- wlug - list.wlug.org.nz

Basic Rust Support Merged For Upcoming Linux 6.1
by Peter Reutemann 06 Oct '22

06 Oct '22

'"This Monday, the first set of patches to enable Rust support and tooling was merged for Linux 6.1," writes Slashdot reader sabian2008, sharing an update from longtime kernel developer Kees Cook: The tree has a recent base, but has fundamentally been in linux-next for a year and a half. It's been updated based on feedback from the Kernel Maintainer's Summit, and to gain recent Reviewed-by: tags. Miguel is the primary maintainer, with me helping where needed/wanted. Our plan is for the tree to switch to the standard non-rebasing practice once this initial infrastructure series lands. The contents are the absolute minimum to get Rust code building in the kernel, with many more interfaces[2] (and drivers -- NVMe[3], 9p[4], M1 GPU[5]) on the way. The initial support of Rust-for-Linux comes in roughly 4 areas: - Kernel internals (kallsyms expansion for Rust symbols, %pA format) - Kbuild infrastructure (Rust build rules and support scripts) - Rust crates and bindings for initial minimum viable build - Rust kernel documentation and samples ' -- source: https://linux.slashdot.org/story/22/10/04/2259259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel Laptop Users Should Avoid Linux 5.19.12 To Avoid Potentially Damaging The Display
by Peter Reutemann 06 Oct '22

06 Oct '22

'Intel laptop users running Linux are being advised to avoid running the latest Linux 5.19.12 stable kernel point release as it can potentially damage the display. From a report: Intel Linux laptop users on Linux 5.19.12 have begun reporting "white flashing" display issues with one user describing it as "[the] laptop display starts to blink like lights in a 90's rave party." Intel Linux kernel engineer Ville Syrjal posted this week on the kernel mailing list: "After looking at some logs we do end up with potentially bogus panel power sequencing delays, which may harm the LCD panel."' -- source: https://linux.slashdot.org/story/22/10/05/141248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel CTO Wants Developers To Build Once, Run On Any GPU
by Peter Reutemann 05 Oct '22

05 Oct '22

'Greg Lavender, CTO of Intel, spoke to VentureBeat about the company's efforts to help developers build applications that can run on any operating system. From the report: "Today in the accelerated computing and GPU world, you can use CUDA and then you can only run on an Nvidia GPU, or you can go use AMD's CUDA equivalent running on an AMD GPU,â Lavender told VentureBeat. "You can't use CUDA to program an Intel GPU, so what do you use?" That's where Intel is contributing heavily to the open-source SYCL specification (SYCL is pronounced like "sickle") that aims to do for GPU and accelerated computing what Java did decades ago for application development. Intel's investment in SYCL is not entirely selfless and isn't just about supporting an open-source effort; it's also about helping to steer more development toward its recently released consumer and data center GPUs. SYCL is an approach for data parallel programming in the C++ language and, according to Lavender, it looks a lot like CUDA. To date, SYCL development has been managed by the Khronos Group, which is a multi-stakeholder organization that is helping to build out standards for parallel computing, virtual reality and 3D graphics. On June 1, Intel acquired Scottish development firm Codeplay Software, which is one of the leading contributors to the SYCL specification. "We should have an open programming language with extensions to C++ that are being standardized, that can run on Intel, AMD and Nvidia GPUs without changing your code," Lavender said. Lavender is also a realist and he knows that there is a lot of code already written specifically for CUDA. That's why Intel developers built an open-source tool called SYCLomatic, which aims to migrate CUDA code into SYCL. Lavender claimed that SYCLomatic today has coverage for approximately 95% of all the functionality that is present in CUDA. He noted that the 5% SYCLomatic doesn't cover are capabilities that are specific to Nvidia hardware. With SYCL, Lavender said that there are code libraries that developers can use that are device independent. The way that works is code is written by a developer once, and then SYCL can compile the code to work with whatever architecture is needed, be it for an Nvidia, AMD or Intel GPU. Looking forward, Lavender said that he's hopeful that SYCL can become a Linux Foundation project, to further enable participation and growth of the open-source effort. [...] "We should have write once, run everywhere for accelerated computing, and then let the market decide which GPU they want to use, and level the playing field," Lavender said. ' -- source: https://news.slashdot.org/story/22/10/04/2225214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

VideoLAN threatens to sue India gov’t as ISPs keep blocking VLC website
by Peter Reutemann 05 Oct '22

05 Oct '22

'VideoLAN is threatening to sue India's government, saying it has received no explanation for why the VLC website has been blocked by Indian ISPs for the past six months. "In March 2022, to our shock and dismay, the URL 'https://www.videolan.org/' appeared to have been blocked for viewing in India without any prior notice to me or any other person in the organization," VideoLAN president and lead VLC developer Jean-Baptiste Kempf wrote in a September 30 letter to India's Department of Telecommunications. "Despite reportage and uproar on social media, no reasons for blocking the URL were provided to us, or to the Indian public." The letter said attempts to reach the URL in India resulted in the message, "Your requested URL has been blocked as per the directions received from the Department of Telecommunications, Government of India." VideoLAN is a French nonprofit organization that developed the free, open source VLC Media Player. In an email, Kempf told Ars that "VideoLAN is an organization that does not do politics (we only take position on anti-DRM and pro-open source subjects). So this topic is a bit of a shock to us." VideoLAN's letter told Indian government officials that the blocking "is particularly shocking to us, since the Government of India itself endorses the use of VLC as a part of its Digital India initiative, where it has expressed its intention to use open-source softwares for government applications. In fact, the Government of India also appears to use VLC Media Player's icon and logo on its website promoting open source softwares." The letter to India's government said, "VLC is currently being used by 80 million Indians, and has consistently seen an average of 25 million downloads per year in India since its release. For millions of Indians VLC is the primary choice for running all kinds of media formats for free."' -- source: https://arstechnica.com/tech-policy/2022/10/videolan-gets-no-answers-on-why… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu 22.10 (Kinetic Kudu) Beta Released with GNOME 43, Linux Kernel 5.19
by Peter Reutemann 04 Oct '22

04 Oct '22

'Featuring the latest GNOME 43 desktop environment, Ubuntu 22.10 beta comes with PipeWire as the default sound system, which is accompanied by WirePlumber as its session and policy manager, GCC 12 as the default system compiler, support for the WebP image format out of the box, as well as updated components and apps. But the most interesting part of this release is the fact that Ubuntu Unity is now available as an official flavor, featuring the good old Unity7 desktop environment on top of an Ubuntu 22.10 base. Canonical decided to accept Ubuntu Unity as an official flavor starting with the Kinetic Kudu release in late October.' -- source: https://9to5linux.com/ubuntu-22-10-kinetic-kudu-beta-released-with-gnome-43… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

North Island GP Network Compromised
by Lawrence D'Oliveiro 04 Oct '22

04 Oct '22

Pinnacle Midlands Health Network, which services medical practices in Taranaki, Rotorua, Taupō-Tūrangi, Thames-Coromandel and Waikato, had its systems broken into last Wednesday, though the incident is only coming to light today <https://www.nzherald.co.nz/nz/patient-details-compromised-in-cyber-attack-o…>. It doesn’t appear like they hold medical information about patients (beyond NHI numbers), only personal contact details.

1 0

Patient details compromised in cyber attack on North Island GP network
by Peter Reutemann 04 Oct '22

04 Oct '22

NZ Herald reports: 'Patient details have been compromised in a cyber attack targeting a network of GP services across the North Island. Pinnacle Midlands Health Network said in a statement that the "cyber incident" impacted some of its IT services. Offices and practices in Taranaki, Rotorua, Taupō-Tūrangi, Thames-Coromandel and Waikato were impacted. [...] Pinnacle holds personal information such as names, addresses and national health index numbers. Butcher said GP notes were not stored on their files.' -- source: https://www.nzherald.co.nz/nz/patient-details-compromised-in-cyber-attack-o… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Still can’t buy a Raspberry Pi board? Things aren’t getting better anytime soon
by Peter Reutemann 04 Oct '22

04 Oct '22

'Shortages for lots of tech components, including things like DDR5 and GPUs, have eased quite a bit since the beginning of 2022, and prices have managed to go down as availability improves. But that reprieve hasn't come for hobbyists hoping to get a Raspberry Pi, which remains as hard to buy today as it was a year ago. The most recent update on the situation comes from Raspberry Pi founder Eben Upton via YouTuber Jeff Geerling—Upton told Geerling that Pi boards are subject to the same supply constraints since the last time he wrote a post about the situation in April. Around 400,000 Pi boards are still produced per month, and some of these are being earmarked to be sent out to consumer retail sites. But Upton says that most of these are still being reserved for and sold to commercial customers who rely on Pi boards to run their businesses.' -- source: https://arstechnica.com/gadgets/2022/10/still-cant-buy-a-raspberry-pi-board… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 6.0 arrives with support for newer chips, core fixes, and oddities
by Peter Reutemann 04 Oct '22

04 Oct '22

'A stable version of Linux 6.0 is out, with 15,000 non-merge commits and a notable version number for the kernel. And while major Linux releases only happen when the prior number's dot numbers start looking too big—"there is literally no other reason"—there are a lot of notable things rolled into this release besides a marking in time. Most notable among them could be a patch that prevents a nearly two-decade slowdown for AMD chips, based on workaround code for power management in the early 2000s that hung around for far too long. Intel's Dave Hansen wrote the patch that made it into 6.0, noting in a comment on an Ars post that the issue had become an expensive drain as AMD systems gained higher CPU core counts. The average desktop user won't see huge gains, but larger systems working on intensive input/output applications should benefit. Intel's new Arc GPUs are supported in their discrete laptop form in 6.0 (though still experimental). Linux blog Phoronix notes that Intel's ARC GPUs all seem to run on open source upstream drivers, so support should show up for future Intel cards and chipsets as they arrive on the market. Linux 6.0 includes several hardware drivers of note: fourth-generation Intel Xeon server chips, the not-quite-out 13th-generation Raptor Lake and Meteor Lake chips, AMD's RDNA 3 GPUs, Threadripper CPUs, EPYC systems, and audio drivers for a number of newer AMD systems. One small, quirky addition points to larger things happening inside Linux. Lenovo's ThinkPad X13s, based on an ARM-powered Qualcomm Snapdragon chip, get some early support in 6.0. ARM support is something Linux founder Linus Torvalds is eager to see—he recently wrote release notes for kernel versions from his M2-powered MacBook Air and believes that more people using Linux on ARM devices leads to more bug reports, more patches, and more enthusiasm. Among other changes you can find in Linux 6.0, as compiled by LWN.net (in part one and part two): - ACPI and power management improvements for Sapphire Rapids CPUs - Support for SMB3 file transfer inside Samba, while SMB1 is further deprecated - More work on RISC-V, OpenRISC, and LoongArch technologies - Intel Habana Labs Gaudi2 support, allowing hardware acceleration for machine-learning libraries - A "guest vCPU stall detector" that can tell a host when a virtual client is frozen Not included in 6.0 are Rust enhancements, but those are likely coming in the next point release, 6.1. Rust, a memory-safe language sponsored by the Mozilla project, started out as something Torvalds took a wait-and-see approach toward and is now something he was hoping to see in 6.0. "Unless something odd happens, it will make it into 6.1," Torvalds told ZDNet's Steven Vaughan-Nichols in mid-September. Even just having the "core infrastructure" for Rust in 6.1 signifies a big change in Linux, which has long been dominated by C languages (however extended and modified). It must be noted that in 2022, there are patches in Linux 6.0 to help Atari's Falcon computers from the early 1990s (or their emulated descendants) better handle VGA modes, color, and other issues.' -- source: https://arstechnica.com/gadgets/2022/10/linux-6-0-arrives-with-support-for-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Fall And Rise Of Xen
by Lawrence D'Oliveiro 03 Oct '22

03 Oct '22

Here’s a report <https://www.theregister.com/2022/09/30/citrix_xen/> on a talk by the software development manager at Citrix, detailing the ups and downs in the history of their Xen hypervisor. Initially they had a “freemium” model, with an open-source “community” version and a proprietary paid “enterprise” version with more capabilities. This worked well and brought in sufficient revenue to be sustainable. Then they decided to switch to make the “enterprise” version open-source as well, relying on customers’ willingness to continue to pay maintenance rather than support the code themselves. This bet failed to pay off, and revenue crashed. On the other hand, Citrix did not include the “accompanying tooling” (not sure what they mean here -- build tools? Add-on admin tools?) with the source code, making it hard for others to use that code. (Were the big “enterprise” users the ones able to figure that out?) Then they tried to go back to a “freemium” model, with restrictions being imposed on the open-source version. While this did restore the revenue stream, it also antagonized a significant part of the community that had been using the open-source version in various unusual and creative ways. These users forked the code to create XCP-ng, leaving Citrix behind. I suppose the lesson to take from this is that “freemium” works, but it is best if you do things that way from the beginning: trying to switch to it (or switch back to it) from an all-Free model can be painful.

1 0

OpenWRT on Linksys WRT1900ACS
by Peter Reutemann 03 Oct '22

03 Oct '22

Hi everyone I finally bit the bullet and installed OpenWRT on my Linksys WRT1900ACS (v2) router. The main reason was the stupid (and incredibly insecure) guest network implementation that the router came with. Despite supplying a password in the admin interface, the network was run as an open network that anyone could access. The password didn't seem to be used at all... Not exactly what I had in mind! Since Ian presented on OpenWRT before, I at least had a rough idea on what I could expect in user interface and functionality, which helped a lot. :-) In case someone should have the same router, I found the following links very useful: - general info on the router and links to images https://openwrt.org/toh/linksys/wrt1900acs - tutorial for migrating your router to OpenWRT https://www.albertogonzalez.net/how-to-install-openwrt-on-the-linksys-wrt19… NB: you need to plug in via ethernet after flashing, since the wlan is not enabled by default - getting fibre working here in NZ (VLAN 10) http://www.lindesay.co.nz/blog/2019/2019-openwrt-nz-fibre/ - setting up a guest wifi network https://openwrt.org/docs/guide-user/network/wifi/guestwifi/configuration_we… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Debian Chooses Reasonable, Common Sense Solution To Dealing With Non-Free Firmware
by Peter Reutemann 03 Oct '22

03 Oct '22

'Michael Larabel writes via Phoronix: Debian developers have been figuring out an updated stance to take on non-free firmware considering the increasing number of devices now having open-source Linux drivers but requiring closed-source firmware for any level of functionality. The voting on the non-free firmware matter has now concluded and the votes tallied... The debian votes option 5 as winning: "Change SC for non-free firmware in installer, one installer." Basically the Debian Installer media will now be allowed to include non-free firmware and to automatically load/use it where necessary while informing the user of it, etc. Considering the state of the hardware ecosystem these days, it's reasonable and common sense since at least users will be able to easily make use of their graphics cards, network adapters, and more. Plus a number of modern CPU security mitigations also requiring the updated closed-source microcode. So all in, I am personally happy with this decision as it will allow for a more pleasant experience for Debian on modern systems and one akin to what is found with other Linux distributions. The solution is described in full via the Debian Wiki.' -- source: https://linux.slashdot.org/story/22/10/02/1650200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Quis Custodiet Ipsos Custodes?
by Lawrence D'Oliveiro 01 Oct '22

01 Oct '22

Came across yet another crop of articles recently which painfully highlight the problems with having social-media companies manage their own moderation. This one <https://arstechnica.com/gaming/2022/09/youtube-age-restriction-quagmire-exp…> shows the inconsistencies in the criteria that YouTube uses to apply age restrictions to uploaded videos. Not only are the criteria mysterious, but the appeal process is opaque, and too often the only way to get results is by appeal to the popular fanbase. Assuming you have one. Related to that, Facebook earlier banned any promotion on its platform of a re-release of a movie called “Beautiful Blue Eyes” <https://arstechnica.com/tech-policy/2022/09/holocaust-filmmaker-says-meta-d…>, seemingly not because of its content (partly set during the Nazi Holocaust), but because of the title. An appeal was rejected with “our decision is final”. Only for the ban to be lifted later, absolutely nothing to do with any public outcry, you can take our word on that. Then there is this coronial inquest <https://arstechnica.com/tech-policy/2022/09/coroner-lists-instagram-algorit…> into the self-inflicted death of a young teen who had been watching way too many posts on Pinterest and Instagram promoting self-harm. Pinterest at least had the humility to admit that their moderation system was not satisfactory and needed to be improved. But Meta (parent company of Instagram and Facebook) sent their “head of health and well-being” to testify that the content was classified as “safe” according to their standards. Free speech between mature adults is one thing, keeping impressionable youngsters safe is quite another.

