- wlug - list.wlug.org.nz

Tim Berners-Lee Approves Web DRM, But W3C Members Have Two Weeks To Appeal
by Peter Reutemann 12 Jul '17

12 Jul '17

'der Atticus Rex writes: A high controversial Web standard has received a seal of approval from Tim Berners-Lee, the inventor of the Web and its chief technical decision-maker. Opponents like the Free Software Foundation and Electronic Frontier Foundation say that the standard, Encrypted Media Extensions, is a step backwards for freedom, privacy, and a host of other rights on the Web. There's still a two-week window in which members of the W3C can appeal the decision, and the Free Software Foundation is asking people to email and encourage them to do so.' -- source: https://news.slashdot.org/story/17/07/08/0147206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

net neutrality article on BBC
by Ian Young 12 Jul '17

12 Jul '17

Some may not have seen this. I thought it a useful summary of the current state of play around this issue. http://www.bbc.com/news/blogs-trending-40494909

2 1

Fedora 26 Linux Distro Released
by Peter Reutemann 12 Jul '17

12 Jul '17

'Today, Fedora 26 sheds its pre-release status and becomes available for download as a stable release. GNOME fans are in for a big treat, as version 3.24 is default. If you stick to stable Fedora releases, this will be your first time experiencing that version of the desktop environment since it was released in March. Also new is LibreOffice 5.3, which is an indispensable suite for productivity. If you still use mp3 music files I've moved onto streaming), support should be baked in for both encoding and decoding. "The latest version of Fedora's desktop-focused edition provides new tools and features for general users as well as developers. GNOME 3.24 is offered with Fedora 26 Workstation, which includes a host of updated functionality including Night Light, an application that subtly changes screen color based on time of day to reduce effect on sleep patterns, and LibreOffice 5.3, the latest update to the popular open source office productivity suite. For developers, GNOME 3.24 provides matured versions of Builder and Flatpak to make application development for a variety of systems, including Rust and Meson, easier across the board," says the Fedora Project.' -- source: https://linux.slashdot.org/story/17/07/11/1722202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu Is Now Available On the Windows Store
by Peter Reutemann 11 Jul '17

11 Jul '17

'Ubuntu is now available for download on the Windows Store. "Initially spotted by Rafael Rivera and Necrosoft Core on Twitter, Ubuntu on the Windows Store will let you install and run the Ubuntu terminal on Windows next to your other apps," reports Windows Central. From the report: Ubuntu's arrival, and that of SUSE, are part of a recent push by Microsoft to embrace Linux and the open source community more broadly. This began with the arrival of the Windows Subsystem for Linux in 2016, allowing users to use the Bash shell from within Windows. Keep in mind that this is limited to the Fall Creators Update, which isn't set for a public release until later this year. If you're running a PC testing the Fall Creators Update through the Windows Insider Program, however, you should be able to download and try Ubuntu from the Windows Store just fine. ' -- source: https://news.slashdot.org/story/17/07/10/202218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Multics Lives!
by Lawrence D'Oliveiro 10 Jul '17

10 Jul '17

I previously mentioned <https://list.waikato.ac.nz/pipermail/wlug/2015-August/013714.html> the old Multics OS, which was so complex and so delayed in its development that a group of folks at AT&T Bell Labs decided not to wait and created their own, less ambitious OS instead, deciding to call it “UNIX” as a sort of pun on “Multics”. Well, at long last <https://www.theregister.co.uk/2017/07/10/multics_resurrected_in_new_simulat…>, you can now run Multics for yourself. The original mainframe hardware is long gone, but today’s PCs can easily support a suitable software emulation without breaking too much of a sweat--even a Raspberry π 2, it seems, can run the emulation at something close to the speed of the early mainframe units. All it took was some suitably dedicated people to build such an emulator. And now you can download their work and try it out for yourself.

1 0

Let’s Encrypt: Wildcard Certs Coming Soon
by Lawrence D'Oliveiro 07 Jul '17

07 Jul '17

Anybody using Let’s Encrypt? Having recently set it up for a client, I’m really impressed with it. It gives you HTTPS certs for your web servers at no cost, and with very little effort, since the entire process is automated (with authentication via the “ACME” protocol). The certs are only valid for 90 days, to try to minimize potential damage from any compromises, but the renewal process is equally easy to automate. The one service they haven’t offered up to now is certs for wildcard domains (e.g. “*.example.com”). Looks like they will soon have a procedure for this, too <https://arstechnica.com/information-technology/2017/07/lets-encrypt-to-star…>.

