- wlug - list.wlug.org.nz

DOD's Third Attempt To Implement IPv6 Isn't Going Well
by Peter Reutemann 03 Jun '20

03 Jun '20

'The US Department of Defense is woefully behind on its plan to upgrade its IT infrastructure to support the newer IPv6 protocol, according to a government report published on Monday. From a report: This current effort is the third time the DOD attempts to upgrade its infrastructure to support IPv6 over in the past 17 years. The first two attempts took place in 2003 and 2010, respectively. The 2003 effort was abandoned with the DOD citing security risks and a lack of personnel trained in IPv6, while the second attempt was also abandoned, similarly on the grounds that IPv6 was not yet secure enough for the DOD's sensitive networks. On Monday, the Government Accountability Office (GAO), the auditing agency of the US government, said that the DOD's third attempt isn't doing any better either. GAO officials said the DOD failed to follow four basic requirements that were set out by the White House Office of Management and Budget (OMB) in 2006. The four requirements were part of an OMB guideline sent to all federal agencies detailing the proper procedure for upgrading networks from IPv4 to IPv6. "For its current [third] initiative, DOD has not completed three of four longstanding OMB requirements," GAO auditors said in a report published on Monday.' -- source: https://news.slashdot.org/story/20/06/02/1447254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 77 Arrives With Faster JavaScript Debugging and Optional Permissions
by Peter Reutemann 03 Jun '20

03 Jun '20

'Mozilla today launched Firefox 77 for Windows, Mac, and Linux. Firefox 77 includes faster JavaScript debugging, optional permissions for extensions, and Pocket recommendations in the U.K. You can download Firefox 77 for desktop now from Firefox.com, and all existing users should be able to upgrade to it automatically. According to Mozilla, Firefox has about 250 million active users, making it a major platform for web developers to consider. [...] Other than Pocket recommendations arriving in the U.K. (they've been in Canada, Germany, and the U.S. since April 2018), this is primarily a developer release. Firefox's Debugger is now better at handling large web apps with all their bundling, live reloading, and dependencies. Mozilla is promising performance improvements that speed up pausing and stepping, as well as cutting down on memory usage over time. Source maps should also see performance boosts -- some inline source maps load 10 times faster -- and improved reliability for many configurations. The debugger will now also respect the currently selected stack when stepping, which is useful when you've stepped into a function call or paused in a library method further down in the stack.' -- source: https://news.slashdot.org/story/20/06/02/1530214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Wallpaper crash explained: Here’s how a simple image can soft-brick phones
by Peter Reutemann 02 Jun '20

02 Jun '20

'How can a simple image crash an Android phone to the point that it becomes unusable? It’s a question that came out frequently over the past 24 hours, as news of a “cursed wallpaper” spread around the web. Here’s a recap: Setting a particular image as wallpaper can send some phones into a loop of crashes that makes them unusable. There are a few solutions, depending on how hard the phone is hit. Some users were able to change the wallpaper in the short interval between crashes. Others had success deleting the wallpaper using the recovery tool TWRP. But in most cases, the only solution was to reset the phone to factory settings, losing any data that’s not backed up. The issue was brought to light by Ice Universe, the Chinese Twitter users known for leaks. Based on user reports, many models from Samsung and Google are affected, while we’ve also seen some reports from users of OnePlus, Nokia, and Xiaomi devices (it’s not clear if these latter devices ran stock software or custom ROMs). From our own testing and looking at user reports, Huawei devices seem to be less exposed to the wallpaper crash issue.' -- source: https://www.androidauthority.com/android-wallpaper-crash-1124577/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Programmers Use 80 Characters Per Line!?
by Lawrence D'Oliveiro 02 Jun '20

02 Jun '20

Are there still people writing their code to the constraints of 80-column CRT terminals which vanished into museums decades ago? Seems there are enough such around to rile Linus Torvalds <https://www.theregister.com/2020/06/01/linux_5_7/>. Even back in the days of those terminals, the printers you used for hard-copy listings could almost always do 132-column lines. And some of the terminals could be put into a mode with such a line length, by using a much narrower font (I remember it hurt my eyes to do much work in this mode). Nowadays I typically have my text-editor windows set to a width of 100 columns. And there is still enough room on my screen for two such views side-by-side.

