April 2022 - wlug - list.wlug.org.nz

List Of IPTV Resources
by Lawrence D'Oliveiro 22 Sep '24

22 Sep '24

This user <https://github.com/iptv-org> just popped up in my GitHub feed. One repo <https://github.com/iptv-org/iptv> claims to be a list of links to over 8000 streaming TV channels from nations all over the world, while the other is a list of tools*, providers and other resources. Do be aware it’s a bit of a mixed bag: yes, there are legitimate channels (no encryption so far that I have noticed), but also some dubious-looking links. *Oddly, FFmpeg and youtube-dl aren’t in the list.

2 5

Enabling Case-Insensitive Filenames On Linux
by Lawrence D'Oliveiro 06 Feb '24

06 Feb '24

The ext4 filesystem has had the “casefold” option for a while now <https://lwn.net/Articles/784041/>. This allows you to specify, when you initialize a new filesystem, that you want file/directory names to be treated as case-insensitive. At the same time, you have to specify that the filenames are to be interpreted as UTF-8 encoding; normally the kernel doesn’t care, it only singles out ASCII slash and NUL bytes for special interpretation, and simply passes through any other byte values in the names. I was able to create such a filesystem, but I wasn’t able to mount it in my last-upgraded-just-a-few-days-ago Debian Unstable setup. When I try, it fails, and in the dmesg log I see Filesystem with casefold feature cannot be mounted without CONFIG_UNICODE Turns out the Debian 5.10 kernel has not been built with this CONFIG_UNICODE option enabled. However, this situation looks set to change shortly, according to <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985689>.

2 3

Weta Digital’s Technology Division Sold To US Firm
by Lawrence D'Oliveiro 30 Nov '23

30 Nov '23

Let me see if I understand this article <https://www.nzherald.co.nz/business/sir-peter-jackson-to-sell-weta-digital-…> correctly: the part of Weta Digital that used to develop the in-house 3D graphics/effects tools that they use in all those movies is being sold to US-based Unity Software. The part that is left will be called “WetaFX”, and will become a customer of Unity for the use of those tools, no longer doing its own development in-house. By the way, I’ve been looking at the Unity site <https://unity.com/>, and it looks like all their products are rentware (subscription-based).

1 1

Outlawing Dark Patterns
by Lawrence D'Oliveiro 05 Nov '22

05 Nov '22

“Dark patterns” is a term coined to describe user interfaces designed to manipulate people into giving up time, money or personal data that they didn’t intend to. A common example is the obstacle course you often have to go through to cancel a subscription to something online. Another example is the use of countdown timers to rush buyers into hasty decisions. They may not be out-and-out deceptive, but they do come close. Now, the US states of California and Washington are looking to pass laws to restrict this practice. <https://arstechnica.com/tech-policy/2021/01/lawmakers-take-aim-at-insidious…>

2 2

Apple’s Windows 10
by Lawrence D'Oliveiro 19 Jul '22

19 Jul '22

Fred Brooks predicted long ago that complex pieces of software would eventually reach the point of irreducible entropy, where any attempt to fix a bug would simply introduce a new one. Microsoft’s Windows 10 seems to be about there, and it’s now clear that Apple’s macOS 10.15 “Catalina” has also joined that elite group <https://www.theregister.co.uk/2020/05/27/apple_catalina_update/>: The first spin of Catalina, officially released in October 2019, was a mess. ... The biggest issue was that all kinds of apps simply stopped working. ... Peripherals like mice, keyboards and printers stopped working. Email went missing; iCloud backups failed; users were constantly harassed by login requests; updates didn’t update ... ... So came for the first update to its new system one week after the main launch which fixed some, but not all, of the issues. ... Version two came in December 2019 and fixed some of those issues, but not all. ... More bug fixes came with version three in January 2020, but the OS seemed to have finally stabilized; something that was then spectacularly undone with version .4. ... Then we had the “supplemental update” to version 10.15.4, which fixed some, but not all, of the problems – most significantly the problem with Finder and transferring large files. And, amazingly, appeared to undo the good work that had been done with website security and broke SSH for some users. But now, with version point-five this week, that problem appears to have been sorted and, of course, your battery might last longer too.

