- wlug - list.wlug.org.nz

Here Comes the Google Chrome Change that Worries Ad-Blocker Creators
by Peter Reutemann 14 Dec '20

14 Dec '20

'CNET reports: With the next version of Chrome, Google is moving ahead with a plan to improve privacy and security by reining in some abilities of extensions used to customize the browser. The move had angered some developers who expected earlier it would cripple ad blockers. Manifest v3, the programming interface behind Google's security plans, will arrive with Chrome 88 in mid-January, Google said Wednesday at the Chrome Dev Summit. Extensions using the earlier Manifest v2 will still work for at least a year... Among other things, Manifest v3 limits the number of "rules" that extensions may apply to a web page as it loads. Rules are used, for example, to check if a website element comes from an advertiser's server and should therefore be blocked. Google announced the changes two years ago. Reducing the number of rules allowed angered creators of extensions like the uBlock Origin ad blocker and the Ghostery tracking blocker. They said the rules limits will stop their extensions from running their full lists of actions to screen ads or block tracking. That could let websites bypass extensions — and the preferences of people who installed them... The shift brought on by Manifest V3 will spread to all browsers, to the detriment of ad blocking software, predicted Andrey Meshkov, co-founder and chief technology officer of AdGuard, an ad-blocking extension... Ghostery is working to update its extension for Manifest V3 but would rather spend its time on "real privacy innovations," President Jeremy Tillman said in a statement Wednesday. "We still have real misgivings that these changes have more to do with Google protecting its bottom line than it does with improving security for Chrome users...." The importance of the Chrome team's choices are magnified by the fact that other browsers, including Microsoft Edge, Vivaldi , Opera and Brave, are built on its Chromium open-source foundation. Microsoft said it will embrace Manifest v3, too. "Another Manifest v3 change is that extensions no longer may update their abilities by downloading code from third-party sites. "The entire extension now must be distributed through the Chrome Web Store, a measure Google says improves security screens and speeds reviews."' -- source: https://tech.slashdot.org/story/20/12/13/0012217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Accessing Judicial Records Online
by Lawrence D'Oliveiro 13 Dec '20

13 Dec '20

This article <https://arstechnica.com/tech-policy/2020/12/us-house-passes-bill-to-tear-do…> about the ongoing can of worms that is the PACER online judicial records system in the US prompted me to take a look at our own. I found this page <https://www.courtsofnz.govt.nz/judgments/>, which links conveniently to separate areas for the Supreme Court, Court of Appeal and High Courts at the Ministry of Justice <https://forms.justice.govt.nz/jdo/Introduction.jsp>, District Courts <https://www.districtcourts.govt.nz/> and the Legal Information Institute <http://www.nzlii.org/>. In terms of copyright and redistribution, there is this note on the MoJ page: No copyright exists in respect of judgments or decisions of any New Zealand Court or Tribunal. See Copyright Act 1994 s27(g). Also, I like this note on the help page for the nzlii.org site: Emulated Search Languages If you have used one of the popular online legal database systems (or even if you haven't) you probably do not need to learn anything new. Most Lexis, Status, Info-One, (and for the non-lawyers, even C and agrep) style searches are recognised.

1 0

CentOS 8 Ending Next Year To Focus Shift On CentOS Stream
by Peter Reutemann 13 Dec '20

13 Dec '20

'Well here is a surprise for those that have long used CentOS as the community-supported rebuild of Red Hat Enterprise Linux... CentOS 8 will end in 2021 and moving forward CentOS 7 will remain supported until the end of its lifecycle but CentOS Stream will be the focus as the future upstream of RHEL. From a report: For those relying on CentOS 8 to enjoy the reliability and features of Red Hat Enterprise Linux 8 but without the licensing costs, etc, that will end in 2021. At the end of 2021, CentOS 8 will no longer be maintained but CentOS 7 will stick around in a supported maintenance state until 2024. The CentOS Project will be focused moving forward just on CentOS Stream as the upstream/development branch of Red Hat Enterprise Linux. CentOS 8 users are encouraged to begin transitioning to CentOS Stream 8. The CentOS Project announced this shift in focus today via the CentOS Blog. Red Hat's announcement meanwhile is promoting the change as beneficial to CentOS Stream.' -- source: https://linux.slashdot.org/story/20/12/08/2010236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

