- wlug - list.wlug.org.nz

Modular, DIY-friendly Framework Laptop gets updated with 12th-gen Intel CPUs
by Peter Reutemann 20 May '22

20 May '22

'We were fans of the Framework Laptop when we reviewed it last year. This was partly because its modular design prioritizes repairability and upgradeability when most other laptops don't. But we also liked it because you didn't need to make huge tradeoffs to get that repairability—the Framework Laptop is lightweight and has a high-quality screen, keyboard, and touchpad, helping it stay competitive with big-box thin-and-light laptops like Dell's XPS 13 and the Lenovo ThinkPad X1 Carbon. An upgradeable laptop is only worthwhile if you can actually upgrade it, though, and Framework is making that possible starting today: The company is introducing a new iteration of the Framework Laptop's motherboard that uses 12th-gen Intel CPUs. A brand-new 12th-gen Framework Laptop starts at $1,049 for a Core i5-equipped base model, or $819 for a build-it-yourself kit with no memory or storage. These products will be available for preorder starting today, and shipping will start in July. [...] While many of Framework's PCs will run Windows, the company boasts that the 12th-gen version of its laptop "continue[s] to focus on solid Linux support." Framework recommends Fedora 36 because it "works fantastically well out of the box" and fully supports the Framework Laptop's new CPUs, its Wi-Fi card, and its fingerprint reader. For now, though, you'll need to be careful about installing other Linux distributions—you need Linux kernel version 5.17.6 or newer to fully support Alder Lake's hybrid CPU architecture, and prominent, actively maintained distributions like Ubuntu 22.04 don't include that kernel version out of the box. This problem will disappear for most Linux distros within the next few months, but for now you may need to upgrade the kernel manually to get the best-possible Linux experience on the Framework Laptop. -- source: https://arstechnica.com/gadgets/2022/05/modular-diy-friendly-framework-lapt… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Bluetooth hack can unlock your Tesla—and all kinds of other devices
by Peter Reutemann 19 May '22

19 May '22

'When you use your phone to unlock a Tesla, the device and the car use Bluetooth signals to measure their proximity to each other. Move close to the car with the phone in hand, and the door automatically unlocks. Move away, and it locks. This proximity authentication works on the assumption that the key stored on the phone can only be transmitted when the locked device is within Bluetooth range. Now, a researcher has devised a hack that allows him to unlock millions of Teslas—and countless other devices—even when the authenticating phone or key fob is hundreds of yards or miles away. The hack, which exploits weaknesses in the Bluetooth Low Energy standard adhered to by thousands of device makers, can be used to unlock doors, open and operate vehicles, and gain unauthorized access to a host of laptops and other security-sensitive devices.' -- source: https://arstechnica.com/information-technology/2022/05/new-bluetooth-hack-c… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Blocks File Manager Total Commander From Allowing Users To Sideload Apps
by Peter Reutemann 19 May '22

19 May '22

'Total Commander has been around since the 90s, eventually expanding into Android after the platform launched over a decade ago. The app has more than 10 million downloads on the Play Store, still supporting OS versions as far back as Android 2.2. With a new update, developer Christian Ghisler has removed the ability to install APK files on Android, blaming Google Play policies in the patch notes for the app. It's a shocking twist for the service and, seemingly, a bad omen of things to come for other mobile file managers. A forum post from Ghisler sheds some more light on what's going on here, as Google sent him a notice warning of his app's removal from the Play Store within a week if the app went unmodified. The company's automated response pointed the developer to the "Device and Network Abuse" policy.' -- source: https://tech.slashdot.org/story/22/05/18/1843221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Will Start Distributing a Security-Vetted Collection of Open-Source Software Libraries
by Peter Reutemann 18 May '22

18 May '22

'Google announced a new initiative Tuesday aimed at securing the open-source software supply chain by curating and distributing a security-vetted collection of open-source packages to Google Cloud customers. From a report: The new service, branded Assured Open Source Software, was introduced in a blog post from the company. In the post, Andy Chang, group product manager for security and privacy at Google Cloud, pointed to some of the challenges of securing open-source software and stressed Google's commitment to open source. "There has been an increasing awareness in the developer community, enterprises, and governments of software supply chain risks," Chang wrote, citing last year's major log4j vulnerability as an example. "Google continues to be one of the largest maintainers, contributors, and users of open source and is deeply involved in helping make the open source software ecosystem more secure." Per Google's announcement, the Assured Open Source Software service will extend the benefits of Google's own extensive software auditing experience to Cloud customers. All open-source packages made available through the service are also used internally by Google, the company said, and are regularly scanned and analyzed for vulnerabilities.' -- source: https://tech.slashdot.org/story/22/05/17/1726201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Software Freedom Conservancy Wins Big Step Forward For Open-Source Rights
by Peter Reutemann 18 May '22