2 2

Google Delays the Death of Manifest V2 Extensions To 2024
by Peter Reutemann 01 Oct '22

01 Oct '22

'Google announced an extension of the deadline to remove support for Manifest V2 extensions in the company's Chrome browser and the open source Chromium core. The change does not impact the core decision of removing support for Manifest V2 extensions in favor of Manifest V3. Dubbed, the adblocker killer initially, due to limitations imposed on content blocking and other types of browser extensions, Google made concessions that allows content blockers to run on Chrome after the final switch is made. Extensions are still limited in comparison to Manifest V2, especially if multiple that use filtering functionality are run simultaneously, or if lots of filters are activated in a single extension. Google's initial plan was to stop supporting Manifest V2 extensions in Chrome by June 2023. For most users, support would run out in January 2023, but an Enterprise policy would enable users to extend the deadline by six months.' -- source: https://tech.slashdot.org/story/22/09/30/1437209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

2022 Web Almanac
by Lawrence D'Oliveiro 30 Sep '22

30 Sep '22

Report <https://devclass.com/2022/09/29/massive-web-tech-survey-shows-how-bad-habit…> on the 2022 Web Almanac (sort of a “state of the Web” report), which is in the process of being published. * WebAssembly is still not being used a lot * WordPress is one of the worst-performing content-management systems, and also still the most popular (and its popularity is still growing) * Image formats: the time has come to move beyond sRGB and 1990s-era formats (e.g. replace JPEG with the more efficient WebP) * JavaScript: a lot of pages seem to load code which is not actually used I was looking up how page-loading performance is measured, and here is my understanding of what the terms mean: * Largest Contentful Paint (LCP): the time to render the largest image/text block on the page. * First Input Delay (FID): how long after the user clicks on a link or a control etc before the browser starts responding. * Cumulative Layout Shift (CLS): a measure of how much things move around on the page while the page is still loading. This is a product of the “impact fraction” (proportion of the viewport affected by movements between frames) and the “distance fraction” (largest distance moved by an element, as a fraction of viewport size).

1 0

Creator Of COVID-19 Tracker Dashboard Wins Science Prize
by Lawrence D'Oliveiro 30 Sep '22

30 Sep '22

Professor Lauren Gardner has been awarded the 2022 Lasker-Bloomberg Public Service Award <https://www.aljazeera.com/news/2022/9/29/creator-of-johns-hopkins-covid-tra…> for co-creating the Johns Hopkins COVID-19 dashboard. This has been collecting and making available information about the pandemic since almost before it came to world attention. For those who don’t want to go through that Twitter link, the dashboard is here <https://gisanddata.maps.arcgis.com/apps/dashboards/bda7594740fd40299423467b…>. Just tried the “Raw Data” link, and it goes to this GitHub area <https://github.com/CSSEGISandData>.

1 0

Numerous orgs hacked after installing weaponized open source apps
by Peter Reutemann 30 Sep '22

30 Sep '22

'Hackers backed by the North Korean government are weaponizing well-known pieces of open source software in an ongoing campaign that has already succeeded in compromising "numerous" organizations in the media, defense and aerospace, and IT services industries, Microsoft said on Thursday. ZINC—Microsoft's name for a threat actor group also called Lazarus, which is best known for conducting the devastating 2014 compromise of Sony Pictures Entertainment—has been lacing PuTTY and other legitimate open source applications with highly encrypted code that ultimately installs espionage malware. The hackers then pose as job recruiters and connect with individuals of targeted organizations over LinkedIn. After developing a level of trust over a series of conversations and eventually moving them to the WhatsApp messenger, the hackers instruct the individuals to install the apps, which infect the employees' work environments. "The actors have successfully compromised numerous organizations since June 2022," members of the Microsoft Security Threat Intelligence and LinkedIn Threat Prevention and Defense teams wrote in a post. "Due to the wide use of the platforms and software that ZINC utilizes in this campaign, ZINC could pose a significant threat to individuals and organizations across multiple sectors and regions." PuTTY is a popular terminal emulator, serial console, and network file transfer application that supports network protocols, including SSH, SCP, Telnet, rlogin, and raw socket connection. Two weeks ago, security firm Mandiant warned that hackers with ties to North Korea had Trojanized it in a campaign that successfully compromised a customer's network. Thursday's post said the same hackers have also weaponized KiTTY, TightVNC, Sumatra PDF Reader, and muPDF/Subliminal Recording software with code that installs the same espionage malware, which Microsoft has named ZetaNile.' -- source: https://arstechnica.com/information-technology/2022/09/north-korean-threat-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Security Recommendation: Try Turning It Off And On Again
by Lawrence D'Oliveiro 29 Sep '22

29 Sep '22

This report on the “Chaos” malware suite <https://arstechnica.com/information-technology/2022/09/never-before-seen-ma…> contains an interesting snippet: A reminder to small office router owners everywhere: Most router malware can't survive a reboot. Consider restarting your device every week or so. Seems like server-based malware is predominantly running entirely from RAM these days, to avoid leaving any forensic traces in the filesystem. But you can use this characteristic against them, since a simple reboot becomes enough to clear the infection.

1 0

We interviewed Linux OS through an AI bot to discover its secrets
by Peter Reutemann 29 Sep '22

29 Sep '22

'Millions of people use Linux every day, but we rarely stop to think about how the operating system feels about it. Wouldn't it be nice to know what Linux really thinks about open source, Windows, Macs, and the command line? Until now, this has been impossible. But thanks to a new AI chat tool, we're able to find out. Two weeks ago, a website called Character.AI opened a public beta that allows visitors to create a chat bot based on any character they can imagine. You input a few parameters, and the AI does the rest using a large language model similar to GPT-3. So we called forth "The Linux OS" as a bot to ask it a few questions about itself. The results were fun and surprising. Using Character.AI is a lot like a texting conversation. You type in what you want to ask, and you read the AI character's responses in written form as the chat history scrolls upward. As with GPT-3, the code behind Character.AI has likely learned from absorbing millions of text sources found on the Internet. As such, its AI characters can easily respond with erroneous or fictional information. In fact, the site carries a bold disclaimer reading, "Remember: Everything Characters say is made up!" [...] Linux: Hello, I am Linux, an open-source operating system. Ars Technica: Hello, this is Benj Edwards, and I am a journalist at Ars Technica. I would like to ask you some questions in an interview. Is that OK? Linux: I, Linux, would be pleased to provide such an interview. Ars: How old are you? Linux: I was "born" in 1991, although the first public release was version 1.0 in 1994.' -- source: https://arstechnica.com/information-technology/2022/09/we-interviewed-linux… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Serious vulnerabilities in Matrix’s end-to-end encryption have been patched
by Peter Reutemann 29 Sep '22

29 Sep '22

'Developers of the open source Matrix messenger protocol are releasing an update on Thursday to fix critical end-to-end encryption vulnerabilities that subvert the confidentiality and authentication guarantees that have been key to the platform's meteoric rise. Matrix is a sprawling ecosystem of open source and proprietary chat and collaboration clients and servers that are fully interoperable. The best-known app in this family is Element, a chat client for Windows, macOS, iOS, and Android, but there's a dizzying array of other members as well. Matrix roughly aims to do for real-time communication what the SMTP standard does for email, which is to provide a federated protocol allowing user clients connected to different servers to exchange messages with each other. Unlike SMTP, however, Matrix offers robust end-to-end encryption, or E2EE, designed to ensure that messages can't be spoofed and that only the senders and receivers of messages can read the contents. Matthew Hodgson—the co-founder and project lead for Matrix and the CEO and CTO at Element, the maker of the flagship Element app—said in an email that conservative estimates are that there are about 69 million Matrix accounts spread throughout some 100,000 servers. The company currently sees about 2.5 million monthly active users using its Matrix.org server, though he said this is also likely an underestimate. Among the hundreds of organizations announcing plans to build internal messaging systems based on Matrix are Mozilla, KDE, and the governments of France and Germany. On Wednesday, a team of researchers published research that reports a host of vulnerabilities that undermine Matrix's authentication and confidentiality guarantees. All of the attacks described by the researchers require the aid of a malicious or compromised homeserver that targets the users who connect to it. In some cases, there are ways for experienced users to detect an attack is underway.' -- source: https://arstechnica.com/information-technology/2022/09/matrix-patches-vulne… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Stock Hacking TV Footage
by Lawrence D'Oliveiro 27 Sep '22

27 Sep '22

On the TVNZ news a few minutes ago, in the stock footage they were showing while John Campbell was talking about some tech-related story or other, I saw the words “struct group_info init_groups” pop up. So I did an online search, and found this Reddit thread <https://www.reddit.com/r/InternetIsBeautiful/comments/g8hcgo/this_site_make…>. Turns out there’s a website where you can pretend to be typing furiously, and this text comes up, as though it was what you were typing, to let you play at being a hacker on TV. Incidentally, the code in question is based on real code, from the Linux kernel.

1 0

20-year-old Linux workaround is still slowing down AMD systems
by Peter Reutemann 27 Sep '22

27 Sep '22

'AMD has come a long way since 2002, but the Linux kernel still treats modern Threadrippers like Athlon-era systems—at least in one potentially lag-inducing respect. AMD engineer Prateek Nayak recently submitted a patch to Linux's processor idle drivers that would "skip dummy wait for processors based on the Zen microarchitecture." When ACPI support was added to the Linux kernel in 2002—written by Andy Grover, committed by Linus Torvalds—it included a "dummy wait op." The system essentially read data with no purpose other than delaying the next instruction until the CPU could fully stop with the STPCLK# command. This allowed for some power saving and compatibility during the early days of ACPI implementation when some chipsets wouldn't move to an idle state when one would expect it. But today's Zen-based AMD chips don't need this workaround, and, as Nayak writes, it's hurting them, at least in specific workloads on Linux. Testing with instruction-based sampling (IBS) workloads shows that "a significant amount of time is spent in the dummy op, which incorrectly gets accounted as C-State residency." The CPU, seeing all this low-effort dummy work, can push into deeper, slower C-State, which then makes the CPU take longer to "wake up," especially on jobs that require lots of switching between busy and idle states. Nayak ran tests in tbench on a dual-socket Zen3 system against the baseline Linux kernel, a kernel with the C2 state entirely disabled, and a kernel with the dummy wait operation patched out. His patched version saw a 1,390 percent increase in minimum MB/s throughput and a 51 percent increase in mean MB/s over the baseline kernel, often just a little behind having C2 disabled entirely.' -- source: https://arstechnica.com/gadgets/2022/09/20-year-old-linux-workaround-is-sti… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Senators Introduce a Bill To Protect Open-Source Software
by Peter Reutemann 25 Sep '22

25 Sep '22

'Washington Post: When researchers discovered a vulnerability in the ubiquitous open-source log4j system last year that could've affected hundreds of millions of devices, the executive branch snapped into action and major tech companies huddled with the White House. Now, leaders of the Senate Homeland Security and Governmental Affairs Committee are introducing legislation to help secure open-source software, first reported by The Cybersecurity 202. Chairman Gary Peters (D-Mich.) and top ranking Republican Rob Portman (Ohio) plan to hold a vote next week on the bill they're co-sponsoring. The Peters/Portman legislation would direct the Cybersecurity and Infrastructure Security Agency to develop a way to evaluate and reduce risk in systems that rely on open-source software. Later, CISA would study how that framework could apply to critical infrastructure. The log4j "incident presented a serious threat to federal systems and critical infrastructure companies -- including banks, hospitals, and utilities -- that Americans rely on each and every day for essential services," Peters said in a written statement. "This common-sense, bipartisan legislation will help secure open source software and further fortify our cybersecurity defenses against cybercriminals and foreign adversaries who launch incessant attacks on networks across the nation." Here's how the Peters-Portman legislation works, as outlined in the report: - It directs CISA to hire open-source experts "to the greatest extent practicable." - It gives the agency a year to publish a framework on open-source code risk. A year later and periodically thereafter, CISA would perform an assessment of open-source code components that federal agencies commonly use. - Also, two years after publishing the initial framework, CISA would have to study whether it could be used in critical infrastructure outside the government and potentially work with one or more critical infrastructure sectors to voluntarily test the idea. - Other agencies would have roles as well, such as the Office of Management and Budget publishing guidance to federal chief information officers on secure use of open-source software. ' -- source: https://news.slashdot.org/story/22/09/23/2357254 What about donating time/money to "critical" open source projects? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AV1 Update Reduces CPU Encoding Times By Up To 34 Percent
by Peter Reutemann 25 Sep '22

25 Sep '22

'According to Phoronix, Google has released a new AOM-AV1 update -- version 3.5, that drastically improves encode times when streaming, rendering, or recording from the CPU. At its best, the update can improve encoding times by up to 34%. Tom's Hardware reports: It is a fantastic addition to AV1's capabilities, with the encoder becoming very popular among powerful video platforms such as YouTube. In addition, we are also seeing significant support for AV1 hardware acceleration on modern discrete GPUs now, such as Intel's Arc Alchemist GPUs and, most importantly - Nvidia's RTX 40-series GPUs. Depending on the resolution, encoding times with the new update have improved by 20% to 30%. For example, at 1080P, encode times featuring 16 threads of processing are reduced by 18% to 34%. At 4K, render times improved by 18% to 20% with 32 threads. Google could do this by adding Frame Parallel Encoding to heavily multi-threaded configurations. Google has also added several other improvements contributing to AV1's performance uplifts in other areas - specifically in real-time encoding. In other words, CPU utilization in programs such as OBS has been reduced, primarily for systems packing 16 CPU threads. As a result, they are allowing users to use those CPU resources for other tasks or increase video quality even higher without any additional performance cost. If you are video editing and are rendering out a video in AV1, processing times will be vastly reduced if you have a CPU with 16 threads or more. ' -- source: https://news.slashdot.org/story/22/09/24/1749206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Urges Action To Unpick Platform Browser Lock-ins
by Peter Reutemann 23 Sep '22

23 Sep '22

'As antitrust regulators around the world dial up scrutiny of platform power, Mozilla has published a piece of research digging into the at times subtle yet always insidious ways operating systems exert influence to keep consumers locked to using their own-brand browsers rather than seeking out and switching to independent options -- while simultaneously warning that competition in the browser market is vital to ensure innovation and choice for consumers and, more broadly, protect the vitality of the open web against the commercial giants trying to wall it up. TechCrunch: "Billions of people across the globe are dependent on operating systems from the largest technology companies. Amazon, Apple, Google, Microsoft and Meta each provide their own browser on their operating systems and each of them uses their gatekeeper position provider to preference their own browsers over independent rivals. Whether it is Microsoft pushing Firefox users to switch their default on Windows computers, Apple restricting the functionality of rival browsers on iOS smartphones or Google failing to apply default browser settings across Android, there are countless examples of independent browsers being inhibited by the operating systems on which they are dependent," Mozilla writes in a summary of its findings. "This matters because American consumers and society as a whole suffer. Not only do people lose the ability to determine their own online experiences but they also receive less innovative and lower quality products. In addition, they can be forced to accept poorer privacy outcomes and even unfair contracts. By contrast, competition from independent browsers can help to drive new features, as well as innovation in areas like privacy and security."' -- source: https://tech.slashdot.org/story/22/09/22/1841231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GNU Grep 3.8 Starts Issuing Warnings About Using Egrep and Fgrep
by Peter Reutemann 22 Sep '22

22 Sep '22

'After 104 commits from six different people, GNU grep was released Saturday, reports Phoronix. The biggest change? "It's now made more clear that if you are still relying on the egrep and fgrep commands, it's past due for switching to just grep with the appropriate command-line arguments." The egrep and fgrep commands have been deprecated since 2007. Beginning with GNU Grep 3.8 today, calling these commands will now issue a warning to the user that instead they should use grep -E and grep -F, respectively. Eventually, GNU Grep will drop the egrep / fgrep commands completely but there doesn't seem to be a firm deadline yet for when that removal will happen. >From grep's updated manual: 7th Edition Unix had commands egrep and fgrep that were the counterparts of the modern 'grep -E' and 'grep -F'. Although breaking up grep into three programs was perhaps useful on the small computers of the 1970s, egrep and fgrep were not standardized by POSIX and are no longer needed. In the current GNU implementation, egrep and fgrep issue a warning and then act like their modern counterparts; eventually, they are planned to be removed entirely. If you prefer the old names, you can use use your own substitutes, such as a shell script... Other notable changes from the release announcement: - The confusing GREP_COLOR environment variable is now obsolescent. Instead of GREP_COLOR='xxx' use GREP_COLORS='mt=xxx' - Regular expressions with stray backslashes now cause warnings' -- source: https://news.slashdot.org/story/22/09/05/0135254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Repairable, upgradeable Framework Laptop will also be available as a Chromebook
by Peter Reutemann 22 Sep '22

