September 2023 - wlug - list.wlug.org.nz

Weta Digital’s Technology Division Sold To US Firm
by Lawrence D'Oliveiro 01 Aug '25

01 Aug '25

Let me see if I understand this article <https://www.nzherald.co.nz/business/sir-peter-jackson-to-sell-weta-digital-…> correctly: the part of Weta Digital that used to develop the in-house 3D graphics/effects tools that they use in all those movies is being sold to US-based Unity Software. The part that is left will be called “WetaFX”, and will become a customer of Unity for the use of those tools, no longer doing its own development in-house. By the way, I’ve been looking at the Unity site <https://unity.com/>, and it looks like all their products are rentware (subscription-based).

1 2

List Of IPTV Resources
by Lawrence D'Oliveiro 22 Sep '24

22 Sep '24

This user <https://github.com/iptv-org> just popped up in my GitHub feed. One repo <https://github.com/iptv-org/iptv> claims to be a list of links to over 8000 streaming TV channels from nations all over the world, while the other is a list of tools*, providers and other resources. Do be aware it’s a bit of a mixed bag: yes, there are legitimate channels (no encryption so far that I have noticed), but also some dubious-looking links. *Oddly, FFmpeg and youtube-dl aren’t in the list.

2 5

Enabling Case-Insensitive Filenames On Linux
by Lawrence D'Oliveiro 06 Feb '24

06 Feb '24

The ext4 filesystem has had the “casefold” option for a while now <https://lwn.net/Articles/784041/>. This allows you to specify, when you initialize a new filesystem, that you want file/directory names to be treated as case-insensitive. At the same time, you have to specify that the filenames are to be interpreted as UTF-8 encoding; normally the kernel doesn’t care, it only singles out ASCII slash and NUL bytes for special interpretation, and simply passes through any other byte values in the names. I was able to create such a filesystem, but I wasn’t able to mount it in my last-upgraded-just-a-few-days-ago Debian Unstable setup. When I try, it fails, and in the dmesg log I see Filesystem with casefold feature cannot be mounted without CONFIG_UNICODE Turns out the Debian 5.10 kernel has not been built with this CONFIG_UNICODE option enabled. However, this situation looks set to change shortly, according to <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985689>.

2 3

Lichee Pi 4A: Serious RISC-V Desktop Computing
by Lawrence D'Oliveiro 02 Oct '23

02 Oct '23

This video on Christopher Barnatt’s “Explaining Computers” channel <https://www.youtube.com/watch?v=1apoFXZ9ad8> just came across my feed. It’s an unboxing and initial review of a Sipeed Lichee Pi 4A, a RISC-V-based rival to the Raspberry Pi. Seems the RISC-V desktop ecosystem is approaching maturity rapidly; he was able to boot up the preinstalled Debian system and run included apps like LibreOffice, GIMP and Chromium just fine (albeit with some audio/video performance hiccups in the last one). He says in the video that he was going to spend a week trying to do all his computing on RISC-V machines, with a report on the results due out on Sunday UK time (I suppose Monday our time).

1 2

Vulnerabilities In Exim MTA
by Lawrence D'Oliveiro 30 Sep '23

30 Sep '23

This article <https://arstechnica.com/security/2023/09/critical-vulnerabilities-in-exim-t…> reports on six different security vulnerabilities in the Exim mail transfer agent (MTA), with uncertain status on their fixes. It seems like patches for three of them are available, but only in a private repo, with no clarification of who has access to this repo. Seems like there has been poor communication between Zero Day Initiative (the group that discovered the vulnerabilities) and the Exim project, going back over a year, on these issues. An MTA is the piece of software that receives mail from other machines for users on the local machine (or on other, related machines that it is responsible for), and also forwards mail sent from local users, destined for users on other machines. Exim is the default MTA you get on a Debian installation, if you don’t choose something else (e.g. Postfix). Not sure about Debian derivatives.

1 0

Raspberry Pi 5
by Lawrence D'Oliveiro 28 Sep '23

28 Sep '23

Just heard about the new-generation Raspberry Pi. Here’s a video about a prerelease unit <https://www.youtube.com/watch?v=9hYfQ7bRgZg> which I haven’t even watched yet.

