- wlug - list.wlug.org.nz

Millions of WordPress sites get forced update to patch critical plugin flaw
by Peter Reutemann 21 Feb '22

21 Feb '22

'Millions of WordPress sites have received a forced update over the past day to fix a critical vulnerability in a plugin called UpdraftPlus. The mandatory patch came at the request of UpdraftPlus developers because of the severity of the vulnerability, which allows untrusted subscribers, customers, and others to download the site’s private database as long as they have an account on the vulnerable site. Databases frequently include sensitive information about customers or the site’s security settings, leaving millions of sites susceptible to serious data breaches that spill passwords, user names, IP addresses, and more.' -- source: https://arstechnica.com/information-technology/2022/02/millions-of-wordpres… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Developers Patch Bugs Faster Than Microsoft, Apple, and Google, Study Shows
by Peter Reutemann 21 Feb '22

21 Feb '22

'Linux programmers fixed bugs faster than anyone — in an average of just 25 days (improving from 32 days in 2019 to just 15 in 2021). That's the conclusion of Google's "Project Zero" security research team, which studied the speed of bug-fixing from January 2019 to December 2021. ZDNet reports that Linux's competition "didn't do nearly as well." For instance, Apple, 69 days; Google, 44 days; and Mozilla, 46 days. Coming in at the bottom was Microsoft, 83 days, and Oracle, albeit with only a handful of security problems, with 109 days. By Project Zero's count, others, which included primarily open-source organizations and companies such as Apache, Canonical, Github, and Kubernetes, came in with a respectable 44 days. Generally, everyone's getting faster at fixing security bugs. In 2021, vendors took an average of 52 days to fix reported security vulnerabilities. Only three years ago the average was 80 days. In particular, the Project Zero crew noted that Microsoft, Apple, and Linux all significantly reduced their time to fix over the last two years. As for mobile operating systems, Apple iOS with an average of 70 days is a nose better than Android with its 72 days. On the other hand, iOS had far more bugs, 72, than Android with its 10 problems. Browsers problems are also being fixed at a faster pace. Chrome fixed its 40 problems with an average of just under 30 days. Mozilla Firefox, with a mere 8 security holes, patched them in an average of 37.8 days. Webkit, Apple's web browser engine, which is primarily used by Safari, has a much poorer track record. Webkit's programmers take an average of over 72 days to fix bugs.' -- source: https://linux.slashdot.org/story/22/02/20/1915222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Why I Don’t Like Checking Version Numbers
by Lawrence D'Oliveiro 18 Feb '22

18 Feb '22

Some major web browsers will soon be hitting version 100. The rollover to a 3-digit version number is going to trigger a repeat of what happened when version numbers rolled from 9 to 10 -- some sites turned out to have buggy version checking based simplistically on strings rather than numeric values, and misbehave <https://www.theregister.com/2022/02/17/browsers_version_100_websites_bug/>. As a matter of habit, I have long been reluctant to condition behaviour in my own code based on writing code to look up version numbers of things. I prefer to include some kind of check that more directly determines the existence of relevant functionality.

1 0

Ransomware-As-A-Service
by Lawrence D'Oliveiro 10 Feb '22

10 Feb '22

From <https://www.theregister.com/2022/02/09/uk_us_au_ransomware_warning/>: Ransomware attacks are proliferating as criminals turn to gangs providing turnkey post-compromise services, Britain's National Cyber Security Centre (NCSC) has warned. So, ransomware has become so routine, it has spawned specialists who will take care of many of the technical details for you. For a fee, of course. I think “turnkey post-compromise services” shall be my phrase of the week ...

1 0

Listening To The Radio Killed My Car Stereo!
by Lawrence D'Oliveiro 10 Feb '22

10 Feb '22

From <https://arstechnica.com/cars/2022/02/radio-station-snafu-in-seattle-bricks-…>: ... the problem began on January 30 and afflicted Mazdas from model years 2014 to 2017 when the cars were tuned to the local NPR station, KUOW 94.9. At some point during the day's broadcast, a signal from KUOW caused the Mazdas' infotainment systems to crash—the screens died and the radios were stuck on 94.9 FM. The problem was image files† in the HD radio stream that the infotainment system didn’t know how to decode (they were lacking filename extensions). So it crashed. But the files were still in its cache on reboot, so it tried to decode them again. And crashed again. And it appears, there is no way to get rid of those files or reset the system to a safe state without major hardware surgery. And a replacement unit costs USD1,500 -- if you can get one. Luckily, Mazda has advised that it knows about the problem, and will replace the affected units free of charge -- once supplies are available. †Radio with pictures? Who knew?

1 0

System76 Linux workstation looks ready for gaming, too
by Peter Reutemann 04 Feb '22

04 Feb '22

'System76's latest Linux laptop combines one of AMD's most powerful 5000 series mobile CPUs with Nvidia's mid-range RTX 3060. Configurable to up to $3,442, the Kudu targets Linux users who have a lot of work to do, while quietly nodding at those who like to play games every now and then, too. The 15.6-inch Kudu is the second-priciest offering in System76's laptop lineup. It comes with an octa-core AMD Ryzen 9 5900HX, which has a base clock speed of 3.3 GHz and a boost of up to 4.6 GHz.' -- source: https://arstechnica.com/gadgets/2022/02/system76-linux-laptop-unites-amd-nv… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla is Shutting Down Its VR Web Browser, Firefox Reality
by Peter Reutemann 04 Feb '22

04 Feb '22

'A top VR web browser is closing down. Today, Mozilla announced it's shutting down its Firefox Reality browser -- the four-year-old browser built for use in virtual reality environments. The technology had allowed users to access the web from within their VR headset, doing things like visiting URLs, performing searches, and browsing both the 2D and 3D internet using your VR hand controllers, instead of a mouse. >From a report: Firefox Reality first launched in fall 2018 and has been available on Viveport, Oculus, Pico, and Hololens platforms through their various app stores. While capable of surfing the 2D web, the expectation was that users would largely use the new technology to browse and interact with the web's 3D content, like 360-degree panoramic images and videos, 3D models, and WebVR games, for example. But in an announcement published today, Mozilla says the browser will be removed from the stores where it's been available for download in the "coming weeks." Mozilla is instead directing users who still want to utilize a web browser in VR to Igalia's upcoming open-source browser, Wolvic, which is based on Firefox Reality's source code. This browser will be available for download starting next week, so users won't have to go without -- they'll just have to make the switch.' -- source: https://tech.slashdot.org/story/22/02/03/1653218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Slackware, the Oldest Actively Maintained Linux Distro, Releases Version 15.0
by Peter Reutemann 04 Feb '22

04 Feb '22

'Slackware, the oldest actively maintained Linux distribution, released version 15.0 yesterday after a long release cycle that goes all the way back to 2016 where the last version (14.2) was released. According to the release notes, the whole spirit of this release is: "Keep it familiar, but make it modern." Among the news, this release offers kernel 5.15.19, PAM, PipeWire and PulseAudio, Wayland and X11 graphical systems, and Rust and Python 3. As graphical environments, both Xfce 4.16 and the latest Plasma 5 (Plasma 5.23.5, Frameworks 5.90, KDE apps 21.12 running under Qt 5.15.3) are available, with Cinnamon and Mate also available from third parties. The main compilers are gcc-11.2 and llvm 13.0. The default browser is Firefox 91.5esr, with Chromium available as a third-party repository. And... no systemd at all. Slackware can be downloaded from a variety of mirrors. BitTorrent downloads are going to be available too. I've used Slackware for 20 years and it's always impressed me with its stability and speed. I encourage everyone interested to try it.' -- source: https://linux.slashdot.org/story/22/02/04/027213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Says Windows May Need Up To 8 Hours of Online Time To Update
by Peter Reutemann 03 Feb '22

03 Feb '22

'According to a post on the Microsoft IT Pro Blog, Windows computers will need at least eight hours of online time to obtain and install the latest OS updates successfully. Tom's Hardware reports: Another revelation in the post is that Microsoft tracks how long PCs are connected to Windows Update, calling the statistics "Update Connectivity." The data is available to IT managers in the InTune app, a component of the Endpoint management suite. The post details Microsoft's attempts to figure out why some Windows devices aren't getting the latest quality and feature updates, and discovered that two hours of continuous connectivity was required to get updates. It then took six hours after the release of the patch for a machine to update itself reliably. Microsoft's figures show that 50 percent of Windows devices left behind by Windows Update and running a build of Windows 10 that's no longer serviced do not spend enough time connected to have the patches downloaded and installed in the background. This figure drops to 25 percent for customers using a serviced build of the operating system that lags behind in security updates by 60 days or more. The goods news, as noted by Tom's Hardware, is that "Windows 11 updates are smaller than their Windows 10 counterparts due to improved compression [and] new Microsoft Graph APIs," which should help speed up the update process.' -- source: https://tech.slashdot.org/story/22/02/01/2056211 Bloatware? I can download/install full Linux distros in less time (and updates don't take that long either, not even a full version upgrade!). Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

Insights Into WSL 1.0
by Lawrence D'Oliveiro 03 Feb '22

03 Feb '22

You may remember that Microsoft’s initial attempt at “Windows Services for Linux”, WSL 1.0 (or maybe just plain “WSL”), involved emulating Linux APIs on top of the Windows kernel. This was later scrapped in favour of the current WSL 2.0, which runs an actual Linux kernel, virtualized. Clearly, Microsoft found it problematic trying to keep things compatible with the native Linux kernel, and decided it was simpler to just run the real article. This report <https://www.theregister.com/2022/02/02/oracle_linux_microsoft/> links in passing to an interesting blog post <https://jmmv.dev/2020/11/wsl-lost-potential.html> covering some of the technicalities of how WSL 1.0 was implemented. Windows NT has, or had, the notion of different “environment subsystems” or “personalities” implemented in layers on top of the core kernel; in fact, Win32 is (or was) just one of these “personalities”, with the original POSIX layer being another. That blog post says that WSL1 was implemented as just such a “personality”. And if that had not been scrapped, it would have made some interesting kinds of integration across Windows and Linux processes possible. However, a reader comment to the original article <https://forums.theregister.com/forum/all/2022/02/02/oracle_linux_microsoft/…>, claiming to come from a former “PM” (“Product Manager”?) for WSL, emphatically declares ... WSL is not an NT kernel "personality" and is in no way related to NT's POSIX subsystem. Not even slightly. They are entirely different implementations of different things and share zero architecture and implementation details. This reinforces an impression I’ve had, that much of the modularity of the original Windows NT architecture has decayed away over the years, sacrificed by Microsoft to marketing exigencies. And that includes the whole “environment subsystem” concept. So WSL1 was actually less modular than it might have appeared to begin with, and that would have added to the support headaches.