22 Sep '22

'Fans of the modular Framework Laptop who also prefer ChromeOS to Windows or Linux are in for a treat: Framework and Google are announcing a Chromebook Edition of the laptop today. It has the same basic hardware design and works with most of the same parts as the regular Framework Laptop but with tweaks to make it a full-fledged Chromebook. While you could always take a standard Framework Laptop and install ChromeOS Flex on it, the standard version of ChromeOS still has a few features that Flex doesn't, including Android app support via Google Play, automated firmware updates, and a few other security and device management features. Framework says that the Chromebook Edition laptop will be available for preorder starting today—a version with a Core i5-1240P CPU will cost $999, although you'll only need to put down $100 to reserve your preorder. Orders begin shipping in December. Framework is also putting parts specific to the Chromebook Edition laptop into its Framework Marketplace parts store.' -- source: https://arstechnica.com/gadgets/2022/09/repairable-upgradeable-framework-la… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Document Foundation Starts Charging For 'Free' LibreOffice
by Peter Reutemann 22 Sep '22

22 Sep '22

'The Document Foundation, the organization that tends the open source productivity suite LibreOffice, has decided to start charging for one version of the software. The Register reports: LibreOffice is a fork of OpenOffice and is offered under the free/open source Mozilla Public License Version 2.0. A Monday missive from the Document Foundation reveals the org will begin charging 8.99 euros for the software -- but only when sold via Apple's Mac App Store. That sum has been styled a "convenience fee ... which will be invested to support development of the LibreOffice project." The foundation suggests paying up in the Mac App Store is ideal for "end users who want to get all of their desktop software from Apple's proprietary sales channel." Free downloads of LibreOffice for macOS from the foundation's site will remain available and arguably be superior to the App Store offering, because that version will include Java. The foundation argued that Apple does not permit dependencies in its store, so it cannot include Java in the 8.99 euro offering. The version now sold in the App Store supersedes a previous offering provided by open source support outfit Collabora, which charged $10 for a "Vanilla" version of the suite and threw in three years of support. The foundation's marketing officer Italo Vignoli said the change was part of a "new marketing strategy." "The Document Foundation is focused on the release of the Community version, while ecosystem companies are focused on a value-added long-term supported versions targeted at enterprises," Vignoli explained. "The distinction has the objective of educating organizations to support the FOSS project by choosing the LibreOffice version which has been optimized for deployments in production and is backed by professional services, and not the Community version generously supported by volunteers." "The objective is to fulfil the needs of individual and enterprise users in a better way," Vignoli added, before admitting "we know that the positive effects of the change will not be visible for some time. Educating enterprises about FOSS is not a trivial task and we have just started our journey in this direction."' -- source: https://apple.slashdot.org/story/22/09/20/2039208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Linus Torvalds: Rust Will Go Into Linux 6.1
by Peter Reutemann 20 Sep '22

20 Sep '22

'As previously indicated on Slashdot, Rust was slated to be coming to the Linux Kernel sometime in the 6.x version. Well wonder no longer on which version of kernel 6.x will have the first bits of Rust officially in the kernel, as Linus has confirmed that 6.1 will be the first with the new NVMe kernel drivers being in Rust. The first version non-production ready code for the NVMe Rust based kernel drivers were already producing performance comparable to C code. So the final drivers to hit 6.1 are already looking promising. It also helped Rust's case that, thanks to the ground-breaking work of Linux kernel and Rust developer Miguel Ojeda, Rust on Linux has gotten much more mature. Kernel maintainers were convinced it is time to move forward with Rust in Linux. In short, they agreed that Rust on Linux was ready for work.' -- source: https://linux.slashdot.org/story/22/09/19/205239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next *Tuesday*
by Peter Reutemann 20 Sep '22

20 Sep '22

Hi everyone We have a meeting next *Tuesday* (since Monday is remembrance day) with the following topic: 'People that never learned to touch type find that typing can severely impede creativity. Rod Aldridge will talk about his experience of getting Google's speech-to-text working on his computer to speed up his writing, what to look out for, how it works and how well it works.' Details: https://www.meetup.com/waikatolinuxusersgroup/events/283776705/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Meeting next Monday
by Peter Reutemann 20 Sep '22

20 Sep '22

Hi everyone We have a meeting next week on Monday but no speaker so far. Anyone keen on demoing or presenting (distro/software/etc)? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Chrome for Android gets fingerprint-protected Incognito tabs
by Peter Reutemann 19 Sep '22

19 Sep '22

'Here's a fun new feature for Chrome for Android: fingerprint-protected Incognito tabs. 9to5Google discovered the feature in the Chrome 105 stable channel, though you'll have to dig deep into the settings to enable it at the moment. If you want to add a little more protection to your private browsing sessions, type "chrome://flags/#incognito-reauthentication-for-android" into the address bar and hit enter. After enabling the flag and restarting Chrome, you should see an option to "Lock Incognito tabs when you leave Chrome." If you leave your Incognito session and come back, an "unlock Incognito" screen will appear instead of your tabs, and you'll be asked for a fingerprint scan. Chrome on iOS has had a biometrics-backed Incognito feature, called "Privacy Screen," for a few years. This is a first for Android, though. Chrome's "flags" menu is technically for experiments and in-development features, so this isn't guaranteed to become a readily accessible user feature, but making it to the stable channel—plus the feature already existing on iOS—is a good sign.' -- source: https://arstechnica.com/gadgets/2022/09/chrome-for-android-gets-fingerprint… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Beloved browser extension acquired by non-beloved antivirus firm
by Peter Reutemann 19 Sep '22

19 Sep '22

'Browser extension I don't care about cookies does one job and does it well. It automatically removes the annoying-but-mandated "This website uses cookies" notices from websites. People like it, donate to it, and don't ask more of it, a rare find for free software. "Damn, this is the **** bro, it saved like 50 minutes of my gaming time lol," reads one review on the tool's Microsoft Edge Add-Ons page. The tone changed when the solo developer posted "GREAT NEWS" on the extension's website. Avast, a giant in cybersecurity that just completed an $8.1 billion merger with NortonLifeLock, will acquire the 10-year-old software for an undisclosed price.' -- source: https://arstechnica.com/gadgets/2022/09/beloved-browser-extension-acquired-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu Aims To Support the $16+ Sipeed LicheeRV and Other RISC-V Boards
by Peter Reutemann 19 Sep '22

19 Sep '22

'"In addition to Ubuntu supporting the StarFive VisionFive and Nezha RISC-V boards, Canonical engineers are also working on supporting the Sipeed LicheeRV board too for next month's 22.10 release," reports Phoronix. "The Sipeed LicheeRV is notable in being one of the cheapest RISC-V boards out there: pricing starts at $16.90 USD...." The Sipeed LicheeRV uses the Allwinner D1 SoC and is powered by a single-core XuanTie C906 64-bit RISC-V processor. This single-core RISC-V processor runs at just 1.0GHz. Yes, this is a very cheap but slow board. The LicheeRV is primarily for networking purposes and other IoT use-cases.... The Sipeed LicheeRV was announced last year and initially targeting support for OpenWrt-based Linux distributions, but Canonical recently has been working on getting support for this RISC-V board squared away in time for Ubuntu 22.10. This appears to be part of an increasing focus by the Ubuntu maker for being a leading distribution contender for RISC-V hardware.' -- source: https://hardware.slashdot.org/story/22/09/17/1728244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fun Mistake Of The Week
by Lawrence D'Oliveiro 17 Sep '22

17 Sep '22

Yesterday I was writing a simple, harmless little Python script. I tried running it for the first time, and my terminal session seemed to lock up. A crosshair cursor appeared. I tried clicking in various places and hitting CTRL/C (and other keystrokes) several times. After several tries, I managed to stop the script and get my terminal session back. This happened a couple of times, until I realized my Python script was missing the “#!/usr/bin/python3” “shebang” line at the top. So when I executed it, the system assumed it was a shell script. And the very first command it saw was an “import” statement, which it interpreted as an attempt to call the ImageMagick “import” command <https://imagemagick.org/script/import.php>. This command lets you capture screenshots of selected windows or the entire screen, or parts thereof. Which is where the crosshair cursor came from. And because I had several of these import statements, after I managed to terminate one, it went on to the next one. Once I added the missing script-interpreter line, my script started behaving a bit more sensibly. ;)

1 0

Trojanized versions of PuTTY utility being used to spread backdoor
by Peter Reutemann 17 Sep '22

17 Sep '22

'Researchers believe hackers with connections to the North Korean government have been pushing a Trojanized version of the PuTTY networking utility in an attempt to backdoor the network of organizations they want to spy on. Researchers from security firm Mandiant said on Thursday that at least one customer it serves had an employee who installed the fake network utility by accident. The incident caused the employer to become infected with a backdoor tracked by researchers as Airdry.v2. The file was transmitted by a group Mandiant tracks as UNC4034.' -- source: https://arstechnica.com/information-technology/2022/09/trojanized-versions-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Nearly One In Two Industry Pros Scaled Back Open Source Use Over Security Fears
by Peter Reutemann 16 Sep '22

16 Sep '22

'The Register: About 40 percent of industry professionals say their organizations have reduced their usage of open source software due to concerns about security, according to a survey conducted by data science firm Anaconda. The company's 2022 State of Data Science report solicited opinions in April and May from 3,493 individuals from 133 countries and regions, targeting academics, industry professionals, and students. About 16 percent of respondents identified as data scientists. About 33 percent of surveyed industry professionals said they had not scaled back on open source, 7 percent said they had increased usage, and 20 percent said they weren't sure. The remaining 40 percent said they had. By industry professionals, or commercial respondents as Anaconda puts it, the biz means a data-science-leaning mix of business analysts, product managers, data and machine-learning scientists and engineers, standard IT folks such as systems administrators, and others in technology, finance, consulting, healthcare, and so on. And by scale back, that doesn't mean stop: 87 percent of commercial respondents said their organization still allowed the use of open source. It appears a good number of them, though, are seeking to reducing the risk from relying on too many open source dependencies. Anaconda's report found that incidents like Log4j and reports of "protestware" prompted users of open source software to take security concerns more seriously. Of the 40 percent who scaled back usage of open source, more than half did so after the Log4j fiasco. Some 31 percent of respondents said security vulnerabilities represent the biggest challenge in the open source community today. Most organizations use open source software, according to Anaconda. But among the 8 percent of respondents indicating that they don't, more than half (54 percent, up 13 percent since last year) cited security risks as the reason. Other reasons for not using open source software include: lack of understanding (38 percent); lack of confidence in organizational IT governance (29 percent); "open-source software is deemed insecure, so it's not allowed" (28 percent); and not wanting to disrupt current projects (26 percent).' -- source: https://news.slashdot.org/story/22/09/15/003243 Any library/tool, whether proprietary or not, on which many other systems rely has that same potential "security" problem (plenty of exploits in Windows/Mac, supply-chain corruptions, etc). Just because your code is proprietary doesn't make it any safer. You could simply spend some of your internal budget (that you didn't spend on developing these libraries), to do some code review on them and contribute back. Otherwise you're just a whinging freeloader... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Microsoft Teams Stores Auth Tokens As Cleartext In Windows, Linux, Macs
by Peter Reutemann 15 Sep '22

15 Sep '22

'Security analysts have found a severe security vulnerability in the desktop app for Microsoft Teams that gives threat actors access to authentication tokens and accounts with multi-factor authentication (MFA) turned on. BleepingComputer reports: "This attack does not require special permissions or advanced malware to get away with major internal damage," Connor Peoples at cybersecurity company Vectra explains in a report this week. The researcher adds that by taking "control of critical seats -- like a company's Head of Engineering, CEO, or CFO -- attackers can convince users to perform tasks damaging to the organization." Vectra researchers discovered the problem in August 2022 and reported it to Microsoft. However, Microsoft did not agree on the severity of the issue and said that it doesn't meet the criteria for patching. With a patch unlikely to be released, Vectra's recommendation is for users to switch to the browser version of the Microsoft Teams client. By using Microsoft Edge to load the app, users benefit from additional protections against token leaks. The researchers advise Linux users to move to a different collaboration suite, especially since Microsoft announced plans to stop supporting the app for the platform by December. ' -- source: https://it.slashdot.org/story/22/09/14/1939242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Exploring GNOME-Based UIs For Mobile Linux Devices
by Peter Reutemann 15 Sep '22

15 Sep '22

'"The GNOME desktop environment is one of the most popular user interfaces and suites of apps available for desktop Linux distributions," writes Liliputing. "Now a team of developers have been working to bring GNOME to mobile devices running Linux-based operating systems." GNOME Shell for mobile provides a touch-friendly user interface optimized for smartphones and tablets. And while it looks a bit like Android or iOS at first glance, there are a few key differences. The GNOME team have outlined some of them in an article about recent updates to GNOME Shell on mobile. Like other modern mobile user interfaces, you interact with GNOME shell using taps, swipes, and other gesture-based navigation. What's different is that Android has three different views for navigation: a home screen, app drawer, and multitasking view. iOS has two: home screen and multitasking. But GNOME Shell has a single screen that allows you to view and launch apps and switch between running apps using gestures. There's no need to wait for a new screen to load. In a nutshell, you can swipe up from the bottom of the any screen to view a list of installed apps, thumbnail images showing all currently running apps, and a search box. You can tap an app icon to launch a new app, enter a term in the search box to find an app, or swipe between running apps to switch which app runs in the foreground. You can also keep swiping upward to shrink the multitasking thumbnails and provide more room for app icons. And you can flick thumbnail previews upward to remove an app from the multitasking section. Typing in the search box will bring up relevant results including apps and settings. "One interesting new feature here is that notifications can be swiped away horizontally to close, and notification bubbles can be swiped up to hide them..." the developers point out. "While the current version is definitely still work in progress, it's quite usable overall, so we feel it would make sense to start having experimental GNOME OS Nightly images with it." But Liliputing also notes that it's not the only GNOME-based UI for mobile devices. There's also Purism's Phosh UI — the default UI for the PureOS on its Librem 5 smartphone (and available for other mobile Linux distros including Debian). And Purism recently bragged that its smartphone is now also "the first mobile computer with a truly convergent OS" — meaning it can run on multiple hardware platforms, with apps adapting to their hardware. The Librem 5 [smartphone] uses the same convergent PureOS as our Librem 14 laptop and Mini PCs, with the same adaptive applications that make the Librem 5 more than merely a phone, it's a mobile computer in your pocket that can shape shift into a laptop, tablet, desktop, or even a server.... Scale your Librem 5 up to be a full laptop by attaching the Nexdock. Because our core apps are adaptive, they are ready to run on whatever screen you have.... With phosh-mobile-settings installed, you can flip the nexdock around and use the big screen just like a tablet.... Don't have a laptop dock? The Librem 5 can also act like a desktop computer when connected to a screen, keyboard, and mouse using our USB-C dock. Using the beta phom virtual mouse app, you can turn your Librem 5 into a touchpad mouse while it's connected to the big screen. With the Librem 5, you can keep your desktop computer in your pocket and connect to a bigger screen at home or at the office and use the same apps on the bigger screen without restarting.... With the Librem 5 phone, you're getting much more than smartphone to run mobile-only apps; you're getting a laptop, tablet, desktop, all running software that respects your privacy and freedom.' -- source: https://linux.slashdot.org/story/22/09/11/047224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

DuckDuckGo, Proton, Mozilla Throw Weight Behind Bill Targeting Big Tech 'Surveillance'
by Peter Reutemann 15 Sep '22

15 Sep '22

'A group of privacy-focused organizations have signed a letter imploring US Congress leaders to schedule a vote on a bill that would hamper data collection by tech giants and promote user access to online privacy tools. From a report: In its letter to Congress, addressed to the likes of Mitch McConnell and Nancy Pelosi, the alliance argued that the continued suppression of the American Innovation and Choice Online Act (AICOA) allows "dominant firms" to "limit competition and restrict user choice" when accessing privacy-focused technologies and products. It also accused tech giants of forcing users into accepting their policies of "perpetual surveillance" because of their positions as "gatekeepers," and of using their "influence in society" to steer users away from rival services more committed to privacy. Signatories included the likes of DuckDuckGo, Proton, Brave and Mozilla, among others, representing sectors ranging from VPN and search to web browsers, office software, and more. The letter to Congress fighting for the revival of the AICOA hit back at the idea that the US technology industry is a free market. The 13 signatories, all of which are relatively small in stature, claim the tech giants deliberately wield the depth and breadth of their product portfolios to establish unassailable monopolies.' -- source: https://yro.slashdot.org/story/22/09/14/1644244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Foundation Announces the OpenWallet Foundation To Develop Interoperable Digital Wallets
by Peter Reutemann 14 Sep '22

14 Sep '22

'The Linux Foundation has announced plans for a new collaborative initiative designed to support interoperability across digital wallets, built on an open source bedrock. From a report: The OpenWallet Foundation (OWF), as the new effort is called, is the brainchild of Daniel Goldscheider, CEO of open banking startup Yes.com, though today's announcement reveals a broad gamut of buy-ins from multiple industry players including Okta, Ping Identity, Accenture, CVS Health, OpenID Foundation, among several other public and private bodies. With the Linux Foundation serving as the project's host, this gives OWF sizeable clout as it strives to enable what Goldscheider calls a "plurarity of wallets based on a common core," according to a press release. The news also comes as regulatory bodies across the globe are moving to support competition through enforcing interoperability across systems, including Europe which is currently trying to make messaging interoperability a thing.' -- source: https://news.slashdot.org/story/22/09/13/1350232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi OS improves menus, networking, camera possibilities
by Peter Reutemann 14 Sep '22