1 0

Linux Interop Is Maturing Fast… Thanks To A Games Console
by Lawrence D'Oliveiro 28 Sep '23

28 Sep '23

Interesting report <https://www.theregister.com/2023/09/27/osseu_steam_os_3/> from the recent European Open Source Summit, about the work being done at Valve and others to improve the ability of the Linux-based Steam Deck handheld console to play games written for Microsoft Windows. And not just to have them playable, but to have them run well, with performance comparable to Microsoft Windows machines. The result, so far, is thousands of games that are usable on the Steam Deck. As a proportion of the total number of games, if I interpret the numbers on the protondb.com home page correctly, that’s 60%—or at least, 60% of games tried by those who submitted reports to the compatibility database. Which is a pretty respectable number. Not enough for world domination yet, but enough to keep the Steam Deck selling, by all accounts. Seems like issues with graphics APIs are not the main problem any more. Now there is a new one: thread/process communication/synchronization primitives. Windows doesn’t use the POSIX/Linux ones, it has a whole set of its own ones, with their own peculiar behaviours. The WINE folks have made a valiant effort to map these onto Linux APIs, but their compatibility layer cannot avoid becoming a performance bottleneck, and it appears this has become a problem for a lot of games. So now there are proposals to add new features to the Linux kernel specifically to make it easier to emulate these idiosyncratic Windows APIs.

1 0

Google quietly corrects previously submitted disclosure for critical webp 0-day
by Peter Reutemann 27 Sep '23

27 Sep '23

'Google has quietly resubmitted a disclosure of a critical code-execution vulnerability affecting thousands of individual apps and software frameworks after its previous submission left readers with the mistaken impression that the threat affected only the Chrome browser. The vulnerability originates in the libwebp code library, which Google created in 2010 for rendering images in webp, a then new format that resulted in files that were up to 26 percent smaller as compared to PNG images. Libwebp is incorporated into just about every app, operating system, or other code library that renders webp images, most notably the Electron framework used in Chrome and many other apps that run on both desktop and mobile devices. Two weeks ago, Google issued a security advisory for what it said was a heap buffer overflow in WebP in Chrome. Google’s formal description, tracked as CVE-2023-4863, scoped the affected vendor as “Google” and the software affected as “Chrome,” even though any code that used libwebp was vulnerable. Critics warned that Google’s failure to note that thousands of other pieces of code were also vulnerable would result in unnecessary delays in patching the vulnerability, which allows attackers to execute malicious code when users do nothing more than view a booby-trapped webp image. On Monday, Google submitted a new disclosure that’s tracked as CVE-2023-5129. The new entry correctly lists libwebp as the affected vendor and affected software. It also bumps up the severity rating of the vulnerability, from 8.8 out of a possible 10 to 10.' -- source: https://arstechnica.com/security/2023/09/google-quietly-corrects-previously… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GPUs From All Major Suppliers Are Vulnerable To New Pixel-Stealing Attack
by Peter Reutemann 27 Sep '23

27 Sep '23

'Ars Technica: GPUs from all six of the major suppliers are vulnerable to a newly discovered attack that allows malicious websites to read the usernames, passwords, and other sensitive visual data displayed by other websites, researchers have demonstrated in a paper (PDF) published Tuesday. The cross-origin attack allows a malicious website from one domain -- say, example.com -- to effectively read the pixels displayed by a website from example.org, or another different domain. Attackers can then reconstruct them in a way that allows them to view the words or images displayed by the latter site. This leakage violates a critical security principle that forms one of the most fundamental security boundaries safeguarding the Internet. Known as the same origin policy, it mandates that content hosted on one website domain be isolated from all other website domains. [...] GPU.zip works only when the malicious attacker website is loaded into Chrome or Edge. The reason: For the attack to work, the browser must: 1. allow cross-origin iframes to be loaded with cookies 2. allow rendering SVG filters on iframes and 3. delegate rendering tasks to the GPU For now, GPU.zip is more of a curiosity than a real threat, but that assumes that Web developers properly restrict sensitive pages from being embedded by cross-origin websites. End users who want to check if a page has such restrictions in place should look for the X-Frame-Options or Content-Security-Policy headers in the source. "This is impactful research on how hardware works," a Google representative said in a statement. "Widely adopted headers can prevent sites from being embedded, which prevents this attack, and sites using the default SameSite=Lax cookie behavior receive significant mitigation against personalized data being leaked. These protections, along with the difficulty and time required to exploit this behavior, significantly mitigate the threat to everyday users. We are in communication and are actively engaging with the reporting researchers. We are always looking to further improve protections for Chrome users." An Intel representative, meanwhile, said that the chipmaker has "assessed the researcher findings that were provided and determined the root cause is not in our GPUs but in third-party software." A Qualcomm representative said "the issue isn't in our threat model as it more directly affects the browser and can be resolved by the browser application if warranted, so no changes are currently planned." Apple, Nvidia, AMD, and ARM didn't comment on the findings. ' -- source: https://it.slashdot.org/story/23/09/26/2031222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux's Multi-Grain Timestamps Short-Lived: Removed From The Kernel After A Few Weeks
by Peter Reutemann 26 Sep '23

