March 2023 - wlug - list.wlug.org.nz

Google Pixel Bug Lets You 'Uncrop' the Last Four Years of Screenshots
by Peter Reutemann 25 Mar '23

25 Mar '23

'Ars Technica: Back in 2018, Pixel phones gained a built-in screenshot editor called "Markup" with the release of Android 9.0 Pie. The tool pops up whenever you take a screenshot, and tapping the app's pen icon gives you access to tools like crop and a few colored drawing pens. That's very handy assuming Google's Markup tool actually does what it says, but a new vulnerability points out the edits made by this tool weren't actually destructive! It's possible to uncrop or unredact Pixel screenshots taken during the past four years. The bug was discovered by Simon Aarons and is dubbed "Acropalypse," or more formally CVE-2023-21036. There's a proof-of-concept app that can unredact Pixel screenshots at acropalypse.app, and it works! There's also a good technical write-up here by Aarons' collaborator, David Buchanan. The basic gist of the problem is that Google's screenshot editor overwrites the original screenshot file with your new edited screenshot, but it does not truncate or recompress that file in any way. If your edited screenshot has a smaller file size than the original -- that's very easy to do with the crop tool -- you end up with a PNG with a bunch of hidden junk data at the end of it. That junk data is made up of the end bits of your original screenshot, and it's actually possible to recover that data. While the bug was fixed in the March 2023 security update for Pixel devices, it doesn't solve the problem, notes Ars. "There's still the matter of the last four years of Pixel screenshots that are out there and possibly full of hidden data that people didn't realize they were sharing."' -- source: https://it.slashdot.org/story/23/03/20/2034220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

GitHub.com Rotates Its Exposed Private SSH Key
by Peter Reutemann 25 Mar '23

25 Mar '23

'GitHub has rotated its private SSH key for GitHub.com after the secret was was accidentally published in a public GitHub repository. BleepingComputer reports: The software development and version control service says, the private RSA key was only "briefly" exposed, but that it took action out of "an abundance of caution." In a succinct blog post published today, GitHub acknowledged discovering this week that the RSA SSH private key for GitHub.com had been ephemerally exposed in a public GitHub repository. "We immediately acted to contain the exposure and began investigating to understand the root cause and impact," writes Mike Hanley, GitHub's Chief Security Officer and SVP of Engineering. "We have now completed the key replacement, and users will see the change propagate over the next thirty minutes. Some users may have noticed that the new key was briefly present beginning around 02:30 UTC during preparations for this change." As some may notice, only GitHub.com's RSA SSH key has been impacted and replaced. No change is required for ECDSA or Ed25519 users.' -- source: https://it.slashdot.org/story/23/03/24/2138222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Bard Says It’s Already A Goner
by Lawrence D'Oliveiro 23 Mar '23

23 Mar '23

Amid all the various AI-related titbits in this article <https://www.theregister.com/2023/03/21/google_bard_ai/> is a link to a Twitter thread where someone asked Google Bard (Google’s answer to ChatGPT) to predict when it is likely to join the ever-growing list of dead Google projects. And it said it is already dead <https://twitter.com/juanbuis/status/1638289186351456257>, and even gave detailed reasons why it was a failure, including lack of user adoption, lack of innovation and lack of resources. Seems the AI managed to pick up a posting on YCombinator predicting it would be shut down in a year’s time, and somehow interpreted it as a news item referring to the present time.

1 0

GNOME 44 Released
by Peter Reutemann 23 Mar '23

23 Mar '23

'"9to5Linux.com reports that the GNOME 44 desktop environment is officially released and gives a detailed look at the major new features and improvements," writes Slashdot reader prisoninmate. From the report: Code-named "Kuala Lumpur" in recognition of the work done by the organizers of GNOME.Asia Summit 2022 conference, GNOME 44 introduces a GTK4 port of the Epihaphy (GNOME Web) web browser, a file chooser grid view for apps that use the standard GTK file chooser, as well as support for adding a WireGuard VPN directly from the Network panel. GNOME 44 continues to improve the Quick Settings feature introduced in GNOME 43 by implementing a submenu to the Bluetooth button to more easily and quickly connect or disconnect peripherals, adding descriptions to buttons to easily see their status, and implementing a new feature called Background Apps via a new background monitoring service in XDG portals 1.16.0." A full list of changes are available in the official release notes. The GNOME project also published a launch video on YouTube.' -- source: https://tech.slashdot.org/story/23/03/22/2211217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Launches a New Startup Focused on 'Trustworthy' AI
by Peter Reutemann 23 Mar '23