14 Sep '22

'The latest Raspberry Pi OS version adds menu search, a more mainstream network and VPN manager, and plenty of camera and machine learning possibilities through a new open source camera package.' -- source: https://arstechnica.com/gadgets/2022/09/raspberry-pi-os-adds-easier-network… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Article: 10 Best Self-Hosted Apps for Your Raspberry Pi
by Peter Reutemann 12 Sep '22

12 Sep '22

It's actually 10 categories with several applications listed for each: 1. Media Server 2. File Sync Server 3. Virtualization Platform 4. Ads Blocker 5. Image Hub 6. Home Automation 7. Security Center 8. News Aggregator 9. Password Manager 10. Gaming Console Full details in the following article: https://linuxiac.com/best-self-hosted-raspberry-pi-apps/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Linux malware combines unusual stealth with a full suite of capabilities
by Peter Reutemann 11 Sep '22

11 Sep '22

'Researchers this week unveiled a new strain of Linux malware that's notable for its stealth and sophistication in infecting both traditional servers and smaller Internet-of-things devices. Dubbed Shikitega by the AT&T Alien Labs researchers who discovered it, the malware is delivered through a multistage infection chain using polymorphic encoding. It also abuses legitimate cloud services to host command-and-control servers. These things make detection extremely difficult. "Threat actors continue to search for ways to deliver malware in new ways to stay under the radar and avoid detection," AT&T Alien Labs researcher Ofer Caspi wrote. "Shikitega malware is delivered in a sophisticated way, it uses a polymorphic encoder, and it gradually delivers its payload where each step reveals only part of the total payload. In addition, the malware abuses known hosting services to host its command and control servers."' -- source: https://arstechnica.com/information-technology/2022/09/new-linux-malware-co… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

Android 13 Raises Minimum System Requirement To 2GB of RAM, 16GB of storage
by Peter Reutemann 10 Sep '22

10 Sep '22

'Android 13 has recently hit the streets, and with it, Google is raising the minimum requirements for Android phones. From a report: Google's latest blog post announced that the minimum amount of RAM for Android Go, the low-end version of Android, is now 2GB for Android 13, whereas previously, it was 1GB. Esper's Mishaal Rahman and Google Product Expert Jason Bayton also claim the minimum storage requirements have been bumped up to 16GB, though Google doesn't seem to have publicly documented this anywhere. The increase in system requirements means any phone that doesn't meet the minimum specs won't be able to update to Android 13. New phones launching with Android 13 will need to meet the minimum requirements to be eligible for Play Store licensing, though launching with an older version of Android (with lower requirements) will still be an option for a while. Technically, anyone can grab the Android source code and build anything with it, but if you want to license the Google apps and have access to the Google-trademarked brand "Android," you'll need to comply with Google's rules.' -- source: https://tech.slashdot.org/story/22/09/09/1742200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Zealand programming contest
by Peter Reutemann 09 Sep '22

09 Sep '22

Hi everyone I just got notified that the New Zealand programming contest is on tomorrow. More information on the Hamilton event is available from here: https://www.cs.waikato.ac.nz/~tl108/nzpc-hamilton/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New wave of data-destroying ransomware attacks hits QNAP NAS devices
by Peter Reutemann 08 Sep '22

08 Sep '22

'Network hardware-maker QNAP is urging customers to update their network-attached storage devices immediately to protect them from a new wave of ongoing ransomware attacks that can destroy terabytes of data in a single stroke. Singapore-based QNAP said recently that it has identified a new campaign from a ransomware group known as DeadBolt. The attacks take aim at QNAP NAS devices that use a proprietary feature known as Photo Station. The advisory instructs customers to update their firmware, suggesting there is a vulnerability that’s under exploit, but the company makes no explicit mention of a CVE designation that security professionals use to track such security flaws.' -- source: https://arstechnica.com/information-technology/2022/09/new-wave-of-data-des… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

NASA Going RISC-V
by Lawrence D'Oliveiro 07 Sep '22

07 Sep '22

NASA’s space probes have been using a PowerPC-based computing architecture going back over two decades, so it’s about time for a refresh. So now SiFive <https://www.theregister.co.uk/2022/09/06/nasas_spaceflight_computer_risc_v/> is going to supply NASA with a new computing platform based on its X280 RISC-V CPU. “RISC” is supposed to stand for “Reduced Instruction Set Computing”. However, many current RISC architectures (including ARM and POWER/PowerPC) have seen a large blowout of their instruction-set size when they started adding SIMD vector operations. These instructions operate on fixed-length sets of around 4, 8 or 16 operands, performing the same operation on all operands simultaneously (hence “SIMD”, standing for “Single Instruction, Multiple Data”). Trouble is, you need a lot of different variants of each instruction for coping with different data types. While vector operations are important for many uses, RISC-V takes a different approach, harking back to the old supercomputers designed by the legendary Seymour Cray: instead of having to operate on all operands simultaneously, the instructions operate elementwise on variable-length arrays (the original Cray-1 design allowed for arrays of up to 64 elements at a time), with operands being processed sequentially through a multi-stage pipeline. This should help keep things simpler, while still making it fast.

1 0

Google Chrome Emergency Update Fixes New Zero-Day Used in Attacks
by Peter Reutemann 07 Sep '22

07 Sep '22

'Google has released Chrome 105.0.5195.102 for Windows, Mac, and Linux users to address a single high-severity security flaw, the sixth Chrome zero-day exploited in attacks patched this year. From a report: "Google is aware of reports that an exploit for CVE-2022-3075 exists in the wild," the company said in a security advisory published on Friday. This new version is rolling out in the Stable Desktop channel, with Google saying that it will reach the entire user base within a matter of days or weeks. It was available immediately when BleepingComputer checked for new updates by going into the Chrome menu > Help > About Google Chrome. The web browser will also auto-check for new updates and automatically install them after the next launch.' -- source: https://it.slashdot.org/story/22/09/06/1424200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Slick new phishing-as-a-service kit emerges
by Peter Reutemann 06 Sep '22

06 Sep '22

'itnews reports: Security researchers at Resecurity have detailed a new phishing-as-a-service kit, EvilProxy, that provides an easy to use interface to attack users with accounts for major online brands, and the ability to bypass multifactor authentication (MFA). Reverse proxies to attack multifactor authentication, such as Modlishka, have been available for several years, but EvilProxy makes it it possible to easily create and deliver advanced phishing links through a graphical user interface, Resecurity said. EvilProxy sits between a victim and the real site the user is trying to connect to, capturing their valid session cookies, to bypass the need to authenticate with user names, passwords, and / or two-factor authentication tokens, the security vendor explained. This includes accounts that have MFA enabled with short messaging text service, or application tokens.' -- source: https://www.itnews.com.au/news/slick-new-phishing-as-a-service-kit-emerges-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Peter Eckersley, Co-Creator of Let's Encrypt, Dies at 43
by Peter Reutemann 06 Sep '22

06 Sep '22

'Seven years ago, Slashdot reader #66,542 announced "Panopticlick 2.0," a site showing how your web browser handles trackers. But it was just one of the many privacy-protecting projects Peter Eckersley worked on, as a staff technologist at the EFF for more than a decade. Eckersley also co-created Let's Encrypt, which today is used by hundreds of millions of people. Friday the EFF's director of cybersecurity announced the sudden death of Eckersley at age 43. "If you have ever used Let's Encrypt or Certbot or you enjoy the fact that transport layer encryption on the web is so ubiquitous it's nearly invisible, you have him to thank for it," the announcement says. "Raise a glass." Peter Eckersley's web site is still online, touting "impactful privacy and cybersecurity projects" that he co-created, including not just Let's Encrypt, Certbot, and Panopticlick, but also Privacy Badger and HTTPS Everywhere. And in addition, "During the COVID-19 pandemic he convened the the stop-covid.tech group, advising many groups working on privacy-preserving digital contact tracing and exposure notification, assisting with several strategy plans for COVID mitigation." You can also still find Peter Eckersley's GitHub repositories online. But Peter "had apparently revealed recently that he had been diagnosed with cancer," according to a tribute posted online by security company Sophos, noting his impact is all around us: If you click on the padlock in your browser [2022-09-0T22:37:00Z], you'll see that this site, like our sister blog site Sophos News, uses a web certificate that's vouched for by Let's Encrypt, now a well-established Certificate Authority (CA). Let's Encrypt, as a CA, signs TLS cryptographic certificates for free on behalf of bloggers, website owners, mail providers, cloud servers, messaging services...anyone, in fact, who needs or wants a vouched-for encryption certificate, subject to some easy-to-follow terms and conditions.... Let's Encrypt wasn't the first effort to try to build a free-as-in-freedom and free-as-in-beer infrastructure for online encryption certificates, but the Let's Encrypt team was the first to build a free certificate signing system that was simple, scalable and solid. As a result, the Let's Encrypt project was soon able to to gain the trust of the browser making community, to the point of quickly getting accepted as a approved certificate signer (a trusted-by-default root CA, in the jargon) by most mainstream browsers.... In recent years, Peter founded the AI Objectives Institute, with the aim of ensuring that we pick the right social and economic problems to solve with AI: "We often pay more attention to how those goals are to be achieved than to what those goals should be in the first place. At the AI Objectives Institute, our goal is better goals." ' -- source: https://yro.slashdot.org/story/22/09/05/0241217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Attacks on Linux Servers Rose 75% Over Last Year, Warn Security Researchers
by Peter Reutemann 05 Sep '22

05 Sep '22

'"There's been a big rise in ransomware attacks targeting Linux," reports ZDNet, "as cyber criminals look to expand their options and exploit an operating system that is often overlooked when businesses think about security." According to analysis by cybersecurity researchers at Trend Micro, Linux servers are "increasingly coming under fire" from ransomware attacks, with detections up by 75% over the course of the last year as cyber criminals look to expand their attacks beyond Windows operating systems. Linux powers important enterprise IT infrastructure including servers, which makes it an attractive target for ransomware gangs — particularly when a perceived lack of threat to Linux systems compared with Windows means that cybersecurity teams might choose to focus on defending Windows networks against cybercrime. Researchers note that ransomware groups are increasingly tailoring their attacks to focus specifically on Linux systems. For example, LockBit is one of the most prolific and successful ransomware operations of recent times and now offers the option of a Linux-based variant that is designed to target Linux systems and has been used to conduct attacks in the wild.... And it isn't just ransomware groups that are increasingly turning their attentions towards Linux — according to Trend Micro, there's been a 145% increase in Linux-based cryptocurrency-mining malware attacks, where cyber criminals secretly exploit the power of infected computers and servers to mine for cryptocurrency for themselves. One of the ways cyber criminals are compromising Linux systems is by exploiting unpatched vulnerabilities. According to the report, these flaws include CVE-2022-0847 — also known as Dirty Pipe — a bug that affects the Linux kernel from versions 5.8 and up, which attackers can use to escalate their privileges and run code. Researchers warn that this bug is "relatively easy to exploit". The article recommends installing all security patches as soon as they're available — and implementing multi-factor authentication across your organization.' -- source: https://linux.slashdot.org/story/22/09/03/1940245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

policy.nz
by Lawrence D'Oliveiro 05 Sep '22

05 Sep '22

Thought I’d mention this handy website <https://policy.nz/2022> which happens to be relevant to the NZ situation right now, namely the upcoming local-body elections. It’s a compilation of relevant policy info that election candidates of all persuasions up and down the country were able and willing to supply. Go look up the elections in your own area, and see what your candidates are standing for, so you can make a more informed choice. (Or more rationalizations for the choice you’ve already made. But hey, I won’t judge...) Participation in local-body elections in NZ is typically pretty poor, even with mail-in voting. Yes, there are some gaps in their coverage, but still, maybe this will help raise the numbers who vote. Go, be informed!

3 2

TIL: Shiny Apps
by Lawrence D'Oliveiro 04 Sep '22

04 Sep '22

Came across this article <https://www.nzherald.co.nz/nz/covid-19-what-nz-flu-data-is-revealing-about-…> about improving the accuracy of tracking Covid-19 rates by looking at self-reporting data on general flu-like symptoms. By careful analysis, they can estimate numbers of Covid-19 cases versus influenza cases, and tell if dropping reported case numbers are actually a result of dropping infections, versus lower rates of testing. The software they developed is called a “Shiny app”. Digging a bit further, I discovered that “Shiny” <https://shiny.rstudio.com/> is a framework for building web-based apps in the R statistical-analysis language.

1 0

Chrome Extensions With 1.4M Installs Covertly Track Visits and Inject Code
by Peter Reutemann 02 Sep '22

02 Sep '22

'Google has removed browser extensions with more than 1.4 million downloads from the Chrome Web Store after third-party researchers reported they were surreptitiously tracking users' browsing history and inserting tracking code into specific ecommerce sites they visited. ArsTechnica: The five extensions flagged by McAfee purport to offer various services, including the ability to stream Netflix videos to groups of people, take screenshots, and automatically find and apply coupon codes. Behind the scenes, company researchers said, the extensions kept a running list of each site a user visited and took additional actions when users landed on specific sites. The extensions sent the name of each site visited to the developer-designated site d.langhort.com, along with a unique identifier and the country, city, and zip code of the visiting device. If the site visited matched a list of ecommerce sites, the developer domain instructed the extensions to insert JavaScript into the visited page. The code modified the cookies for the site so that the extension authors receive affiliate payment for any items purchased. To help keep the activity covert, some of the extensions were programmed to wait 15 days after installation before beginning the data collection and code injection.' -- source: https://yro.slashdot.org/story/22/09/01/1647229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Debian Replaces Google with DuckDuckGo as Chromium's Default Search Engine
by Peter Reutemann 30 Aug '22

30 Aug '22

'A story from the Linux/Open Source news site It's FOSS: While Firefox is still the default web browser in Debian, you can find the Chromium browser in the repositories. Chromium is the open source project upon which Google has built its Chrome web browser. It is also preferred by many Linux users as it provides almost the same features as Google Chrome. Earlier, Chromium used Google as the default search engine in Debian. However, Debian is going to use DuckDuckGo as the default search engine for Chromium. It all started when bug report #956012 was filed in April 2020, stating to use DuckDuckGo as the default search engine for the Chromium package. You can see the decision was not taken in any hurry, as the maintainers took more than two years to close the bug report. The reason for the change goes as stated in the official package update announcement. Change default search engine to DuckDuckGo for privacy reasons. Set a different search engine under Settings -> Search Engine (closes: #956012). ' -- source: https://linux.slashdot.org/story/22/08/29/0443230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ARM’s Morello Runs CheriBSD
by Lawrence D'Oliveiro 29 Aug '22

29 Aug '22

“CHERI” is a project at Cambridge University based on a very old concept for implementing memory/process protection on computer hardware: that of “capabilities”. Instead of having specially-trusted kernel code run in a privileged mode that is allowed to do pretty much anything, capabilities allow for a more decentralized model, with distribution and separation of different areas of trust. The capability concept fell out of favour, because its implementation overhead was greater than the processor-privilege-level (also often described as “privilege rings”) concept that is so commonplace today. But with the increase in security vulnerabilities like Meltdown and Spectre, there is increasing interest in alternative approaches that might reduce complexity, hopefully with less of a performance cost than the fixes that were needed to mitigate those vulnerabilities. ARM Ltd’s experimental “Morello” chip is an implementation of the CHERI concept. And it has got as far as running CheriBSD, which is a specially-adapted variant of FreeBSD. This now includes Wayland as the GUI server, and it provides a KDE Plasma desktop on top of that, according to <https://www.theregister.com/2022/07/26/cheri_computer_runs_kde/>. All this code has been tweaked, where appropriate, to remove the assumptions of arbitrary access to process memory allowed by conventional C pointers, in favour of the more restricted access controlled by capabilities. The CHERI project started with MIPS-based hardware, and besides being on ARM now, it looks to be coming to RISC-V as well. By the way, the Linux kernel has already (mis)used the term ”capability” to refer to an entirely different concept <https://manpages.debian.org/bullseye/manpages/capabilities.7.en.html>. Those familiar with the process-privilege system on old VMS from DEC may notice some resemblance ...

