July 2022 - wlug - list.wlug.org.nz

Servers running Digium Phones VoiP software are getting backdoored
by Peter Reutemann 19 Jul '22

19 Jul '22

'Servers running the open source Asterisk communication software for Digium VoiP services are under attack by hackers who are managing to commandeer the machines to install web shell interfaces that give the attackers covert control, researchers have reported. Researchers from security firm Palo Alto Networks said they suspect the hackers are gaining access to the on-premises servers by exploiting CVE-2021-45461. The critical remote code-execution flaw was discovered as a zero-day vulnerability late last year, when it was being exploited to execute malicious code on servers running fully updated versions of Rest Phone Apps, aka restapps, which is a VoiP package sold by a company called Sangoma. The vulnerability resides in FreePBX, the world's most widely used open source software for Internet-based Private Branch Exchange systems, which enable internal and external communications in organizations' private internal telephone networks. CVE-2021-45461 carries a severity rating of 9.8 out of 10 and allows hackers to execute malicious code that takes complete control of servers.' -- source: https://arstechnica.com/information-technology/2022/07/servers-running-digi… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Apple’s Windows 10
by Lawrence D'Oliveiro 19 Jul '22

19 Jul '22

Fred Brooks predicted long ago that complex pieces of software would eventually reach the point of irreducible entropy, where any attempt to fix a bug would simply introduce a new one. Microsoft’s Windows 10 seems to be about there, and it’s now clear that Apple’s macOS 10.15 “Catalina” has also joined that elite group <https://www.theregister.co.uk/2020/05/27/apple_catalina_update/>: The first spin of Catalina, officially released in October 2019, was a mess. ... The biggest issue was that all kinds of apps simply stopped working. ... Peripherals like mice, keyboards and printers stopped working. Email went missing; iCloud backups failed; users were constantly harassed by login requests; updates didn’t update ... ... So came for the first update to its new system one week after the main launch which fixed some, but not all, of the issues. ... Version two came in December 2019 and fixed some of those issues, but not all. ... More bug fixes came with version three in January 2020, but the OS seemed to have finally stabilized; something that was then spectacularly undone with version .4. ... Then we had the “supplemental update” to version 10.15.4, which fixed some, but not all, of the problems – most significantly the problem with Finder and transferring large files. And, amazingly, appeared to undo the good work that had been done with website security and broke SSH for some users. But now, with version point-five this week, that problem appears to have been sorted and, of course, your battery might last longer too.

1 1

Linux distro for Apple silicon Macs is already up and running on the brand-new M2
by Peter Reutemann 19 Jul '22

19 Jul '22

'Unlike Intel Macs, Apple silicon Macs were designed to run only Apple's software. But the developers on the Asahi Linux team have been working to change that, painstakingly reverse-engineering support for Apple's processors and other Mac hardware and releasing it as a work-in-progress distro that can actually boot up and run on bare metal, no virtualization required. The Asahi Linux team put out a new release today with plenty of additions and improvements. Most notably, the distro now supports the M1 Ultra and the Mac Studio and has added preliminary support for the M2 MacBook Pro (which has been tested firsthand by the team) and the M2 MacBook Air (which hasn't been tested but ought to work). Preliminary Bluetooth support for all Apple silicon Macs has also been added, though the team notes that it works poorly when connected to a 2.4GHz Wi-Fi network because "Wi-Fi/Bluetooth coexistence isn't properly configured yet." There are still many other things that aren't working properly, including the USB-A ports on the Studio, faster-than-USB-2.0 speeds from any Type-C/Thunderbolt ports, and GPU acceleration, but progress is being made on all of those fronts. GPU work in particular is coming along, with a "prototype driver" that is "good enough to run real graphics applications and benchmarks" already up and running, though it's not included in this release.' -- source: https://arstechnica.com/gadgets/2022/07/linux-distro-for-apple-silicon-macs… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

In Defence Of Swap: Common Misconceptions
by Lawrence D'Oliveiro 19 Jul '22

19 Jul '22

Came across this page <https://chrisdown.name/2018/01/02/in-defence-of-swap.html>, which gives an overview of the point of swap space. Some people (including myself) think “we have so much RAM on our systems nowadays, why bother allocating any swap space at all?” But really it’s more than just an overflow area for when you run out of RAM, it is a basis for more efficiently managing that RAM, no matter how much you might have. Actually I found the above linked from this <https://www.freedesktop.org/software/systemd/man/systemd-oomd.service.html> manual page on systemd-oomd. This service (available via an additional package on Debian) tries to take corrective action when the system starts running low on memory, before things get bad enough to wake up the kernel’s dreaded “OOM-killer”.

