- wlug - list.wlug.org.nz

Should Intel Stop Making Chips?
by Lawrence D'Oliveiro 01 Jan '21

01 Jan '21

Intel has suffered more than one misstep in its recent attempts to move to more advanced chip-fabrication technologies. Performance-wise, AMD has been eating its breakfast. RISC-based alternative architectures like ARM and RISC-V are eating into the x86 market. Now an investor fund <https://arstechnica.com/gadgets/2020/12/activist-hedge-fund-advises-intel-t…> is suggesting that Intel outsource its chip-making facilities altogether (like AMD did years ago). This part was news to me: “Intel has lost some $60 billion in market value over the past year...”. According to Yahoo Finance <https://finance.yahoo.com/quote/INTC/>, its current market cap is just a bit over $200 billion. So that $60 billion represents a huge drop in its share price.

1 0

Mastodon Versus Gab
by Lawrence D'Oliveiro 29 Dec '20

29 Dec '20

(OK, this is an old article, but I just noticed it.) Mastodon is not a social network, but a “federation” of social networks. It is built on open-source protocols and software, which you can use to set up your own social-network node. You can then become part of the “fediverse” by associating with other Mastodon nodes, allowing users of one to interact with users of another. What is allowed on a node is entirely up the policies of the node admins. The Fediverse is intentionally decentralized, and admins of one node do not have the power to control what users do on another node. Contrast this with traditional social-networking sites like Facebook and Twitter, each of which is controlled by a single company. Naturally, such autonomy is a double-edged sword. So what do you do when the neo-Nazis move in? Gab, home of those who have promoted violence against various groups based on ethnicity, sexuality etc, is now a Mastodon node. How is the rest of the Fediverse dealing with them? The answer seems to be: you can’t stop them operating, but you can shun them. <https://www.theverge.com/2019/7/12/20691957/mastodon-decentralized-social-n…>

1 0

Linux Kernel Ported to the Nintendo 64
by Peter Reutemann 29 Dec '20

29 Dec '20

'Phoronix reports: It's been a turbulent year and 2020 is certainly ending interesting in the Linux/open-source space... If it wasn't odd enough seeing Sony providing a new official Linux driver for their PlayStation 5 DualSense controller for ending out the year, there is also a new Linux port to the Nintendo 64 game console... Yes, a brand new port to the game console that launched more than two decades ago. Open-source developer Lauri Kasanen who has contributed to Mesa and the Linux graphics stack took to developing a new Nintendo 64 port and announced it this Christmas day. This isn't the first time Linux has been ported to the N64 but prior attempts weren't aimed at potentially upstreaming it into the mainline Linux kernel... This fresh port to the N64 was pursued in part to help port emulators and frame-buffer or console games. And also, the announcement adds, "Most importantly, because I can."' -- source: https://linux.slashdot.org/story/20/12/28/0024241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Let’s Encrypt comes up with workaround for abandonware Android devices
by Peter Reutemann 29 Dec '20

29 Dec '20

'Things were touch-and-go for a while, but it looks like Let's Encrypt's transition to a standalone certificate authority (CA) isn't going to break a ton of old Android phones. This was a serious concern earlier due to an expiring root certificate, but Let's Encrypt has come up with a workaround. Let's Encrypt is a fairly new certificate authority, but it's also one of the world's leading. The service was a major player in the push to make the entire Web run over HTTPS, and as a free, open issuing authority, it went from zero certs to one billion certs in just four years. For regular users, the list of trusted CAs is usually issued by your operating system or browser vendor, so any new CA has a long rollout that involves getting added to the list of trusted CAs by every OS and browser on Earth as well as getting updates to every user. To get up and running quickly, Let's Encrypt got a cross-signature from an established CA, IdenTrust, so any browser or OS that trusted IdenTrust could now trust Let's Encrypt, and the service could start issuing useful certs. When it launched in 2016, Let's Encrypt also issued its own root certificate ("ISRG Root X1") and applied for it to be trusted by the major software platforms, most of which accepted it sometime that year. Now, several years later, with IdenTrust's "DST Root X3" certificate set to expire in September 2021, the time has come for Let's Encrypt to stand on its own and rely on its own root certificate. Since this was submitted four years ago, surely every Web-capable OS currently in use has gotten an update with Let's Encrypt's cert, right? That's true of every mainstream OS except for one. Sitting in the corner of the room, wearing a dunce cap, is Android, the world's only major consumer operating system that can't be centrally updated by its creator. Believe it or not, there are still quite a lot of people running a version of Android that hasn't been updated in four years. Let's Encrypt says it was added to Android's CA store in version 7.1.1 (released December 2016) and, according to Google's official stats, 33.8 percent of active Android users are on a version older than that. Given Android's 2.5 billion strong monthly active user base, that's 845 million people who have a root store frozen in 2016. Oh no.' -- source: https://arstechnica.com/gadgets/2020/12/lets-encrypt-comes-up-with-workarou… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Websites That Won’t Let Go
by Lawrence D'Oliveiro 26 Dec '20