1 1

Will Google's 'Cross-Device' Development Kit Bring Android Apps to Non-Android Devices?
by Peter Reutemann 29 Aug '22

29 Aug '22

'Google is trying "to make it easier for developers to create Android apps that connect in some way across a range of devices," reports the Verge. Documentation for the software development kit says it will simplify development for "multi-device experiences." "The Cross device SDK is open-source and will be available for different Android surfaces and non-Android ecosystem devices (Chrome OS, Windows, iOS)," explains the documentation, though the current developer preview only works with Android phones and tablets, according to the Verge. But they report that Google's new SDK "contains the tools developers need to make their apps play nice across Android devices, and, eventually non-Android phones, tablets, TVs, cars, and more." The SDK is supposed to let developers do three key things with their apps: discover nearby devices, establish secure connections between devices, and host an app's experience across multiple devices. According to Google, its cross-device SDK uses Wi-Fi, Bluetooth, and ultra-wideband to deliver multi-device connectivity.... [I]t could let multiple users on separate devices choose items from a menu when creating a group food order, saving you from passing your phone around the room. It could also let you pick up where you left off in an article when swapping from your phone to a tablet, or even allow the passengers in a car to share a specific map location with the vehicle's navigation system. It almost sounds like an expansion of Nearby Share, which enables users on Android to transfer files to devices that use Chrome OS and other Androids. In April, Esper's Mishaal Rahman spotted an upcoming Nearby Share update that could let you quickly share files across the devices that you're signed into Google with. Google also said during a CES 2022 keynote that it will bring Nearby Share to Windows devices later this year. "This SDK abstracts away the intricacies involved with working with device discovery, authentication, and connection protocols," argues Google's blog post, "allowing you to focus on what matters most — building delightful user experiences and connecting these experiences across a variety of form factors and platforms."' -- source: https://developers.slashdot.org/story/22/08/27/219224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Debian Considers Changing How It Handles Non-Free Firmware
by Peter Reutemann 29 Aug '22

29 Aug '22

'"Debian currently doesn't load non-free firmware by default on its systems," reports Phoronix, "even when it means no working hardware support/acceleration without those binary elements. Not loading the non-free firmware can also mean missing out on security updates or for addressing usability issues." Now the Debian community is discussing three proposals on how non-free firmware should be handled going forward (before a vote in September). Proposal A and B both start with the same two paragraphs: We will include non-free firmware packages from the "non-free-firmware" section of the Debian archive on our official media (installer images and live images). The included firmware binaries will normally be enabled by default where the system determines that they are required, but where possible we will include ways for users to disable this at boot (boot menu option, kernel command line etc.). When the installer/live system is running we will provide information to the user about what firmware has been loaded (both free and non-free), and we will also store that information on the target system such that users will be able to find it later. The target system will also be configured to use the non-free-firmware component by default in the apt sources.list file. Our users should receive security updates and important fixes to firmware binaries just like any other installed software. But Proposal A adds that "We will publish these images as official Debian media, replacing the current media sets that do not include non-free firmware packages," while Proposal B says those images "will not replace the current media sets," but will instead be offered alongside them. And Proposal C? "The Debian project is permitted to make distribution media (installer images and live images) containing packages from the non-free section of the Debian archive available for download alongside with the free media in a way that the user is informed before downloading which media are the free ones.' -- source: https://linux.slashdot.org/story/22/08/28/0242228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Pine64 Touts Its RISC-V-Based Single-Board Computer and Soldering Irons
by Peter Reutemann 29 Aug '22

29 Aug '22

'PINE64's August update included photos of their first prototype for its upcoming Star64 single-board computer, "the first true RISC-V single-board computer from us...but as I wrote last month it certainly isn't the last RISC-V piece of hardware you'll be seeing from us." Just as a short recap: Star64 comes with a StarFive JH7110 64bit CPU sporting quad SiFive FU740 cores clocked at 1.5GHz. The SOC is equipped with BXE-2-32 from Imagination Technologies, which is said to be a solid mid-range GPU. Star64 will be available in two configurations — with 4Gb and 8GB of RAM, similarly to the Quartz64. Both hardware versions include USB 3.0 and a PCIe slot as well as two native Gigabit Ethernet NICs.... Along the long leading edges you'll find PCIe on one end and GPIO on the other. At one end of the board you'll find a digital video output, a double-stacked Gigabit Ethernet port and a 12V barrel plug for power. On the opposite side, you'll find 3x USB 2.0, 1x USB 3.0, an audio jack as well as a power button. There are also two U.FL ports for antennas — one for bluetooth and the other for WiFi.... The Star64 also has an MiPi display output complete with a touch panel (TP) input, a 12V power port, a CSI camera port and an eMMC slot. A micro SD card slot can be found at the bottom of the PCB. Similarly to the RockPro64 and Quartz64, the 12V port on the Star64 can be used for powering other hardware directly from the board — a popular example is powering one or multiple SSDs connected to a PCIe SATA adapter. I'll add that, at least in theory, the Star64 would make a great network-attached storage device because of its SoCs low thermals and idle power. I am looking forward to seeing NAS-focused Linux or BSD* OSes available for the board. Speaking of software, efforts to support the SoC in Linux have already begun. I've been told that both Debian and Fedora are already being ported to the StarFive JH7110, which is great news. We are certain that many other OSes will follow swiftly — especially once we start delivering the Star64 to interested developers. On the subject of availability: the Star64 will be available in a few weeks time, and will initially be available to developers. Given the interest in the Star64's and the SoC powering I hope to see functional distributions available for the board soon after launch. The announcement also included an update on their PinecilV2 smart mini portable soldering iron (built with a 32-bit RISC-V SoC). "The Pinecil V2 landed earlier this month and sold out almost instantly. The next production run of the ought to be available soon however..."' -- source: https://hardware.slashdot.org/story/22/08/28/1759238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Heroku Announces Plans To Eliminate Free Plans, Blaming 'Fraud and Abuse'
by Peter Reutemann 29 Aug '22

29 Aug '22

'After offering them for over a decade, Heroku announced this week that it will eliminate all of its free services -- pushing users to paid plans. From a report: Starting November 28, the Salesforce-owned cloud platform as a service will stop providing free product plans and shut down free data services and soon (on October 26) will begin deleting inactive accounts and associated storage for accounts that have been inactive for over a year. In a blog post, Bob Wise, Heroku general manager and Salesforce EVP, blamed "abuse" on the demise of the free services, which span the free plans for Heroku Dynos and Heroku Postgres as well as the free plan for Heroku Data for Redis. [...] Wise went on to note that Heroku will be announcing a student program at Salesforce's upcoming Dreamforce conference in September, but the details remain a mystery at this point. For the uninitiated, Heroku allows programmers to build, run and scale apps across programming languages including Java, PHP, Scala and Go. Salesforce acquired the company for $212 million in 2010 and subsequently introduced support for Node.js and Clojure and Heroku for Facebook, a package to simplify the process of deploying Facebook apps on Heroku infrastructure. Heroku claims on its website that it's been used to develop 13 million apps to date.' -- source: https://developers.slashdot.org/story/22/08/26/188231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Google's Fuchsia OS is Taking Over Smart Displays, Now on Its Second Device
by Peter Reutemann 26 Aug '22

26 Aug '22

'The kingdom of Google's third major operating system, Fuchsia, is growing a little wider today. ArsTechnica: 9to5Google reports Google completed the rollout of Fuchsia to the Google Nest Hub Max. Along with the original Nest Hub/Google Home Hub, that puts two of Google's three smart displays on the new OS, with the one holdout being the 2nd Gen Nest Hub. The Nest Hub Max is the first device running Fuchsia that Google is currently selling -- the Home Hub only got Fuchsia after it had been discontinued. The Google smart display user interface is written in Flutter, a Google programming language designed for portability, which runs on Android, iOS, Fuchsia, and the weird cast platform Nest Hubs typically use. So it's not right to describe the user interface as "similar" after the OS swap -- it's the exact same code because Flutter runs on nearly everything. You are getting a slightly newer code version, though, and it comes with a Bluetooth menu. If you dive into the settings and hit "about device," you'll see a "Fuchsia Version" field that will say something like "6.20211109.1.3166243." It's a bit weird to do an entire OS switch to the futuristic, secretive Fuchsia project and then have basically nothing to show (or say) for it in terms of obvious improvements in performance or security. You can dive into the minutia of the Fuchsia source code, but it continues to be a mystery in terms of what practical benefits it offers consumers. Google never talks about Fuchsia, so not much is known about what, exactly, Google is accomplishing here.' -- source: https://tech.slashdot.org/story/22/08/25/1856206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linux 6.1 Will Make It A Bit Easier To Help Spot Faulty CPUs
by Peter Reutemann 26 Aug '22

26 Aug '22

'While mostly of benefit to server administrators with large fleets of hardware, Linux 6.1 aims to make it easier to help spot problematic CPUs/cores by reporting the likely socket and core when a segmentation fault occurs, which can help in spotting any trends if routinely finding the same CPU/core is causing problems. Queued up now in TIP's x86/cpu branch for the Linux 6.1 merge window in October is a patch to print the likely CPU at segmentation fault time. Printing the likely CPU core and socket when a seg fault occurs can be beneficial if routinely finding seg faults happening on the same CPU package or particular core.' -- source: https://linux.slashdot.org/story/22/08/25/1841209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DuckDuckGo now offers anti-tracking email service to everyone
by Peter Reutemann 26 Aug '22

26 Aug '22

'DuckDuckGo's tracker-removing email service, which has been available in private beta for a year, is now open to anyone who uses a DuckDuckGo mobile app, browser extension, or Mac browser. It has also added a few more privacy tools. The service provides you a duck.com email address, one intended to be given out for the kind of "Subscribe to our newsletter for 20 percent off" emails you know exist only to harvest data and target you for ads. Email sent to your duck.com address forwards to your chosen primary email—but with trackers removed. Email Protection now also fixes up links, strips them of tracking modifiers, upgrades unencrypted HTTP URLs to HTTPS where possible, and, for the rare necessary reply, allows you to send directly from your duck address instead of exposing your primary email. During their closed beta, DuckDuckGo claims that 85 percent of the emails it processed contained hidden trackers.' -- source: https://arstechnica.com/gadgets/2022/08/duckduckgo-now-offers-anti-tracking… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Experts Warn of Widespread Exploitation Involving Hikvision Cameras
by Peter Reutemann 25 Aug '22

25 Aug '22

'Both government and criminal hacking groups are still targeting Hikvision cameras with a vulnerability from 2021, according to reports from several security researchers. From a report: Cybersecurity firm CYFIRMA released a report this week saying Russian cybercriminal forums are awash with hackers looking to collaborate on exploiting Hikvision cameras using the command injection vulnerability CVE-2021-36260. "Specifically in the Russian forums, we have observed leaked credentials of Hikvision camera products available for sale," the company's researchers said. "These can be leveraged by hackers to gain access to the devices and exploit further the path of attack to target an organization's environment." CYFIRMA reported they found that more than 80,000 Hikvision cameras are still vulnerable to the critical command injection flaw, which carries a CVSS score of 9.8 out of 10. Of the more than 80,000 vulnerable cameras, more than 100 nations and 2,300 organizations are impacted.' -- source: https://tech.slashdot.org/story/22/08/24/1856244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FSearch 0.2 File Search Utility Removes Snap Support
by Peter Reutemann 24 Aug '22

24 Aug '22

Since we were discussing find during this week's meeting, I thought some of you might be interested in this post: 'FSearch, the GTK-based lightning-fast file search tool, now has a new version, 0.2, that significantly improves its functionality. Many Linux users believe the only options for searching for files are those built into the operating system. Of course, the ‘find’ command or the file search capability provided by the file manager does an excellent job. But what if you could go to the next level using a handy graphical tool that searches for files at the speed of light? Meet FSearch. FSearch is an open-source standalone file search utility based on GTK3 inspired by Everything Search Engine. Because it is written in C, FSearch offers incredibly fast search speed, which is the application’s main advantage.' -- source: https://linuxiac.com/fsearch-0-2-file-search-utility/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Can You Ban Source Code?
by Lawrence D'Oliveiro 24 Aug '22

24 Aug '22

Let me see if I understand what’s going on here <https://www.theregister.com/2022/08/24/github_eff_tornado_cash/>: * “Tornado Cash” is a cryptocurrency “mixing” service. This takes input cryptocoins and outputs the same value again, but in a mix of different cryptocoins that makes it harder to trace where the input came from. * Tornado Cash is also the name of the open-source software written to implement this service. * The US Treasury Department’s Office of Foreign Assets Control has designated the Tornado Cash service as an illegal money-laundering operation. It also appears the principal developers (of the service and the software) are wanted internationally by financial crime investigators, and one has already been arrested. * Presumably in response to this, GitHub has shut down the accounts of those developers, and also removed the original Tornado Cash source code repo. * However, it’s not clear that GitHub was legally obliged to do any of this -- did the OFAC sanctions include the source code as well? Or were they contravening the GitHub terms and conditions somehow--if so, which one(s)? * In any case, lots of other copies of the Tornado Cash source code remain available on GitHub, untouched. And no doubt there are copies elsewhere.

1 0

Unix legend, who owes us nothing, keeps fixing foundational AWK code
by Peter Reutemann 24 Aug '22

24 Aug '22

'A Princeton professor, finding a little time for himself in the summer academic lull, emailed an old friend a couple months ago. Brian Kernighan said hello, asked how their US visit was going, and dropped off hundreds of lines of code that could add Unicode support for AWK, the text-parsing tool he helped create for Unix at Bell Labs in 1977. "I have tested this a fair amount but clearly more tests are needed," Kernighan wrote in the email, posted in late May as a kind of pseudo-commit on the onetrueawk repo by longtime maintainer Arnold Robbins. "Once I figure out how ... I will try to submit a pull request. I wish I understood git better, but in spite of your help, I still don't have a proper understanding, so this may take a while."' -- source: https://arstechnica.com/gadgets/2022/08/unix-legend-who-owes-us-nothing-kee… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Lightweight Linux laptop crams a 99 Wh battery inside
by Peter Reutemann 24 Aug '22

24 Aug '22

'Ultralight laptops are great for slipping into a bag and traveling with, and they look pretty stylish. However, a trim build often comes with trade-offs. Battery capacity is a common one, as companies struggle to fit larger batteries into machines that are under an inch thick. German PC-maker Tuxedo Computers' latest ultralight InfinityBook Pro 14 seeks to address that challenge with a massive battery. The InfinityBook Pro 14 - Gen7 announced today comes with either big storage or a big battery. The company is selling it with the option for a 99 watt-hour (Wh) battery, which is about as big as a lithium battery can be while being allowed on an airplane (100 Wh).' -- source: https://arstechnica.com/gadgets/2022/08/lightweight-linux-laptop-crams-a-99… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hyundai Uses Example Keys For Encryption System
by Peter Reutemann 23 Aug '22

23 Aug '22

'"Hyundai predictably fails in attempting to secure their car infotainment system with a default key lifted from programming examples," writes Slashdot reader sinij. "This level of security is unfortunately expected from auto manufacturers, who also would like to sell you always-connected Car2Car self-driving automobiles." Cryptographer and security experience Bruce Schneier writes: "Turns out the [AES] encryption key in that script is the first AES 128-bit CBC example key listed in the NIST document SP800-38A [PDF]," writes an unidentified developer under the name "greenluigi1." Luck held out, in a way. "Greenluigi1" found within the firmware image the RSA public key used by the updater, and searched online for a portion of that key. The search results pointed to a common public key that shows up in online tutorials like "RSA Encryption & Decryption Example with OpenSSL in C." Two questions remain: 1.) How did the test key get left behind? 2) Was it by accident or design?' -- source: https://it.slashdot.org/story/22/08/22/227245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday
by Peter Reutemann 23 Aug '22

23 Aug '22

Hi everyone We have a meeting next Monday with the following topic: "Command-line tools under Linux are the bread and butter of sysadmins, but any user can benefit from a wide variety of hidden gems. In this meetup, we will explore essential command-line tools that one should be aware of. Please join us if you would like to learn about them or even demo your personal set of useful tools!" Details: https://www.meetup.com/waikatolinuxusersgroup/events/283776695/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 3

The New USB Rubber Ducky Is More Dangerous Than Ever
by Peter Reutemann 21 Aug '22

21 Aug '22

'The USB Rubber Ducky "has a new incarnation, released to coincide with the Def Con hacking conference this year," reports The Verge. >From the report: To the human eye, the USB Rubber Ducky looks like an unremarkable USB flash drive. Plug it into a computer, though, and the machine sees it as a USB keyboard -- which means it accepts keystroke commands from the device just as if a person was typing them in. The original Rubber Ducky was released over 10 years ago and became a fan favorite among hackers (it was even featured in a Mr. Robot scene). There have been a number of incremental updates since then, but the newest Rubber Ducky makes a leap forward with a set of new features that make it far more flexible and powerful than before. With the right approach, the possibilities are almost endless. Already, previous versions of the Rubber Ducky could carry out attacks like creating a fake Windows pop-up box to harvest a user's login credentials or causing Chrome to send all saved passwords to an attacker's webserver. But these attacks had to be carefully crafted for specific operating systems and software versions and lacked the flexibility to work across platforms. The newest Rubber Ducky aims to overcome these limitations. It ships with a major upgrade to the DuckyScript programming language, which is used to create the commands that the Rubber Ducky will enter into a target machine. While previous versions were mostly limited to writing keystroke sequences, DuckyScript 3.0 is a feature-rich language, letting users write functions, store variables, and use logic flow controls (i.e., if this... then that). That means, for example, the new Ducky can run a test to see if it's plugged into a Windows or Mac machine and conditionally execute code appropriate to each one or disable itself if it has been connected to the wrong target. It also can generate pseudorandom numbers and use them to add variable delay between keystrokes for a more human effect. Perhaps most impressively, it can steal data from a target machine by encoding it in binary format and transmitting it through the signals meant to tell a keyboard when the CapsLock or NumLock LEDs should light up. With this method, an attacker could plug it in for a few seconds, tell someone, "Sorry, I guess that USB drive is broken," and take it back with all their passwords saved. ' -- source: https://it.slashdot.org/story/22/08/19/2136257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu Upgrades Now Arrive with a Simple Prompt (and Security Fixes)
by Peter Reutemann 21 Aug '22

