- wlug - list.wlug.org.nz

Debian Discusses Vendoring -- Again
by Peter Reutemann 14 Jan '21

14 Jan '21

'Jake Edge, writing at LWN: The problems with "vendoring" in packages -- bundling dependencies rather than getting them from other packages -- seems to crop up frequently these days. We looked at Debian's concerns about packaging Kubernetes and its myriad of Go dependencies back in October. A more recent discussion in that distribution's community looks at another famously dependency-heavy ecosystem: JavaScript libraries from the npm repository. Even C-based ecosystems are not immune to the problem, as we saw with iproute2 and libbpf back in November; the discussion of vendoring seems likely to recur over the coming years. Many application projects, particularly those written in languages like JavaScript, PHP, and Go, tend to have a rather large pile of dependencies. These projects typically simply download specific versions of the needed dependencies at build time. This works well for fast-moving projects using collections of fast-moving libraries and frameworks, but it works rather less well for traditional Linux distributions. So distribution projects have been trying to figure out how best to incorporate these types of applications. This time around, Raphael Hertzog raised the issue with regard to the Greenbone Security Assistant (gsa), which provides a web front-end to the OpenVAS vulnerability scanner (which is now known as Greenbone Vulnerability Management or gvm). "the version currently in Debian no longer works with the latest gvm so we have to update it to the latest upstream release... but the latest upstream release has significant changes, in particular it now relies on yarn or npm from the node ecosystem to download all the node modules that it needs (and there are many of them, and there's no way that we will package them individually). The Debian policy forbids download during the build so we can't run the upstream build system as is." Hertzog suggested three possible solutions: collecting all of the dependencies into the Debian source package (though there would be problems creating the copyright file), moving the package to the contrib repository and adding a post-install step to download the dependencies, or removing gsa from Debian entirely. He is working on updating gsa as part of his work on Kali Linux, which is a Debian derivative that is focused on penetration testing and security auditing. Kali Linux does not have the same restrictions on downloading during builds that Debian has, so the Kali gsa package can simply use the upstream build process. He would prefer to keep gsa in Debian, "but there's only so much busy-work that I'm willing to do to achieve this goal". He wondered if it made more sense for Debian to consider relaxing its requirements. But Jonas Smedegaard offered another possible approach: analyzing what packages are needed by gsa and then either using existing Debian packages for those dependencies or creating new ones for those that are not available. Hertzog was convinced that wouldn't be done, but Smedegaard said that the JavaScript team is already working on that process for multiple projects.' -- source: https://linux.slashdot.org/story/21/01/13/1744228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

WhatsApp Clarifies It's Not Giving All Your Data To Facebook
by Peter Reutemann 14 Jan '21

14 Jan '21

'The Verge: WhatsApp has published a new FAQ page to its website outlining its stances on user privacy in response to widespread backlash over an upcoming privacy policy update. The core issue relates to WhatsApp's data-sharing procedures with Facebook, with many users concerned an updated privacy policy going into effect on February 8th will mandate sharing of sensitive profile information with WhatsApp's parent company. That isn't true -- the update has nothing to do with consumer chats or profile data, and instead the change is designed to outline how businesses who use WhatsApp for customer service may store logs of its chats on Facebook servers. That's something the company feels it is required to disclose in its privacy policy, which it's now doing after previewing the upcoming changes to business chats back in October. But a wave of misinformation on social media, not helped by Facebook's abysmal track record on privacy and its reputation for obfuscating changes to its various terms of service agreements, has resulted in a full-blown WhatsApp backlash that has users fleeing to competitors like Signal and Telegram. [...] WhatsApp executives, as well as Instagram chief Adam Mosseri and Facebook AR / VR head Andrew "Boz" Bosworth, are now trying to set the record straight, perhaps to little avail at this point. "We want to be clear that the policy update does not affect the privacy of your messages with friends or family in any way. Instead, this update includes changes related to messaging a business on WhatsApp, which is optional, and provides further transparency about how we collect and use data," the company writes on the new FAQ page. It also stresses in the FAQ that neither Facebook nor WhatsApp read users' message logs or listen to their calls, and that WhatsApp doesn't store user location data or share contact information with Facebook. (It's also worth noting that data sharing with Facebook is extremely limited for European users due to stronger user privacy protections in the EU.) WhatsApp chief Will Cathcart also took to Twitter a few days ago to post a thread (later shared by Bosworth in the tweet above) trying to cut through the confusion and explain what's actually going on. "With end-to-end encryption, we cannot see your private chats or calls and neither can Facebook. We're committed to this technology and committed to defending it globally," Cathcart wrote. "It's important for us to be clear this update describes business communication and does not change WhatsApp's data sharing practices with Facebook. It does not impact how people communicate privately with friends or family wherever they are in the world." ' -- source: https://it.slashdot.org/story/21/01/13/065219 In the meantime, people are moving to Telegram and Signal... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers steal Mimecast certificate used to encrypt customers’ M365 traffic
by Peter Reutemann 13 Jan '21