1 0

topic for next Monday?
by Peter Reutemann 19 Jul '22

19 Jul '22

Hi everyone We have a meeting coming up next Monday, but no topic/speaker at this stage. Any suggestions/volunteers? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Report: Facebook has Started Encrypting Links to Counter Browsers' Anti-Tracking Measures
by Peter Reutemann 19 Jul '22

19 Jul '22

'"Facebook has started to use a different URL scheme for site links," writes the technology blog Ghacks, "to combat URL stripping technologies that browsers such as Firefox or Brave use to improve privacy and prevent user tracking." Some sites, including Facebook, add parameters to the web address for tracking purposes. These parameters have no functionality that is relevant to the user, but sites rely on them to track users across pages and properties. Mozilla introduced support for URL stripping in Firefox 102, which it launched in June 2022. Firefox removes tracking parameters from web addresses automatically, but only in private browsing mode or when the browser's Tracking Protection feature is set to strict. Firefox users may enable URL stripping in all Firefox modes, but this requires manual configuration. Brave Browser strips known tracking parameters from web addresses as well.... It is no longer possible to remove the tracking part of the URL, as Facebook merged it with part of the required web address.' -- source: https://tech.slashdot.org/story/22/07/18/0433238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Can a Fork Save Cutefish OS (or Its Desktop)?
by Peter Reutemann 18 Jul '22

18 Jul '22

'In April ZDNet called its beta "the cutest Linux distro you'll ever use," praising the polished "incredible elegance" of Debian-based Cutefish OS, with its uncluttered, MacOS-like "Cutefish DE" desktop. But now CutefishOS.com times out, with at least one Reddit user complaining "their email is not responding" and seeking contributors for a fork. But meanwhile, the technology site DebugPoint.com shares another update: It looks like the OpenMandriva project is already continuing with the development of the Cutefish DE (not the OS) for its own OS. For more details, visit the Matrix discussion page. Besides, it's worth mentioning that Arch Linux already have the Cutefish desktop packages in the community repo. You can even install it as a standalone desktop environment in Arch Linux with easy steps. As you can see, it is easier to maintain the desktop environment to continue its development because the structure is already out there. I have tested and reviewed hundreds of distros for years, and Cutefish OS is the promising one with its stunning desktop environment. It was written from the ground up with QML and C++ and took advantage of KWin. It would have been an attractive desktop as a separate component and could have been another great option besides KDE Plasma or GNOME. Many open-source projects are born and die every year, and it's unfortunate to see the situation of Cutefish OS. I hope an official fork comes up soon, and we all can contribute to it.' -- source: https://linux.slashdot.org/story/22/07/17/0143210 It's been a while to see another desktop environment in action. Anyone keen presenting Cutefish DE next Monday? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Google says you can now turn these 400 Macs, PCs into reliable Chromebooks
by Peter Reutemann 18 Jul '22

18 Jul '22

'Google today announced in a blog post that ChromeOS Flex, a version of its Chromebook operating system suitable for most hardware, has moved from early access to general availability. It also said it certified "over 400" devices, including systems from Apple, Dell, and HP, to run the OS smoothly and stably. Google announced ChromeOS Flex in February, building upon its 2020 acquisition of CloudReady (CloudReady becomes ChromeOS Flex now that the latter is stable). Cloud OS Flex is downloadable to a USB drive for free, allowing you to install it on a Mac or Windows PC. The most obvious use for ChromeOS Flex is to bring new life to a dated machine that may be too old to get software updates for its native OS. Our ChromeOS Flex beta review found the OS to be an interesting alternative for people content with doing most of their computing in a browser and for getting a budget-level Chromebook experience from an 8-to 9-year-old system.' -- source: https://arstechnica.com/gadgets/2022/07/google-says-you-can-now-turn-these-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android 13 marches toward release with final beta version
by Peter Reutemann 18 Jul '22

18 Jul '22

'Google is quickly marching toward the next release of Android. The company announced the "final" Android 13 beta yesterday, beta 4, with word that an official release is "coming in the weeks ahead." After the massive overhaul of Android 12, Android 13 seems to be a smaller release focusing on various improvements and tablet features. A lot of Android 13 is building on the work from Android 12 and the tablet-focused mini-release, Android 12L. There are more Material You color options and more tweaks to the new notification media player. The tablet interface has a new app-drawer button for the taskbar and split-screen drag-and-drop support for notifications. You get more control over apps with a foreground app task manager and a new permission that requires apps to ask for notification access. Under the hood there is some serious virtualization power and support for Bluetooth LE Audio. There's even finally a standard QR Code reader now.' -- source: https://arstechnica.com/gadgets/2022/07/android-13-marches-toward-release-w… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

techradar: "I've started using Mozilla Firefox and now I can never go back to Google Chrome"
by Peter Reutemann 18 Jul '22

18 Jul '22

'The year is 2008 and I had been using Mozilla Firefox for two years after my painful but inevitable breakup with Internet Explorer. But, out of school and professional necessity, I had to make the switch to Google Chrome. For the most part, it worked out for me. It had features that Firefox at the time didn’t, like being able to sync and access tabs from other devices or saving all my bookmarks under a single profile that I could transfer to other PCs. Then over the years, Google became more invasive. It, like many other major corporations, started tracking and compiling data and creating detailed profiles that it could sell to marketing firms. Lucrative business for them, but a nail in the coffin for internet privacy. The other nail is the fact that Chrome’s market share has absolutely skyrocketed during this period of time. Back in 2008 when I first made the switch, Google and Mozilla weren’t too far apart but now, thanks to most other browsers using some form of Chromium to power them, the gap might as well be an ocean. But I’m here to tell you that it doesn’t have to be that way. I finally switched back to Mozilla Firefox in 2019 and found it to be an incredible browser that had every feature Chrome had and more.' -- source: https://www.techradar.com/in/features/ive-started-using-mozilla-firefox-and… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1