26 Dec '20

A friend asked me for help, saying some kind of “gambling app” had managed to attach itself to his Android phone, and kept popping up all the time. I figured he had been tricked into installing something, and we would probably have to track down the app, which likely had some innocuous name to obscure its purpose. Or possibly even worse, it had managed to take advantage of some vulnerability in his OS version to hide itself. Turned out it was a bit simpler than that. It was a website he had visited in Chrome (most likely following a link from an ad or something), which had an interesting technique to prevent him from getting away: it kept pestering him to allow it to access his location data. The trick was, it had maybe a hundred (maybe more) different site names of the form “«nn».example.com”, so when you blocked one, it would simply ask again, the request coming from a different number for «nn». The expectation obviously was that the user would eventually give up and allow one of these sites access. I was able to close the offending tab, but on quitting and restarting Chrome, it would come back. I figured out that his Chrome setting was to restore the last-visited page(s) when Chrome was restarted, which was why this page kept coming up. So I just turned off that setting. I thought maybe there was some deeper malware that would just bring the problem back when that setting was restored, and that he should consult somebody expert on more recent versions of Android to see about a permanent fix. But he suggested re-enabling that setting, just to confirm the problem was still there. And I did. And it wasn’t! So there was no obvious sign of any malware installation, it was just the website itself, exploiting a quirk of browser behaviour, to gain a lock on the user and blackmail them into giving up their location data.

1 0

Redox OS 0.6 Released With Many Fixes, Rewritten Kernel Memory Manager
by Peter Reutemann 26 Dec '20

26 Dec '20

'Redox OS, the micro-kernel based Rust-written operating system, is out with a new Christmas release. From a report: Redox OS 0.6 was released on Christmas Eve with many bug fixes and new features. Redox OS 0.6 features a complete rewrite of its RMM kernel memory manager, improvements to its Relibc C library implementation, Pkgar as a new package format, and Rust code compatibility updates. It's been the better part of two years since Redox 0.5 was released but moving forward they hope to start releasing new updates more often.' -- source: https://tech.slashdot.org/story/20/12/25/1349219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Citrix Devices Are Being Abused as DDoS Attack Vectors
by Peter Reutemann 26 Dec '20

26 Dec '20

'Threat actors have discovered a way to bounce and amplify junk web traffic against Citrix ADC networking equipment to launch DDoS attacks. From a report: While details about the attackers are still unknown, victims of these Citrix-based DDoS attacks have mostly included online gaming services, such as Steam and Xbox, sources have told ZDNet earlier today. The first of these attacks have been detected last week and documented by German IT systems administrator Marco Hofmann. Hofmann tracked the issue to the DTLS interface on Citrix ADC devices. DTLS, or Datagram Transport Layer Security, is a more version of the TLS protocol implemented on the stream-friendly UDP transfer protocol, rather than the more reliable TCP. Just like all UDP-based protocols, DTLS is spoofable and can be used as a DDoS amplification vector. ' -- source: https://tech.slashdot.org/story/20/12/25/1337207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Up To 3 Million Devices Infected By Malware-Laced Chrome and Edge Add-Ons
by Peter Reutemann 17 Dec '20

