- wlug - list.wlug.org.nz

Anker's Eufy Cameras Caught Uploading Content To the Cloud Without User Consent
by Peter Reutemann 30 Nov '22

30 Nov '22

'Anker's popular Eufy-branded security cameras appear to be sending some data to the cloud, even when cloud storage is disabled and local only storage settings are turned on. MacRumors reports: The information comes from security consultant Paul Moore, who last week published a video outlining the issue. According to Moore, he purchased a Eufy Doorbell Dual, which was meant to be a device that stored video recording on device. He found that Eufy is uploading thumbnail images of faces and user information to its cloud service when cloud functionality is not enabled. Moore demonstrates the unauthorized cloud uploading by allowing his camera to capture his image and turning off the Eufy HomeBase. The website is still able to access the content through cloud integration, though he had not signed up for cloud service, and it remains accessible even when the footage is removed from the Eufy app. It's important to note that Eufy does not appear to be automatically uploading full streaming video to the cloud, but rather taking captures of the video as thumbnails. The thumbnails are used in the Eufy app to activate streaming video from the Eufy base station, allowing Eufy users to watch their videos when away from home, as well as for sending rich notifications. The problem is the thumbnails are uploaded to the cloud automatically even when the cloud functionality is not active, and Eufy also seems to be using facial recognition on the uploads. Some users have taken issue with the unauthorized cloud uploads because Eufy advertises local-only service and has been popular among those who want a more private camera solution. "No Clouds or Costs," reads the Eufy website. Moore suggests that Eufy is also able to link facial recognition data collected from two separate cameras and two separate apps to users, all without camera owners being aware. Moore received a response from Eufy in which Eufy confirmed that it is uploading event lists and thumbnails to AWS, but said the data is not able to "leak to the public" because the URL is restricted, time limited, and requires account login. There is also another issue that Moore has highlighted, suggesting Eufy camera streams can be watched live using an app like VLC, but little information on the exploit is available at this time. Moore said that unencrypted Eufy camera content can be accessed without authentication, which is alarming for Eufy users. There's a dedicated Reddit thread where other Eufy users are reporting the same thing happening.' -- source: https://yro.slashdot.org/story/22/11/29/2148250 Eufy products are for sale here in NZ as well. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Amazon's New Chip Moves AWS Into High-Performance Computing
by Peter Reutemann 30 Nov '22

30 Nov '22

'Amazon's cloud-computing unit is rolling out new chips designed to power the highest-end of computing, supporting tasks such as weather forecasting and gene sequencing. From a report: Amazon Web Services, the largest provider of over-the-internet computing, on Monday said it would let customers rent computing power that relies on a new version of its Graviton chips. Peter DeSantis, a senior vice president who oversees most of AWS's engineering teams, said in an interview that the product is a springboard for making what the industry calls high-performance computing more readily available. The newest chip is the latest piece of Amazon's effort to build more of the hardware that fills the massive data centers that power AWS. Amazon says making its own chips will give customers more cost-effective computing power than they could get by renting time on processors built by the likes of Intel Corp., Nvidia Corp. or Advanced Micro Devices. The move has put AWS in direct competition with those companies, which are also among its biggest suppliers. DeSantis said the chipmakers remain "great partners," and that AWS plans to continue to offer high-performance computing services based on chips made by other companies. On Tuesday, AWS Chief Executive Officer Adam Selipsky announced a new version of the Inferentia chip, which is designed to draw inferences from vast amounts of data. Inferentia2 is built to handle bigger sets of data than its predecessor, enabling things like software-generated images or detecting and interpreting human speech, Amazon said. [...] The latest version of AWS's line of Graviton processors, the Graviton3E, will have twice the ability of current versions in one type of calculations needed by high-performance computers, DeSantis said. When combined with other AWS technology, the new offering will be 20% better than the previous one. Amazon didn't say when services based on the new chip would be available' -- source: https://tech.slashdot.org/story/22/11/29/192229 According to this site, the Graviton2 chip is supported by several Linux distros (specific kernel flags?): https://aws.amazon.com/ec2/graviton/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

RIP Fred “Mythical Man-Month” Brooks
by Lawrence D'Oliveiro 29 Nov '22

29 Nov '22

“The Mythical Man-Month” was a classic book on the nature of computer programming, written by Fred Brooks after (among other things) his experience heading up the OS/360 project back in the 1960s. The man himself has now passed away at the age of 91 <https://www.theregister.com/2022/11/28/fred_mythical_man_month_brooks/>. OS/360 was the most ambitious of several operating systems developed by IBM for its System/360 line of computers. It provided conclusive proof that, if a project was running late, adding more people to work on it could actually make things worse. I have a copy of the 25th-Anniversary edition of the book, which includes his “No Silver Bullet” essay and also a detailed retrospective on how the original text stood up (or not) to the state of the programming art in the 1990s.