26 Sep '23

'Phoronix: One of the new features merged for the Linux 6.6 kernel was multi-grained timestamps for the VFS layer and wiring it up for the EXT4, Btrfs, XFS, and Tmpfs file-systems. This alternative though to coarse-grained timestamps ended up exposing some problems and this week ahead of Linux 6.6-rc3, the feature has been stripped entirely from the kernel. Multi-grain timestamps were intended for addressing cases where the current coarse-grained timestamps can be ineffective for updating creation/modification times with a lot of I/O potentially happening within the once per jiffy timestamp... Multi-grained timestamps though were only to be selectively enabled to avoid the performance overhead. Christian Brauner of Microsoft who originally submitted the feature for Linux 6.6 went ahead and submitted the pull request, which has already been honored, for dropping the short-lived kernel feature... "As there are multiple solutions discussed the honest thing to do here is not to fix this up or disable it but to cleanly revert. The general infrastructure will probably come back but there is no reason to keep this code in mainline." ' -- source: https://linux.slashdot.org/story/23/09/25/009244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Developer Creates 'Dark Style' GNOME Extension for Ubuntu 23.10
by Peter Reutemann 25 Sep '23

25 Sep '23

'In GNOME Shell there's a dark background for the Quick Settings menu, the calendar applet, and desktop notification-- but in Ubuntu 23.10, "the default Yaru theme uses a light style for GNOME Shell elements," according to the blog OMG Ubuntu. "But there's a new GNOME extension that lets you change this without affecting the rest of your desktop..." You can make GNOME Shell dark in Ubuntu by turning the 'Dark Style' toggle on but that also makes apps use a dark theme too. Not everyone wants that; they want a 'mixed' look... [I]f you would like to use dark GNOME Shell elements in Ubuntu 23.10 without using the dark mode preference (which, as said, will turn your apps dark too) then the Dark Style GNOME extension is exactly what you need. It only works with Ubuntu 23.10 and GNOME 45.' -- source: https://tech.slashdot.org/story/23/09/24/2317206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android phones get PC webcam capabilities in the latest beta
by Peter Reutemann 25 Sep '23

25 Sep '23

'Here's a fun new use for your Android phone: A PC webcam! In the latest Android beta, plugging a phone into a PC will reveal a new option in the USB Preferences menu for webcam functionality. Just pick that option instead of the default "file transfer," and the phone camera will register itself as a webcam. Then you can fire up Zoom and start video calling. The Android build with this feature is "Android 14 QPR1 Beta 1." Android's getting confusing with all these overlapping betas, but the current stable version is still Android 13. Android 14, currently on its 10th beta/developer preview, will most likely be out alongside the Pixel 8 in October. Android 14 QPR1 is the quarterly release after the first stable build of Android 14, and it should be out around December. (QPR stands for quarterly platform release.) These happen between major releases, often marketed as "feature drops." Right now, Android 13 is technically "Android 13 QPR3."' -- source: https://arstechnica.com/gadgets/2023/09/android-phones-get-pc-webcam-capabi… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Behind the Scenes at 'Have I Been Pwned'
by Peter Reutemann 25 Sep '23