18 May '22

'ZDNet: The Software Freedom Conservancy (SFC), a non-profit organization that promotes open-source software and defends the free software General Public License (GPL), recently sued major TV vendor Vizio for abusing the GPL with its Linux-based SmartCast OS. Vizio replied that the SFC had no right to ask for the source code. On May 13, however, the SFC succeeded in federal court with its motion to have its lawsuit against Vizio remanded back to Superior Court in Orange County, CA. Doesn't sound like that big a deal? Think again. The important part of the decision by U.S. District Court Judge Josephine L. Staton stated that SFC's claim "that the [GPLv2] enforcement of 'an additional contractual promise separate and distinct from any rights provided by the copyright laws' amounts to an 'extra element,' and therefore, SFC's claims are not preempted." Karen M. Sandler, SFC's executive director, explained, "The ruling is a watershed moment in the history of copyleft licensing. This ruling shows that the GPL agreements function both as copyright licenses and as a contractual agreement." Sandler added that even in the Free and Open Source Software (FOSS) legal community people argue incorrectly that the GPL and other copyleft licenses only function as copyright licenses. This decision clearly states that the GPL also acts as a contract. Further, this decision makes it the first case to show individual consumers have rights to the source code as third-party beneficiaries of the GPL.' -- source: https://news.slashdot.org/story/22/05/17/2039236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How Parliament Protest Supercharged NZ's Misinfodemic
by Lawrence D'Oliveiro 18 May '22

18 May '22

A report <https://www.nzherald.co.nz/nz/tectonic-shift-how-parliament-protest-superch…> on how online misinformation--and deliberate disinformation--has been spreading in NZ. A flood of recent Covid-19-related activity has exposed thousands more Kiwis to what the report's authors called "splintered realities", while also helping push people toward racist and violent ideologies. ... The websites they focused on ranged from mainstream platforms like Facebook, Twitter, Instagram and YouTube, to channels linked to the far-right, such as Telegram, Rumble, Odysee, Gab and Gettr. Each shift in New Zealand's Covid-19 response caused ripples across these sites. As our pediatric vaccine roll-out kicked off, for instance, one post bogusly claiming five children had collapsed at a vaccination centre swiftly went viral. In other words, a dramatic-sounding report, even though it was wrong, can spread faster than any attempts to correct it, simply because the correction seems much less interesting in comparison. You don’t have to assume that the ones spreading these reports are deliberately lying in order to create this effect: Hanlon’s Razor says “Never attribute to malice that which can be adequately explained by stupidity”. But the unprecedented surge in online traffic they observed around February's anti-mandate convoy to Wellington, and the 24-day occupation that followed, surprised even them. ... Posts on a single Facebook page, run by a known "misinformation super-spreader" they didn't name, drew some of the highest engagement of all public pages in the country over that period. The amount of traffic on Facebook misinformation pages even eclipsed that of pages operated by New Zealand mainstream media outlets combined – receiving 357,089 and 247,620 interactions respectively on March 2. There’s more in the news article, and also on the website of the Disinformation Project group which did the research <https://thedisinfoproject.org/>. I thought one of the names of the researchers was familiar: Dr Sanjana Hattotuwa. I’ve seen him on TV news a couple of times talking about this very thing.

1 0

meeting next Monday
by Peter Reutemann 16 May '22

16 May '22

Hi everyone We have another hybrid (virtual + in-person) meeting next Monday: Since we ran out of time at our last meeting, we are continuing our theme on cyber security with more show and tells: A far simpler firewall than pfSense, ufw (uncomplicated firewall), will be introduced by Peter (command-line and GUI). He will also briefly talk about tools like ClamAV (anti-virus), nmap (port scanner) and rkhunter (root kit detection). Angus will demo Wireguard, the VPN solution that made it into the Linux kernel (starting with 5.6). Details (and virtual meeting link): https://www.meetup.com/WaikatoLinuxUsersGroup/events/283776643/ If you'd like to demo a tool as well, then please let me know. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Surprise: Microsoft Has a Second Internal-Use-Only Linux Distro
by Peter Reutemann 16 May '22