1 0

64-bit Raspberry Pi OS exits beta, is available for all Pi 3, 4, and Zero 2 boards
by Peter Reutemann 03 Feb '22

03 Feb '22

'The Raspberry Pi hardware has included a 64-bit processor since the Pi 3 launched in early 2016, but the Raspberry Pi OS (formerly known as Raspbian) has remained primarily 32-bit. The Raspberry Pi Foundation has been testing a 64-bit version of the OS since 2020, though, and today the organization announced that the 64-bit version is leaving beta and is now a fully supported OS option on all 64-bit Pi hardware. This includes the Pi 3, Pi 4, Pi Zero 2 W, and all variants thereof.' -- source: https://arstechnica.com/gadgets/2022/02/64-bit-raspberry-pi-os-exits-beta-i… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Backblaze Hard Drive Reliability Stats For 2021
by Lawrence D'Oliveiro 02 Feb '22

02 Feb '22

Data-backup company Backblaze has released its annual report on hard-drive reliability for 2021 <https://www.theregister.com/2022/02/01/backblaze_hd_reliability_stats_show/>. Interesting that there is an overall longer-term downward trend in drive failures, though this can fluctuate some. The company is in a good position to compare different brands and models, since they tend to shop around a lot (look at that list). Their whole system is designed to cope with drive failures, and given how many drives they have, they get a lot of failures. So there is plenty of raw data available to analyze, which they make freely available.

1 0

Remembering Windows Vista
by Lawrence D'Oliveiro 02 Feb '22

02 Feb '22

Here is a look back <https://www.theregister.com/2022/02/01/happy_birthday_windows_vista/> at the troubled gestation of Windows Vista. It’s useful as a retrospective, full of links to reports on developments from that time. One of the article links is to this analysis <https://www.theregister.com/2001/08/07/ms_poised_to_switch_windows/> of where Microsoft was supposedly going at the time. (Re)reading that is like peering through a portal into an alien, forgotten world -- one where the company was full of grandiose plans for building an entire OS on Dotnet, making your Exchange mail folders look like a filesystem volume, tying the representation of Office documents to proprietary features of NTFS, and turning the filesystem itself into a database. And one where users and pundits took such plans seriously.

1 0

German Court Fines Company For Linking To Google-Hosted Web Font
by Lawrence D'Oliveiro 01 Feb '22

01 Feb '22

Seems lots of websites link to web fonts hosted by Google. But do they realize this means that users of their sites are sending their IP addresses to Google’s servers? And that not getting the consent of your users to such a thing can land you in legal trouble, at least in the EU? <https://www.theregister.com/2022/01/31/website_fine_google_fonts_gdpr/> I don’t know why people do this anyway -- depending on another site just introduces an additional potential point of failure to your site. Fonts are not that big‡: how great a hardship would it be to copy them to your own site, and link to them there? ‡Had a quick check of my /usr/share/fonts/truetype/noto/ directory, which contains an installation of Google’s entire Unicode-friendly “Noto” font collection; that’s got 2380 entries totalling not quite half a gigabyte.

1 0

A Developer Watching QA Test The Product
by Lawrence D'Oliveiro 01 Feb '22

01 Feb '22

Those with OCD tendencies might want to look away ... <https://www.youtube.com/watch?v=baY3SaIhfl0>

1 0

Fwd: [NZLUG] Fwd: Flounder startup 5th Feb 1PM Melbourne time
by Peter Reutemann 01 Feb '22

01 Feb '22

Apologies for cross-posting, but this event might be of interest to some of you. Cheers, Peter ---------- Forwarded message --------- From: Russell Coker <russell(a)coker.com.au> Date: Sun, Jan 30, 2022 at 10:53 PM Subject: [NZLUG] Fwd: Flounder startup 5th Feb 1PM Melbourne time To: DL Neil <nzlug(a)etelligence.info>, Stephen Dalton <steve(a)refactor.com.au>, NZ Linux Users Group <nzlug(a)lists.nzoss.org.nz>, Mark Foster <blakjak(a)blakjak.net> https://flounder.coker.com.au/2022/01/30/flounder-overview/ The FLOSS Down Under group (Flounder) group is starting next Saturday 1PM Melbourne time (the above page summarises it). https://b.coker.com.au/ The above URL will redirect to the meeting URL, it's deliberately short so if your primary device has an issue you can quickly type it into another device. We haven't entirely decided on the main feature, but thinking of having it be hands on training on BTRFS and ZFS while at the same time discussing new advances (both new technology and older technology that has become cheaper and thus more usable) in storage for FOSS systems. If there's someone who has experience with Optane on Linux who could give a 10+ minute talk about it then please contact me off list. The meetings will include a summary and discussion of new free software that is noteworthy (with input welcome from anyone who thinks we missed something noteworthy). We will also have some mention of recent security issues and other changes to the environment that we operate in. Anyone who wants to contribute to a meeting can contact me in advance to have some time reserved for a lightning talk or a feature talk at a future meeting. Please forward this message to all free software users groups in Australia and NZ. Note that this is not designed to compete with existing LUGs, but to offer something different. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/ _______________________________________________ NZLUG mailing list NZLUG(a)lists.nzoss.org.nz http://lists.nzoss.org.nz/mailman/listinfo/nzlug -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Bug in Early Creative Commons Licenses Has Enabled a New Breed of Superpredator
by Peter Reutemann 01 Feb '22

01 Feb '22

'Here’s a supreme irony: the Creative Commons licenses were invented to enable a culture of legally safe sharing, spurred by the legal terror campaign waged by the entertainment industry, led by a literal criminal predator who is now in prison for sex crimes. But because of a small oversight in old versions of the licenses created 12 years ago, a new generation of legal predator has emerged to wage a new campaign of legal terror. To make matters worse, this new kind of predator specifically targets people who operate in good faith, only using materials that they explicitly have been given permission to use.' -- source: https://doctorow.medium.com/a-bug-in-early-creative-commons-licenses-has-en… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Review: MNT Reform laptop has fully open hardware and software—for better or worse
by Peter Reutemann 01 Feb '22

01 Feb '22

'If you’re a Linux fan or open source advocate looking for a decent laptop, you actually have some solid options right now—much better, at least, than buying a Windows laptop, installing Linux on it, and hoping for the best. Dell has offered Ubuntu editions of some of its XPS laptops and other PCs for years now, and Lenovo sells a respectable collection of desktops and laptops with Linux. System76 sells a selection of Linux-friendly laptops preloaded with Ubuntu or its own Pop!_OS distribution. The repair-friendly Framework Laptop doesn’t ship with Linux, but it can be configured without an OS, and Framework promises robust Linux support from multiple distributions. But those laptops all have something in common with run-of-the-mill Windows PCs: a reliance on closed-source hardware and, often, the proprietary software and drivers needed to make it function. For some people, this is a tolerable trade-off. You put up with the closed hardware because it performs well, and it supports the standard software, development tools, and APIs that keep the computing world spinning. For others, it’s anathema—if you can’t see the source code for these “binary blobs,” they are inherently untrustworthy and should be used sparingly or not at all. The MNT Reform is a laptop for the latter group. It's a crowdfunded, developed-in-the-open, extensively documented device that cares more about being open than it cares about literally any other aspect of the computing experience. Perhaps predictably, this makes for a laptop that is ideologically pure but functionally compromised.' -- source: https://arstechnica.com/gadgets/2022/01/review-mnt-reform-laptop-has-fully-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GitHub Is Broken
by Lawrence D'Oliveiro 28 Jan '22

28 Jan '22

github.com is currently returning a server-error page.

2 4

Only 90s Web Developers Remember This
by Lawrence D'Oliveiro 28 Jan '22

28 Jan '22

An only-slightly-tongue-in-cheek expletive-laden rant <https://zachholman.com/posts/only-90s-developers/> about how Web development used to be: the wonders of the 1×1 GIF (“To this day it is the only way to vertically center elements”) and the fun of “ ”, to the coming of JavaScript to create the “Technology of Terror”, DHTML (Dynamic HTML).

1 0

A bug lurking for 12 years gives attackers root on most major Linux distros
by Peter Reutemann 27 Jan '22

27 Jan '22

'Linux users on Tuesday got a major dose of bad news—a 12-year-old vulnerability in a system tool called Polkit gives attackers unfettered root privileges on machines running most major distributions of the open source operating system. Previously called PolicyKit, Polkit manages system-wide privileges in Unix-like OSes. It provides a mechanism for nonprivileged processes to safely interact with privileged processes. It also allows users to execute commands with high privileges by using a component called pkexec, followed by the command.' -- source: https://arstechnica.com/information-technology/2022/01/a-bug-lurking-for-12… I think, I saw an update coming through the other day... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fwd: [NZLUG] Fwd: [Linux-aus] Australia (and hopefully NZ) LUG meetings
by Peter Reutemann 26 Jan '22

26 Jan '22

Apologies for cross-posting, but this may be of interest to some of you. Cheers, Peter -------- Original Message -------- From: Mark Foster <blakjak(a)blakjak.net> Sent: January 26, 2022 9:12:30 PM GMT+13:00 To: NZ Linux Users Group <nzlug(a)lists.nzoss.org.nz>, russell(a)coker.com.au Subject: [NZLUG] Fwd: [Linux-aus] Australia (and hopefully NZ) LUG meetings There may be some interest in this initiative from the (now largely defunct, it seems) NZLUG mailing list.... Thanks to Russell for offering up this initiative and trying to make it accessible to New Zealanders as well as Australians. I myself am unlikely to be available but am forwarding this to NZLUG in case there's interest here. Cheers Mark (sometime NZLUG admin; there's still a mailing list with some people subscribed to it... so who knows? :)) -------- Forwarded Message -------- Subject: [Linux-aus] Australia (and hopefully NZ) LUG meetings Date: Wed, 26 Jan 2022 17:45:44 +1100 From: Russell Coker via linux-aus <linux-aus(a)lists.linux.org.au> Reply-To: russell(a)coker.com.au To: linux-aus(a)lists.linux.org.au https://etbe.coker.com.au/2022/01/26/australia-nz-linux-meetings/ I'm starting a new group for online meetings with the aim of giving benefits you can't get from watching YouTube etc. Details of how to connect etc will be available shortly. -- My Main Bloghttp://etbe.coker.com.au/ My Documents Bloghttp://doc.coker.com.au/ _______________________________________________ linux-aus mailing list linux-aus(a)lists.linux.org.au http://lists.linux.org.au/mailman/listinfo/linux-aus To unsubscribe from this list, send a blank email to linux-aus-unsubscribe(a)lists.linux.org.au -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/.

