- wlug - list.wlug.org.nz

Tails, the Security-Focused OS, Adds Support For Secure Boot
by Peter Reutemann 09 Apr '20

09 Apr '20

'Tail OS, an operating system optimized for privacy and anonymity, has released version 4.5 this week, the first version that supports a crucial security feature named UEFI Secure Boot. From a report: Secure Boot works by using cryptographic signatures to verify that firmware files loaded during a computer's boot-up process are authentic and have not been tampered. If any of the firmware checks fail, Secure Boot has the authority to stop the boot process, preventing the operating system from launching. The feature has been available as part of the UEFI specification for almost two decades but is rarely used. The reason is because not all firmware vendors cryptographically sign their files, leaving the door open to verification errors that -- when Secure Boot is enabled -- block many operation systems from launching.' -- source: https://it.slashdot.org/story/20/04/08/1712239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google makes seamless update support mandatory in Android 11
by Peter Reutemann 09 Apr '20

09 Apr '20

'Google is putting new rules in place for Android 11: it's going to make support for Android's "seamless update" feature mandatory for devices launching with the new OS. The news comes to us via an Android source code commit first spotted by XDA Developers, which reads, "Require Virtual A/B on R launches." In English, this means the seamless update system, which requires two partitions (labeled "A" and "B"), will be required on Android R, aka Android 11. Android's seamless update system was introduced in Android 7.0 Nougat (it was actually borrowed from Chrome OS) as a way to reduce the downtime caused by OS updates and to offer a recovery mechanism in case an update applies incorrectly. Applying an update to an operating system usually means taking the OS offline for an extended period of downtime. On Android, before seamless updates, the phone would boot into recovery and could be stuck on the "Installing System Update" screen for as much as 25 minutes. That's a lot of downtime, and during this time you can't run any apps, see any text messages, or get any phone calls. The downtime happens because updating the system files requires taking the system partition offline, but the seamless update system fixes this by just having a second copy of the system partition.' -- source: https://arstechnica.com/gadgets/2020/04/google-makes-seamless-update-suppor… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Scratch Makes It To TIOBE Top 20
by Lawrence D'Oliveiro 08 Apr '20

08 Apr '20

Scratch, the graphically-based language designed to teach kids how to program, has entered TIOBE’s latest Top 20 list <https://devclass.com/2020/04/06/kids-programming-language-scratch-nails-top…>. Stats language R has also made some gains, getting into the top 10 for the first time.

1 0

Firefox 75 Arrives With Revamped Address Bar; Mozilla To Stick With 2020 Schedule
by Peter Reutemann 08 Apr '20

08 Apr '20

'Mozilla today launched Firefox 75 for Windows, Mac, and Linux. Firefox 75 includes a revamped address bar with significant search improvements, a few performance tweaks, and a handful of developer features. You can download Firefox 75 for desktop now from Firefox.com, and all existing users should be able to upgrade to it automatically. According to Mozilla, Firefox has about 250 million active users, making it a major platform for web developers to consider. When the coronavirus crisis took hold, millions found themselves spending more time in their browsers as they learn and work from home. But the crisis is also impacting software developers. Google was forced to pause its Chrome releases, which typically arrive every six weeks. Ultimately, Chrome 81 was delayed, Chrome 82 is being skipped altogether, and Chrome 83 has been moved up a few weeks. Microsoft has followed suit with Edge's release schedule, consistent with Google's open source Chromium project, which both Chrome and Edge are based on. Mozilla wants to make clear it is not in the same boat. The company took an indirect jab at Google and Microsoft today, saying: "We've built empathy into our systems for handling difficult or unexpected circumstances. These strengths are what allow us to continue to make progress where some of our competitors have had to slow down or stop work."' -- source: https://news.slashdot.org/story/20/04/07/162246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Announces IPE, a New Code Integrity Feature for Linux
by Peter Reutemann 08 Apr '20

08 Apr '20

'Microsoft has revealed details about a new project it has been working on for Linux kernel. From a report: Named Integrity Policy Enforcement -- or IPE -- the project is a Linux security module (LSM). LSMs are optional add-ons for the Linux kernel that enable additional security features. According to a documentation page published on Monday, IPE is Microsoft's attempt to solve the code integrity problem for Linux -- an operating system the company broadly uses in its Azure cloud service. On Linux systems where IPE is enabled, system administrators can create a list of binaries that are allowed to execute and then add the verification attributes the kernel needs to check for each binary before allowing it to run. If binaries have been altered by an attacker, IPE can block the execution of the malicious code.' -- source: https://linux.slashdot.org/story/20/04/07/1615232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Backs Apple's SMS OTP Standard Proposal
by Peter Reutemann 08 Apr '20

08 Apr '20

'Google is now backing a standard proposed by Apple engineers in January to create a default format for one-time passcodes (OTP) sent via SMS to users during the two-factor authentication (2FA) process. >From a report: The standard, proposed by Apple engineers working on the Safari WebKit project, has now reached the status of official Web Platform Incubator Community Group (WICG) specification draft. "We've moved 'Origin-bound one-time codes delivered via SMS' to @wicg_, where we're working on a shared spec with our collaborators at Google. Please take a look! Updated explainer, and specification," wrote Apple's Ricky Mondello. The proposal aims to fix some issues with the current state of SMS 2FA/OTP codes, all of which have different formats, unique per the websites sending the codes.' -- source: https://apple.slashdot.org/story/20/04/07/199245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Edge Overtakes Firefox To Become the Second-Most Popular Browser
by Peter Reutemann 06 Apr '20