25 Sep '23

'The founder of the data-breach notification site Have I Been Pwned manages "the largest known repository of stolen data on the planet," reports Australia's public broadcaster ABC, including over 6 billion email address. Yet with no employees, Troy Hunt manages all of the technical and operational aspects single-handedly, and "has ended up playing an oddly central role in global cybersecurity." Troy is very careful with how he handles what he finds. He only collects (and encrypts) the mobile numbers, emails and passwords that he finds in the breaches, discarding the victims' names, physical addresses, bank details and other sensitive information. The idea is to let users find out where their data has been leaked from, but without exposing them to further risk. Once he identifies where a data breach has occurred, Troy also contacts the organisation responsible to allow it to inform its users before he does. This, he says, is often the hardest step of the process because he has to convince them it's legitimate and not some kind of scam itself. He's not required to give organisations this opportunity, much less persist when they ignore his messages or accuse him of trying to shake them down for money. But there's evidence that this approach is working. Despite the legal grey area he has operated in for a decade now, he's avoided being sued by any of the organisations responsible for the 705 breaches that are now searchable on Have I Been Pwned. These days, major tech companies like Mozilla and 1Password use Have I Been Pwned, and Troy likes to point out that dozens of national governments and law enforcement agencies also partner with his service... "He's not a company that's audited. He's just a dude on the web," says Jane Andrew, an expert on data breaches at the University of Sydney. "I think it's so shocking that this is where we find out information about ourselves. She says governments and law enforcement have, in general, left it to individuals to deal with the fallout from data breaches... Without an effective global regulator, Professor Andrew says, a crucial part of the world's cybersecurity infrastructure is left to rely on the goodwill of this one man on the Gold Coast.' -- source: https://it.slashdot.org/story/23/09/24/201233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

LMDE-5 download
by john 24 Sep '23

24 Sep '23

I recently decided to try LMDE-5 Mate version. I found all my usual download sources were returning a 404 error, Checked again at 9.35am https://blog.linuxmint.com/?p=4281 Has this been pulled for some reason??

2 1

Linux gives up on 6-year LTS kernels, says they’re too much work
by Peter Reutemann 21 Sep '23

21 Sep '23

'The LTS (long-term support) period for the Linux kernel is being cut down. In 2017, the kernel jumped from two years of support to six. Now, six years later, it turns out that's a lot of work. ZDNet reports that at the Open Source Summit Europe this week (videos will be out in a few weeks), Linux Weekly News executive editor Jonathan Corbet announced the Linux kernel will return to two years of LTS support. The plan to cut back down to two years isn't instant. The Linux community is still honoring the current end-of-life timelines, so 6.1, 5.15, 5.10, 5.4, 4.19, and 4.14 are still six years, but new kernels will only get two years. Even this six-year window was supposed to be an optional thing when it started, with the release page FAQ saying, "Each new longterm kernel usually starts with only a 2-year projected EOL that can be extended further if there is enough interest from the industry at large to help support it for a longer period of time." The reality was that everything received a six-year life span, and now that will no longer be the case. Corbet cited a mix of lack of use and a lack of support for why Linux is cutting back on LTS kernels. Corbet says, "There's really no point to maintaining [old kernels] for that long because people are not using them." The other big problem is the burnout from maintainers, which are often unpaid and could use a lot more support from the billion-dollar companies that benefit from using Linux.' -- source: https://arstechnica.com/gadgets/2023/09/linux-gives-up-on-6-year-lts-thats-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

The Signal Protocol used by 1+ billion people is getting a post-quantum makeover
by Peter Reutemann 21 Sep '23

21 Sep '23

'The Signal Foundation, maker of the Signal Protocol that encrypts messages sent by more than a billion people, has rolled out an update designed to prepare for a very real prospect that’s never far from the thoughts of just about every security engineer on the planet: the catastrophic fall of cryptographic protocols that secure some of the most sensitive secrets today. The Signal Protocol is a key ingredient in the Signal, Google RCS, and WhatsApp messengers, which collectively have more than 1 billion users. It’s the engine that provides end-to-end encryption, meaning messages encrypted with the apps can be decrypted only by the recipients and no one else, including the platforms enabling the service. Until now, the Signal Protocol encrypted messages and voice calls with X3DH, a specification based on a form of cryptography known as Elliptic Curve Diffie-Hellman. [...] There is little disagreement, however, that there will come a day when many of the most widely used forms of encryption will die at the hands of quantum computing. To head off that doomsday eventuality, engineers and mathematicians have been developing a new class of PQC, short for post-quantum cryptography. The PQC added to the Signal Protocol on Monday is called PQXDH. It uses the same X3DH specification the Signal Protocol has always employed. On top, it adds an additional layer of encryption using Crystals-Kyber, one of four PQC algorithms the National Institute of Standards and Technology selected last year as a potential replacement to ECC and other quantum-vulnerable forms of encryption.' -- source: https://arstechnica.com/security/2023/09/signal-preps-its-encryption-engine… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Terraform Fork Gets Renamed OpenTofu, Joins Linux Foundation
by Peter Reutemann 21 Sep '23