1 0

Who's Paying to Fix Open Source Software?
by Peter Reutemann 26 Jan '22

26 Jan '22

'The Log4Shell exploit "exposes how a vulnerability in a seemingly simple bit of infrastructure code can threaten the security of banks, tech companies, governments, and pretty much any other kind of organization," writes VentureBeat. But the incident also raises some questions: Should large deep-pocketed companies besides Google, which always seems to be heavily involved in such matters, be doing more to support the cause with people and resources? Long-time Slashdot reader frank_adrian314159 shares a related article from a programming author on Dev.To, who'd read hot takes like "Open source needs to grow the hell up." and "Open source' is broken". [T]he log4j developers had this massive security issue dumped in their laps, with the expectation that they were supposed to fix it. How did that happen? How did a group of smart, hard-working people get roped into a thankless, high-pressure situation with absolutely no upside for themselves...? It is this communal mythology I want to talk about, this great open source brainwashing that makes maintainers feel like they need to go above and beyond publishing source code under an open source license — that they need to manage and grow a community, accept contributions, fix issues, follow vulnerability disclosure best practices, and many other things... In reality what is happening, is that open source maintainers are effectively unpaid outsourcing teams for giant corporations. The log4j exploit was first reported by an engineer at Alibaba — a corporation with a market capitalization of $348 billion — so the article wonders what would happen if log4j's team had sent back a bill for the time they'd spend fixing the bug. Some additional opinions (via the "This Week in Programming" column): * PuTTY maintainer Andrew Ducker: "The internet (and many large companies) are dependent on software maintained by people in their spare time, for free. This may not be sustainable." * Filippo Valsorda, a Go team member at Google: "The role of Open Source maintainer has failed to mature from a hobby into a proper profession... The status quo is unsustainable.... GitHub Sponsors and Patreon are a nice way to show gratitude, but they are an extremely unserious compensation structure." Valsorda hopes to eventually see "a whole career path with an onramp for junior maintainers, including training, like a real profession."' -- source: https://news.slashdot.org/story/21/12/18/2016216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Big Surprise Of The Week: Oracle’s Audit Process Is In Cahoots With Sales
by Lawrence D'Oliveiro 26 Jan '22

26 Jan '22

As part of the licensing terms for certain (most?) Oracle products, you have to agree to be audited by the company, to ensure your usage does not exceed the licences you have bought. Such audits are notorious for regularly telling customers that what they thought was compliance with the licence was nothing of the sort, and that they had better hand over more money to make the problem go away. Oracle’s official position has always been that there is some kind of separation between the operations of the audit department and the sales department, so the auditing process was entirely impartial and under no pressure to increase company revenues. Now some ex-Oracle execs are publicly admitting this is a load of nonsense <https://www.theregister.com/2022/01/25/oracle_audits/>. I don’t think Oracle is unique in this. Lots of big software companies (including Microsoft, I believe) offer similar site-licensing of their products, with similar audit requirements. And likely similar outcomes when an audit actually takes place.

1 0

SystemRescueCD is now just SystemRescue
by Lawrence D'Oliveiro 25 Jan '22

25 Jan '22

Since (almost) nobody uses CDs any more, the handy bootable system-fixer Linux distro has dropped the “CD” from its name <https://www.system-rescue.org/>. The latest version, 9.00, is reviewed here <https://www.theregister.com/2022/01/24/systemrescue/>. Not sure what the benefit of the new in-kernel NTFS driver is, since the existing FUSE support works fine, and benchmarks I have seen seem to indicate that one is not unambiguously faster than the other. Seems SystemRescue is very popular with Windows users: “Windows gets its underwear in a twist relatively easily, and it's not generous with tools to fix it.” The writer also says “We would have quite liked to see some tools to help with a dead Linux box, too, though.” But the main (software) issue I get with Linux installations not booting is some screwup in the bootloader, and you can use the Linux installation itself to fix that, by chrooting into it from your SystemRescue boot.

1 0

New MoonBounce UEFI Bootkit Can't Be Removed by Replacing the Hard Drive
by Peter Reutemann 25 Jan '22

25 Jan '22

'Security researchers from Kaspersky said they have discovered a novel bootkit that can infect a computer's UEFI firmware. From a report: What makes MoonBounce -- the name they gave the bootkit -- special is the fact that the malware doesn't burrow and hide inside a section of the hard drive named ESP (EFI System Partition), where some UEFI code typically resides, but instead it infects the SPI flaws memory that is found on the motherboard. This means that, unlike similar bootkits, defenders can't reinstall the operating system and replace the hard drive, as the bootkit will continue to remain on the infected device until the SPI memory is re-flashed (a very complex process) or the motherboard is replaced. According to Kaspersky, MoonBounce marks the third UEFI bootkit they have seen so far that can infect and live inside the SPI memory, following previous cases such as LoJax and MosaicRegressor. Furthermore, MoonBounce's discovery also comes after researchers have also found additional UEFI bootkits in recent months, such as ESPectre, FinSpy's UEFI bootkit, and others, which has led the Kaspersky team to conclude that what was once considered unachievable following the rollout of the UEFI standard has gradually become the norm.' -- source: https://it.slashdot.org/story/22/01/24/1815234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AGM next week
by Peter Reutemann 24 Jan '22

24 Jan '22

Hi everyone We have our AGM coming up on Monday next week, with the following agenda: - President's Report - Treasurer's Report - Election of 2022 Committee - General business - Consumption of pizza (if applicable) However, I'm not sure whether we have a meeting room, as I'm still waiting on the confirmation whether we get our room sponsored or not for the year (head of CMS was on holiday till today). And if we should get it sponsored, then I need to sort out the room booking (which will take time, too). Worst case scenario: it will be an online only one via BigBlueButton. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 7

KDE-Powering Qt's New Framework Lets Developers Bring Ads Into Their Apps
by Peter Reutemann 24 Jan '22

24 Jan '22

'"Qt, the framework that powers the KDE desktop, is announcing support for ads in client-side applications," reports Neowin: This means that application developers will now be able to serve ads in traditional desktop applications.... Windows users have been dealing with this in Metro UI apps since Windows 8 and it's something that's never gone over well on the desktop. While it's doubtful you'll see ads in KDE's core applications, it would be possible for distributions that wish to further monetize their work to fork these applications, placing ads in them.... According to the documentation, the advertising plugin supports a variety of platforms. They are as follows: - Windows 10 - Ubuntu 20.04 - Raspbian Buster - macOS - Android 7.0 — iOS "Our offering aims to disrupt the IoT industry," explains Qt's press release, "enabling new business models and business cases that before were not possible." Reactions have been mixed. Comments on Phoronix ranged from calling it "a great way for boost development on KDE" to "Not sure if I like this."' -- source: https://tech.slashdot.org/story/22/01/22/1751259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

Supply chain attack used legitimate WordPress add-ons to backdoor sites
by Peter Reutemann 24 Jan '22

24 Jan '22

'Dozens of legitimate WordPress add-ons downloaded from their original sources have been found backdoored through a supply chain attack, researchers said. The backdoor has been found on “quite a few” sites running the open source content management system. The backdoor gave the attackers full administrative control of websites that used at least 93 WordPress plugins and themes downloaded from AccessPress Themes. The backdoor was discovered by security researchers from JetPack, the maker of security software owned by Automatic, provider of the WordPress.com hosting service and a major contributor to the development of WordPress. In all, Jetpack found that 40 AccessPress themes and 53 plugins were affected.' -- source: https://arstechnica.com/information-technology/2022/01/supply-chain-attack-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Blender 3.0 Released With More New Features and Improvements
by Peter Reutemann 24 Jan '22

24 Jan '22

'The Free Open Source 3D production software Blender has been released in version 3.0 (official showreel) with more new features, improvements and performance optimizations as well as further improved workflows. In recent years Blender has received an increasing rate of attention from the 3D industry, with various larger businesses such as Epic, Microsoft, Apple and most recently Intel joining the blender foundation and donating to its development fund. Blender has seen an increasing rise in usage in various industries, such as animated feature film production, architecture and game development.' -- source: https://tech.slashdot.org/story/22/01/23/0026257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

New FSF Procedures Let Its 5,000 'Associate Members' Nominate New Board Members
by Peter Reutemann 24 Jan '22