1 1

Microsoft finds Linux desktop flaw that gives root to untrusted users
by Peter Reutemann 14 Jun '22

14 Jun '22

'Vulnerabilities recently discovered by Microsoft make it easy for people with a toehold on many Linux desktop systems to quickly gain root system rights— the latest elevation of privileges flaw to come to light in the open source OS. As operating systems have been hardened to withstand compromises in recent years, elevation of privilege (EoP) vulnerabilities have become a crucial ingredient for most successful hacks. They can be exploited in concert with other vulnerabilities that on their own are often considered less severe, with the latter giving what’s called local access and the former escalating the root access. From there, adversaries with physical access or limited system rights can deploy backdoors or execute code of their choice. Nimbuspwn, as Microsoft has named the EoP threat, is two vulnerabilities that reside in the networkd-dispatcher, a component in many Linux distributions that dispatch network status changes and can run various scripts to respond to a new status. When a machine boots, networkd-dispatcher runs as root. The flaws, tracked as CVE-2022-29799 and CVE-2022-29800, combine threats including directory traversal, symlink race, and time-of-check time-of-use (TOCTOU) race condition.' -- source: https://arstechnica.com/information-technology/2022/04/microsoft-finds-linu… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Linux On Mars: NASA’s Ingenuity Helicopter Flies
by Lawrence D'Oliveiro 10 May '22

10 May '22

The first powered aircraft on Mars <https://www.theregister.com/2021/04/19/perseverance_computing_feature/> has proved its concept, taken flight for a few seconds, and made a controlled landing again. The control system is running Linux on a Qualcomm Snapdragon 801 chip, not because NASA considered it the best tool for the job, but because it was the easiest solution available. The hardware “is tuned for use on Earth, not Mars”, so it is only planned to make brief flights of no more than 90 seconds at a time, always landing back at the same spot, and it is not expected to endure beyond the initial 30 days of the Perseverance mission.

1 3

30,000 New Users Signed Up For Mastodon After Elon Musk Bought Twitter
by Peter Reutemann 29 Apr '22

29 Apr '22

'Motherboard: Social media platform Mastodon, often seen as an alternative to Twitter, gained nearly 30,000 new users on the day that Elon Musk bought Twitter. On Tuesday a Mastodon domain became unresponsive. Eugen Rochko, Mastodon's CEO, later told Motherboard in an email that there were performance issues. "I'm sorry I couldn't have responded sooner," he wrote. "I was working all day on fixing performance issues on the Mastodon servers I operate due to the influx of new and returning users following Twitter's acquisition by Elon Musk." Rochko added that Mastodon has seen an increase of 41,287 active users, including both returning users and new users. When breaking that figure down by just new users, 28,391 new people have joined Mastodon in the past day, Rochko said. Mastodon is a piece of open-source software that people can use as a base to create their own social networks. Although its appearance is similar to Twitter, it also differs from Twitter in the sense that Twitter is a single social network people sign up for. When it comes to the social network side of things, Mastodon holds more similarities with Discord, in that users have to find specific Mastodon instances to join. Those looking to create their own Mastodon instance also have to host it themselves, a step that may alienate many non-technical users. Donald Trump's social media site, Truth Social, is based on Mastodon and was recently called out by the company for failing to provide the source code for the site built on top of it. Two weeks later, the social media site quietly acknowledged Mastodon in a dedicated section labeled "open source." In regard to the matter, Mastodon founder Eugen Rochko said: "Compliance with our AGPLv3 license is very important to me as that is the sole basis upon which I and other developers are willing to give away years of work for free." Twitter did confirm some fluctuations in follower counts after Musk's deal was made official, although they said they were organic in nature.' -- source: https://news.slashdot.org/story/22/04/27/2141231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

