August 2022 - wlug - list.wlug.org.nz

Google's Fuchsia OS is Taking Over Smart Displays, Now on Its Second Device
by Peter Reutemann 26 Aug '22

26 Aug '22

'The kingdom of Google's third major operating system, Fuchsia, is growing a little wider today. ArsTechnica: 9to5Google reports Google completed the rollout of Fuchsia to the Google Nest Hub Max. Along with the original Nest Hub/Google Home Hub, that puts two of Google's three smart displays on the new OS, with the one holdout being the 2nd Gen Nest Hub. The Nest Hub Max is the first device running Fuchsia that Google is currently selling -- the Home Hub only got Fuchsia after it had been discontinued. The Google smart display user interface is written in Flutter, a Google programming language designed for portability, which runs on Android, iOS, Fuchsia, and the weird cast platform Nest Hubs typically use. So it's not right to describe the user interface as "similar" after the OS swap -- it's the exact same code because Flutter runs on nearly everything. You are getting a slightly newer code version, though, and it comes with a Bluetooth menu. If you dive into the settings and hit "about device," you'll see a "Fuchsia Version" field that will say something like "6.20211109.1.3166243." It's a bit weird to do an entire OS switch to the futuristic, secretive Fuchsia project and then have basically nothing to show (or say) for it in terms of obvious improvements in performance or security. You can dive into the minutia of the Fuchsia source code, but it continues to be a mystery in terms of what practical benefits it offers consumers. Google never talks about Fuchsia, so not much is known about what, exactly, Google is accomplishing here.' -- source: https://tech.slashdot.org/story/22/08/25/1856206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linux 6.1 Will Make It A Bit Easier To Help Spot Faulty CPUs
by Peter Reutemann 26 Aug '22

26 Aug '22

'While mostly of benefit to server administrators with large fleets of hardware, Linux 6.1 aims to make it easier to help spot problematic CPUs/cores by reporting the likely socket and core when a segmentation fault occurs, which can help in spotting any trends if routinely finding the same CPU/core is causing problems. Queued up now in TIP's x86/cpu branch for the Linux 6.1 merge window in October is a patch to print the likely CPU at segmentation fault time. Printing the likely CPU core and socket when a seg fault occurs can be beneficial if routinely finding seg faults happening on the same CPU package or particular core.' -- source: https://linux.slashdot.org/story/22/08/25/1841209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DuckDuckGo now offers anti-tracking email service to everyone
by Peter Reutemann 26 Aug '22

26 Aug '22

'DuckDuckGo's tracker-removing email service, which has been available in private beta for a year, is now open to anyone who uses a DuckDuckGo mobile app, browser extension, or Mac browser. It has also added a few more privacy tools. The service provides you a duck.com email address, one intended to be given out for the kind of "Subscribe to our newsletter for 20 percent off" emails you know exist only to harvest data and target you for ads. Email sent to your duck.com address forwards to your chosen primary email—but with trackers removed. Email Protection now also fixes up links, strips them of tracking modifiers, upgrades unencrypted HTTP URLs to HTTPS where possible, and, for the rare necessary reply, allows you to send directly from your duck address instead of exposing your primary email. During their closed beta, DuckDuckGo claims that 85 percent of the emails it processed contained hidden trackers.' -- source: https://arstechnica.com/gadgets/2022/08/duckduckgo-now-offers-anti-tracking… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Experts Warn of Widespread Exploitation Involving Hikvision Cameras
by Peter Reutemann 25 Aug '22

25 Aug '22

'Both government and criminal hacking groups are still targeting Hikvision cameras with a vulnerability from 2021, according to reports from several security researchers. From a report: Cybersecurity firm CYFIRMA released a report this week saying Russian cybercriminal forums are awash with hackers looking to collaborate on exploiting Hikvision cameras using the command injection vulnerability CVE-2021-36260. "Specifically in the Russian forums, we have observed leaked credentials of Hikvision camera products available for sale," the company's researchers said. "These can be leveraged by hackers to gain access to the devices and exploit further the path of attack to target an organization's environment." CYFIRMA reported they found that more than 80,000 Hikvision cameras are still vulnerable to the critical command injection flaw, which carries a CVSS score of 9.8 out of 10. Of the more than 80,000 vulnerable cameras, more than 100 nations and 2,300 organizations are impacted.' -- source: https://tech.slashdot.org/story/22/08/24/1856244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FSearch 0.2 File Search Utility Removes Snap Support
by Peter Reutemann 24 Aug '22