24 Jan '22

'This week the Free Software Foundation's board announced that for the first time in the organization's 37-year-history, its 5,000-plus associate members will now be able to nominate and evaluate candidates for its board of directors. Under new procedures adopted by the FSF board on January 17 and summarized here, the organization will proactively engage associate members with a sufficient history of association with the FSF in the recruiting process by inviting them to suggest board nominees and then research collectively those nominees' suitability for a position on the board, including most importantly their record of commitment to free software ideals.... Following the new procedures, voting members (which include all current directors and are listed here) can start a process to recruit new directors, or a modified process to reconsider existing directors... The FSF intends to first add several new directors in 2022, utilizing these new procedures, and then begin a review of existing directors. The FSF staff and board have made this expanded engagement process a high priority and are working together to put in place the necessary infrastructure to support it, with a target to activate it within the first quarter of 2022... Voting members will review the community's nominations. A nominee may be removed from consideration if at least two voting members vote to do so without opposition from other voting members. The voting members will discuss the candidates and decide which should move forward in the process next. The FSF's associate members will then review each nominee's application, then evaluate and comment on those nominees in a private, staff-moderated discussion forum. Voting members will review this input and privately interview the finalists to assess their candidacy, ideals, and commitment to free software, then vote on their appointment.... The process is designed such that new iterations for both recruiting new directors and reviewing existing directors can be run whenever the need arises in the future. "Opening the director recruitment process to our associate members is a historic and welcome milestone for the FSF," said FSF president Geoffrey Knauth. "We are pleased to engage the free software community in attracting new talent to our leadership who will keep the freedoms.... We have worked hard to strengthen governance standards at the FSF and to create a transparent leadership recruitment process. We look forward to tackling new challenges and opportunities this year." The FSF's announcement calls the new "community engagement process" a "key result of a six-month consultant-led review designed to help make FSF governance and recruitment practices more transparent and participatory, while more systematically ensuring their commitment to the FSF's values and principles."' -- source: https://news.slashdot.org/story/22/01/22/050207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Building Your Own Silicon Chips In Your Parents’ Garage
by Lawrence D'Oliveiro 23 Jan '22

23 Jan '22

Here’s a guy named Sam Zeloof <https://arstechnica.com/information-technology/2022/01/this-22-year-old-bui…> who has been using cast-off equipment from bygone eras to put together his own chip fab. He made his first chip (an op-amp) just about four years ago; it had just six transistors. His second one (more proof of concept of the manufacturing process) had 1200 transistors. He has made a bunch of them, testing each one by hand. He is currently working on his third design, in a plan to get to a full working microprocessor.

1 0

Autodesk Acquires Moxion
by Lawrence D'Oliveiro 20 Jan '22

20 Jan '22

Moxion is an NZ-based company that manages digital “dailies” (raw footage from movie production) for remote working. It is now being acquired by content-creation behemoth Autodesk, known for its CG apps Maya and 3DS Max, among other products <https://www.hollywoodreporter.com/business/digital/autodesk-moxion-digital-…>. Here <https://www.stuff.co.nz/entertainment/film/104976105/moxion-the-kiwi-compan…> is an older backgrounder on the company’s business model. Dating from 2018, it gives some interesting examples of where the logistics of location shooting make their approach superior to traditional methods of managing footage. I’m not sure what the value of the acquitision is. I think I saw a figure of “tens of millions”, which makes Moxion a minnow in typical US terms.

1 0

Is Altering The Appearance Of A Website A Copyright Violation?
by Lawrence D'Oliveiro 20 Jan '22

20 Jan '22

A German court has just decided that a browser extension which strips ads from websites does not violate copyright <https://www.theregister.com/2022/01/19/ad_blockers_copyright_germany/>. One may have concerns with the business model of this particular company, but the general principle of a user being able (perhaps with the help of a third party) to modify a website’s content before displaying it on their own machine seems sacrosanct. However, a similar issue is being re-raised in the US, with a website owner filing a lawsuit against Google for the way its Android search app superimposes its own ads on top of the website display. It has long been decided that this does not violate copyright, but now the plaintiff is trying to argue that a website’s HTML code is not merely “intellectual property”, but actual physical property, so the principle of “trespass to chattels” can be applied to it.

1 0

Are We Getting Closer to the Year of the Linux Desktop?
by Peter Reutemann 19 Jan '22

19 Jan '22

'Earlier this year TechRepublic argued that while 2021 wasn't the year of the Linux desktop, "there was no denying the continued dominance of Linux in the enterprise space and the very slow (and subtle) growth of Linux on the desktop. And in just about every space (minus the smartphone arena), Linux made some serious gains." So would 2022 be the year of the Linux desktop? "Probably not." But developer Tim Wells honestly believes we're getting closer: The idea of the year of the Linux desktop is that there would come a year that the free and open source operating system would reach a stage that the average user could install and use it on their pc without running into problems. Linus Sebastian from Linus Tech Tips recently did an experiment where he installed Linux on his home PC for one month to see if he could use it not only for everyday tasks, but for gaming and also streaming. Ultimately he concluded (in a video just released) that this year will not be the year of the Linux desktop and that while doing everyday stuff was reasonably okay, the state of gaming on Linux (despite Valves lofty goals) is to put it simply, a shit-show. (That's my word, not his)... The experiment done by Linus seems to show that while some games do indeed run well using [Valve's Windows compatibility layer] Proton, there are just as many that run with issues. Some of those issues can be game breaking. Such as the game running, but its multiplayer functionality not working at all. Some games just plain don't work at all due to dependencies on services such as Easy Anti Cheat... In his video Linus mentions that the main problem preventing the "year of the Linux desktop" is the fragmentation. By fragmentation, he means the range of available distributions and the fact that each distribution has (potentially) different versions of libraries and drivers and software that makes the behind the scenes operate.... Flatpak and Snap as well as AppImage are making progress towards fixing this fragmentation issue, but those are not yet perfect either. Flatpak works by ensuring that the expected versions of libraries required for that software are installed along side it and independent of the existing library the distro may provide... Valve have said that the Steamdeck will also use an immutable core operating system for the same reasons. So while Linus is sure that 2022 isn't yet the year of the Linux desktop and that fragmentation is the biggest problem. I think maybe, just maybe, we're closer to solving those problems and closer perhaps to the year of the Linux desktop that some might realise.' -- source: https://linux.slashdot.org/story/22/01/15/0224235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

Safari and iOS users: Your browsing activity is being leaked in real time
by Peter Reutemann 19 Jan '22

19 Jan '22

'For the past four months, Apple’s iOS and iPadOS devices and Safari browser have violated one of the Internet’s most sacrosanct security policies. The violation results from a bug that leaks user identities and browsing activity in real time. The same-origin policy is a foundational security mechanism that forbids documents, scripts, or other content loaded from one origin—meaning the protocol, domain name, and port of a given webpage or app—from interacting with resources from other origins. Without this policy, malicious sites—say, badguy.example.com—could access login credentials for Google or another trusted site when it’s open in a different browser window or tab. Since September’s release of Safari 15 and iOS and iPadOS 15, this policy has been broken wide open, research published late last week found. As a demo site graphically reveals, it’s trivial for one site to learn the domains of sites open in other tabs or windows, as well as user IDs and other identifying information associated with the other sites.' -- source: https://arstechnica.com/information-technology/2022/01/safari-and-ios-bug-r… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linux Malware Sees 35% Growth During 2021
by Peter Reutemann 18 Jan '22

18 Jan '22

'The number of malware infections targeting Linux devices rose by 35% in 2021, most commonly to recruit IoT devices for DDoS (distributed denial of service) attacks. BleepingComputer reports: A Crowdstrike report looking into the attack data from 2021 summarizes the following: - In 2021, there was a 35% rise in malware targeting Linux systems compared to 2020. - XorDDoS, Mirai, and Mozi were the most prevalent families, accounting for 22% of all Linux-targeting malware attacks observed in 2021. - Mozi, in particular, had explosive growth in its activity, with ten times more samples circulating in the wild the year that passed compared to the previous one. - XorDDoS also had a notable year-over-year increase of 123%. [...] The Crowstrike findings aren't surprising as they confirm an ongoing trend that emerged in previous years. For example, an Intezer report analyzing 2020 stats found that Linux malware families increased by 40% in 2020 compared to the previous year. In the first six months of 2020, a steep rise of 500% in Golang malware was recorded, showing that malware authors were looking for ways to make their code run on multiple platforms. This programming, and by extension, targeting trend, has already been confirmed in early 2022 cases and is likely to continue unabated. ' -- source: https://linux.slashdot.org/story/22/01/17/2239204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Why is Android 12 So Buggy?
by Peter Reutemann 18 Jan '22

18 Jan '22

'Android 12 is one of the platform's most ambitious updates in recent history, bringing a major design overhaul to every corner of the operating system. It has also been one of the rockiest Android OS launches in the past few years. From a report: Both Samsung and OnePlus paused the rollout of their stable Android 12-based updates amid reports of serious bugs. Google itself has addressed a laundry list of bug reports from Pixel 6 owners, just as it's trying to convince them it's finally figured out how to build a truly premium phone. What in the heck is going on? The short answer is that there are some unique complicating factors at play this year but also that Android is inherently a little bit messy -- that just comes with the territory when you're designing a delightful public park compared to Apple's walled garden. Despite a refreshed look and some appealing new high-end handsets, Android is still Android -- the good and the bad. To try and figure out what the heck is going on, we talked to Mishaal Rahman, former editor-in-chief of XDA Developers, who's well known for digging into Android codebases and discovering Google's secrets. Speaking to the Pixel 6 bugs in particular, Rahman guesses that it has a lot to do with the unusually large size of the update. "Many people have called it, myself included, the biggest OS update to Android since Android 5.0 Lollipop, and that was many years ago. There are just so many massive changes to the interface and to the feature set." He also suggests that Google's commitment to issue a new Android update every year can make things worse when it's trying to do so much, and the self-imposed one-year development cycle doesn't leave much wiggle room in the timeline. "They started immediately after Android 11 was released to the public -- and they have a hard cutoff date... After that, they just focus on fixing bugs." Delay any longer, and they'd risk bumping into next year's development cycle. It's also possible that the attempt to bring timely Android updates to non-Google devices wound up backfiring. Android phone owners have been asking for faster updates for a long time -- outside of Google's Pixel phones and pricey flagships, many devices face long waits for OS updates. Sure enough, the updates have come faster this year. Case in point: Samsung users are accustomed to waiting about three months after an Android stable release to get their finished One UI update with the new version of the OS, but this year, One UI 4.0 arrived just one and a half months after Android 12. But the way things have gone this year, many users would likely have opted for a slower, stable update rather than a fast one riddled with bugs.' -- source: https://mobile.slashdot.org/story/22/01/17/2026239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

EFF praises Android’s new 2G kill switch, wants Apple to follow suit
by Peter Reutemann 17 Jan '22