23 Mar '23

'On the eve of its 25th anniversary, Mozilla, the not-for-profit behind the Firefox browser, is launching an AI-focused startup. From a report: Called Mozilla.ai, the newly forged company's mission isn't to build just any AI -- its mission is to build AI that's open source and "trustworthy," according to Mark Surman, the executive president of Mozilla and the head of Mozilla.ai. "Working on trustworthy AI for almost five years, I've constantly felt a mix of excitement and anxiety," he told TechCrunch in an email interview. "The last month or two of rapid-fire big tech AI announcements has been no different. Really exciting new tech is emerging -- new tools that have immediately sparked artists, founders ... all kinds of people to do new things. The anxiety comes when you realize almost no one is looking at the guardrails." Surman was referring to the rash of AI models in recent months that, while impressive in their capabilities, have worrisome real-world implications. At release, OpenAI's text-generating ChatGPT could be prompted to write malware, identify exploits in open source code and create phishing websites that looked similar to well-trafficked sites. Text-to-image AI like Stable Diffusion, meanwhile, has been co-opted to create pornographic, nonconsensual deepfakes and ultra-graphic depictions of violence. The creators of these models say that they're taking steps to curb abuse. But Mozilla felt that not enough was being done. "We've been working on trustworthy AI on the public interest research side for about five years, hoping other industry players with more AI expertise would step up to build more trustworthy tech," Surman said. "They haven't. So we decided mid-last year we needed to do it ourselves -- and to find like-minded partners to do it alongside us. We then set out to find someone with the right mix of academic and industry AI experience to lead it." Funded by a $30 million seed investment from the Mozilla Foundation, Mozilla's parent organization, Mozilla.ai is a wholly owned subsidiary of the Mozilla Foundation -- much like the Mozilla Corporation (the org responsible for developing Firefox) and Mozilla Ventures (the Mozilla Foundation's VC fund). Its managing director is Moez Draief, who previously was the chief scientist at Huawei's Noah's Ark AI lab and the global chief scientist at consulting company Capgemini.' -- source: https://tech.slashdot.org/story/23/03/22/1510255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Russian Developers Blocked From Contributing To FOSS Tools
by Peter Reutemann 22 Mar '23

22 Mar '23

'The Reg has seen two recent incidents of Russian developers being blocked from public development of FOSS code. One was a refusal on the Linux kernel mailing list, the other a more general block on Github. In the last week, these events have both caused active, and sometimes heated, discussions in FOSS developer communities. From the report: The GitHub account of developer Alexander Amelkin has been blocked, and his repositories marked as "archived" â" including ipmitool, whose README describes it as "a utility for managing and configuring devices that support the Intelligent Platform Management Interface." Unable to comment on Github itself, Amelkin described what happened on the project's older Soureforge page. Amelkin works for Russian chipbuilder Yadro, which we described as working on RISC-V chips back in 2021. Microsoft is just obeying US law in this: according to the War and Sanctions database of the Ukrainian National Agency on Corruption Prevention, the NACP, Yadro is a sanctioned company. However, on LinkedIn, Amelkin disputes his employer's involvement. Over on Hacker News, commentators seem to be generally in favor of the move, although the discussion on LWN is more measured, pointing out both that there is little threat from server-management tools like this, but that Microsoft probably has no choice. Amelkin is not alone. Over on the Linux Kernel Mailing List, a contribution from Sergey Semin has been refused with the terse notice: "We don't feel comfortable accepting patches from or relating to hardware produced by your organization. Please withhold networking contributions until further notice." Semin is a developer at chipmaker Baikal Electronics, a company whose website has been suspended for a year now, as we noted a year ago in a story that also mentions Yadro. We were reporting on Baikal's efforts to develop its own CPUs nearly a decade ago, mere months after the Russian annexation of Crimea. And once again, there is spirited debate over the move on the Orange Site. ' -- source: https://news.slashdot.org/story/23/03/21/2126227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ASUS Unveils the Tinker V As Their First RISC-V Board
by Peter Reutemann 21 Mar '23