1 0

Lawsuit Over Online Book Lending Could Bankrupt Internet Archive
by Lawrence D'Oliveiro 02 Jun '20

02 Jun '20

A group of book publishers is suing the Internet Archive over its recent loosening of restrictions on lending out copyrighted books <https://arstechnica.com/tech-policy/2020/06/publishers-sue-internet-archive…>. Choice description of the founder of the Internet Archive: "Brewster Kahle is what the Russians might call a holy fool—someone who acts without real regard for himself or the worldly things in the service of a higher calling," [copyright scholar James] Grimmelmann said.

1 0

Cisco Discloses Security Breach That Impacted VIRL-PE Infrastructure
by Peter Reutemann 01 Jun '20

01 Jun '20

'Thursday Cisco disclosed a security breach that impacted a small part of its backend infrastructure and two of its commercial products also bundling the SaltStack software package as part of their firmware. ZDNet reports: Cisco said that hackers used a vulnerability in the SaltStack software package, which Cisco bundles with some products, to gain access to six servers... The six servers provide the backend infrastructure for VIRL-PE (Internet Routing Lab Personal Edition), a Cisco service that lets users model and create virtual network architectures to test network setups before deploying equipment in real situations. "Cisco identified that the Cisco maintained salt-master servers that are servicing Cisco VIRL-PE releases 1.2 and 1.3 were compromised," the company said Thursday. Cisco said it patched and remediated all hacked VIRL-PE servers on May 7, when it deployed updates for the SaltStack software. However, the issue isn't localized to Cisco's backend infrastructure alone. Cisco says that two of its commercial products also bundle the SaltStack software package as part of their firmware. These are the aforementioned Cisco VIRL-PE, and Cisco Modeling Labs Corporate Edition (CML), another network modeling tool. Both VIRL-PE and CML can be used in Cisco-hosted and on-premise scenarios. In case companies use the two products on location, Cisco says CML and VIRL-PE need to be patched.' -- source: https://tech.slashdot.org/story/20/05/30/055201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

An advanced and unconventional hack is targeting industrial firms
by Peter Reutemann 01 Jun '20

01 Jun '20

'Attackers are putting considerable skill and effort into penetrating industrial companies in multiple countries, with hacks that use multiple evasion mechanisms, an innovative encryption scheme, and exploits that are customized for each target with pinpoint accuracy. The attacks begin with emails that are customized for each target, a researcher at security firm Kaspersky Lab reported this week. For the exploit to trigger, the language in the email must match the localization of the target’s operating system. For example, in the case of an attack on a Japanese company, the text of the email and an attached Microsoft Office document containing a malicious macro had to be written in Japanese. Also required: an encrypted malware module could be decrypted only when the OS had a Japanese localization as well. Recipients who click on a request to urgently enable the document’s active content will see no indication anything is amiss. Behind the scenes, however, a macro executes a Powershell script. The reason it stays hidden: the command parameters: - ExecutionPolicy ByPass—to override organization policies - WindowStyle Hidden. This hides the PowerShell window - NoProfile, which executes the script with no end-user configuration.' -- source: https://arstechnica.com/information-technology/2020/05/an-advanced-and-unco… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GitHub Warns Java Developers of New Malware Poisoning NetBeans Projects
by Peter Reutemann 01 Jun '20