17 Jan '22

'The Electronic Frontier Foundation is celebrating Google's addition of a 2G kill switch to Android 12. The digital rights group has been campaigning against the dated, insecure 2G cellular standard since 2020, and Android is the first mobile OS to take the group's advice and let users completely disable 2G. In the US, carriers shut down 2G years ago, and the 3G shutdown is already underway. Phones have not really gotten the message, though, and modems still try to connect to any nearby 2G signals automatically. The problem is that 2G is very old, and it's a lot like connecting to a WEP-secured Wi-Fi hotspot—the security is obsolete, so it's easy to crack. If you're in a country where legitimate uses of 2G are long dead, the standard only serves as an attack vector via fake cell phone towers, so why not just shut it off?' -- source: https://arstechnica.com/gadgets/2022/01/eff-praises-androids-new-2g-kill-sw… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Russia says it has neutralized the cutthroat REvil ransomware gang
by Peter Reutemann 17 Jan '22

17 Jan '22

'Russian law enforcement authorities said on Friday that they have arrested 14 people associated with REvil, a top ransomware group that has disrupted critical operations of wealthy targets and held their data hostage. The action, carried out by Russia’s FSB, the successor agency to the KGB, is a rare example of the country’s government cracking down on cybercrime by its citizens. The US and Russia have no extradition treaty in place, and critics have said the Kremlin routinely harbors cybercriminals as long as they don’t target organizations located in the former Soviet Union. The arrests come as tensions between Russia and the US escalate over a standoff involving Ukraine.' -- source: https://arstechnica.com/information-technology/2022/01/russia-says-it-has-n… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Backdoor RAT for Windows, macOS, and Linux went undetected until now
by Peter Reutemann 17 Jan '22

17 Jan '22

'Researchers have uncovered a never-before-seen backdoor malware written from scratch for systems running Windows, macOS, or Linux that remained undetected by virtually all malware scanning engines. Researchers from security firm Intezer said they discovered SysJoker—the name they gave the backdoor malware—on the Linux-based Webserver of a “leading educational institution.” As the researchers dug in, they found SysJoker versions for both Windows and macOS as well. They suspect the cross-platform RAT—short for remote access trojan—was unleashed in the second half of last year. The discovery is significant for several reasons. First, fully cross-platform malware is something of a rarity, with most malicious software being written for one specific operating system. The RAT was also written from scratch and made use of four separate command-and-control servers, an indication that the people who developed and used it were part of an advanced threat actor that invested significant resources. It’s also unusual for previously unseen Linux malware to be found in a real-world attack.' -- source: https://arstechnica.com/information-technology/2022/01/backdoor-for-windows… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GitHub Restores Account of Developer Who Intentionally Corrupted His Libraries
by Peter Reutemann 17 Jan '22

17 Jan '22

'What happened after a developer intentionally corrupted two of their libraries which collectively had more than 20 million weekly downloads and thousands of dependent projects? Mike Melanson's "This Week in Programming" column reports: In response to the corrupted libraries, Microsoft quickly suspended his GitHub access and reverted the projects on npm.... While this might seem like an open and shut case to some — the developer committed malicious code and GitHub and npm did what it had to do to protect its users — a debate broke out around a developer's rights to do what they wish with their code, no matter how many projects and dependencies it may have. "GitHub suspending someone's account for modifying their own code in a project they own however they want spooks me a lot more than NPM reverting a package," [tweeted one company's Director of Engineering & Technology]. "I kind of love what Marak did to make a point and protest to be honest." An article on iProgrammer further outlines the dilemma present in what might otherwise seem like a clear-cut case.... "Yes, it is open source in that you can fork it and can contribute to it but does this mean that GitHub is justified in denying you the right to change or even destroy your own code?" As of last night, however, it would appear that the entire affair is merely one for intellectual debate, as GitHub has indeed lived up to what some might view as its end of the bargain: the developer's account is active, he has been allowed to remove his faker.js library on GitHub (depended upon as it might be), and has since offered an update that he does "not have Donkey Brains".' -- source: https://developers.slashdot.org/story/22/01/15/212234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Host of Youtube-dl Web Site Sued by Major Record Labels
by Peter Reutemann 17 Jan '22

17 Jan '22

'"As part of their growing battle against popular open source software tool youtube-dl, three major music labels are now suing Uberspace, the company that currently hosts the official youtube-dl homepage," reports TorrentFreak: According to plaintiffs Sony, Universal and Warner, youtube-dl circumvents YouTube's "rolling cipher" technology, something a German court found to be illegal in 2017.... While the RIAA's effort to take down youtube-dl from GitHub grabbed all the headlines, moves had already been underway weeks before that in Germany. Law firm Rasch works with several major music industry players and it was on their behalf that cease-and-desist orders were sent to local hosting service Uberspace. The RIAA complained that the company was hosting the official youtube-dl website although the tool itself was hosted elsewhere. "The software itself wasn't hosted on our systems anyway so, to be honest, I felt it to be quite ridiculous to involve us in this issue anyway — a lawyer specializing in IT laws should know better," Jonas Pasche from Uberspace said at the time. In emailed correspondence today Uberspace informed TorrentFreak that, following the cease-and-desist in October 2020, three major music labels are now suing the company in Germany... According to the labels, youtube-dl poses a risk to their business and enables users to download their artists' copyrighted works by circumventing YouTube's technical measures. As a result, Uberspace should not be playing a part in the tool's operations by hosting its website if it does not wish to find itself liable too.... The alleged illegality of youtube-dl is indeed controversial. While YouTube's terms of service generally disallow downloading, in Germany there is the right to make a private copy, with local rights group GEMA collecting fees to compensate for just that. Equally, when users upload content to YouTube under a Creative Commons license, for example, they agree to others in the community making use of that content. "Even if YouTube doesn't provide video download functionality right out of the box, the videos are not provided with copy protection," says former EU MP Julia Reda from the Society for Freedom Rights (GFF) to NetzPolitik. "Not only does YouTube pay license fees for music, we all pay fees for the right to private copying in the form of the device fee, which is levied with every purchase of smartphones or storage media," says Reda. "Despite this double payment, Sony, Universal and Warner Music want to prevent us from exercising our right to private copying by saving YouTube videos locally on the hard drive."' -- source: https://news.slashdot.org/story/22/01/16/025217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Pine64's Newest Linux Smartphone 'PinePhone Pro Explorer Edition' Now Available for Pre-Order
by Peter Reutemann 17 Jan '22

17 Jan '22

'"Linux fans rejoice!" writes Hot Hardware. " Pine64's newest smartphone is officially available for pre-order." PinePhone Pro Explorer Edition pre-orders opened up Tuesday. Devices that are pre-ordered before January 18th will be shipped from Pine64's Hong Kong warehouse by January 24th and should arrive by early February.... According to Pine64, the PinePhone Pro Explorer Edition is the "fastest mainline Linux smartphone on the market." It uses a Rockchip RK3399S SoC that is composed of two ARM A72 cores (1.5GHz) and four A53 efficiency cores (1.5GHz).... Consumers will also likely be pleased with the price of the device. The PinePhone Pro Explorer Edition currently rings in at $399 USD. The production run is purportedly "large" and interested consumers should therefore be able to easily purchase the device at this price. Liliputing adds: While the PinePhone Pro has better hardware than the original PinePhone, Pine64 plans to continue selling both phones indefinitely. The first-gen phone will continue to sell for $150 to $200, offering an entry-level option for folks that want to experiment with mobile Linux, while the higher-priced PinePhone Pro should offer a hardware experience closer to what folks would expect from a modern mid-range phone.... In addition to the PinePhone Keyboard, the recently launched PinePhone wireless charging case, fingerprint reader case, and LoRa cases should all work with either phone. But the new phone has a faster processor, more memory and storage, higher-resolution cameras, a higher-speed USB-C port and support for WiFi 5 and Bluetooth 4.1. And those features should make it a little more viable as a replacement for an iPhone or Android device... if you're comfortable running work-in-progress software. They also add that "Thanks to the recent launch of the $50 PinePhone Keyboard, you can also think of the PinePhone Pro as a $400 phone that can be used as a $449 mini-laptop...." And the Pine64 site's January update also points out that "Pico 8 Raspberry Pi port works on the PinePhone," adding "yes, it does run DOOM."' -- source: https://mobile.slashdot.org/story/22/01/16/0051226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Pine64's 'PineNote' E-Ink Tablet Now Available for $399 for Developers
by Peter Reutemann 17 Jan '22

17 Jan '22

'"The PineNote is a tablet with a 10.1 inch grayscale E Ink display and pen support," reports Liliputing. "It's designed to be a hackable, Linux-friendly device and it's one of the latest products from the makers of the PinePhone and PineBook line of devices." First introduced last summer, the PineNote began shipping to developers in limited quantities in December. Now it's available for anyone to purchase for $399 — no invitation required. But it's probably only a good idea to buy one if you're a developer or very early adopter because there's very little software available for the PineNote so far. At this point, Pine64 is shipping the PineNote without an operating system installed. It will have only a bootloader, allowing developers and enthusiasts to load their own software... [D]evelopers have already made some progress in getting builds Alpine and Debian Linux to run on the E Ink slate, and according to Pine64, there are ports for NixOS and other operating systems on the way. There's already a partially working display driver, but it's still a work in progress. The goal is to allow developers to port mainline Linux operating systems and applications to play well with a monochrome display with a slow refresh rate. Developers have also figured out how to enable support PineNote's touchscreen, audio playback, and USB port, making it possible to use USB keyboards, storage devices, and other peripherals.' -- source: https://hardware.slashdot.org/story/22/01/16/012231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Adhole, the Massive Public Pi-hole Instance, Shuts Down
by Peter Reutemann 14 Jan '22

14 Jan '22

'segaboy81 writes: I've been running Pihole for years (for myself), but this guy was running one for everybody! Since 2017, those not so savvy who still wanted the experience of Pi-hole, could turn to Adhole.org. That is, until now. Adhole.org is shutting down, citing issues with maintenance and stability' -- source: https://it.slashdot.org/story/22/01/13/1858208 Haven't used Pi-Hole myself, but maybe someone here would be willing to demo it at one of our up-coming meetings? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Nikola Static Website Generator now supports Māori language
by Ian Stewart 13 Jan '22

13 Jan '22

Kia ora, The developers of the Nikola static website and blog generator ( https://getnikola.com/ ) recently released version 8.2.0. The website generator is written in python and is an open-source project that is developed on a github repository ( https://github.com/getnikola/nikola ) Nikola V8.2.0 supports 55 languages and now includes support for Māori. Thus a website may be built that is only in Māori. Alternatively a website may default to displaying English and then have the options to select Māori, French or Chinese, etc. For details on how to install Nikola refer to: https://getnikola.com/getting-started.html Kia pārekareka, Ian.