21 Mar '23

'Phoronix: For over a half-decade ASUS has been selling the Tinker Board devices as their line of Raspberry Pi alternatives. To date the ASUS Tinker Board single board computers have all been Arm-based while now they have launched their first RISC-V board, the Tinker V. The ASUS Tinker V is their first RISC-V single board computer and intended for the industrial IoT (Internet of Things) developer community. The ASUS Tinker V is set to officially run Debian Linux and Yocto while surely with time more Linux distributions will be supported.... Being IoT focused, there isn't any display support. Those interested in learning more about the ASUS Tinker V can do so via tinker-board.asus.com. The Register notes that Asus "is offering at least five years of support for Tinker V... Dedicated on-site technical support is also available to shorten customer development cycles and accelerate application deployment." The move shows that the RISC-V open-source instruction set architecture continues to garner support. The last RISC-V Summit in San Jose saw the launch of a family of datacenter-class processors based on the architecture from Ventana Micro Systems, while XMOS unveiled new high-performance microcontrollers using RISC-V. According to Asus, Tinker V samples will be available in Q2 of this year, but it did not disclose a date for full availability or pricing.' -- source: https://hardware.slashdot.org/story/23/03/20/0034207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Question please re: How to attach an Android (Samsung cellphone Galaxy A03S) photo to a Gmail email using Firefox and Ubuntu
by Michael James 20 Mar '23

20 Mar '23

G'day... Can anyone please suggest how to attach a photo - (from a Samsung Galaxy A03S cellphone via USB cable from the phone to a desktop) - onto a Gmail email using Firefox and running Ubuntu. Have tried connecting the phone via USB to the desktop and clicking the attach button on the email and double clicking the file in the Ubuntu Files folder under the Activities heading. This does not work. I tried both right and left mouse options and the 'OPEN' option; I also tried copying the file (photo) to downloads and attempted to attach via the same above pathway but this did not work either. I came across this post (below) on the internet from 2010 with the same question and the following answer: https://superuser.com/questions/132783/how-to-email-photo-from-ubuntu-f-spo… I'm not familiar with Python code and wonder if this answer is now outdated? Wondering if the problem is with Firefox? Gmail is running fine on Ubuntu with Firefox, it's just the attaching of photos from the Android that's giving trouble. Short of using the phone itself or Thunderbird or any other email service to send the photo, is there a way to attach photos to Gmail emails via Firefox running on Ubuntu please? Thanks, Michael James __________________________________________________________________________________________

2 2

Google tells users of some Android phones: Nuke voice calling to avoid infection
by Peter Reutemann 20 Mar '23

20 Mar '23

'Google is urging owners of certain Android phones to take urgent action to protect themselves from critical vulnerabilities that give skilled hackers the ability to surreptitiously compromise their devices by making a specially crafted call to their number. It’s not clear if all actions urged are even possible, however, and even if they are, the measures will neuter devices of most voice-calling capabilities. The vulnerability affects Android devices that use the Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, Exynos Auto T5123 chipsets made by Samsung’s semiconductor division. Vulnerable devices include the Pixel 6 and 7, international versions of the Samsung Galaxy S22, various mid-range Samsung phones, the Galaxy Watch 4 and 5, and cars with the Exynos Auto T5123 chip. These devices are ONLY vulnerable if they run the Exynos chipset, which includes the baseband that processes signals for voice calls. The US version of the Galaxy S22 runs a Qualcomm Snapdragon chip. A bug tracked as CVE-2023-24033 and three others that have yet to receive a CVE designation make it possible for hackers to execute malicious code, Google’s Project Zero vulnerability team reported on Thursday. Code-execution bugs in the baseband can be especially critical because the chips are endowed with root-level system privileges to ensure voice calls work reliably.' -- source: https://arstechnica.com/information-technology/2023/03/critical-vulnerabili… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Unix Pioneer Ken Thompson Announces He's Switching From Mac To Linux
by Peter Reutemann 20 Mar '23

20 Mar '23

'The closing keynote at the SCaLE 20x conference was delivered by 80-year-old Ken Thompson (co-creator of Unix, Plan9, UTF8, and the Go programming language). Slashdot reader motang shared Thompson answer to a question at the end about what operating system he uses today: I have, for most of my life — because I was sort of born into it — run Apple. Now recently, meaning within the last five years, I've become more and more depressed, and what Apple is doing to something that should allow you to work is just atrocious. But they are taking a lot of space and time to do it, so it's okay. And I have come, within the last month or two, to say, even though I've invested, you know, a zillion years in Apple — I'm throwing it away. And I'm going to Linux. To Raspbian in particular. ' -- source: https://apple.slashdot.org/story/23/03/18/237211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0