21 Aug '22

'"After a slight delay due to an installer issue, the first point release for Ubuntu 22.04 has been officially released," swrites Jack Wallen for TechRepublic. "Although point releases are often overlooked by users, because they aren't major upgrades, this time around you should certainly run the upgrade immediately." The biggest reason is that this point release combines all of the security fixes and improvements that have been added since the initial release of Jammy Jellyfish. So, if you haven't bothered to upgrade Ubuntu 22.04 since you first installed it, which you should have been doing all along, this point upgrade will add everything you've missed in one fell swoop. One of the biggest upgrades for end users will be the ability of 20.04 users to upgrade to the latest release without having to touch the command line. At some point, users of 20.04 will see an upgrade prompt on their desktops, allowing them to easily make the jump to 22.04.1. This is a big deal because previously such upgrades would have required running several commands. That means no more: sudo apt-get update sudo apt-get upgrade -y sudo apt-get dist-upgrade -y sudo do-release-upgrade -y Another point release found in 22.04.1 is GNOME 42, which features a new enhanced dark mode and switches to Wayland by default, with the inclusion of Xorg for unsupported hardware.' -- source: https://linux.slashdot.org/story/22/08/20/021216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers Are Stealing Session Cookies To Bypass Multi-factor Authentication
by Peter Reutemann 21 Aug '22

21 Aug '22

'Hackers are stealing cookies from current or recent web sessions to bypass multi-factor authentication (MFA), according to an eSecurity Planet report. The attack method, reported by Sophos researchers, is already growing in use. The "cookie-stealing cybercrime spectrum" is broad, the researchers wrote, ranging from "entry-level criminals" to advanced adversaries, using various techniques. Cybercriminals collect cookies or buy stolen credentials "in bulk" on dark web forums. Ransomware groups also harvest cookies and "their activities may not be detected by simple anti-malware defenses because of their abuse of legitimate executables, both already present and brought along as tools," the researchers wrote. Browsers allow users to maintain authentication, remember passwords and autofill forms. That might seem convenient, but attackers can exploit this functionality to steal credentials and skip the login challenge. Behind the scenes, browsers use SQLite database files that contain cookies. These cookies are composed of key-value pairs, and the values often contain critical information such as tokens and expiration dates. Adversaries know the exact name and location of these files for all major browsers such as Chrome, Firefox, and even Brave, on various operating systems. That's why the attack can be scripted. It's not uncommon to find such scripts along with other modules in info-stealing and other malware. For example, the latest version of the Emotet botnet targets cookies and credentials stored by browsers, which include saved credit cards. According to the Sophos researchers, "Google's Chrome browser uses the same encryption method to store both multi-factor authentication cookies and credit card data." To gain initial access, attackers can also perform phishing and spear-phishing campaigns to implant droppers that can deploy cookie-stealer malware stealthily. The cookies are then used for post-exploitation and lateral movements. Cybercriminals can use them to change passwords and emails associated with user accounts, or trick the victims into downloading additional malware, or even deploy other exploitation tools such as Cobalt Strike and Impacket kit. Users should not use built-in features to save passwords unless the browser encrypts them with, at least, a master password. It's recommended that users uncheck the setting called "remember passwords," and users should probably not allow persistent sessions as well. Developers can be part of the problem if they don't secure authentication cookies properly. Such cookies must have a short expiration date. Otherwise, the persistent authentication could turn into a persistent threat. You can have great security processes and still get hacked because the cookies do not have the necessary flags (e.g., HttpOnly, Secure attribute). For example, authentication cookies must be sent using SSL/TLS channels. Otherwise the data could be sent in plain text and attackers would only have to sniff traffic to intercept credentials.' -- source: https://it.slashdot.org/story/22/08/20/0332200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Free, Secure, and Open-Source: How FileZilla is Making an Old School Protocol Cool Again
by Peter Reutemann 21 Aug '22

21 Aug '22

'It's a free and open-source, cross-platform FTP application that allows secure file transfering — and it's making an old-school protocol cool again, according to a recent blog post. Started about 21 years ago — and downloaded by millions each year — FileZilla remains "committed to their role in liberating technology, by making it accessible, open and also secure," according to the blog post. But it also explains how FileZilla has beefed up that security through a collaboration with the internet freedom nonprofit, the Open Technology Fund (or "OTF"): Over the past year, FileZilla has utilised support from OTF to undertake two activities that enhanced and ensured the security of their tools. The first was integrating FileZilla Server with Let's Encrypt, a free, automated, and open source certificate authority that ensures secure communication between the two end-points sending or receiving a file via FileZilla.... Secondly, FileZilla ran a penetration test, a service offered by OTF's Red Team Lab. A team of independent researchers attempted to force access to the FileZilla server to see if they could gain control. These researchers were highly skilled, and the testing was extensive. The team conducting the test only found very minor security vulnerabilities that FileZilla were able to fix immediately. As a result of this process, anyone wanting to use the FileZilla software can trust that it has been cross-scrutinised by a third party and found to be secure.... FileZilla respects users' confidentiality: they do not track your behaviour, nor sell your data to other companies. While they do have advertisements on their website, they are posted exactly as advertisements would be posted in a newspaper. Nobody knows that you are reading the advertisements, or that you decided to call or connect to the advertised website. The advertisement has simply been attached to the webpage, without any underlying tracking.... . "Our mission hasn't changed in over 20 years: design, develop, maintain and enhance free tools to securely transfer files with ease and reliability," said Tim Kosse, FileZilla Lead Developer. This decision was a political one taken by FileZilla, to always preserve the freedom of their tools, and of their users. "We aren't the typical commercial open-source venture that starts doing things for free, and over time, closes this and that to make money" said Roberto Galoppini, FileZilla Director of Strategy. "While you might not see FileZilla listed at the NYSE [New York Stock Exchange] any time soon, the freedom of our tools will never be questioned...." [I]f you work in an industry that requires the secure transfer of sensitive files, or if you simply have personal photographs or videos you want to keep confidential, using proprietary platforms to share or store them can put your information at risk of being exposed.... FileZilla offers an alternative that is secure and private. Their tools are developed by a team that is deeply invested in protecting users' confidentiality, and liberating technology is central to their work and decision-making.... At the same time, projects like FileZilla remind us that there exists a global community of technologists, activists, coders, bloggers, journalists, software developers, and mindful internet users making internet freedom a lived reality and daily practice. Supporting, experimenting with and using free and open source tools, such as the FileZilla client and server, enables us to disinvest from the capitalist pursuit of corporate control of technology and unchecked surveillance of our data. Rather, we can step into alignment with an alternative, parallel narrative being created by a community of resistance that is grounded in principles of cooperation, solidarity, commons and openness.' -- source: https://news.slashdot.org/story/22/08/20/2031207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

eternal terminal
by Peter Reutemann 18 Aug '22

18 Aug '22

Hi everyone Facing recurring ssh connection interruptions with long running processes, my go-to solution is to use "screen" on the remote server. But that doesn't get around the problem of my ssh sessions being defunct or closed ("broken pipe"). Doing a quick internet search, I've just come across "eternal terminal": "Eternal Terminal (ET) is a remote shell that automatically reconnects without interrupting the session. " https://eternalterminal.dev/ https://github.com/MisterTea/EternalTerminal Does anybody have any experience with it? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

Android could go 64-bit only in 2023, starting with the Pixel tablet
by Peter Reutemann 18 Aug '22

18 Aug '22

'Android 13 hit AOSP the other day, and included in the code source dump is an interesting commit spotted by Esper's Mishaal Rahman. It sounds like Google is planning to—or at least experimenting with—moving the upcoming Pixel tablet to a 64-bit-only build of Android. The commit doesn't beat around the bush, saying: "Move tangor to 64-bit only." "Tangor" is the codename for the already-announced Pixel tablet. iOS, with its single hardware manufacturer, has been 64-bit only since 2017. Android has a million moving parts split across a bunch of different companies, so getting to 64-bit only is going to be a long road. Getting there is worth the effort, though, with a promise of increased performance and additional security features. The Google Play app ecosystem is probably furthest along in supporting 64 bit. Any apps written entirely in Java or Kotlin already get automatic 64-bit compatibility from the system. Google mandated that Google Play apps using native code (usually these are games) needed to provide 64-bit versions back in 2019. There were exceptions for a few popular SDKs like Adobe Air and Unity, but these exceptions were ended in August 2021, when all apps were required to have 64-bit versions. As for hardware, every SoC should support 64-bit by now, and some flagship Android SoCs are actually reducing their ability to run 32-bit code. Any flagship chip following the recommended ARM design only supports 32-bit processing on three of the eight cores—the other five are 64-bit only. ARM wants to drop 32-bit support entirely from its 2023 flagship SoC design, but there are already rumors stating that Qualcomm doesn't want to follow that recommended design. The most likely reason is because of China. Google's 64-bit app requirements apply only to apps in Google Play, which doesn't exist in China. China has a big collection of competing app stores with more lax policies, so 32-bit apps have not been phased out as aggressively. China is working on this issue, though, with the top-five Chinese app stores—from Alibaba, Baidu, OPPO, Tencent, and Xiaomi—agreeing to ban 32-bit-only apps by the end of this month. There's also the issue of 64-bit compatibility among packed-in apps from OEM skins, which app store rules don't apply to. Rahman found another commit that suggests 64-bit-only support might be a regular feature of 2023's Android 14, so the Pixel tablet, which is already officially confirmed for next year, is looking like a test run to see how everything goes.' -- source: https://arstechnica.com/gadgets/2022/08/google-might-give-the-pixel-tablet-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Update Chrome now to patch actively exploited zero-day
by Peter Reutemann 18 Aug '22

18 Aug '22

'Google announced an update on Wednesday to the Stable channel of its Chrome browser that includes a fix for an exploit that exists in the wild. CVE-2022-2856 is a fix for "insufficient validation of untrusted input in Intents," according to Google's advisory. Intents are typically a way to pass data from inside Chrome to another application, such as the share button on Chrome's address bar. As noted by the Dark Reading blog, input validation is a common weakness in code. The exploit was reported by Ashley Shen and Christian Resell of the Google Threat Analysis Group, and that's all the information we have for now. Details of the exploit are currently tucked behind a wall in the Chromium bugs group and are restricted to those actively working on related components and registered with Chromium. After a certain percentage of users have applied the relevant updates, those details may be revealed. Google says the update—104.0.5112.101 for Mac and Linux and 104.0.5112.102/101 for Windows—will "roll out over the coming days/weeks," but you can (and should) manually update Chrome now (check the "About" section of your settings). There are 10 other security fixes included in the update. Dark Reading notes that this is Chrome's fifth zero-day vulnerability disclosed in 2022.' -- source: https://arstechnica.com/information-technology/2022/08/update-chrome-now-to… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

VLC-Developer VideoLan Says India Blocking Site Endangers Its Own Citizens
by Peter Reutemann 17 Aug '22

17 Aug '22

'VideoLan, the developer of popular media player VLC, says Indian telecom operators have been blocking its website since February of this year in a move that is potentially impacting some users in one of the open source firm's largest markets. From a report: "Most major ISPs [internet service providers] are banning the site, with diverse techniques," VideoLan president and lead developer Jean-Baptiste Kempf said of the blocking in India, in an email to TechCrunch. India represents 10% of all VLC users worldwide, he said. The website's traffic has seen an overall drop of 20% as a result of the blocking in India. [...] VLC, downloaded over 3.5 billion times worldwide, is a local media player that doesn't require internet access or connection to any particular service online for the vast majority of its features. But by blocking the website, India is pushing its citizens to "shady websites that are running hacked version of VLC. So they are endangering their own citizens with this ban," Kempf added.' -- source: https://developers.slashdot.org/story/22/08/16/146257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Releases Android 13, Rolling Out First To Pixel Phones
by Peter Reutemann 16 Aug '22

16 Aug '22

'This year's major Android update, Android 13, is officially releasing today for Googleâ(TM)s Pixel phones, the search giant has announced. >From a report: The annual update is getting an official release a little earlier than usual, following Android 12's release last October and Android 11's release in September 2020. The list of updates arriving with this year's version of Android is likely to be familiar if you've been keeping up with Android 13's beta releases. There's the ability to customize non-Google app icons to match your homescreen wallpaper that we saw in Android 13's first developer preview, a new permission to cut down on notification spam, and a new option to limit which of your photos and videos an app can access. Back in January, we wrote that Google planned to spend this year catching up with Apple's ecosystem integrations, and there's more evidence of this in Android 13's official release. The update includes support for spatial audio with head tracking, which is designed to make sounds appear as though they're coming from a fixed point in space when you move your head while wearing compatible headphones, similar to a feature Apple offers for its AirPods. Today's post doesn't say exactly which headphones this will work with, but Google previously announced it would be updating its Pixel Buds Pro to offer support for spatial audio. Secondly, there's the ability to stream messages from apps including Google Messages directly to a Chromebook, similar to iMessage on the Mac.' -- source: https://tech.slashdot.org/story/22/08/15/1747228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 6.0 Arrives With Performance Improvements and More Rust Coming
by Peter Reutemann 16 Aug '22

16 Aug '22

'Linux creator Linus Torvalds has announced the first release candidate for the Linux kernel version 6.0, but he says the major number change doesn't signify anything especially different about this release. ZDNet: While there is nothing fundamentally different about this release compared with 5.19, Torvalds noted that there were over 13,500 non-merge commits and over 800 merged commits, meaning "6.0 looks to be another fairly sizable release." According to Torvalds, most of the updates are improvements to the GPU, networking and sound. Torvalds stuck to his word after releasing Linux kernel 5.19 last month, when he flagged he would likely call the next release 6.0 because he's "starting to worry about getting confused by big numbers again." On Sunday's release of Linux 6.0 release candidate version 1 (rc-1), he explained his reasoning behind choosing a new major version number and its purpose for developers. Again, it's about avoiding confusion rather than signaling that the release has major new features. His threshold for changing the lead version number was .20 because it is difficult to remember incremental version numbers beyond that. "Despite the major number change, there's nothing fundamentally different about this release - I've long eschewed the notion that major numbers are meaningful, and the only reason for a 'hierarchical; numbering system is to make the numbers easier to remember and distinguish," said Torvalds. Torvalds lamented some Rust-enabling code didn't make it into the release. The Register adds: "I actually was hoping that we'd get some of the first rust infrastructure, and the multi-gen LRU VM, but neither of them happened this time around," he mused, before observing "There's always more releases. This is one of those releases where you should not look at the diffstat too closely, because more than half of it is yet another AMD GPU register dump," he added, noting that Intel's Gaudi2 Ai processors are also likely to produce plenty of similar kernel additions. "The CPU people also show up in the JSON files that describe the perf events, but they look absolutely tiny compared to the 'asic_reg' auto-generated GPU and AI hardware definitions," he added.' -- source: https://linux.slashdot.org/story/22/08/15/199255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

NetBSD 9.3: A 2022 OS That Can Run On Late-1980s Hardware
by Peter Reutemann 14 Aug '22

14 Aug '22

'Version 9.3 of NetBSD is here, able to run on very low-end systems and with that authentic early-1990s experience. The Register reports: Version 9.3 comes some 15 months after NetBSD 9.2 and boasts new and updated drivers, improved hardware support, including for some recent AMD and Intel processors, and better handling of suspend and resume. The next sentence in the release announcement, though, might give some readers pause: "Support for wsfb-based X11 servers on the Commodore Amiga." This is your clue that we are in a rather different territory from run-of-the-mill PC operating systems here. A notable improvement in NetBSD 9.3 is being able to run a graphical desktop on an Amiga. This is a 2022 operating system that can run on late-1980s hardware, and there are not many of those around. NetBSD supports eight "tier I" architectures: 32-bit and 64-bit x86 and Arm, plus MIPS, PowerPC, Sun UltraSPARC, and the Xen hypervisor. Alongside those, there are no less than 49 "tier II" supported architectures, which are not as complete and not everything works -- although almost all of them are on version 9.3 except for the version for original Acorn computers with 32-bit Arm CPUs, which is still only on NetBSD 8.1. There's also a "tier III" for ports which are on "life support" so there may be a risk Archimedes support could drop to that. This is an OS that can run on 680x0 hardware, DEC VAX minicomputers and workstations, and Sun 2, 3, and 32-bit SPARC boxes. In other words, it reaches back as far as some 1970s hardware. Let this govern your expectations. For instance, in VirtualBox, if you tell it you want to create a NetBSD guest, it disables SMP support. ' -- source: https://tech.slashdot.org/story/22/08/12/1958253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Microsoft Urges Windows Users To Run Patch For DogWalk Zero-Day Exploit
by Peter Reutemann 14 Aug '22