1 0

Raspberry Pi Can Detect Malware By Scanning For Electromagnetic Waves
by Peter Reutemann 13 Jan '22

13 Jan '22

'Gizmodo reports: A team of researchers at France's Research Institute of Computer Science and Random Systems created an anti-malware system centered around a Raspberry Pi that scans devices for electromagnetic waves. As reported by Tom's Hardware, the security device uses an oscilloscope (Picoscope 6407) and H-Field probe connected to a Raspberry Pi 2B to pick up abnormalities in specific electromagnetic waves emitted by computers that are under attack, a technique the researchers say is used to "obtain precise knowledge about malware type and identity." The detection system then relies on Convolution Neural Networks (CNN) to determine whether the data gathered indicates the presence of a threat. Using this technique, researchers claims they could record 100,000 measurement traces from IoT devices infected by genuine malware samples, and predicted three generic and one benign malware class with an accuracy as high as 99.82%. Best of all, no software is needed and the device you're scanning doesn't need to be manipulated in any way. As such, bad actors won't be successful with their attempts to conceal malicious code from malware detection software using obfuscation techniques. "Our method does not require any modification on the target device. Thus, it can be deployed independently from the resources available without any overhead. Moreover, our approach has the advantage that it can hardly be detected and evaded by the malware authors," researchers wrote in the paper.' -- source: https://hardware.slashdot.org/story/22/01/12/2214257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Reinvention Of The Chord Keyboard
by Lawrence D'Oliveiro 13 Jan '22

13 Jan '22

Someone else has invented a new chord keyboard <https://www.nzherald.co.nz/technology/the-end-of-the-qwerty-keyboard-new-ga…>. The idea of being able to type using multiple fingers for each keystroke, instead of just one, is not new. There is also the convenience aspect, for example being able to mount the two halves on the sides of your body, so you can use the keyboard on the go. And adding a predictive system allows it to exceed the speeds of the world’s fastest typists on a conventional keyboard. But the drawback is always the same: it needs special training to use, and most people simply cannot be bothered. Come to think of it, is there any reason you cannot add chord recognition to a conventional typewriter-style keyboard? As in holding down multiple non-modifier keys at once.

2 1

Something Is Jamming Our Remote Car Locks ...
by Lawrence D'Oliveiro 13 Jan '22

13 Jan '22

This is such a weird story <https://www.nzherald.co.nz/nz/hamilton-customers-unable-to-lock-cars-after-…>, and right in our neighbourhood, too: Customers at a Hamilton shopping complex were mysteriously unable to lock their cars on the weekend after a rather bizarre fault in the centre's system. ... On January 11, The Base Shopping Centre confirmed the issue on social media. "We have received reports of an issue that interfered with vehicle remote locking over the weekend. "This has been linked to an incident off-site which was out of our control and is being addressed. No malicious or intentional signal blocking activity was involved." The next day: "An external electrical event had caused a fault to onsite equipment resulting in the interference - this equipment has now been reset and checked by authorities. ..." No mention of what exactly the “system” or “equipment” was, or the “event” was about ... Were any readers of this list there at the time?

2 1

Hotel Chain Switches To Chrome OS To Recover From Ransomware Attack
by Peter Reutemann 13 Jan '22

13 Jan '22

'A Scandinavian hotel chain that fell victim to a ransomware attack last month said it took a novel approach to recover from the incident by switching all affected systems to Chrome OS. The Record reports: Nordic Choice Hotels, which operates 200 hotels across Northern Europe, fell victim to a ransomware attack on December 2, when hackers encrypted some of its internal systems using the Conti ransomware strain. The attack prevented staff from accessing guest reservation data and from issuing key cards to newly arriving guests, as one of the hotel's guests told The Record in an interview last month. But in a press release today, Nordic Choice said that instead of contacting the hackers and negotiating a ransom for the decryption key that would have unlocked the infected devices, the hotel chose to migrate its entire PC fleet from Windows to Chrome OS. "[I]n less than 24 hours, the first hotel was operating in the Chrome OS ecosystem from Google. And in the following two days, 2000 computers were converted all over the company consisting of 212 hotels in five different countries," the hotel chain explained. Kari Anna Fiskvik, VP Technology at Nordic Choice Hotels, said the hotel had already run a pilot program to test the tool before the attack as a way to save money by reusing old computers with a less-demanding OS. "So when we suddenly had to deal with the cyberattack, the decision to go all in and fasttrack the project was made in seconds," Fiskvik said. Nordic Choice said it plans to migrate another 2,000 computers to Chrome OS, on top of the 2,000 it migrated during the attack. The hotel chain said they expect to save $6.7 million by converting old computers to Chrome OS instead of buying new hardware.' -- source: https://yro.slashdot.org/story/22/01/11/227251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Is Going To Track Facebook Tracking You
by Peter Reutemann 13 Jan '22

13 Jan '22

'Gizmodo reports: Researchers at Mozilla announced this week the launch of its "Facebook Pixel Hunt" study, which seeks to track the company's immense web-wide tracking network and investigate the intel it's collecting on users. As the name suggests, this study is focused on a piece of tracking tech known as the "Facebook pixel." Chances are, you've visited a site that uses it; these tiny pieces of tech are buried in literally millions of sites across the web, from online stores to news outlets to... well, you name it. In exchange for onboarding a free pixel on their site, these sites can then track their own visitors and microtarget ads with the same sort of precision you'd expect from a data-hungry company like Facebook. In exchange for giving these sites the power to track every pageview, purchase, search query, and much, much more, Facebook (naturally) requires that this data be shared with it, too. In cases where the website visitor has an account on some Facebook platform, this offsite data just gets glombed onto whatever Facebook already knows about that person. If they don't have a Facebook account, then the company collects that data anyway, and uses it to create a "shadow profile" of that particular person. These are the sorts of shadowy practices that Mozilla's team wants to research with this study -- and you can help them do it if you're a Firefox user. Mozilla teamed up with reporters from the Markup to gather details about Facebook tracking using a free-to-download browser extension, Mozilla Rally, that will hoover up data sent out by Facebook's pixels as you browse across the web. Aside from that data, the extension also keeps track of the time spent on different web pages, the URLs that the browser visits, and more. Mozilla was quick to note in its announcement that the only data being exported from the extension will be de-identified, and not shared with any third parties besides the Markup's reporters.' -- source: https://news.slashdot.org/story/22/01/11/2257237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome Will Limit Access To Private Networks, Citing Security Reasons
by Peter Reutemann 13 Jan '22

13 Jan '22

'Google says that its Chrome browser will soon block internet websites from querying and interacting with devices and servers located inside local private networks, citing security reasons and past abuse from malware operations. From a report: The change will take place through the implementation of a new W3C specification called Private Network Access (PNA) that will be rolled out in the first half of the year. The new PNA specification adds a mechanism inside the Chrome browser through which internet sites can ask systems inside local networks for permission before establishing a connection. If local devices, such as servers or routers fail to respond, internet websites will be blocked from connecting.' -- source: https://it.slashdot.org/story/22/01/12/2012211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 96 Yields Less Load On The Main Thread, WebP Encoder For Canvas
by Peter Reutemann 12 Jan '22

12 Jan '22

'Firefox 96.0 is officially shipping today as the first update of 2022 for this open-source web browser. From a report: Firefox 96.0 has "significantly" reduced the amount of load placed on the browser's main thread and there is also "significant" improvements in noise suppression and auto-gain-control and improvements in echo cancellation. In addition to that performance work, there are also WebRTC improvements, an improved cookie policy to reduce the likelihood of Cross-Site Request Forgery (CSRF) attacks, video quality degradation fixes, and other fixes. Over on developer.mozilla.org are some of the web developer changes with Firefox 96 including CSS color value function hwb() support for specifying the hue/whiteness/blackness, support for the CSS color-scheme property, the Web Locks API is enabled by default, image encoder support for WebP for exporting HTML5 canvas elements, and other additions.' -- source: https://news.slashdot.org/story/22/01/11/1639243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chip Shortage Has Canon Telling Customers How To Defeat Its DRM
by Peter Reutemann 11 Jan '22

11 Jan '22

'Ars Technica: For years, printers have been encumbered with digital rights management systems that prevent users from buying third-party ink and toner cartridges. Printer companies have claimed that their chip-enabled cartridges can "enhance the quality and performance" of their equipment, provide the "best consumer experience," and "protect [the printers] from counterfeit and third-party ink cartridges." Left unsaid is the fact that requiring first-party cartridges also ensures a recurring revenue stream. It's an old business model -- Gillette sold its razor handles cheaply to sell more razors, for example -- and it's one that printer companies have enthusiastically embraced. Lexmark, HP, Canon, Brother, and others all effectively require users to purchase first-party ink and toner. To enforce the use of first-party cartridges, manufacturers typically embed chips inside the consumables for the printers to "authenticate." But when chips are in short supply, like today, manufacturers can find themselves in a bind. So Canon is now telling German customers how to defeat its printers' warnings about third-party cartridges. "Due to the worldwide continuing shortage of semiconductor components, Canon is currently facing challenges in procuring certain electronic components that are used in our consumables for our multifunction printers (MFP)," a Canon support website says in German. "In order to ensure a continuous and reliable supply of consumables, we have decided to supply consumables without a semiconductor component until the normal supply takes place again." [...] The software on these printers comes with a relatively simple way to defeat the chip checks. Depending on the model, when an error message occurs after inserting toner, users can press either "I Agree," "Close," or "OK." When users press that button, the world does not end. Rather, Canon says users may find that their toner cartridge doesn't give them a low-toner warning before running empty. "Although there are no negative effects on print quality when consumables are used without electronic components, certain additional functions, such as the detection of the toner level, may be impaired," Canon's support site says.' -- source: https://hardware.slashdot.org/story/22/01/10/1959243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Is Antivirus Software More Trouble Than It’s Worth?
by Lawrence D'Oliveiro 11 Jan '22

11 Jan '22

<https://www.theregister.com/2022/01/10/opinion_column_consumer_av/>: Game knows game. Thus it came as little surprise that Norton's consumer security software not only sprouted a cryptominer that slurps your computer's life essence and skims a cut, but that it's hard to turn it off. ... Now? Even the meanest computer has hardware and software architectures that can be, and often are, configured for very high resilience against classic virus attacks. The observant may have noted that data security has not been solved – but the attacks aren't the sort of thing that resident consumer AV software can do much about. Endpoint protection managed in the cloud, whether explicit anti-malware services or OS-led protection as seamless as Chrome OS or through aggressive online patching, is as good as it's going to get. Keep up to date, and third-party security software you have to manage has no right to your system at all. Obvious question: how long before proprietary “OS-managed” or “cloud-managed” antimalware starts resorting to the same sharp practices as the consumer-grade stuff? Just consider how often Microsoft has tricked or strong-armed users into installing things they may not want, and made it hard to remove them ...