21 Sep '23

'TechCrunch: When HashiCorp announced it was changing its Terraform license in August, it set off a firestorm in the open source community, and actually represented an existential threat to startups that were built on top of the popular open source project. The community went into action and within weeks they had written a manifesto, and soon after that launched an official fork called OpenTF. Today, that group went a step further when the Linux Foundation announced OpenTofu, the official name for the Terraform fork, which will live forever under the auspices of the foundation as an open source project. At the same time, the project announced it would be applying for entry into the Cloud Native Computing Foundation (CNCF). "OpenTofu is an open and community-driven response to Terraform's recently announced license change from a Mozilla Public License v2.0 (MPLv2) to a Business Source License v1.1 providing everyone with a reliable, open source alternative under a neutral governance model," the foundation said in a statement. The name is deliberately playful says Yevgeniy (Jim) Brikman from the OpenTofu founding team, who is also co-founder of Gruntwork. "I'm glad your reaction was to laugh. That's a good thing. We're trying to keep things a little more humorous," Brikman told TechCrunch, but the group is dead serious when it comes to building an open fork. [...] "The first thing was to get an alpha release out there. So you can go to the OpenTofu website and download OpenTofu and start using it and trying it out," he said. "Then the next thing is a stable release. That's coming in the very near future, but there's work to do. Once you have a stable release, people can start using it. Then we can start growing adoption, and once we start growing adoption, some of the big players will start stepping in when some of the big players start stepping in other big players will start stepping in as well."' -- source: https://linux.slashdot.org/story/23/09/20/1951214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chinese hackers have unleashed a never-before-seen Linux backdoor
by Peter Reutemann 19 Sep '23

19 Sep '23

'Researchers have discovered a never-before-seen backdoor for Linux that’s being used by a threat actor linked to the Chinese government. The new backdoor originates from a Windows backdoor named Trochilus, which was first seen in 2015 by researchers from Arbor Networks, now known as Netscout. They said that Trochilus executed and ran only in memory, and the final payload never appeared on disks in most cases. That made the malware difficult to detect. Researchers from NHS Digital in the UK have said Trochilus was developed by APT10, an advanced persistent threat group linked to the Chinese government that also goes by the names Stone Panda and MenuPass. Other groups eventually used it, and its source code has been available on GitHub for more than six years. Trochilus has been seen being used in campaigns that used a separate piece of malware known as RedLeaves. In June, researchers from security firm Trend Micro found an encrypted binary file on a server known to be used by a group they had been tracking since 2021. By searching VirusTotal for the file name, libmonitor.so.2, the researchers located an executable Linux file named “mkmon”. This executable contained credentials that could be used to decrypt libmonitor.so.2 file and recover its original payload, leading the researchers to conclude that “mkmon” is an installation file that delivered and decrypted libmonitor.so.2. The Linux malware ported several functions found in Trochilus and combined them with a new Socket Secure (SOCKS) implementation. The Trend Micro researchers eventually named their discovery SprySOCKS, with “spry” denoting its swift behavior and the added SOCKS component. SprySOCKS implements the usual backdoor capabilities, including collecting system information, opening an interactive remote shell for controlling compromised systems, listing network connections, and creating a proxy based on the SOCKS protocol for uploading files and other data between the compromised system and the attacker-controlled command server.' -- source: https://arstechnica.com/security/2023/09/never-before-seen-linux-backdoor-i… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Linux Mint Debian Edition' Begins Public Beta Testing
by Peter Reutemann 18 Sep '23

18 Sep '23

'This week saw the public beta-testing release of "Linux Mint Debian Edition". Besides listing download locations, its release notes also list out the project's three goals: - Ensure Linux Mint would be able to continue to deliver the same user experience - See how much work would be involved if Ubuntu was ever to disappear. - Guarantee the software we develop is compatible outside of Ubuntu. 9to5Linux reports: Based on the Debian GNU/Linux 12 "Bookworm" operating system series, Linux Mint Debian Edition 6 is powered by the long-term supported Linux 6.1 LTS kernel series and features the latest Cinnamon 5.8 desktop environment that was introduced with the Linux Mint 21.2 "Victoria" release in July 2023â¦ [T]his release comes with a new look and feel thanks to newly added folder icons with different color variants, improved consistency of tooltips to look the same across different apps and desktops, support for symbolic icons that adapt to their background, and full support for HEIF and AVIF' -- source: https://linux.slashdot.org/story/23/09/16/2147219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