01 Jun '20

'GitHub issued a security alert Thursday warning about new malware spreading on its site via boobytrapped Java projects, ZDNet reports: The malware, which GitHub's security team has named Octopus Scanner, has been found in projects managed using the Apache NetBeans IDE (integrated development environment), a tool used to write and compile Java applications. GitHub said it found 26 repositories uploaded on its site that contained the Octopus Scanner malware, following a tip it received from a security researcher on March 9. But the article adds GitHub "believes that many more projects have been infected during the past two years." GitHub says that when other users would download any of the 26 projects, the malware would behave like a self-spreading virus and infect their local computers. It would scan the victim's workstation for a local NetBeans IDE installation, and proceed to burrow into the developer's other Java projects. The malware, which can run on Windows, macOS, and Linux, would then download a remote access trojan (RAT) as the final step of its infection, allowing the Octopus Scanner operator to rummage through an infected victim's computer, looking for sensitive information. GitHub says the Octopus Scanner campaign has been going on for years, with the oldest sample of the malware being uploaded on the VirusTotal web scanner in August 2018, time during which the malware operated unimpeded.' -- source: https://news.slashdot.org/story/20/05/30/2031219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Zoom's New, Stronger Encryption May Only Protect Paying Clients
by Peter Reutemann 01 Jun '20

01 Jun '20

'"Zoom plans to strengthen the encryption of its service for paying customers," reports Newsweek, "but the upgrade will not be available to users of its free service." Zoom security consultant Alex Stamos later confirmed the details of the reported move in an interview with Reuters, which first reported the changes on Friday. But he also told the news outlet that Zoom's plans could still change. "The CEO is looking at different arguments," Stamos said. "The current plan is paid customers plus enterprise accounts where the company knows who they are." In the wake of privacy concerns, he added that Zoom was making significant efforts to upgrade safety and trust on its platform. In an emailed statement to Newsweek, a Zoom spokesperson said: "Zoom's approach to end-to-end encryption is very much a work in progress — everything from our draft cryptographic design, which was just published last week, to our continued discussions around which customers it would apply to." The tech company's plans to boost the encryption of video calls on its platform have been revealed a month after it was reported that half a million Zoom account credentials were being sold on the Dark Web. Zoom's increased usage during lockdowns brought increase scrutiny, reports CNET, which "revealed several Zoom security problems and the fact that an earlier Zoom boast of end-to-end encryption was baseless."' -- source: https://it.slashdot.org/story/20/05/30/2311256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Should Maintainers of Open Source Projects Be Paid?
by Peter Reutemann 01 Jun '20

01 Jun '20

'Matt Asay, a former COO of Canonical now working at AWS, writes "Over the last few weeks I've interviewed a range of open source project maintainers, most of which don't directly get paid for supporting their projects... Is this a bad thing?" It's not completely clear. Linux Foundation executive Chris Aniszczyk has been an outspoken opponent of open source "tip jars" that seek to sustain projects with donations. "These [open source developers] should be encouraged to start businesses or your business should hire them directly," he argues. But many such developers don't want a 9-to-5 corporate job, preferring the independence of contract work. Open source sustainability, in other words, is messy. Most open source project maintainers with whom I've spoken got started because it was a "fun" way to spend their free time. They had a variety of personal "itches" they needed to scratch. Exactly none started coding because they were hoping to get paid for that work. In fact, in some cases, it was specifically to create space from their employer that they started the project. For Datasette founder Simon Willison, for example, he "wanted a creative outlet." That is, a project that he got to have complete control over. In some ways, he said, it was perhaps "a way of blowing off steam," but really it was a place where he could express his creativity without a corporate overlord steering that creativity. See the problem...? Aniszczyk reasonably suggests that the most sustainable source of funding is a paycheck, but that's precisely what many of these developers don't want. Or, at least, they don't want a paycheck that comes with restrictions on their ability to code freely... [O]pen source sustainability will never have one, meta answer for all of open source. It's always a project-by-project analysis and, really, a founder-by-founder (or community-by-community) decision. ' -- source: https://news.slashdot.org/story/20/05/31/0138252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0