2 1

OneDrive Has Stopped Working On Non-NTFS Drives
by Peter Reutemann 07 Jul '17

07 Jul '17

'OneDrive users around the world have been upset to discover that with its latest update, Microsoft's cloud file syncing and storage system no longer works with anything other than disks formatted with the NTFS file system. Both older file systems, such as FAT32 and exFAT, and newer ones, such as ReFS, will now provoke an error message when OneDrive starts up. To continue to use the software, files will have to be stored on an NTFS volume. While FAT disks can be converted, ReFS volumes must be reformatted and wiped. This has left various OneDrive users unhappy. While NTFS is the default file system in Windows, people using SD cards to extend the storage on small laptops and tablets will typically use exFAT. Similarly, people using Storage Spaces to manage large, redundant storage volumes will often use ReFS. The new policy doesn't change anything for most Windows users, but those at the margins will feel hard done by. Microsoft said in a statement that it "discovered a warning message that should have existed was missing when a user attempted to store their OneDrive folder on a non-NTFS filesystem -- which was immediately remedied." According to Ars, Microsoft's position, apparently, is that OneDrive should always have warned about these usage scenarios and that it's only a bug or an oversight that allowed non-NTFS volumes to work.' -- source: https://hardware.slashdot.org/story/17/07/06/2012255 Time to switch to ownCloud! :-) https://owncloud.org/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

WikiLeaks Unveils CIA Implants That Steal SSH Credentials From Windows, Linux PCs
by Peter Reutemann 07 Jul '17

07 Jul '17

'WikiLeaks has today published the 15th batch of its ongoing Vault 7 leak, this time detailing two alleged CIA implants that allowed the agency to intercept and exfiltrate SSH (Secure Shell) credentials from targeted Windows and Linux operating systems using different attack vectors. Secure Shell or SSH is a cryptographic network protocol used for remote login to machines and servers securely over an unsecured network. Dubbed BothanSpy -- implant for Microsoft Windows Xshell client, and Gyrfalcon -- targets the OpenSSH client on various distributions of Linux OS, including CentOS, Debian, RHEL (Red Hat), openSUSE and Ubuntu. Both implants steal user credentials for all active SSH sessions and then sends them to a CIA-controlled server. ' -- source: https://linux.slashdot.org/story/17/07/06/224211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

iPhone Bugs Are Too Valuable To Report To Apple
by Peter Reutemann 07 Jul '17

07 Jul '17

'Last year, Apple launched a long-awaited bug bounty program to reward friendly hackers who report flaws in the iPhone to the company. Despite inviting some of the best hackers in the world to join, it's a bit of a flop so far. The iPhone's security is so tight that it's hard to find any flaws at all, which leads to sky-high prices for bugs on the grey market. Researchers I spoke to are reluctant to report bugs both because they are so valuable and because reporting some bugs may actually prevent them from doing more research. "People can get more cash if they sell their bugs to others," said Nikias Bassen, a security researcher for the company Zimperium, and who joined Apple's program last year. "If you're just doing it for the money, you're not going to give [bugs] to Apple directly." Patrick Wardle, a former NSA hacker who now specializes in MacOS research and was invited to the Apple bug bounty program, agreed. He said that iOS bugs are "too valuable to report to Apple."' -- source: https://apple.slashdot.org/story/17/07/06/1551210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Severe' Systemd Bug Allowed Remote Code Execution For Two Years
by Peter Reutemann 06 Jul '17

06 Jul '17

'A flaw in systemd, the init system used on many Linux systems, can be exploited using a malicious DNS query to either crash a system or to run code remotely. The vulnerability resides in the daemon systemd-resolved and can be triggered using a TCP payload, according to Ubuntu developer Chris Coulson. This component can be tricked into allocating less memory than needed for a look-up. When the reply is bigger it overflows the buffer allowing an attacker to overwrite memory. This would result in the process either crashing or it could allow for code execution remotely. "A malicious DNS server can exploit this by responding with a specially crafted TCP payload to trick systemd-resolved in to allocating a buffer that's too small, and subsequently write arbitrary data beyond the end of it," is how Coulson put it. Affected Linux vendors have pushed out patches -- but the bug has apparently been present in systemd code since June of 2015. And long-time Slashdot reader walterbyrd also reports a recently-discovered bug where systemd unit files that contain illegal usernames get defaulted to root.' -- source: https://it.slashdot.org/story/17/07/03/0343258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 4