Random Firefox Tweaks
by Lawrence D'Oliveiro 12 Dec '20

12 Dec '20

Been looking at various settings changes you can make in the “about:config” page in Firefox. Here are a couple I have found useful: * keyword.enabled -- set to false to stop Firefox trying to do a search on the contents of the address box if it doesn’t match a URL. This is why I have a search box separate from the address box. * browser.fixup.alternate.enabled -- set to false to stop it helpfully tacking on “www.” and “.com” if the original URL you type doesn’t work. I have occasionally been confused by it complaining about not finding a URL, but showing a different one from the one I typed. By the way, when you first try to view this page, Firefox shows you a warning to ensure you understand the consequences of messing about with settings at this level. It remembers it has shown you this warning by adding the following line to the prefs.js file in your profile: user_pref("browser.aboutConfig.showWarning", false); Firefox seems to overwrite this file when it quits, and reloads it when it is launched again.

2 2

Google Says It is Expanding Fuchsia's Open Source Model
by Peter Reutemann 11 Dec '20

11 Dec '20

'Fuchsia is a long-term project to create a general-purpose, open source operating system, and today we are expanding Fuchsia's open source model to welcome contributions from the public. Fuchsia is designed to prioritize security, updatability, and performance, and is currently under active development by the Fuchsia team. We have been developing Fuchsia in the open, in our git repository for the last four years. You can browse the repository history at fuchsia.googlesource.com to see how Fuchsia has evolved over time. We are laying this foundation from the kernel up to make it easier to create long-lasting, secure products and experiences. Starting today, we are expanding Fuchsia's open source model to make it easier for the public to engage with the project. We have created new public mailing lists for project discussions, added a governance model to clarify how strategic decisions are made, and opened up the issue tracker for public contributors to see what's being worked on. As an open source effort, we welcome high-quality, well-tested contributions from all. There is now a process to become a member to submit patches, or a committer with full write access. In addition, we are also publishing a technical roadmap for Fuchsia to provide better insights for project direction and priorities. Some of the highlights of the roadmap are working on a driver framework for updating the kernel independently of the drivers, improving file systems for performance, and expanding the input pipeline for accessibility.' -- source: https://news.slashdot.org/story/20/12/08/2048257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

South Korea Finally Gets Rid Of ActiveX
by Lawrence D'Oliveiro 11 Dec '20

11 Dec '20

Being just about the first country in the world to introduce secure online banking (in 1999!) came at a cost to the Republic of Korea: because SSL/TLS wasn’t widespread at the time, they had to cobble together a solution based on Microsoft’s ActiveX technology. This made it specific to Windows. It worked OK for a while, but as computing platforms have continued to evolve, this dependency on a “legacy” technology has become increasingly annoying to just about everybody. Then in 2017, it actually became an election campaign promise to get rid of this. And finally, now, the promise is being fulfilled. <https://www.theregister.com/2020/12/10/south_korea_activex_certs_dead/>

1 0

Brave Browser-Maker Launches Privacy-Friendly News Reader
by Peter Reutemann 11 Dec '20