06 Apr '20

'It was probably just a matter of time, but the thing so many people, including everyone at Microsoft, expected finally happened: Microsoft Edge surpassed Mozilla Firefox to become the world's second most-used desktop browser. Data provided by market analysis firm NetMarketShare reveals that the whole thing happened in March, when the adoption of the Chromium-powered Microsoft Edge improved to a level that allowed it to overtake Mozilla's own browser. So right now, Microsoft Edge is the second most-used desktop browser on the planet with a share of 7.59%, while Mozilla Firefox is now third with 7.19%. As for who's leading the pack, Google Chrome continues to be number one with a share of 68.50%' -- source: https://news.slashdot.org/story/20/04/05/1727217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

Eclipse Foundation Unveils Open Source Alternative to Microsoft's 'Visual Studio Code' IDE
by Peter Reutemann 05 Apr '20

05 Apr '20

'"The Eclipse Foundation just released version 1.0 of an open-source alternative to Visual Studio Code called Eclipse Theia," reports SD Times: Theia is an extensible platform that allows developers to create multi-language cloud and desktop IDEs, allowing them to create entirely new developer experiences. According to the Eclipse Foundation, the differences between Theia and Visual Studio Code are that Theia has a more modular architecture, Theia was designed from the ground to run on desktop and cloud, and Theia was developed under community-driven and vendor-neutral governance of the Eclipse Foundation. The Theia project was started by Ericsson and TypeFox in 2016, and since then it has become an integral part of cloud solutions globally. The project approached the Eclipse Foundation about becoming a potential host in 2019. Early contributors to the project include ARM, Arduino, EclipseSource, Ericsson, Google Cloud, IBM, Red Hat, SAP, and TypeFox. "We are thrilled to see Eclipse Theia deliver on its promise of providing a production-ready, vendor-neutral, and open source framework for creating custom and white-labeled developer products," announced Mike Milinkovich, the Eclipse Foundation's executive director. "Visual Studio Code is one of the world's most popular development environments. Not only does Theia allow developers to install and reuse VS Code extensions, it provides an extensible and adaptable platform that can be tailored to specific use cases, which is a huge benefit for any organization that wants to deliver a modern and professional development experience. Congratulations to all the Theia committers and contributors on achieving this milestone." InfoWorld points out that "thus far Theia is intended to be fitted into third-party products. An end-user version is on the roadmap for release later this year." But programming columnist Mike Melanson notes that "Chances are, you've already run into Theia without even realizing it, as it already serves as the basis for Red Hat's CodeReady Workspaces, the Eclipse Foundation's own Eclipse Che, and Google Cloud Shell."' -- source: https://developers.slashdot.org/story/20/04/04/1819251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

What's New in Linux 5.6? WireGuard VPN and USB4
by Peter Reutemann 05 Apr '20

05 Apr '20

'Linux 5.6 "has a bit more changes than I'd like," Linus Torvalds posted on the kernel mailing list, "but they are mostly from davem's networking fixes pulls, and David feels comfy with them. And I looked over the diff, and none of it looks scary..." TechRadar reports that the new changes include support for USB4 and GeForce RTX 2000 series graphics cards with the Nouveau driver: Yes, Turing GPU support has arrived with the open source Nouveau driver, along with the proprietary firmware images, as Phoronix.com reports. However, don't get too excited, as re-clocking doesn't work yet (getting the GPU to operate at stock clocks), and other important pieces of the puzzle are missing (like no Vulkan support with Nouveau). For the unfamiliar, Nouveau is an alternative to Nvidia's proprietary drivers on Linux, and although it remains in a relatively rough state in comparison, it's still good to see things progressing for Linux gamers with one of Nvidia's latest cards in their PC. Linux 5.6 also introduces fresh elements on the AMD front, with better reset support for Navi and Renoir graphics cards (which helps the GPU recover if it hits a problem)... Another notable move is the introduction of WireGuard support, a newcomer VPN protocol which makes a potentially nifty alternative to OpenVPN. Linux 5.6 also supports the Amazon Echo speaker, and naturally comes with a raft of other minor improvements... Linus's post also notes that for the next release's timing they'll "play it by ear... It's not like the merge window is more important than your health, or the health of people around you." But he says he hasn't seen signs that the pandemic could affect its development (other than the possibility of distraction by the news). "I suspect a lot of us work from home even normally, and my daughter laughed at me and called me a 'social distancing champ' the other day..."' -- source: https://linux.slashdot.org/story/20/04/04/2128207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

U.S. Government: Update Chrome 80 Now, Multiple Security Concerns Confirmed
by Peter Reutemann 05 Apr '20

05 Apr '20

'Part of America's Department of Homeland Security, the Cybersecurity and Infrastructure Security Agency (CISA) "has advised users to update Google Chrome as new high-rated security vulnerabilities have been found," reports Forbes: In an April 1 posting, CISA confirmed that Google Chrome version 80.0.3987.162 "addresses vulnerabilities that an attacker could exploit to take control of an affected system," be that Windows, Mac or Linux. It went on to state that it "encourages" users and administrators to apply the update. It's not just CISA that is warning about the need to update Google Chrome. The Center for Internet Security (CIS) is a non-profit entity that works to safeguard both private and public organizations against cyber threats. In a multi-state information sharing and analysis center (MS-ISAC) advisory, it has also warned of multiple vulnerabilities in Google Chrome. The most severe of these could allow an attacker to achieve arbitrary code execution within the context of the browser... All it would take for an attacker to exploit the vulnerabilities is to get the user to visit, by way of a phishing attack or even redirection from a compromised site, a maliciously crafted web page. Beside three high-rated vulnerabilities, Forbes reports that "a further five security vulnerabilities were discovered by the Google internal security team using a combination of internal audits and fuzzing."' -- source: https://it.slashdot.org/story/20/04/04/2020211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0