13 Jan '21

'Email management provider Mimecast said that hackers have compromised a digital certificate it issued and used it to target select customers who use it to encrypt data they sent and received through the company’s cloud-based service. In a post published on Tuesday, the company said that the certificate was used by about 10 percent of its customer base, which—according to the company—numbers about 36,100. The “sophisticated threat actor” then likely used the certificate to target “a low single digit number” of customers using the certificate to encrypt Microsoft 365 data. Mimecast said it learned of the compromise from Microsoft. Certificate compromises allow hackers to read and modify encrypted data as it travels over the Internet. For that to happen, a hacker must first gain the ability to monitor the connection going into and out of a target’s network. Typically, certificate compromises require access to highly fortified storage devices that store private encryption keys. That access usually requires deep-level hacking or insider access. The Mimecast post didn’t describe what type of certificate was compromised, and a company spokesman declined to elaborate. This post, however, discusses how customers can use a certificate provided by Mimecast to connect their Microsoft 365 servers to the company’s service. Mimecast provides seven different certificates based on the geographic region of the customer.' -- source: https://arstechnica.com/information-technology/2021/01/mimecast-says-hacker… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Quote Of The Week
by Lawrence D'Oliveiro 13 Jan '21

13 Jan '21

“The “S” in “IoT” stands for “security”.” (Copied from <https://forums.theregister.com/forum/all/2021/01/12/flash_is_dead/#c_4185268>.)

1 0

Keeping Flash Player Going A Little Longer
by Lawrence D'Oliveiro 13 Jan '21

13 Jan '21

Adobe Flash Player has officially stopped working, since apparently Adobe included a logic bomb a few releases back with an expiry date in it <https://www.theregister.com/2021/01/12/flash_is_dead/>. However, for those who really, really need it, this article <https://charleswilkinson.co.uk/2021/01/12/how-to-use-flash-in-2021/> describes a workaround to re-enable it for certain sites (e.g. corporate intranet ones), by editing certain .cfg files. Those .cfg files don’t exist on a Linux installation -- not by default, anyway. However, doing a “strings” on libflashplayer.so finds (among other things) a reference to “/etc/adobe” and “/opt/adobe” directories. So perhaps you could create one of these and put files with the right names in it? Anyway, I’m just throwing this out there for anyone who wants to play with it. ;)

1 0

The Impractical but Indisputable Rise of Retrocomputing
by Peter Reutemann 13 Jan '21

13 Jan '21

'For all the personal technology introduced and popularized in 2020 -- upscale fitness bikes, at-home Covid tests, game consoles new and old -- the personal computer lands on the list with a bit of a thud. PCs lack the novelty of other gadgets, but they're practical, essential even, in a year when work, school and social life have come to rely heavily upon them. From a report: While modern, ever more efficient computers are selling better than they have in years, vintage computers -- impractical old devices in need of repairs and out-of-production parts -- are also in demand on sites like eBay. Collectors also flock to message boards, subreddits and Discord servers to buy, sell and trade parts. People are buying these PCs not necessarily for daily use, but for the satisfaction they get from rebuilding them. It's a trend one might chalk up to quarantine boredom, though it's been gaining traction for years. Retrocomputing, the hobby is called, is hardly just a way to pass the time. Instead, as enthusiasts see it, it's a means of communing with the past. "You get into this mind-set of what it must've been like to be somebody in the late '70s, having spent thousands of dollars on this thing that barely does anything more than a calculator," said Clint Basinger, 34, who runs the YouTube channel Lazy Game Reviews. (The devices do allow retrocomputers to make art and music using software unavailable on new computers and to play 8-bit games, but not much else beyond that.) "It's like a time machine to me," Mr. Basinger added. Before the pandemic, there were several vintage computing conventions located around the United States, to which collectors brought their computers to show off. Attendees bought and traded hardware at these events, as well as meet the friends they've made online.' -- source: https://it.slashdot.org/story/21/01/12/1910218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AMD Shows Off Impressive Ryzen 5000 Mobile Processors and 3rd Gen Epyc Server Chips
by Peter Reutemann 13 Jan '21