16 May '22

'ZDNet reports there's more than just the one Microsoft-created Linux distribution for internal use only called CBL (Common Base Linux) Mariner. "It turns out there's another Microsoft-developed Linux distribution that's also for internal use that's known as CBL-Delridge or CBL-D." I discovered the existence of CBL-D for the first time this week in a rather round-about way. I stumbled onto a February 2 blog post from Hayden Barnes. a Senior Engineering Manager at SuSE who led the Windows on Rancher engineering team, which traced his steps in discovering and building his own image of CBL-D. Barnes noted that Microsoft published CBL-Delridge in 2020, the same year that it also published CBL-Mariner. The main difference between the two: Delridge is a custom Debian derivative, while Mariner is a custom Linux From Scratch-style distribution. CBL-D powers Azure's Cloud Shell. The Azure Cloud Shell provides a set of cloud-management tools packaged in a container. In a note on the GitHub repo for the Cloud Shell, officials noted that "the primary difference between Debian and CBL-D is that Microsoft compiles all the packages included in the CBL-D repository internally. This helps guard against supply chain attacks...." CBL-Mariner and CBL-Delridge are just two of the Microsoft-developed Linux-related deliverables from the Linux Systems Group. Others include the Windows Subsystem for Linux version 2 (WSL2), which is part of Windows 10; an Azure-tuned Linux kernel which is designed for optimal performance as Hyper-V guests; and Integrity Policy Enforcement (IPE), a proposed Linux Security Module (LSM) from the Enterprise and Security team.' -- source: https://linux.slashdot.org/story/22/05/14/1934226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers Are Using SEO To Rank Malicious PDFs On Search Engines, Research Finds
by Peter Reutemann 15 May '22

15 May '22

'VentureBeat: Today, researchers at security service edge provider, Netskope, published the Netskope Cloud and Threat Report: Global Cloud and Malware Trends, which found that phishing downloads rose 450% over the past 12 months, and highlighted that attackers are using search engine optimization (SEO) to rank malicious PDF files on search engines. The report's findings show that phishing attempts are constantly evolving, and attackers aren't just targeting employees through their email inboxes; they're also using popular search engines like Google and Bing. The increase in phishing attacks and the growing popularity of SEO techniques among cybercriminals highlights the need for enterprises to provide their employees with security awareness training so they're prepared to spot threats and not at risk of handing over sensitive information. When it comes to defending against these SEO-driven attacks, [Ray Canzanese, director of Netskope's Threat Labs] highlights several methods that security teams can use to protect employees. One of the most effective is to use a solution that can decrypt and scan web traffic for malicious content. At the same time, security teams should encourage users to inspect all links they click on, and to exercise caution if the link takes them to an unfamiliar website. In the event an employee does click on a malicious PDF, they can expect to see a fake captcha at the top of the first page, followed by text on other pages. In these scenarios, users should close the file, delete it from the device and report it to the security team ASAP. Canzanese also notes that it's important for users to report malicious URLs that feature on popular search engines to help the provider unlist them from the site and prevent other users from falling victim to a scam.' -- source: https://it.slashdot.org/story/22/05/13/2155201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Some top 100,000 websites collect everything you type—before you hit submit
by Peter Reutemann 15 May '22

15 May '22

'When you sign up for a newsletter, make a hotel reservation, or check out online, you probably take for granted that if you mistype your email address three times or change your mind and X out of the page, it doesn't matter. Nothing actually happens until you hit the Submit button, right? Well, maybe not. As with so many assumptions about the web, this isn't always the case, according to new research: A surprising number of websites are collecting some or all of your data as you type it into a digital form. Researchers from KU Leuven, Radboud University, and University of Lausanne crawled and analyzed the top 100,000 websites, looking at scenarios in which a user is visiting a site while in the European Union and visiting a site from the United States. They found that 1,844 websites gathered an EU user's email address without their consent, and a staggering 2,950 logged a US user's email in some form. Many of the sites seemingly do not intend to conduct the data-logging but incorporate third-party marketing and analytics services that cause the behavior. After specifically crawling sites for password leaks in May 2021, the researchers also found 52 websites in which third parties, including the Russian tech giant Yandex, were incidentally collecting password data before submission. The group disclosed their findings to these sites, and all 52 instances have since been resolved.' -- source: https://arstechnica.com/information-technology/2022/05/some-top-100000-webs… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0