2 1

Source Of The Famous “Now You Have Two Problems” Quote
by Lawrence D'Oliveiro 11 Jan '22

11 Jan '22

Lots of us have come across this: Some people, when confronted with a problem, think “I know, I'll use regular expressions.” Now they have two problems. -- usually attributed to Jamie Zawinski The form of this joke is also versatile enough to adapt to dumping on other things that the speaker might not like, e.g. “Some people, when confronted with a memory-management programming problem, think ‘I know, I’ll use a garbage-collected language.’ Now they have two problems.” Some time back, a guy named Jeffrey Friedl published a book called “Mastering Regular Expressions”, and the Slashdot discussion† got flooded with posts quoting this at him. So he took the trouble to track down the precise provenance of the quote, and how it had spread. His report is here <http://regex.info/blog/2006-09-15/247>. While his original blog post was put up in 2006, the last update is from the end of 2020. Some reader comments are interesting, too. By the way, something I didn’t know before, is that Jamie Zawinski really, really hates Perl. Or at least he used to. †I told you it was some time back.

1 0

Linux Mint Sells Out for Mozilla Money
by Peter Reutemann 11 Jan '22

11 Jan '22

'Brian Fagioli, reporting for BetaNews: The developers of the Ubuntu-based operating system have agreed to accept an undisclosed amount of money from Mozilla in exchange for making significant changes to Linux Mint. This includes removal of modifications to Firefox and a big change for search. The devs share the upcoming changes to Firefox in Linux Mint 19 and higher. The default start page no longer points to https://www.linuxmint.com/start/ The default search engines no longer include Linux Mint search partners (Yahoo, DuckDuckGo...) but Mozilla search partners (Google, Amazon, Bing, DuckDuckGo, Ebay...) The default configuration switches from Mint defaults to Mozilla defaults. Firefox no longer includes code changes or patches from Linux Mint, Debian or Ubuntu.' -- source: https://linux.slashdot.org/story/22/01/10/1930243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Invents The “Year 2022” Bug
by Lawrence D'Oliveiro 04 Jan '22

04 Jan '22

Microsoft released a new version of Exchange Server at the start of the new year, which promptly caused everybody’s on-premises servers to crash. The reason? The version number. There is apparently code somewhere in the bowels of the software that interprets that number as a signed 32-bit integer, computed as the (year - 2000) × 100 million + additional digits for the month and day etc. Spot the problem with that? The largest representable such integer is 2147483647, so the top two digits can’t be greater than 21. So it can’t actually represent the correct version number for any version released after 2021. Why does the code do that? Who knows... Microsoft’s fix? Change the version number to restrict the top two digits to 21, and increment the lower digits instead, beyond their usual range (e.g. so the release date becomes effectively something like “33 December 2021”). They released a PowerShell script to automate the fix, but it might not work properly, so there is an option for a manual fix as well. <https://arstechnica.com/information-technology/2022/01/exchange-server-bug-…>

1 1

Developer creates ‘Quite OK Image Format’ – but it performs better than just OK
by Peter Reutemann 27 Dec '21

27 Dec '21

'A developer named Dominic Szablewski has given the world a new file format with a splendid name: the Quite OK Image Format (QOI). The file format might be better than that. Szablewski explained that he decided the world needed a new image format because the likes of PNG, JPEG, MPEG, MOV and MP4 “burst with complexity at the seams.” “Every tiny aspect screams ‘design by consortium’,” he added, going on to lament the fact that most common codecs are old, closed, and “require huge libraries, are compute hungry and difficult to work with.” Szablewski thought he could do better and appears to have achieved that objective by cooking up some code, floating it on GitHub, and paying attention to the 500-plus comments it generated. While Szablewski admits that QOI will not compress images as well as an optimized PNG encoder, he claims it “losslessy compresses images to a similar size of PNG, while offering 20x-50x faster encoding and 3x-4x faster decoding.”' -- source: https://www.theregister.com/2021/12/21/quite_ok_image_format/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/.

1 0

Second Ransomware Family Exploiting Log4j Spotted In US, Europe
by Peter Reutemann 23 Dec '21

23 Dec '21

'Researchers say a second family of ransomware has been growing in usage for attack attempts that exploit the critical vulnerability in Apache Log4j, including in the U.S. and Europe. VentureBeat reports: A number of researchers, including at cybersecurity giant Sophos, have now said they've observed the attempted deployment of a ransomware family known as TellYouThePass. Researchers have described TellYouThePass as an older and largely inactive ransomware family -- which has been revived following the discovery of the vulnerability in the widely used Log4j logging software. TellYouThePass is the second family of ransomware that's been observed to exploit the vulnerability in Log4j, known as Log4Shell, joining the Khonsari ransomware, according to researchers. While previous reports indicated that TellYouThePass was mainly being directed against targets in China, researchers at Sophos told VentureBeat that they've observed the attempted delivery of TellYouThePass ransomware both inside and outside of China -- including in the U.S. and Europe. "Systems in China were targeted, as well as some hosted in Amazon and Google cloud services in the U.S. and at several sites in Europe," said Sean Gallagher, a senior threat researcher at Sophos Labs, in an email to VentureBeat on Tuesday. Sophos detected attempts to deliver TellYouThePass payloads by utilizing the Log4j vulnerability on December 17 and December 18, Gallagher said. TellYouThePass has versions that run on either Linux or Windows, "and has a history of exploiting high-profile vulnerabilities like EternalBlue," said Andrew Brandt, a threat researcher at Sophos, in an email. The Linux version is capable of stealing Secure Socket Shell (SSH) keys and can perform lateral movement, Brandt said. Sophos initially disclosed its detection of TellYouThePass ransomware in a December 20 blog post. The first report of TellYouThePass ransomware exploiting the Log4j vulnerability appears to have come from the head of Chinese cybersecurity group KnownSec 404 Team on December 12. The attempted deployment of TellYouThePass in conjunction with Log4Shell was subsequently confirmed by additional researchers, according to researcher community Curated Intelligence. In a blog post Tuesday, Curated Intelligence said its members can now confirm that TellYouThePass has been seen exploiting the vulnerability "in the wild to target both Windows and Linux systems." TellYouThePass had most recently been observed in July 2020, Curated Intelligence said. It joins Khonsari, a new family of ransomware identified in connection with exploits of the Log4j vulnerability. ' -- source: https://it.slashdot.org/story/21/12/22/2255231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Patch fixing critical Log4J 0-day has its own vulnerability that’s under exploit
by Peter Reutemann 20 Dec '21

20 Dec '21

'Last Thursday, the world learned of an in-the-wild exploitation of a critical code-execution zero-day in Log4J, a logging utility used by just about every cloud service and enterprise network on the planet. Open source developers quickly released an update that patched the flaw and urged all users to install it immediately. Now, researchers are reporting that there are at least two vulnerabilities in the patch, released as Log4J 2.15.0, and that attackers are actively exploiting one or both of them against real-world targets who have already applied the update. The researchers are urging organizations to install a new patch, released as version 2.16.0, as soon as possible to fix the vulnerability, which is tracked as CVE-2021-45046. ' -- source: https://arstechnica.com/information-technology/2021/12/patch-fixing-critica… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

This USB 'Kill Cord' Can Instantly Wipe Your Laptop if Snatched or Stolen
by Peter Reutemann 18 Dec '21

18 Dec '21

'Journalists, activists, and human rights defenders face a constant battle to keep files safe from a growing set of digital threats and surveillance. But physical attacks can be challenging to defend against, whether an opportunist snatch-and-grab thief or an oppressive government kicking down someone's door. This week, a project called BusKill launched a custom USB magnetic breakaway cable that acts as a "dead man's switch," locking a computer if someone physically snatches it and severs the magnetic connectors. BusKill has been in the works for more than two years as a do-it-yourself project. Anyone with the hardware could compile the source code, but it only worked on Linux and components quickly sold out. After a crowdsourcing effort, the cable is now available to buy starting at $59 and has an accompanying app that works on macOS, Windows, and Linux, allowing the person using the cable to easily arm and disarm the cable with a touch of a button.' -- source: https://tech.slashdot.org/story/21/12/17/1530254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Pop!_OS 21.10 Review
by Lawrence D'Oliveiro 17 Dec '21

17 Dec '21

This review <https://www.theregister.com/2021/12/16/pop_os_2110_new_system76/> of the new version of the Ubuntu variant from System76 mentions a lot of trouble getting it to play nicely with other installed OSes on the same machine. One key difference is that it doesn’t boot with GRUB. Instead, it is EFI-only, and requires your kernel and initial RAM disk to live inside the “EFI System Partition” (ESP), where they can be found by systemd-boot. This typically requires the ESP to be enlarged beyond its initial size. And, depending on the tools you use, that can be problematic. This EFI-only boot procedure can also complicate coexistence with other OS installations on a multiboot system. But, interestingly, not Microsoft Windows, at least according to one of the reader comments. Indeed, a well-known issue where installing Windows on an MBR-based system destroys your ability to boot other OSes goes away with EFI-only booting. Seems Windows is well-enough behaved to only replace its own EFI state, leaving that for other OSes alone.

