutemann 28 Oct '22

28 Oct '22

'Do you have a laptop that's either "pretty old" or "weird in some other way"? Did it ship without Windows from the factory, or did you flash its firmware with coreboot? You could help the Linux kernel move its backlight code forward without abandoning quirky gear like yours. ArsTechnica: Hans de Goede, a longtime Linux developer and principal engineer at Red Hat, writes on his Livejournal about the need to test "a special group of laptops" to prevent their backlight controls from disappearing in Linux kernel 6.1. Old laptop tests are needed because de Goede is initiating some major changes to user-space backlight controls, something he has been working on since 2014. As detailed at Linux blog Phoronix, there are multiple issues with how Linux tries to address the wide variety of backlight schemes in displays, which de Goede laid out at the recent Linux Plumbers Conference. There can be multiple backlight devices operating a single display, leaving high-level controls to "guess which one will work." Brightness control requires root permissions at the moment. And "0" passed along as a backlight value remains a conundrum, as the engineer pointed out in 2014: Is that entirely off, or as low as the display can be lit?' -- source: https://linux.slashdot.org/story/22/10/27/1920206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Systemd Supremo Proposes Tightening up Linux Boot Process
by Peter Reutemann 27 Oct '22

27 Oct '22

'Lennart Poettering's latest blog post proposes moving the Linux boot process into a "Brave New Trusted Boot World" of cryptographically signed Unified Kernel Images. From a report: Agent Poettering offers a mechanism for tightening up the security of the system startup process on Linux machines, using TPM 2.0 hardware. In brief, what he sees as the problem is that on hardware with Secure Boot enabled, while the boot process up to and including the kernel is signed, the next step, loading the initrd, is not. That's what he wants to fix. ' -- source: https://it.slashdot.org/story/22/10/26/1743234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Passkeys Are Finally Here
by Peter Reutemann 26 Oct '22

26 Oct '22

'Ars Technica: Generically, passkeys refer to various schemes for storing authenticating information in hardware, a concept that has existed for more than a decade. What's different now is that Microsoft, Apple, Google, and a consortium of other companies have unified around a single passkey standard shepherded by the FIDO Alliance. Not only are passkeys easier for most people to use than passwords; they are also completely resistant to credential phishing, credential stuffing, and similar account takeover attacks. On Monday, PayPal said US-based users would soon have the option of logging in using FIDO-based passkeys, joining Kayak, eBay, Best Buy, CardPointers, and WordPress as online services that will offer the password alternative. In recent months, Microsoft, Apple, and Google have all updated their operating systems and apps to enable passkeys. Passkey support is still spotty. Passkeys stored on iOS or macOS will work on Windows, for instance, but the reverse isn't yet available. In the coming months, all of that should be ironed out, though. Passkeys work almost identically to the FIDO authenticators that allow us to use our phones, laptops, computers, and Yubico or Feitian security keys for multi-factor authentication. Just like the FIDO authenticators stored on these MFA devices, passkeys are invisible and integrate with Face ID, Windows Hello, or other biometric readers offered by device makers. There's no way to retrieve the cryptographic secrets stored in the authenticators short of physically dismantling the device or subjecting it to a jailbreak or rooting attack. Even if an adversary was able to extract the cryptographic secret, they still would have to supply the fingerprint, facial scan, or -- in the absence of biometric capabilities -- the PIN that's associated with the token. What's more, hardware tokens use FIDO's Cross-Device Authentication flow, or CTAP, which relies on Bluetooth Low Energy to verify the authenticating device is in close physical proximity to the device trying to log in. "Users no longer need to enroll each device for each service, which has long been the case for FIDO (and for any public key cryptography)," said Andrew Shikiar, FIDO's executive director and chief marketing officer. "By enabling the private key to be securely synced across an OS cloud, the user needs to only enroll once for a service, and then is essentially pre-enrolled for that service on all of their other devices. This brings better usability for the end-user and -- very significantly -- allows the service provider to start retiring passwords as a means of account recovery and re-enrollment." In other words: "Passkeys just trade WebAuthn cryptographic keys with the website directly," says Ars Review Editor Ron Amadeo. "There's no need for a human to tell a password manager to generate, store, and recall a secret -- that will all happen automatically, with way better secrets than what the old text box supported, and with uniqueness enforced." If you're eager to give passkeys a try, you can use this demo site created by security company Hanko.' -- source: https://yro.slashdot.org/story/22/10/25/1912214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next *Tuesday*
by Peter Reutemann 26 Oct '22

26 Oct '22

Hi everyone We have a meeting next week on Tuesday (not Monday, due to Labour Day) with the following topic: "Ever wondered what Docker was all about? Peter Reutemann will give a hands-on introduction into the tool and show you why it is so useful." Details: https://www.meetup.com/waikatolinuxusersgroup/events/283776731/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Memtest86+ Is Back After 9 Years
by Peter Reutemann 26 Oct '22