14 Aug '22

'Computerworld reports: Despite previously claiming the DogWalk vulnerability did not constitute a security issue, Microsoft has now released a patch to stop attackers from actively exploiting the vulnerability. [...] The vulnerability, known as CVE-2022-34713 or DogWalk, allows attackers to exploit a weakness in the Windows Microsoft Support Diagnostic Tool (MSDT). By using social engineering or phishing, attackers can trick users into visiting a fake website or opening a malicious document or file and ultimately gain remote code execution on compromised systems. DogWalk affects all Windows versions under support, including the latest client and server releases, Windows 11 and Windows Server 2022. The vulnerability was first reported in January 2020 but at the time, Microsoft said it didn't consider the exploit to be a security issue. This is the second time in recent months that Microsoft has been forced to change its position on a known exploit, having initially rejected reports that another Windows MSDT zero-day, known as Follina, posed a security threat. A patch for that exploit was released in June's Patch Tuesday update. ' -- source: https://tech.slashdot.org/story/22/08/12/2037213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google's New Bug Bounties Include Their Custom Linux Kernel's Experimental Security Mitigations
by Peter Reutemann 14 Aug '22

14 Aug '22

'Google uses Linux "in almost everything," according to the leader of Google's "product security response" team — including Chromebooks, Android smartphones, and even Google Cloud. "Because of this, we have heavily invested in Linux's security — and today, we're announcing how we're building on those investments and increasing our rewards." In 2020, we launched an open-source Kubernetes-based Capture-the-Flag (CTF) project called, kCTF. The kCTF Vulnerability Rewards Program lets researchers connect to our Google Kubernetes Engine (GKE) instances, and if they can hack it, they get a flag, and are potentially rewarded. All of GKE and its dependencies are in scope, but every flag caught so far has been a container breakout through a Linux kernel vulnerability. We've learned that finding and exploiting heap memory corruption vulnerabilities in the Linux kernel could be made a lot harder. Unfortunately, security mitigations are often hard to quantify, however, we think we've found a way to do so concretely going forward.... First, we are indefinitely extending the increased reward amounts we announced earlier this year, meaning we'll continue to pay $20,000 — $91,337 USD for vulnerabilities on our lab kCTF deployment to reward the important work being done to understand and improve kernel security. This is in addition to our existing patch rewards for proactive security improvements. Second, we're launching new instances with additional rewards to evaluate the latest Linux kernel stable image as well as new experimental mitigations in a custom kernel we've built. Rather than simply learning about the current state of the stable kernels, the new instances will be used to ask the community to help us evaluate the value of both our latest and more experimental security mitigations. Today, we are starting with a set of mitigations we believe will make most of the vulnerabilities (9/10 vulns and 10/13 exploits) we received this past year more difficult to exploit. For new exploits of vulnerabilities submitted which also compromise the latest Linux kernel, we will pay an additional $21,000 USD. For those which compromise our custom Linux kernel with our experimental mitigations, the reward will be another $21,000 USD (if they are clearly bypassing the mitigations we are testing). This brings the total rewards up to a maximum of $133,337 USD. We hope this will allow us to learn more about how hard (or easy) it is to bypass our experimental mitigations..... With the kCTF VRP program, we are building a pipeline to analyze, experiment, measure and build security mitigations to make the Linux kernel as safe as we can with the help of the security community. We hope that, over time, we will be able to make security mitigations that make exploitation of Linux kernel vulnerabilities as hard as possible. "We don't care about vulnerabilities; we care about exploits," Vela told the Register. "We expect the vulnerabilities are there, they will get patched, and that's nice and all. But the whole idea is what do to beyond just patching a couple of vulnerabilities." In total, Google paid out $8.7 million in rewards to almost 700 researchers across its various VPRs last year. "We are just one actor in the whole community that happens to have economic resources, financial resources, but we need the community to help us make the Kernel better," Vela said. "If the community is engaged and helps us validate the mitigations that we have, then, we will continue growing on top of that. But the whole idea is that we need to see where the community wants us to go with this...." [I]t's not always about the cash payout, according to Vela, and different bug hunters have different motivations. Some want money, some want fame and some just want to solve an interesting problem, Vela said. "We are trying to find the right combination to captivate people." ' -- source: https://linux.slashdot.org/story/22/08/13/064239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Researchers Find Vulnerability In Software Underlying Discord, Microsoft Teams, and Other Apps
by Peter Reutemann 12 Aug '22

12 Aug '22

'Motherboard reports: A group of security researchers found a series of vulnerabilities in the software underlying popular apps like Discord, Microsoft Teams, Spotify and many others, which are used by tens of millions of people all over the world. At the Black Hat cybersecurity conference in Las Vegas on Thursday, the researchers presented their findings, detailing how they could have hacked people who use Discord, Microsoft Teams, and the chat app Element by exploiting the software underlying all of them: Electron, which is a framework built on the open source Chromium and the cross-platform javascript environment Node JS. In all these cases, the researchers submitted vulnerabilities to Electron to get them fixed, which earned them more than $10,000 in rewards. The bugs were fixed before the researchers published their research. Aaditya Purani, one of the researchers who found these vulnerabilities, said that "regular users should know that the Electron apps are not the same as their day-to-day browsers," meaning they are potentially more vulnerable. In the case of Discord, the bug Purani and his colleagues found only required them to send a malicious link to a video. With Microsoft Teams, the bug they found could be exploited by inviting a victim to a meeting. In both cases, if the targets clicked on these links, hackers would have been able to take control of their computers, Purani explained in the talk. For him, one of the main takeaways of their research is that Electron is risky precisely because users are very likely to click on links shared in Discord or Microsoft Teams.' -- source: https://it.slashdot.org/story/22/08/11/211256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi-Powered Anti-Tracking Tool Checks If You're Being Followed
by Peter Reutemann 12 Aug '22

12 Aug '22

'Matt Edmondson, a hacker and digital forensics expert, built a Raspberry Pi-powered anti-tracking tool that "scans for nearby devices and alerts you if the same phone is detected multiple times within the past 20 minutes," reports Wired. The device, which can be carried around or placed in a car, consists of parts that cost around $200 in total. From the report: The homemade system works by scanning for wireless devices around it and then checking its logs to see whether they also were present within the past 20 minutes. It was designed to be used while people are on the move rather than sitting in, say, a coffee shop, where it would pick up too many false readings. The anti-tracking tool, which can sit inside a shoebox-sized case, is made up of a few components. A Raspberry Pi 3 runs its software, a Wi-Fi card looks for nearby devices, a small waterproof case protects it, and a portable charger powers the system. A touchscreen shows the alerts the device produces. Each alert may be a sign that you are being tailed. The device runs Kismet, which is a wireless network detector, and is able to detect smartphones and tablets around it that are looking for Wi-Fi or Bluetooth connections. The phones we use are constantly looking for wireless networks around them, including networks they've connected to before as well as new networks. Edmondson says Kismet makes a record of the first time it sees a device and then the most recent time it was detected. But to make the anti-tracking system work, he had to write code in Python to create lists of what Kismet detects over time. There are lists for devices spotted in the past five to 10 minutes, 10 to 15 minutes, and 15 to 20 minutes. If a device appears twice, an alert flashes up on the screen. The system can show a phone's MAC address, although this is not much use if it's been randomized. It can also record the names of Wi-Fi networks that devices around it are looking for -- a phone that's trying to connect to a Wi-Fi network called Langley may give some clues about its owner. "If you have a device on you, I should see it," he says. In an example, he showed WIRED that a device was looking for a network called SAMSUNGSMART. To stop the system from detecting your own phone or those of other people traveling with you, it has an "ignore" list. By tapping one of the device's onscreen buttons, it's possible to "ignore everything that it has already seen." Edmondson says that in the future, the device could be modified to send a text alert instead of showing them on the screen. He is also interested in adding the capability to detect tire-pressure monitoring systems that could show recurring nearby vehicles. A GPS unit could also be added so you can see where you were when you were being tracked, he says. [...] Edmondson has no plans to make the device into a commercial product, but he says the design could easily be copied and reused by anyone with some technical knowledge. Many of the parts involved are easy to obtain or may be lying around the homes of people in tech communities. For those interested, Edmondson open-sourced its underlying code and plans to present the research project at the Black Hat security conference in Las Vegas this week.' -- source: https://yro.slashdot.org/story/22/08/11/2143207 Anybody interested in exploring that project and demoing it at our September meeting slot? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

SGX, Intel's Supposedly Impregnable Data Fortress, Has Been Breached Yet Again
by Peter Reutemann 10 Aug '22

10 Aug '22

'Intel's latest generation of CPUs contains a vulnerability that allows attackers to obtain encryption keys and other confidential information protected by the company's software guard extensions, the advanced feature that acts as a digital vault for security users' most sensitive secrets. From a report: Abbreviated as SGX, the protection is designed to provide a fortress of sorts for the safekeeping of encryption keys and other sensitive data, even when the operating system or a virtual machine running on top is maliciously compromised. SGX works by creating trusted execution environments that protect sensitive code and the data it works with from monitoring or tampering by anything else on the system. SGX is a cornerstone of the security assurances many companies provide to users. Servers used to handle contact discovery for the Signal Messenger, for instance, rely on SGX to ensure the process is anonymous. Signal says running its advanced hashing scheme provides a "general recipe for doing private contact discovery in SGX without leaking any information to parties that have control over the machine, even if they were to attach physical hardware to the memory bus." The example is purely hypothetical. Signal spokesperson Jun Harada wrote in an email: "Intel alerted us to this paper... and we were able to verify that the CPUs that Signal uses are not impacted by the findings of this paper and therefore are not vulnerable to the stated attack." Key to the security and authenticity assurances of SGX is its creation of what are called "enclaves," or blocks of secure memory. Enclave contents are encrypted before they leave the processor and are written in RAM. They are decrypted only after they return. The job of SGX is to safeguard the enclave memory and block access to its contents by anything other than the trusted part of the CPU.' -- source: https://it.slashdot.org/story/22/08/09/1814258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

NVIDIA Publishes 73k Lines Worth Of 3D Header Files For Fermi Through Ampere GPUs
by Peter Reutemann 10 Aug '22

10 Aug '22

'In addition to NVIDIA being busy working on transitioning to an open-source GPU kernel driver, yesterday they made a rare public open-source documentation contribution... NVIDIA quietly published 73k lines worth of header files to document the 3D classes for their Fermi through current-generation Ampere GPUs. Phoronix's Michael Larabel reports: To NVIDIA's Open-GPU-Docs portal they have posted the 73k lines worth of 3D class header files covering RTX 30 "Ampere" GPUs back through the decade-old GeForce 400/500 "Fermi" graphics processors. These header files define the classes used to program the 3D engine of the GPU, the texture header and texture sampler layout are documented, and other 3D-related programming bits. Having all of these header files will be useful to the open-source Nouveau driver developers to save on their reverse-engineering and guessing/uncertainty over certain bits. NVIDIA's Open GPU Kernel Driver is for only GeForce RTX 20 "Turing" series and newer, so it's great seeing NVIDIA now posting this documentation going back to Fermi which is squarely to help the open-source community / Nouveau. [...] The timing of NVIDIA opening these 3D classes back to Fermi is interesting and potentially tied to SIGGRAPH 2022 happening this week. Those wanting to grab NVIDIA's latest open-source GPU documentation can find it via this GitHub repository. ' -- source: https://news.slashdot.org/story/22/08/09/2225215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Phone Carrier That Doesn't Track Your Browsing Or Location
by Peter Reutemann 10 Aug '22

10 Aug '22

'Wired reports: As marketers, data brokers, and tech giants endlessly expand their access to individuals' data and movements across the web, tools like VPNs or cookie blockers can feel increasingly feeble and futile. Short of going totally off the grid forever, there are few options for the average person to meaningfully resist tracking online. Even after coming up with a technical solution last year for how phone carriers could stop automatically collecting users' locations, researchers Barath Raghavan and Paul Schmitt knew it would be challenging to convince telecoms to implement the change. So they decided to be the carrier they wanted to see in the world. The result is a new company, dubbed Invisv, that offers mobile data designed to separate users from specific identifiers so the company can't access or track customers' metadata, location information, or mobile browsing. Launching in beta today for Android, the company's Pretty Good Phone Privacy or PGPP service will replace the mechanism carriers normally use to turn cell phone tower connection data into a trove of information about users' movements. And it will also offer a Relay service that disassociates a user's IP address from their web browsing. PGPP's ability to mask your phone's identity from cell towers comes from a revelation about why cell towers collect the unique identifiers known as IMSI numbers, which can be tracked by both telecoms and other entities that deploy devices known as IMSI catchers, often called stringrays, which mimic a cell tower for surveillance purposes. Raghavan and Schmitt realized that at its core, the only reason carriers need to track IMSI numbers before allowing devices to connect to cell towers for service is so they can run billing checks and confirm that a given SIM card and device are paid up with their carrier. By acting as a carrier themselves, Invisv can implement their PGPP technology that simply generates a "yes" or "no" about whether a device should get service. On the PGPP "Mobile Pro" plan, which costs $90 per month, users get unlimited mobile data in the US and, at launch, unlimited international data in most European Union countries. Users also get 30 random IMSI number changes per month, and the changes can happen automatically (essentially one per day) or on demand whenever the customer wants them. The system is designed to be blinded so neither INVISV nor the cell towers you connect to know which IMSI is yours at any given time. There's also a "Mobile Core" plan for $40 per month that offers eight IMSI number changes per month and 9 GB of high-speed data per month. Both of these plans also include PGPP's Relay service. Similar to Apple's iCloud Private Relay, PGPP's Relay is a method for blocking everyone, from your internet provider or carrier to the websites you visit, from knowing both who you are and what you're looking at online at the same time. Such relays send your browsing data through two way stations that allow you to browse the web like normal while shielding your information from the world. When you navigate to a website, your IP address is visible to the first relay -- in this case, Invisv -- but the information about the page you're trying to load is encrypted. Then the second relay generates and connects an alternate IP address to your request, at which point it is able to decrypt and view the website you're trying to load. The content delivery network Fastly is working with Invisv to provide this second relay. Fastly is also one of the third-party providers for iCloud Private Relay. In this way, each relay knows some of the information about your browsing; the first simply knows that you are using the web, and the second sees the sites you connect to, but not who specifically is browsing there. In addition to being included in the two PGPP data plans, customers can also purchase the Relay service on its own for $5 per month and turn it on while connected to mobile data or Wi-Fi. The carrier is still working to bring its services to Apple's iOS. It's also worth noting that Invisv only offers mobile data; there are no voice calling services.' -- source: https://yro.slashdot.org/story/22/08/08/219258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

Amazon's Roomba Deal Is Really About Mapping Your Home
by Peter Reutemann 09 Aug '22

09 Aug '22

'Bloomberg: Amazon.com hasn't just bought a maker of robot vacuum cleaners. It's acquired a mapping company. To be more precise: a company that can make maps of your home. The company announced a $1.7 billion deal on Friday for iRobot, the maker of the Roomba vacuum cleaner. And yes, Amazon will make money from selling those gadgets. But the real value resides in those robots' ability to map your house. As ever with Amazon, it's all about the data. A smart home, you see, isn't actually terribly smart. It only knows that your Philips Hue lightbulbs and connected television are in your sitting room because you've told it as much. It certainly doesn't know where exactly the devices are within that room. The more it knows about a given space, the more tightly it can choreograph the way they interact with you. The smart home is clearly a priority for Amazon. Its Echo smart speakers still outsell those from rivals Apple and Google, with an estimated 9.9 million units sold in the three months through March, according to the analysis firm Strategy Analytics. It's complemented that with a $1 billion deal for the video doorbell-maker Ring in 2018, and the wi-fi company Eero a year later. But you still can't readily buy the Astro, Amazon's household robot that was revealed with some fanfare last year, is still only available in limited quantities. That, too, seemed at least partly an effort to map the inside of your property, a task that will now fall to iRobot. The Bedford, Mass.-based company's most recent products include a technology it calls Smart Maps, though customers can opt out of sharing the data. Amazon said in a statement that protecting customer data is "incredibly important." Slightly more terrifying, the maps also represent a wealth of data for marketers. The size of your house is a pretty good proxy for your wealth. A floor covered in toys means you likely have kids. A household without much furniture is a household to which you can try to sell more furniture. This is all useful intel for a company such as Amazon which, you may have noticed, is in the business of selling stuff.' -- source: https://slashdot.org/story/22/08/08/2039234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Purism's 'Librem 5 USA' Smartphone Achieves Major New Shipping Milestone
by Peter Reutemann 08 Aug '22