KSMBD Finally Reaches 'Stable' State in Release Candidate for Linux Kernel 6.6
by Peter Reutemann 18 Sep '23

18 Sep '23

'When Linus Torvalds announced Linux kernel 6.6's first release candidate, it included a newly-stable version of KSMBD, which is Samsung's in-kernel server for the SMB protocol (for sharing files/folders/printers over a network). An announcement in 2021 had said that "For many cases the current userspace server choices were suboptimal either due to memory footprint, performance or difficulty integrating well with advanced Linux features." LWN noted at the time that Linux has been using "the user-space Samba solution since shortly after the beginning." In a sense, ksmbd is not meant to compete with Samba; indeed, it has been developed in cooperation with the Samba project. It is, however, meant to be a more performant and focused solution than Samba is; at this point, Samba includes a great deal of functionality beyond simple file serving. Ksmbd claims significant performance improvements on a wide range of benchmarks...One other reason — which tends to be spoken rather more quietly — is that a new implementation can be licensed under GPLv2, while Samba is GPLv3. The Register notes that when Samba switched to GPL 3, "one result was that Apple dropped Samba from Mac OS X and replaced it with its own, in-house server called SMBX." And they also remember that a month after its debut in 2021, "Linux sysadmins got to enjoy KSMBD's first security exploit." What's changed now is that it has faced considerable security testing and as a result it is no longer marked as experimental. It's been developed with the assistance of the Samba team, which itself documents how to use it. It's compatible with existing Samba configuration files. As the team says, "It is not meant to replace the existing Samba fileserver 'smbd', but rather be an extension and will integrate with Samba in the future...." KSMBD is also important in that placing such core server functionality right inside the kernel represents a significant potential attack surface for crackers... The new bcachefs file system will not be going into kernel 6.6, and its developer is not happy. "It's taken some time to get KSMBD to a state that was considered stable," points out Linux magazine. That time has come, and KSMBD is planned for Linux kernel 6.6.: But why is KSMBD important? First off, it promises considerable performance gains and better support for modern features such as Remote Direct Memory Access (RDMA)... KSMBD also adds enhanced security, considerably better performance for both single and multi-thread read/write, better stability, and higher compatibility. In the end, hopefully, this KSMBD will also mean easier share setups in Linux without having to jump through the same hoops one must with the traditional Samba setup.' -- source: https://linux.slashdot.org/story/23/09/16/0412208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Error message.
by john 14 Sep '23

14 Sep '23

Hi All, I attempted to install Warpinator using this guide: https://ubunlog.com/en/warpinator-sends-and-receives-files-on-a-local-netwo… I thought the install was a success even though I needed to issue "|sudo apt install -f"| On running the program from a terminal a sad outcome appears....... john(a)johnbuntu:~$ warpinator Gtk-Message: 09:36:55.896: Failed to load module "xapp-gtk3-module" 2023-09-14 09:36:56,719::warpinator: Initializing Warpinator 2023-09-14 09:36:57,000::warpinator: Starting server on xxx.xxx.x.x Any help will be much appreciated.. Cheers John..

2 1

Mozilla Patches Firefox, Thunderbird Against Zero-Day Exploited in Attacks
by Peter Reutemann 14 Sep '23

14 Sep '23

'Mozilla has released emergency security updates to fix a critical zero-day vulnerability exploited in the wild, impacting its Firefox web browser and Thunderbird email client. From a report: Tracked as CVE-2023-4863, the security flaw is caused by a heap buffer overflow in the WebP code library (libwebp), whose impact spans from crashes to arbitrary code execution. "Opening a malicious WebP image could lead to a heap buffer overflow in the content process. We are aware of this issue being exploited in other products in the wild," Mozilla said in an advisory published on Tuesday. Mozilla addressed the exploited zero-day in Firefox 117.0.1, Firefox ESR 115.2.1, Firefox ESR 102.15.1, Thunderbird 102.15.1, and Thunderbird 115.2.2. Even though specific details regarding the WebP flaw's exploitation in attacks remain undisclosed, this critical vulnerability is being abused in real-world scenarios.' -- source: https://tech.slashdot.org/story/23/09/13/1328236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Password-stealing Linux malware served for 3 years and no one noticed
by Peter Reutemann 13 Sep '23