11 Dec '20

'Ars Technica: Brave Software, maker of the Brave Web browser, is introducing a news reader that's designed to protect user privacy by preventing parties -- both internal and third party -- from tracking the sites, articles, and story topics people view. Brave Today, as the service is called, is using technology that the company says sets it apart from news services offered by Google and Facebook. It's designed to deliver personalized news feeds in a way that leaves no trail for Brave, ISPs, and third parties to track. The new service is part of Brave's strategy of differentiating its browser as more privacy-friendly than its competitors'. Key to Brave Today is a new content delivery network the company is unveiling. Typically, news services use a single CDN to cache content and then serve it to users. This allows the CDN or the service using it to see both the IP address and news feed of each user, and over time, that data can help services build detailed profiles of a person's interests. The Brave Today CDN takes a different approach. It's designed in a way that separates a user's IP address from the content they request. One entity offers a load-balancing service that receives TLS-encrypted traffic from the user. The load balancer then passes the traffic on to the CDN that processes the request. The load balancer knows the user's IP address but, because the request is encrypted, has no visibility into the content the user is seeking. The CDN, meanwhile, sees only the request but has no way of knowing the IP address that's making it. Responses are delivered in reverse order. To prevent the data from being combined, Brave says that it will use one provider for load balancing and a different one for content delivery. To prevent the load-balancing provider from using the size of the requests and responses to infer the contents of the encrypted data, the service will also use a technique called padding, which adds characters to the plaintext before it's encrypted. The CDN uses several other techniques to preserve the anonymity of users. Among them: stripping out various headers that could be used to identify the person making the request. Furthermore, Brave is also taking steps to shield user information from its own employees. "... [T]he company has configured its account with the load-balancing provider to restrict access to its logging resources," reports Ars. "The load-balancing provider also doesn't provide the ability for customers to use the proxy protocol to inject the requester's IP address into outgoing requests. In case that changes, however, Brave has also entered into a contract with the load balancer that restricts access to logs or use of the protocol, even if Brave asks."' -- source: https://yro.slashdot.org/story/20/12/10/2151244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Exposes Adrozek, Malware That Hijacks Chrome, Edge, and Firefox
by Peter Reutemann 11 Dec '20

11 Dec '20

'Microsoft has raised the alarm today about a new malware strain that infects users' devices and then proceeds to modify browsers and their settings in order to inject ads into search results pages. From a report: Named Adrozek, the malware has been active since at least May 2020 and reached its absolute peak in August this year when it controlled more than 30,000 browsers each day. But in a report today, the Microsoft 365 Defender Research Team believes the number of infected users is much, much higher. Microsoft researchers said that between May and September 2020, they observed "hundreds of thousands" of Adrozek detections all over the globe. Based on internal telemetry, the highest concentration of victims appears to be located in Europe, followed by South and Southeast Asia. Microsoft says that, currently, the malware is distributed via classic drive-by download schemes. Users are typically redirected from legitimate sites to shady domains where they are tricked into installing malicious software. The boobytrapped software installs the Androzek malware, which then proceeds to obtain reboot persistence with the help of a registry key.' -- source: https://news.slashdot.org/story/20/12/10/1857222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

arch - low disk space on root partition
by Peter Reutemann 10 Dec '20

10 Dec '20

Hi everyone My experience with EndeavourOS has been really positive so far. However, this morning, after a big upgrade, I received the notification that I was running low on disk space on my root partition (only 1.9GB out of 37GB remaining!). After a bit of looking around the web, I settled on clearing my pacman cache: sudo pacman -Sc And I'm back to having 19GB free disk space. :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 4

The Origins Of T he C Programming Language
by Lawrence D'Oliveiro 10 Dec '20

10 Dec '20

This article <https://arstechnica.com/features/2020/12/a-damn-stupid-thing-to-do-the-orig…> goes a bit more in-depth into the precursors of the C programming language. The story begins with a computer scientist from a well-connected family named Christopher Strachey (I remember the name of his uncle Lytton as the author of a volume of short biographies in my parents’ library called “Eminent Victorians”), who led a group to create a language called “CPL”. CPL proved a bit too ambitious to implement at the time. And it didn’t help that its designers insisted on certain syntactical niceties that might be considered more literary than practical. (Reflecting a certain British public-school background, I suppose ...) But a cut-down subset of this was implemented, with the aim of using it as a “bootstrap” language for writing the compiler for the full language. This was BCPL, and it turned out to be useful for a range of programming projects. The group at AT&T Bell Labs got hold of this after the Labs pulled out of the MULTICS project, and implemented an even more cut-down version called “B”, which could run on the limited memory of the PDP-7 which was all they had at the time. Then a later enhancement of this was called “New B” or “NB”. Several attempts were made to rewrite the fledgling Unix operating system in NB, which didn’t work. After each attempt, the language was revised to add more features. Finally, after the addition of structured types, the result was a language sufficiently useful to write an OS, and sufficiently different to warrant a new name. So it was dubbed “C”.

1 0