08 Aug '22

'Purism posted an announcement Thursday about their privacy-focused "Librem 5 USA" smartphones. "New orders placed today will ship within our standard 10-business-day window." The Librem 5 USA now joins the Librem Mini and Librem 14 as a post-Just In Time product, one where instead of relying on Just In Time supply chains to manufacture a product just as we need it, we have invested in maintaining much larger inventories so that we can better absorb future supply chain issues that may come our way. For anyone who is new to the product, the Librem 5 USA is our premium phone that shares the same hardware design and features as our mass-produced Librem 5, but with electronics we make in the USA using a separate electronics supply chain that sources from US suppliers whenever possible. This results in a tighter, more secure supply chain for the Librem 5 USA. The Librem 5 USA uses the same PureOS as our other computers and so it runs the same desktop Linux applications you might be used to, just on a small screen. PureOS on the Librem 5 USA demonstrates real convergence, where the device becomes more than just a phone, it becomes a full-featured pocket-sized computer that can act like a desktop when connected to a monitor, keyboard and mouse, or even a laptop (or tablet!) when connected to a laptop docking station. All of your files and all of your software remains the same and follows you where you go. Applications just morph from the smaller screen to the larger screen when docked, just like connecting a external monitor to a laptop. Everyone who has backed the Librem 5 and Librem 5 USA projects hasn't just supported the production of the hardware itself, they have also supported a massive, multi-year software development effort to bring the traditional Linux desktop to a phone form-factor. Projects such as Phosh (the GUI), Phoc (the Compositor), Squeekboard (the Keyboard), Calls (for calling), Chats (for texting and messaging), and libhandy/libadwaita (libraries to make GTK applications adaptive) all required massive investment and many of these projects have already been moved to the GNOME infrastructure to better share our effort with a larger community. We are delighted to see that many other mobile projects have recognized the quality of our efforts and adopted our software into their own projects.... The Librem 5 USA was designed for longevity and because we support right to repair, we also offer a number of spare parts in our shop, including replacement modems so you can make sure you support all the cellular bands in a particular continent, replacement batteries for when you ultimately wear out your existing battery, and plenty of other spare parts that haven't had sufficient demand to post formally on our shop (yet). If you need a spare part that isn't yet on the shop, just ask.' -- source: https://linux.slashdot.org/story/22/08/07/0528255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Development Suddenly Resumes on Linux Distro CutefishOS
by Peter Reutemann 08 Aug '22

08 Aug '22

'Last month fans were worried about CuteFish OS, with its domain timing out, emails going unanswered, and a Twitter feed that hadn't posted anything since March. But "now it looks like the original development team behind CuteFishOS is coming back to life," according to this report from The New Stack — with a Reddit user planning a fork now saying that's been put on hold, since "I'd be duplicating work for no reason." Last Sunday — on July 31st — CuteFish's official repository on GitHub was updated with a new announcement in its profile. "Your Favorite CutefishOS are back now!" [sic] It also promised "New website in the works (coming soon)." and pointed to a new URL. You can see the changes happening right before your eyes. That website's domain — OpenFish.org — was registered just ten days ago, on Thursday, July 28th — and it's still a work in progress. On Thursday afternoon it was pointing to a non-English-language page hosted on the Pakistani cloud platform QCloud — but by Thursday night it was showing a testing page for a NGNIX HTTP server running Red Hat Enterprise Linux. And there's now also a new README file in CuteFish's GitHub repository listing five items as "progressing." The first item is "official website preparation," but other items include collating the previous pull requests and issues, "fix the existing problem," and eventually adding new features. The sole contributor to the repository appears to be a Chinese coder going under the name of Biukang. "We are preparing for the restart of CutefishOS," says Biukang's GitHub profile now. But the article still hails last month's discussion of a fork as "a chance to see open source communities mobilizing into action just to fill a perceived void."' -- source: https://linux.slashdot.org/story/22/08/06/0019243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DreamWorks Animation To Release Renderer As Open-Source Software
by Peter Reutemann 07 Aug '22

07 Aug '22

'With annual CG confab SIGGRAPH slated to start Monday in Vancouver, DreamWorks Animation announced its intent to release its proprietary renderer, MoonRay, as open-source software later this year. Hollywood Reporter reports: MoonRay has been used on feature films such as How to Train Your Dragon: The Hidden World, Croods: A New Age, The Bad Guys and upcoming Puss in Boots: The Last Wish. MoonRay uses DreamWorks' distributed computation framework, Arras, also to be included in the open-source code base. "We are thrilled to share with the industry over 10 years of innovation and development on MoonRay's vectorized, threaded, parallel, and distributed code base," said Andrew Pearce, DWA's vp of global technology. "The appetite for rendering at scale grows each year, and MoonRay is set to meet that need. We expect to see the code base grow stronger with community involvement as DreamWorks continues to demonstrate our commitment to open source."' -- source: https://news.slashdot.org/story/22/08/05/229228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

After Backlash, GitLab U-Turns on Deleting Dormant Projects
by Peter Reutemann 07 Aug '22

07 Aug '22

'"GitLab has reversed its decision to automatically delete projects that are inactive for more than a year and belong to its free-tier users," reports the Register. Thursday GitLab tweeted: "We discussed internally what to do with inactive repositories. We reached a decision to move unused repos to object storage. Once implemented, they will still be accessible but take a bit longer to access after a long period of inactivity." But the Register says they've seen internal documents from "well-placed sources" showing that GitLab had originally "hoped the move would save it up to $1 million a year and help make its SaaS business sustainable." And the company had spent a long time preparing for such a move: Documents we have seen gave staff notice of an internal meeting scheduled for August 9. The agenda for the meeting lays out the plan to delete dormant code repositories... Other internal documents seen by The Register mention the possible use of object storage to archive projects but express concerns that doing so would increase GitLab's costs by creating a need for multiple redundant backups. We have also seen internal discussions confirming the automation code to delete inactive projects was completed by the end of July, and was ready to roll out after months of debate and development work. One of our sources told us [Thursday] that it was online pressure, led by The Register's reporting, that forced a dramatic rethink at the GitHub rival. Word of the deletion policy as a money-saving exercise sparked fury on Twitter and Reddit. On GitLab's Twitter feed Thursday, someone raised an interesting point about GitLab's new promise to move inactive repos into object storage. "Wait, does 'inactive' mean repositories that have no new commits? Or only those without new commits AND without read access by cloning / fetching?" And GitLab's CEO/co-founder Sid Sijbrandij replied, "We're not sure yet. Probably all write operations would keep a project active, creating an issue, a merge request, pushing changes to a branch, etc. We might also keep it active as long as people are doing read operations such as cloning, forking, etc." Friday Sijbrandij tweeted this status update: "Archived projects is a user activated state that signals intent. We're not sure yet but very likely the storage type used is orthogonal to that. Our current plan for object storage would keep the repos visible to everyone."' -- source: https://developers.slashdot.org/story/22/08/06/0417218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DuckDuckGo Browser's Stricter Privacy Protection Will Also Apply To Microsoft Scripts Now
by Peter Reutemann 06 Aug '22

06 Aug '22

'After a revelation in May that DuckDuckGo's (DDG) privacy-focused web browser allows Microsoft tracking scripts on third-party websites, the company now says it will start blocking those too. From a report: DuckDuckGo's browser had third-party tracker loading protection by default that already blocked scripts embedded on websites from Facebook, Google, and others, but until now Microsoft's scripts from the Bing and LinkedIn domains (but not its third-party cookies) had a pass. A security researcher named Zach Edwards pointed out the exclusion that he apparently uncovered while auditing the browser's privacy claims, and noted it is especially curious because Microsoft is the partner that delivers ads in DDG's search engine (while promising not to use that data to create a monitored profile of users to target ads, instead relying on context to decide which ones it should show). DuckDuckGo CEO Gabe Weinberg said at the time that the reason for it was a search syndication agreement with Microsoft, and that more updates on third-party tracker preventions were coming. A backlash ensued, with some seizing on DuckDuckGo's own words that "tracking is tracking," a phrase the company used against Google's cookie-replacing "privacy sandbox" ad technology. Now Weinberg writes in a blog post, "I've heard from a number of users and understand that we didn't meet their expectations around one of our browser's web tracking protections." DuckDuckGo is vowing to be more transparent about what trackers its browser and extensions are protecting users from, making its tracker blocklists available and offering users more information on how its tracking protections with a new help page.' -- source: https://yro.slashdot.org/story/22/08/05/173203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mint 20: disappearing window decorations (MATE)
by Peter Reutemann 05 Aug '22

05 Aug '22

Hi everyone Since a few weeks, I've been getting these random events where all my window decorations are disappearing and I basically have to restart my X session. This happens under Linux Mint 20, MATE edition. Looking through systemd journals, I noticed core dumps and I ran the following command to just list core dumps: sudo coredumpctl list I noticed that "/usr/bin/marco" (the MATE window manager) was causing some of the crashes. After a bit of duckduckgoing, I came across some posts on the Mint forums that mention a bug in marco 1.24, which apparently got fixed in 1.24.1: https://forums.linuxmint.com/viewtopic.php?t=354845 And I'm running indeed that version of the window manager ("dpkg -l | grep marco"): 1.24.0-1ubuntu1 One suggestion was to switch from "marco+compositing" to "metacity+compositing", which I'm trialing now (Control Center -> Desktop settings -> Windows -> Window manager). Maybe this will help other people experiencing this issue... :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

GitLab Plans To Delete Dormant Projects in Free Accounts
by Peter Reutemann 05 Aug '22

05 Aug '22

'GitLab plans to automatically delete projects if they've been inactive for a year and are owned by users of its free tier, The Register reported Thursday. From the report: The Register has learned that such projects account for up to a quarter of GitLab's hosting costs, and that the auto-deletion of projects could save the cloudy coding collaboration service up to $1 million a year. The policy has therefore been suggested to help GitLab's finances remain sustainable. People with knowledge of the situation, who requested anonymity as they are not authorized to discuss it with the media, told The Register the policy is scheduled to come into force in September 2022. GitLab is aware of the potential for angry opposition to the plan, and will therefore give users weeks or months of warning before deleting their work. A single comment, commit, or new issue posted to a project during a 12-month period will be sufficient to keep the project alive. The Register understands some in the wider GitLab community worry that the policy could see projects disappear before users have the chance to archive code on which they rely. As many open-source projects are widely used, it is feared that the decision could have considerable negative impact.' -- source: https://developers.slashdot.org/story/22/08/04/1919231 Ouch... I have a bunch of projects that haven't been touched for years, as they are plugins to stable APIs (and didn't require any fixes/updates). Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Raspberry Pi 4 Expands 3D Potential With Vulkan Update
by Peter Reutemann 03 Aug '22

03 Aug '22

'The Raspberry Pi 4 has hit a major graphics milestone, adding support for a more modern Vulkan 3D APIa. Ars Technica reports: Raspberry Pi CEO Eben Upton announced the Pi 4's Vulkan 1.2 conformance on Monday. Support isn't available yet in downloadable Pi-friendly operating systems but should be coming soon. For most people using their Pi as a server, a DIY controller, or a light desktop, Vulkan 1.2 conformance won't be noticeable. Desktop graphics on the standard Raspberry Pi OS are powered by OpenGL, the older graphics API that Vulkan is meant to replace. There is one group that benefits, says Upton: games and other 3D Android applications. Android uses Vulkan as its low-overhead graphics API. As with most Raspberry Pi advancements, there could be unforeseen opportunities unleashed by this seemingly tiny change. Vulkan 1.2 support gives developers the same 3D-graphics interface (if not anywhere near the same power) as 2019 NVIDIA graphics cards, 2020 Intel chips with integrated graphics, and dozens of other devices. With a Vulkan 1.0 driver installed, developer Iago Toral was able in 2020 to get the original Quake trilogy mostly running on a Pi 4, with not-too-shabby frame rates. ' -- source: https://tech.slashdot.org/story/22/08/02/226200 Cheers, peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

New Gmail Attack Bypasses Passwords and 2FA To Read All Email
by Peter Reutemann 03 Aug '22

03 Aug '22

'Forbes: According to cyber security firm Volexity, the threat research team has found the North Korean 'SharpTongue' group, which appears to be part of, or related to, the Kimsuky advanced persistent threat group, deploying malware called SHARPEXT that doesn't need your Gmail login credentials at all. Instead, it "directly inspects and exfiltrates data" from a Gmail account as the victim browses it. This quickly evolving threat, Volexity says it is already on version 3.0 according to the malware's internal versioning, can steal email from both Gmail and AOL webmail accounts, and works across three browsers: Google Chrome, Microsoft Edge, and a South Korean client called Whale. The U.S. Cybersecurity & Infrastructure Security Agency, CISA, reports that Kimsuky has been operating since 2012, and is "most likely tasked by the North Korean regime with a global intelligence gathering mission." While CISA sees Kimsuky most often targeting individuals and organizations in South Korea, Japan, and the U. S., Volexity says that the SharpTongue group has frequently been seen targeting South Korea, the U. S. and Europe. The common denominator between them is that the victims often " work on topics involving North Korea, nuclear issues, weapons systems, and other matters of strategic interest to North Korea." The report says that SHARPEXT differs from previous browser extensions deployed by these hacking espionage groups in that it doesn't attempt to grab login credentials but bypasses the need for these and can grab email data as the user reads it. The good news is that your system needs to be compromised by some means before this malicious extension can be deployed. Unfortunately, we know all too well that system compromise is not as difficult as it should be. Once a system has been compromised by phishing, malware, unpatched vulnerabilities, whatever, the threat actors can install the extension using a malicious VB script that replaces the system preference files. Once that's done and the extension runs quietly in the background, it is tough to detect. The user logs in to their Gmail account from their normal browser on the expected system. The security researchers recommend "enabling and analyzing PowerShell ScriptBlock logging" to detect whether you've been targeted by this attack, reports Forbes. Additionally, they recommend reviewing installed extensions regularly, especially looking for ones you don't recognize or are not available from the Chrome Web Store.' -- source: https://it.slashdot.org/story/22/08/02/2041205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Dirty Carbon Secret Behind Solid State Memory Drives
by Peter Reutemann 03 Aug '22

03 Aug '22

'Solid state drives use far less power than hard disc drives. But a new study unexpectedly reveals that their lifetime carbon footprint is much higher than their hard disc cousins, raising difficult questions for the computer industry. From a report: The benefits of SSDs over HDDs are legion. They are smaller, mechanically simpler, faster to read and write data than their hard disc cousins. They are also more energy efficient. So with many computer manufacturers and datacenter operators looking to reduce their carbon footprints, it's easy to imagine that all this makes the choice of memory easy. But all is not as it seems, say Swamit Tannu at University of Wisconsin in Madison and Prashant Nair at the University of British Columbia in Vancouver. SSDs have a dirty secret. Tannu and Nair have measured the carbon footprint per gigabyte of these devices across their entire lifetimes and, unexpectedly, it turns out that SSDs are significantly dirtier. "Compared to SSDs, the embodied [carbon] cost of HDDs is at least an order of magnitude lower," say the researchers. Tannu and Nair come to their conclusion by adding up the amount of carbon emitted throughout the estimated 10-year lifespans of these devices. This includes the carbon emitted during manufacture, during operation, for transportation and for disposal. The carbon emitted during operation is straightforward to calculate. To read and write data, HDDs consume 4.2 Watts versus 1.3W for SSDs. The researchers calculate that a 1 terabyte HDD emits the equivalent of 159 kilograms of carbon dioxide during a 10-year operating lifespan. By comparison, a 1 terabyte SSD emits just 49.2 kg over 10 years. But SSDs are significantly more carbon intensive to manufacture. That's because the chip fabrication facilities for SSDs operate at extreme temperatures and pressures that are energy intensive to maintain. And bigger memories require more chips, which increases the footprint accordingly. All this adds up to a significant carbon footprint for SSD manufacture. Tannu and Nair calculate that manufacturing a 1 terabyte SSD emits the equivalent of 320 kg of carbon dioxide. By comparison, a similar HDD emits just 40 kg. So the lifetime footprint for a 1 terabyte SSD is 369.2 kg of carbon dioxide equivalent versus 199 kg for an HDD. So HDDs are much cleaner. That's a counterintuitive result with important implications. At the very least, it suggests that computer manufacturers and cloud data storage operators should reconsider the way they use SSDs and HDDs. For example, almost 40 per cent of the carbon footprint of a desktop computer comes from its SSD, compared to just 4 per cent from the CPU and 11 per cent from the GPU.' -- source: https://hardware.slashdot.org/story/22/08/02/1837229 I wish my drives would last 10 years, neither HDD or SSD seem to last that long... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0