One of the most powerful DDoSes ever targets cryptocurrency platform
by Peter Reutemann 29 Apr '22

29 Apr '22

'A cryptocurrency platform was recently on the receiving end of one of the biggest distributed denial-of-service attacks ever after threat actors bombarded it with 15.3 million requests, content delivery network Cloudflare said. DDoS attacks can be measured in several ways, including by the volume of data, the number of packets, or the number of requests sent each second. The current records are 3.4 terabits per second for volumetric DDoSes—which attempt to consume all bandwidth available to the target—and 809 million packets per second, and 17.2 million requests per second. The latter two records measure the power of application-layer attacks, which attempt to exhaust the computing resources of a target’s infrastructure. Cloudflare's recent DDoS mitigation peaked at 15.3 million requests per second. While still smaller than the record, its power was more considerable because the attack was delivered through HTTPS requests rather than HTTP requests used in the record. Because HTTPS requests are much more compute-intensive than HTTP requests, the latest attack had the potential to put much more strain on the target.' -- source: https://arstechnica.com/information-technology/2022/04/one-of-the-most-powe… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fwd: New Zealand Cyber Security Challenge 2022
by Peter Reutemann 29 Apr '22

29 Apr '22

Considering our cyber security theme from this week, some of you might want to participate in the (free) challenge outlined below. Cheers, Peter ---------- Forwarded message --------- From: Buddhika Subasinghe <buddhika.subasinghe(a)waikato.ac.nz> Date: Fri, Apr 29, 2022 at 10:28 AM Subject: New Zealand Cyber Security Challenge 2022 To: Computing Staff: CS & SE <computing-staff(a)waikato.ac.nz>, Mathematics Staff <maths-staff(a)waikato.ac.nz>, Design staff: NZ <design-nz(a)waikato.ac.nz > Hi all FYI Please see the message below from Harpreet re the NZ Cyber Security Challenge 2022. Please contact Vimal vimal.kumar(a)waikato.ac.nz ro Harpreet harpreet.kaur(a)waikato.ac.nz if you need any further information about this event. Many thanks! Buddhika On Fri, Apr 29, 2022 at 9:26 AM Harpreet Kaur <harpreet.kaur(a)waikato.ac.nz> wrote: > Dear Buddhika, > > This is the email we want to regulate in the cs list. Much appreciated > your help! > > > *Hi All,* > *Cyber Security Researchers of Waikato (CROW) team is organising the NZ > Cyber Security Challenge again this year. Could you please distribute this > email invitation to your students?* > > ------------------------------------------------------------------------------------------ > *New Zealand Cyber Security Challenge 2022* > > The NZ Cyber Security Challenge is back for its 9th edition. Participation > is free and as always there are a number of prizes to be won. > > We invite anyone interested in cybersecurity to join and take part in the > challenge. The challenge will start with an online CTF round (Round 0). We > will then invite the top 150 participants to the University of Waikato > campus for the main competition involving Rounds 1,2, a networking lunch, > cybersecurity talks and a side challenge. > > The schedule of the NZCSC’22 is as follows: > > - > > 04 June - 22 June: > - > > Online Round 0: open for everyone > > > - > > 15 June - 22 June: > - > > Online Waikato x Cardiff Challenge (special round for Waikato and > Cardiff University Students) > - > > 22-23 July : > - > > Round 1 - Incident Response round > - > > Round 2 - Capture the Flag > - > > Side Challenge > - > > Networking lunch and talks from the industry > > Feel free to contact me (vimal.kumar(a)waikato.ac.nz) or Harpreet Kaur ( > harpreet.kaur(a)waikato.ac.nz) if you have any questions. More information > and the Registration of Interest link can be found on the event website. > > https://cybersecuritychallenge.org.nz/ > > > We look forward to hosting you at the event! > > > > -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0