24 Aug '22

Since we were discussing find during this week's meeting, I thought some of you might be interested in this post: 'FSearch, the GTK-based lightning-fast file search tool, now has a new version, 0.2, that significantly improves its functionality. Many Linux users believe the only options for searching for files are those built into the operating system. Of course, the ‘find’ command or the file search capability provided by the file manager does an excellent job. But what if you could go to the next level using a handy graphical tool that searches for files at the speed of light? Meet FSearch. FSearch is an open-source standalone file search utility based on GTK3 inspired by Everything Search Engine. Because it is written in C, FSearch offers incredibly fast search speed, which is the application’s main advantage.' -- source: https://linuxiac.com/fsearch-0-2-file-search-utility/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Can You Ban Source Code?
by Lawrence D'Oliveiro 24 Aug '22

24 Aug '22

Let me see if I understand what’s going on here <https://www.theregister.com/2022/08/24/github_eff_tornado_cash/>: * “Tornado Cash” is a cryptocurrency “mixing” service. This takes input cryptocoins and outputs the same value again, but in a mix of different cryptocoins that makes it harder to trace where the input came from. * Tornado Cash is also the name of the open-source software written to implement this service. * The US Treasury Department’s Office of Foreign Assets Control has designated the Tornado Cash service as an illegal money-laundering operation. It also appears the principal developers (of the service and the software) are wanted internationally by financial crime investigators, and one has already been arrested. * Presumably in response to this, GitHub has shut down the accounts of those developers, and also removed the original Tornado Cash source code repo. * However, it’s not clear that GitHub was legally obliged to do any of this -- did the OFAC sanctions include the source code as well? Or were they contravening the GitHub terms and conditions somehow--if so, which one(s)? * In any case, lots of other copies of the Tornado Cash source code remain available on GitHub, untouched. And no doubt there are copies elsewhere.

1 0

Unix legend, who owes us nothing, keeps fixing foundational AWK code
by Peter Reutemann 24 Aug '22

24 Aug '22

'A Princeton professor, finding a little time for himself in the summer academic lull, emailed an old friend a couple months ago. Brian Kernighan said hello, asked how their US visit was going, and dropped off hundreds of lines of code that could add Unicode support for AWK, the text-parsing tool he helped create for Unix at Bell Labs in 1977. "I have tested this a fair amount but clearly more tests are needed," Kernighan wrote in the email, posted in late May as a kind of pseudo-commit on the onetrueawk repo by longtime maintainer Arnold Robbins. "Once I figure out how ... I will try to submit a pull request. I wish I understood git better, but in spite of your help, I still don't have a proper understanding, so this may take a while."' -- source: https://arstechnica.com/gadgets/2022/08/unix-legend-who-owes-us-nothing-kee… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Lightweight Linux laptop crams a 99 Wh battery inside
by Peter Reutemann 24 Aug '22

24 Aug '22

'Ultralight laptops are great for slipping into a bag and traveling with, and they look pretty stylish. However, a trim build often comes with trade-offs. Battery capacity is a common one, as companies struggle to fit larger batteries into machines that are under an inch thick. German PC-maker Tuxedo Computers' latest ultralight InfinityBook Pro 14 seeks to address that challenge with a massive battery. The InfinityBook Pro 14 - Gen7 announced today comes with either big storage or a big battery. The company is selling it with the option for a 99 watt-hour (Wh) battery, which is about as big as a lithium battery can be while being allowed on an airplane (100 Wh).' -- source: https://arstechnica.com/gadgets/2022/08/lightweight-linux-laptop-crams-a-99… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hyundai Uses Example Keys For Encryption System
by Peter Reutemann 23 Aug '22

23 Aug '22

'"Hyundai predictably fails in attempting to secure their car infotainment system with a default key lifted from programming examples," writes Slashdot reader sinij. "This level of security is unfortunately expected from auto manufacturers, who also would like to sell you always-connected Car2Car self-driving automobiles." Cryptographer and security experience Bruce Schneier writes: "Turns out the [AES] encryption key in that script is the first AES 128-bit CBC example key listed in the NIST document SP800-38A [PDF]," writes an unidentified developer under the name "greenluigi1." Luck held out, in a way. "Greenluigi1" found within the firmware image the RSA public key used by the updater, and searched online for a portion of that key. The search results pointed to a common public key that shows up in online tutorials like "RSA Encryption & Decryption Example with OpenSSL in C." Two questions remain: 1.) How did the test key get left behind? 2) Was it by accident or design?' -- source: https://it.slashdot.org/story/22/08/22/227245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday
by Peter Reutemann 23 Aug '22

23 Aug '22

Hi everyone We have a meeting next Monday with the following topic: "Command-line tools under Linux are the bread and butter of sysadmins, but any user can benefit from a wide variety of hidden gems. In this meetup, we will explore essential command-line tools that one should be aware of. Please join us if you would like to learn about them or even demo your personal set of useful tools!" Details: https://www.meetup.com/waikatolinuxusersgroup/events/283776695/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 3