1 0

Linux Kernel Gets More Infrastructure for Rust, Increasing Interest in the Language
by Peter Reutemann 28 Nov '22

28 Nov '22

'Linux 6.1 (released last month) included what Linus Torvalds described as "initial Rust scaffolding," remembers this update from SD Times But now, "work has already been done since the 6.1 release to add more infrastructure for Rust in the kernel, though still none of the code interacts with any C code." And there's still no actual Rust code in Linux: "You need to get all those things that can make sure that Rust can compile, and you can do the debugging and all these things," explained Joel Marcey, director of advocacy and operations for the Rust Foundation, "and make sure that the memory safety is there and all that sort of stuff. And that has to happen first before you can actually write any real code in Rust for the Linux kernel itself." Marcey explained that Linux is going to be doing this inclusion very piecemeal, with lots of little integrations here and there over time so they can see how it is working. "I would imagine that over the next year, you're going to see more small incremental changes to the kernel with Rust, but as people are seeing that it's actually kind of working out, you'll be able to maybe, for example, write Linux drivers or whatever with Rust," said Marcey.... According to Bec Rumbul, executive director of the Rust Foundation, Rust being added to the kernel is an "enormous vote of confidence in the Rust programming language." She explained that in the past other languages have been planned to make it into the kernel and ended up not getting put in. "I think having someone with the kind of intellectual gravity of Linus Torvalds saying 'No, it's going in there,' that kind of says an awful lot about how reliable Rust already is and how much potential there is for the future as well," she said. Rumbul believes that there will be an increased interest in the language, which is still relatively new (It first made its debut in 2010) compared to some of the other languages out there to choose from. "I suspect that because Rust is now in the kernel, and it's just being talked about much ... more widely, that it will seem like an attractive prospect to a lot of people that are looking to develop their skills and their knowledge," she said. Rumbul hopes people will also be inspired to participate in the language as contributors and maintainers, because those are some of the less popular roles within open source, but are extremely critical to the health of a language, she explained. The Rust Foundation also launched a new security team in September to ensure best practices (including a dedicated security engineer). Their first initiative will be a security audit and threat modeling exercises. "We want to basically shore up," Rust operations director Marcey tells SD Times, "to ensure that Rust itself is actually as secure as we always say it is." In this year's Stack Overflow Developer Survey, 86.73% of developers said they love Rust.' -- source: https://developers.slashdot.org/story/22/11/27/1853228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday
by Peter Reutemann 28 Nov '22

28 Nov '22

Hi everyone We have a hybrid meeting next Monday with the following topic: 'Gnome, MATE, Cinnamon and KDE are the most common window managers for Linux desktops. But what about the lesser known ones? There are plenty of compositing, stacking or tiling window managers out there. Let's have a look at some (https://en.wikipedia.org/wiki/Comparison_of_X_window_managers) Maybe you'll find the one that you have been looking for all those years?' Details: https://www.meetup.com/waikatolinuxusersgroup/events/283776741/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Human Rights Commissioner Wants To See Regulation, Not Bans On Disinformation
by Lawrence D'Oliveiro 26 Nov '22

26 Nov '22

Paul Hunt, our Chief Human Rights Commissioner is not so keen on Justice Minister Kiri Allan’s proposals on hate speech legislation, saying “We do need controls, we do need checks, we do need independent accountability but not rendering the information unlawful, unless it reaches that far end of the spectrum.” according to <https://www.nzherald.co.nz/nz/politics/disinformation-should-be-regulated-b…>. Internal Affairs Minister Jan Tinetti has been looking at how Finland has had some success in keeping its young people aware of misinformation and disinformation online, to see if something similar could be done here.