17 Dec '20

'As many as 3 million people have been infected by Chrome and Edge browser extensions that steal personal data and redirect users to ad or phishing sites, a security firm said on Wednesday. Ars Technica reports: In all, researchers from Prague-based Avast said they found 28 extensions for the Google Chrome and Microsoft Edge browsers that contained malware. The add-ons billed themselves as a way to download pictures, videos, or other content from sites including Facebook, Instagram, Vimeo, and Spotify. At the time this post went live, some, but not all, of the malicious extensions remained available for download from Google and Microsoft. Avast researchers found malicious code in the JavaScript-based extensions that allows them to download malware onto an infected computer. In a post, the researchers wrote: "Users have also reported that these extensions are manipulating their internet experience and redirecting them to other websites. Anytime a user clicks on a link, the extensions send information about the click to the attacker's control server, which can optionally send a command to redirect the victim from the real link target to a new hijacked URL before later redirecting them to the actual website they wanted to visit. User's privacy is compromised by this procedure since a log of all clicks is being sent to these third party intermediary websites. The actors also exfiltrate and collect the user's birth dates, email addresses, and device information, including first sign in time, last login time, name of the device, operating system, used browser and its version, even IP addresses (which could be used to find the approximate geographical location history of the user)." The researchers don't yet know if the extensions came with the malicious code preinstalled or if the developers waited for the extensions to gain a critical mass of users and only then pushed a malicious update. It's also possible that legitimate developers created the add-ons and then unknowingly sold them to someone who intended to use them maliciously. [...] The list Avast provides in its blog post includes links to download locations for both Chrome and Edge. Anyone who has downloaded one of these add-ons should remove it immediately and run a virus scan. ' -- source: https://it.slashdot.org/story/20/12/16/2138210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Will Officially Support Running Chrome OS On Old PCs
by Peter Reutemann 17 Dec '20

17 Dec '20

'This week, Google acquired a company called Neverware that allows users to turn their old PCs and Macs into a Chromebook with its CloudReady software. Now, Google is planning to make CloudReady into an official Chrome OS release. Engadget reports: When that happens, Neverware says its existing users will be able to seamlessly upgrade to the updated software. Moreover, once that transition is complete, Google will support CloudReady in the same way that it currently does Chrome OS. In the immediate future, Neverware says it's business as usual. The Home Edition of CloudReady isn't changing, and the company says it's committed to supporting its existing education and enterprise customers. Moreover, there's no plan to change pricing at the moment, and Google will honor any current multi-year licenses. Not only does this acquisition make a lot of sense from Google's perspective, but it's hard to see a downside for CloudReady users. The fact the operating system wasn't officially supported by Google was one of the few downsides to the software. It meant you couldn't install Android apps on CloudReady devices, even though it's based on Chromium OS. With this acquisition, support for Android apps becomes much more likely. Direct support from Google will also make the software more appealing to schools and businesses since they can get help directly from the company if they have any technical issues.' -- source: https://tech.slashdot.org/story/20/12/16/219202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Australia Sues Facebook Over Its Use of Onavo To Snoop
by Peter Reutemann 17 Dec '20

17 Dec '20

'Australia's Competition and Consumer Commission (ACCC) is suing Facebook over its use, in 2016 and 2017, of the Onavo VPN app to spy on users for commercial purposes. From a report: The ACCC's case accuses Facebook of false, misleading or deceptive conduct toward thousands of Australian consumers, after it had promoted the Onavo Protect app -- saying it would keep users personal activity data private, protected and secret and not use it for any other purpose, when it was being used to gather data to help Facebook's business. "Through Onavo Protect, Facebook was collecting and using the very detailed and valuable personal activity data of thousands of Australian consumers for its own commercial purposes, which we believe is completely contrary to the promise of protection, secrecy and privacy that was central to Facebook's promotion of this app," said ACCC chair Rod Sims in a statement. "Consumers often use VPN services because they care about their online privacy, and that is what this Facebook product claimed to offer. In fact, Onavo Protect channelled significant volumes of their personal activity data straight back to Facebook."' -- source: https://yro.slashdot.org/story/20/12/16/1652247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0