26 Oct '22

'Memtest86+ just got its first update after 9 years. The program has reportedly been rewritten from scratch and is back in active development. The new version, 6.0, features a plethora of updates to bring the application up to date, and support the latest system hardware from Intel and AMD. Tom's Hardware reports: For the uninitiated, MemTest86 was originally created back in the mid 1990s, and was one of the earliest DDR memory testing applications for personal computers. But development stopped in 2013 once Memtest86 was split into Memtest86 and Memtest86", with the former being bought by PassMark. Officially, we don't know why development stopped. But compared to the now modern Memtest86, Memtest86+ is the open-source variant. Needless to say, version 6.00 features a lot of updates, which were required to bring it up to modern standards compared to the 2013 version. The new version includes completely rewritten code for UEFI-based motherboards, the modern version of a BIOS, for both 32-bit and 64-bit versions of the application. Furthermore, the application features added support for x64 long mode paging, support for up to 256 cores, added detection for DDR4 and DDR5 memory -- since DDR3 was the latest memory standard in 2013 -- and adds support for XMP version 3.0. CPU support has been significantly enhanced, addingdetection for all pre-Zen and AMD Zen-based processors ranging from the Ryzen 1000 series to 7000 series, and any older parts that were made after 2013. Intel support has also been added for chips up to 13th gen Raptor Lake. Finally, the last patch notes indicate version 6.0 adds support for older Nvidia and AMD chipsets - probably pre-2010 since it mentions Nvidia nForce chipsets, along with numerous bug fixes, optimizations and enhancements.' -- source: https://hardware.slashdot.org/story/22/10/24/2315242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Just When You Thought Y2K Was Done And Dusted ...
by Lawrence D'Oliveiro 25 Oct '22

25 Oct '22

Remember what the whole Y2K issue was like, over a quarter-century ago? And all the work that had to be done to fix it? You’d think that lessons were learned, software developers would be wiser, and henceforth they would always use four digits for year numbers, so that a situation like that would not occur again. Guess again. Recently I hit a situation where a piece of software was *still* using just two digits for year numbers. Basically it was maintaining Certificate Revocation Lists (CRLs) for OpenVPN connections; these have an expiry date, in the form of the “nextupdate” field, to ensure that outdated lists are regularly replaced with fresh ones, to reduce the chance that anybody is inadvertently continuing to use compromised keys. The software in question is pfSense, from Netgate <https://forum.netgate.com/topic/172870/crl-has-expired>. The standard format for these CRLs can handle a full range of dates, but the internal system on pfSense for generating them can only handle years from 1950 to 2049. The generated CRLs were being given validity durations of 9999 days, which was fine up until about August this year, when the expiry date went past 2049, and wrapped around to 1950. On an incoming connection attempt, OpenSSL would check the CRL, find it invalid, and cause OpenVPN to drop the connection. The forum discussion above links to a patch to fix the issue. Only the patch doesn’t really make for a permanent fix: all it does is reduce the assigned validity duration from 9999 days to 730 days; the actual underlying software is still only working with 2-digit year numbers. This gives Netgate a few decades’ breathing room to come up with a proper fix.

2 2

Online Misinformation Monitor Newsletter
by Lawrence D'Oliveiro 20 Oct '22

20 Oct '22

Came across this useful series of monthly reports <https://www.newsguardtech.com/misinformation-monitor/> on how online services are being conduits for spreading misinformation and disinformation. Don’t trust them? Learn to watch out for those who keep insisting they are correct, versus those who are willing to offer reasons why they are correct (and are willing to correct their mistakes) <https://www.newsguardtech.com/about/why-should-you-trust-us/>.

1 0

Firefox 106 Is Now Available With PDF Annotation, Firefox View
by Peter Reutemann 20 Oct '22

20 Oct '22

'Firefox 106 is now available for download, bringing various new features and enhancements, such as a new PDF editing feature and new way to organize recently closed tabs. 9to5Linux reports: Mozilla says that Firefox 106 finally brings the long-anticipated two-finger swipe horizontal gesture for navigating back and forward on a website without having to hold down the Alt key. [...] Firefox 106 also introduces annotation capabilities to the built-in PDF viewer so you can write text, draw, or add signatures on PDF files. You'll be able to change the size and color of the text tool, as well as the thickness, opacity, and color of the draw tool. Another interesting new feature of the Firefox 106 release is called Firefox View, which is implemented as a pinned tab, promising to help you get back to the content you've previously discovered by allowing you to switch seamlessly between your devices running Firefox. On top of all that, Firefox 106 also brings major WebRTC changes to improve Windows and Wayland screen sharing, RTP performance and reliability, statistics, and more. There are also the usual bug and security fixes to make Firefox more stable and reliable on your system. ' -- source: https://news.slashdot.org/story/22/10/19/2053217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

In Praise of FFmpeg
by Peter Reutemann 19 Oct '22

19 Oct '22

'Drew DeVault, prolific FOSS blogger and hacker behind SourceHut, Sway, wlroots, and many other projects, writes in a blog post: I have relied on ffmpeg for many tasks and for many years. It has always been there to handle any little multimedia-related task I might put it to for personal use -- re-encoding audio files so they fit on my phone, taking clips from videos to share, muxing fonts into mkv files, capturing video from my webcam, live streaming hacking sessions on my own platform, or anything else I can imagine. It formed the foundation of MediaCrush back in the day, where we used it to optimize multimedia files for efficient viewing on the web, back when that was more difficult than "just transcode it to a webm." ffmpeg is notable for being one of the first large-scale FOSS projects to completely eradicate proprietary software in its niche. Virtually all multimedia-related companies rely on ffmpeg to do their heavy lifting. It took a complex problem and solved it, with free software. The book is now closed on multimedia: ffmpeg is the solution to almost all of your problems. And if it's not, you're more likely to patch ffmpeg than to develop something new. The code is accessible and the community are experts in your problem domain. ffmpeg is one of the foremost pillars of achievement in free software. It has touched the lives of every reader, whether they know it or not. If you've ever watched TV, or gone to a movie, or watched videos online, or listened to a podcast, odds are that ffmpeg was involved in making it possible. It is one of the most well-executed and important software projects of all time.' -- source: https://tech.slashdot.org/story/22/10/17/188205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1