1 0

Google Says Google and Other Android Manufacturers Haven't Patched Security Flaws
by Peter Reutemann 25 Nov '22

25 Nov '22

'Google has disclosed several security flaws for phones that have Mali GPUs, such as those with Exynos chipsets. From a report: The company's Project Zero team says it flagged the problems to ARM (which produces the GPUs) back in the summer. ARM resolved the issues on its end in July and August. However, smartphone manufacturers including Samsung, Xiaomi, Oppo and Google itself hadn't deployed patches to fix the vulnerabilities as of earlier this week, Project Zero said. Researchers identified five new issues in June and July and promptly flagged them to ARM. "One of these issues led to kernel memory corruption, one led to physical memory addresses being disclosed to userspace and the remaining three led to a physical page use-after-free condition," Project Zero's Ian Beer wrote in a blog post. "These would enable an attacker to continue to read and write physical pages after they had been returned to the system." Beer noted that it would be possible for a hacker to gain full access to a system as they'd be able to bypass the permissions model on Android and gain "broad access" to a user's data. The attacker could do so by forcing the kernel to reuse the afore-mentioned physical pages as page tables.' -- source: https://tech.slashdot.org/story/22/11/24/218212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DSA Slowly Going Away
by Lawrence D'Oliveiro 24 Nov '22

24 Nov '22

I notice that the new version of OpenSSH in Debian Unstable is taking another step toward dropping support for the DSA algorithm for key generation. I can remember back when DSA was introduced as an alternative to RSA. Unlike RSA, which is an encryption algorithm that can also be used for digital signatures, DSA was deliberately designed to be usable for signatures but not for encryption. This was back in the day when the US Government was still restricting exports of strong encryption products. Not long after that, I remember a research paper being published showing that DSA could in fact be used as an encryption algorithm. It wasn’t particularly efficient or even very practical, but it could theoretically be done. There was a time, in fact, when DSA was actually being preferred to RSA for generating SSH keys. Just checking the ssh-keygen man page, and the current default is RSA.

1 0

Windows Subsystem for Linux with GUI apps launches for Windows 10
by Peter Reutemann 24 Nov '22

24 Nov '22

'The Windows Subsystem for Linux (WSL), one of the best reasons to run Windows 11, is now available to Windows 10 users, in the latest version and with all its features. WSL dropped its "preview" label with this 1.0 release, and aims to simplify its installation from here on out. Getting the best version of WSL used to mean installing big, system-level Windows updates (including 11 itself). As part of its broader moving of key apps into its Store, Microsoft now offers the most feature-rich version of WSL there. "The in-Windows version of WSL will still receive critical bug fixes, but the Store version of WSL is where new features and functionality will be added," Windows Developer Platform Program Manager Craig Loewen noted in a blog post. Loewen noted that the "WSL community's requests" drove Microsoft to make the latest, GUI-ready framework version available to Windows 10 users. Now a Store installation is the default, even if you use the command line (PowerShell) to install and update WSL. Now anyone whose system is capable of running WSL has access to graphical apps and (optional) systemd support, and can hopefully spend less time wondering which WSL version they have, what they need, and what the differences are.' -- source: https://arstechnica.com/gadgets/2022/11/windows-subsystem-for-linux-with-gu… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Network-crashing leap seconds to be abandoned by 2035, for at least a century
by Peter Reutemann 23 Nov '22

23 Nov '22

'There are not many things you can get Facebook, Google, the United States, France, and Linus Torvalds to agree on, but one of them has come to pass. A near-unanimous vote on Friday in Versailles, France, by parties to the International Bureau of Weights and Measures (BIPM in its native French) on Resolution 4 means that starting in 2035, the leap second, the remarkably complicated way of aligning the Earth's inconsistent rotation with atomic-precision timekeeping, will see its use discontinued. Coordinated Universal Time, or UTC, will run without them until 2135. It was unclear whether any leap seconds might occur before then, though it seems unlikely. The assumption is that within those 100 years, time-focused scientists (metrologists) will have found a way to synchronize time as measured by humans to time as experienced by our planet orbiting the Sun. But most people will not notice any difference at all, even as the time difference could reach up to one minute by the end of that 100 years.' -- source: https://arstechnica.com/science/2022/11/network-crashing-leap-seconds-to-be… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2