13 Jan '21

'Advanced Micro Devices showed off some impressive Ryzen 5000 mobile processors today and teased the performance of its 3rd Gen Epyc server chips. From a report: Those chips are aimed at keeping AMD's performance lead over its rival Intel in the mobile and server markets. AMD CEO Lisa Su showed off the new chips in a keynote speech at CES 2021, the online-only tech trade show. AMD is launching its Ryzen 5000 Series mobile processors for gaming laptops and thin-and-light notebooks. These eight-core x86 chips are built with a 7-nanometer manufacturing process (where the circuits are 7 billionths of a meter apart). They are also based on the Zen3 design for processor cores, which can process instructions 19% faster per clock cycle than Zen2 cores. The H-Series focuses on top performance in laptops for gamers and content creators, while the U-Series focuses on thin-and-light notebooks with great battery life. The chips have four to eight cores and they range in power consumption from 15 watts to 45 watts. AMD said the 5000 Series will be available in PCs in February, and we'll see more than 150 systems using it. That compares to 100 systems for the Ryzen 4000 Series and 70 for the Ryzen 3000.' -- source: https://hardware.slashdot.org/story/21/01/12/1826233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Kernel Developers Discuss Dropping a Bunch of Old CPUs
by Peter Reutemann 12 Jan '21

12 Jan '21

'Charlotte Web writes: With Linux 5.10 having shipped as the latest Long Term Support (LTS) release to be maintained for at least the next five years, a discussion has begun over dropping a number of old and obsolete CPU platform support currently found within the mainline kernel. For many of the architectures being considered for removal they haven't seen any new commits in years but as is the case once proposals are made for them to be removed there are often passionate users wanting the support to be kept.' -- source: https://linux.slashdot.org/story/21/01/11/187220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Firefox To Block Backspace Key From Working as 'Back' Button
by Peter Reutemann 12 Jan '21

12 Jan '21

'Mozilla developers plan to remove support for using the Backspace key as a Back button inside Firefox. From a report: The change is currently active in the Firefox Nightly version and is expected to go live in Firefox 86, scheduled to be released next month, in late February 2021. The removal of the Backspace key as a navigational element didn't come out of the blue. It was first proposed back in July 2014, in a bug report opened on Mozilla's bug tracker. At the time, Mozilla engineers argued that many users who press the Backspace key don't always mean to navigate to the previous page (the equivalent of pressing the Back button).' -- source: https://news.slashdot.org/story/21/01/11/1551224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Rediscovering RISC-V: Apple M1 Sparks Renewed Interest in Non-x86 Architecture
by Peter Reutemann 11 Jan '21

11 Jan '21

'"With the runaway success of the new ARM-based M1 Macs, non-x86 architectures are getting their closeup," explains a new article at ZDNet. "RISC-V is getting the most attention from system designers looking to horn-in on Apple's recipe for high performance. Here's why..." RISC-V is, like x86 and ARM, an instruction set architecture (ISA). Unlike x86 and ARM, it is a free and open standard that anyone can use without getting locked into someone else's processor designs or paying costly license fees... Reaching the end of Moore's Law, we can't just cram more transistors on a chip. Instead, as Apple's A and M series processors show, adding specialized co-processors — for codecs, encryption, AI — to fast general-purpose RISC CPUs can offer stunning application performance and power efficiency. But a proprietary ISA, like ARM, is expensive. Worse, they typically only allow you to use that ISA's hardware designs, unless, of course, you're one of the large companies — like Apple — that can afford a top-tier license and a design team to exploit it. A canned design means architects can't specify tweaks that cut costs and improve performance. An open and free ISA, like RISC-V, eliminates a lot of this cost, giving small companies the ability to optimize their hardware for their applications. As we move intelligence into ever more cost-sensitive applications, using processors that cost a dollar or less, the need for application and cost-optimized processors is greater than ever... While open operating systems, like Linux, get a lot of attention, ISAs are an even longer-lived foundational technology. The x86 ISA dates back 50 years and today exists as a layer that gets translated to a simpler — and faster — underlying hardware architecture. (I suspect this fact is key to the success of the macOS Rosetta 2 translation from x86 code to Apple's M1 code.) Of course, an open ISA is only part of the solution. Free standard hardware designs — with tools to design more — and smart compilers to generate optimized code are vital. That larger project is what Berkeley's Adept Lab is working on. As computing continues to permeate civilization, the cost of sub-optimal infrastructure will continue to rise. Optimizing for efficiency, long-life, and broad application is vital for humanity's progress in a cyber-enabled world. One RISC-V feature highlighted by the article: 128-bit addressing (in addition to 32 and 64 bit).' -- source: https://hardware.slashdot.org/story/21/01/10/2020208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 5