13 Sep '23

'A download site surreptitiously served Linux users malware that stole passwords and other sensitive information for more than three years until it finally went quiet, researchers said on Tuesday. The site, freedownloadmanager[.]org, offered a benign version of a Linux offering known as the Free Download Manager. Starting in 2020, the same domain at times redirected users to the domain deb.fdmpkg[.]org, which served a malicious version of the app. The version available on the malicious domain contained a script that downloaded two executable files to the /var/tmp/crond and /var/tmp/bs file paths. The script then used the cron job scheduler to cause the file at /var/tmp/crond to launch every 10 minutes. With that, devices that had installed the booby-trapped version of Free Download Manager were permanently backdoored. After accessing an IP address for the malicious domain, the backdoor launched a reverse shell that allowed the attackers to remotely control the infected device. Researchers from Kaspersky, the security firm that discovered the malware, then ran the backdoor on a lab device to observe how it behaved. “This stealer collects data such as system information, browsing history, saved passwords, cryptocurrency wallet files, as well as credentials for cloud services (AWS, Google Cloud, Oracle Cloud Infrastructure, Azure),” the researchers wrote in a report on Tuesday. “After collecting information from the infected machine, the stealer downloads an uploader binary from the C2 server, saving it to /var/tmp/atd. It then uses this binary to upload stealer execution results to the attackers’ infrastructure.”' -- source: https://arstechnica.com/security/2023/09/password-stealing-linux-malware-se… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Multi-Account Containers
by Peter Reutemann 11 Sep '23

11 Sep '23

Hi everyone Just came across this Firefox plugin: The Firefox Multi-Account Containers extension lets you carve out a separate box for each of your online lives – no more opening a different browser just to check your work email! Under the hood, it separates website storage into tab-specific Containers. Cookies downloaded by one Container are not available to other Containers. You can even integrate individual Containers with Mozilla VPN to protect your browsing and location. With the Firefox Multi-Account Containers extension, you can... - Sign in to two different accounts on the same site (for example, you could sign in to work email and home email in two different Container tabs. - Keep different kinds of browsing far away from each other (for example, you might use one Container tab for managing your Checking Account and a different Container tab for searching for new songs by your favorite band) - Avoid leaving social-network footprints all over the web (for example, you could use a Container tab for signing in to a social network, and use a different tab for visiting online news sites, keeping your social identity separate from tracking scripts on news sites) - Protect your browsing activity in individual Containers using Mozilla VPN, so you can shop while travelling abroad but check your bank account from a server in your home country. -- source: https://discuss.systems/@ricci/111024736570863186 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Connected cars are a “privacy nightmare,” Mozilla Foundation says
by Peter Reutemann 07 Sep '23

07 Sep '23

'Today, the Mozilla Foundation published its analysis of how well automakers handle the privacy of data collected by their connected cars, and the results will be unlikely to surprise any regular reader of Ars Technica. The researchers were horrified by their findings, stating that "cars are the worst product category we have ever reviewed for privacy." Mozilla looked at 25 car brands and found that all of them collected too much personal data, and from multiple sources—monitoring not just which buttons you push or what you do in any of the infotainment system's apps but also data from other sources like satellite radio or third-party maps. Or even when you connect your phone—remember that prompt asking you if you wanted to share all your contacts and notes with your car when you connected it via Bluetooth? While some gathered data seems innocuous or even helpful—feedback to improve cabin ergonomics and UIs, for example—some data is decidedly not. For example, Nissan's privacy policy says it can collect "sensitive personal information, including driver’s license number, national or state identification number, citizenship status, immigration status, race, national origin, religious or philosophical beliefs, sexual orientation, sexual activity, precise geolocation, health diagnosis data, and genetic information," although it's unlikely your car knows whether you're getting busy in the back seat. While this might be technically possible with a car fitted with a camera-based driver-monitoring system, Nissan's privacy policy notes the data source for the quoted paragraph as "direct contact with users and Nissan employees." (Although more sophisticated driver-monitoring systems that claim to detect emotional states have been demonstrated at shows like CES, we're unaware of any that are in production.) Mozilla found plenty more to worry about. Eighty-four percent of the brands they analyzed said they can share your data, and 76 percent said they can sell it. And more than half say they'll share data with the government and law enforcement by request. Users have very little control over what those brands do with their data. Only two of the 25 brands (Renault and Dacia) tell users they have the right to have their data deleted, and neither sell cars in the United States.' -- source: https://arstechnica.com/cars/2023/09/connected-cars-are-a-privacy-nightmare… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0