1 0

AGM next month
by Peter Reutemann 17 Dec '21

17 Dec '21

Hi everyone We have our Annual General Meeting (AGM) coming up on January 24th with the following (preliminary) agenda: - President's Report - Treasurer's Report - Election of 2022 Committee - General business - Consumption of pizza Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/282720630/ BTW Meeting venue (or whether to be held online due to COVID) will be confirmed closer to the date. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Is Building a New AR Device and OS
by Peter Reutemann 15 Dec '21

15 Dec '21

'According to job listings on LinkedIn, Google appears to be working on an augmented reality device and operating system to pair with it. Ars Technica reports: On LinkedIn, operating system engineering director Mark Lucovsky announced that he has joined Google. He previously headed up mixed reality operating system work for Meta, and before that he was one of the key architects of Windows NT at Microsoft. "My role is to lead the Operating System team for Augmented Reality at Google," he wrote. He also posted a link to some job listings at Google that give the impression Google is getting just as serious about AR as Apple or Meta. As 9to5Google discovered, one of the listings ("Senior Software Developer, Embedded, Augmented Reality OS") described Google's objective in clear terms: "Our team is building the software components that control and manage the hardware on our Augmented Reality (AR) products. These are the software components that run on the AR devices and are the closest to the hardware. As Google adds products to the AR portfolio, the OS Foundations team is the very first software team to work with new hardware." Other job listings say new hires will be working on an "innovative AR device." And one specifies that Google is "focused on making immersive computing accessible to billions of people through mobile devices." The roles are largely in the United States, but some are located in Waterloo, Ontario -- the HQ of Canadian smart glasses maker North, which Google acquired in 2020.' -- source: https://tech.slashdot.org/story/21/12/14/2233208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android 12 Go Edition Brings New Speed, Battery, Privacy Features To Lower-end Phones
by Peter Reutemann 15 Dec '21

15 Dec '21

'Google's Pixel 6 line may have served as Android 12's big debut for higher-end phones, but Android 12 (Go edition) plans to bring many of the enhancements and features of Android 12 to lower-end phones, too. Google on Tuesday unveiled a host of new features for the Go edition that are set to roll out to devices in 2022. From a report: Google says that in addition to speed enhancements that'll help apps launch up to 30% faster, Android 12 (Go edition) will include a feature that'll save battery life and storage by automatically "hibernating apps that haven't been used for extended periods of time." And with the Files Go app, you'll be able to recover files within 30 days of deletion. Android 12 (Go edition) will also help you easily translate any content, listen to the news and share apps with nearby devices offline to save data, Google says. The company said Android Go has amassed 200 million users.' -- source: https://mobile.slashdot.org/story/21/12/14/1848213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Log4Shell Vuln Rated 10 Out Of 10
by Lawrence D'Oliveiro 14 Dec '21

14 Dec '21

The Log4Shell vulnerability has been given the highest possible CVE severity rating <https://arstechnica.com/information-technology/2021/12/the-log4shell-zeroda…>. It’s a really, really stupid bug in a logging framework called Log4J, which is used by an incredible variety of Java-based applications, including Minecraft. Log messages are generated according to customizable format templates that the admin can specify. These templates allow the creation of a range of different messages, including all kinds of useful information which can aid in debugging, performance monitoring, usage statistics gathering etc. But one thing you should never, ever do is, having substituted some text from some random source (e.g. user input), go back and scan that text for format substitution codes. But that is what the buggy code does.

1 1

VPOTUS Getting Flak For Her Bluetooth Aversion
by Lawrence D'Oliveiro 14 Dec '21

14 Dec '21

Seems US Vice President Kamala Harris is copping a fair amount of ridicule after saying she prefers wired headphones to wireless Bluetooth ones, for security reasons <https://www.theregister.com/2021/12/13/in_brief_security/>. She’s just listening to her security advisors, folks. And their advice makes sense.

1 0

n-dimensional image tool powers up Python
by Matthew Skiffington 08 Dec '21

08 Dec '21

>From the nature science briefing: A free, open-source and extensible image viewer for arbitrarily complex (‘ <https://nature.us17.list-manage.com/track/click?u=2c6057c528fdc6f73fa196d9d…> *n* <https://nature.us17.list-manage.com/track/click?u=2c6057c528fdc6f73fa196d9d…>-dimensional’) data <https://nature.us17.list-manage.com/track/click?u=2c6057c528fdc6f73fa196d9d…> fills a gap in the Python scientific ecosystem. napari — whose name refers to a Pacific island village midway between the developers’ bases in San Francisco and Melbourne — features a simple graphical interface with a built-in Python console. Early adopters are using it to streamline everything from visualizing atmospheric jet streams to identifying cells in tissue. Nature | 4 min read <https://nature.us17.list-manage.com/track/click?u=2c6057c528fdc6f73fa196d9d…> Cheers,Matthew *Doctoral Researcher, TAIAO project <https://taiao.ai/>**, University of Waikato* *Machine Learning Laboratory, FG.2.01LinkedIn <https://www.linkedin.com/in/matthew-skiffington>*

1 0

A Mysterious Threat Actor is Running Hundreds of Malicious Tor Relays
by Peter Reutemann 07 Dec '21

07 Dec '21

'Since at least 2017, a mysterious threat actor has run thousands of malicious servers in entry, middle, and exit positions of the Tor network in what a security researcher has described as an attempt to deanonymize Tor users. The Record: Tracked as KAX17, the threat actor ran at its peak more than 900 malicious servers part of the Tor network, which typically tends to hover around a daily total of up to 9,000-10,000. Some of these servers work as entry points (guards), others as middle relays, and others as exit points from the Tor network. Their role is to encrypt and anonymize user traffic as it enters and leaves the Tor network, creating a giant mesh of proxy servers that bounce connections between each other and provide the much-needed privacy that Tor users come for. Servers added to the Tor network typically must have contact information included in their setup, such as an email address, so Tor network administrators and law enforcement can contact server operators in the case of a misconfiguration or file an abuse report. However, despite this rule, servers with no contact information are often added to the Tor network, which is not strictly policed, mainly to ensure there's always a sufficiently large number of nodes to bounce and hide user traffic.' -- source: https://it.slashdot.org/story/21/12/06/1941209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FSF's Anti-DRM Campaign Plans Bad-Review Protest Against Disney+
by Peter Reutemann 07 Dec '21

07 Dec '21

'For their fifteenth International Day Against DRM this Friday, the Free Software Foundation's "Defective by Design" campaign is "calling on you to help us send a message to purveyors of Digital Restrictions Management (DRM)". And this year they're targeting Disney+ The ongoing pandemic has only tightened the stranglehold streaming services have as some of the most dominant forms of entertainment media, and Disney+ is among the worst of them. After years of aggressive lobbying to extend the length of copyright, based on their perceived need to keep a certain rat from entering the public domain, they've now set their sights on "protecting" their various franchises in a different way: by shackling them with digital restrictions. If Disney's stated mission is to keep "inspiring hope and sparking the curiosity of all ages", using DRM to limit that curiosity remains the wrong move. This year, we'll be using one of Disney's own means of spreading their "service" and the DRM bundled with it: their mobile app. If you're an existing user of the Google Play (Android) or Apple App Stores, you can support the International Day Against DRM by voicing your objection to Disney's subjugation of their users. Streaming services like Netflix and Peacock have the same issues, but by targeting a newer one with such massive investment and capital behind it, we can make sure that we're heard. Disney+ is new: that gives it time to change. Disney+ is placed near the top of the most frequently downloaded apps on both the Google Play and Apple App Stores. We invite you to write a well-thought objection to Disney's use of DRM, with a fitting review. It is the perfect way to let the corporation, and other users intending to use its services know Disney's grievous mistake in using DRM to restrict customers who already want to view their many films and television shows. It will give you a chance to give them the exact rating that any service that treats its users so poorly: a single star. DRM isn't the only problem with the Disney+ app. It's also nonfree software. If you're not already an Android or iOS user, we don't recommend starting an account just to participate in this action. You can also choose to send an email to Disney executives following our template. They're urging supporters to also share the actions they've taken on social media using the tag #DayAgainstDRM. (And there's also an IRC channel "to discuss and share strategies for anti-DRM activism," with more anti-DRM actions still to come. "While some aspects of the struggle have changed, the core principles remain the same: users should not be forced to surrender their digital autonomy in exchange for media."' -- source: https://slashdot.org/story/21/12/04/187207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 95 Will Include RLBox Sandboxing for Added Security
by Peter Reutemann 07 Dec '21

07 Dec '21

'Mozilla has announced through its Mozilla Hacks blog that it plans to ship a 'novel sandboxing technology' called RLBox with Firefox 95 which it has been developing alongside researchers from the University of California San Diego and the University of Texas. From a report: It said RLBox makes it easier to isolate subcomponents of the browser efficiently and gives Mozilla more options than traditional sandboxing granted it. Mozilla said this new method of sandboxing, which uses WebAssembly to isolate potentially-buggy code, builds on a prototype that was shipped in Firefox 74 and Firefox 75 to Linux and Mac users respectively. With Firefox 95, RLBox will be deployed on all supported Firefox platforms including desktop and mobile to isolate three different modules: Graphite, Hunspell, and Ogg. With Firefox 96, two more modules, Expat and Woff2, will also be isolated.' -- source: https://news.slashdot.org/story/21/12/06/1558251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Blender 3.0 Is Out
by Lawrence D'Oliveiro 04 Dec '21

04 Dec '21

A new major release of Blender, the 3D modelling/animation/sculpting/rendering software, finally hit stable earlier today. The version numbering is now taking bigger jumps. This is a far cry from the old days, when, for example, major new features would come out with only small version number changes (e.g. the Cycles ray-traced renderer appearing in 2.61, geometry nodes in 2.92 etc). My only worry is that the file format only has a single digit for the major version number. What happens after 9.99? Get it from <https://www.blender.org/>. Release notes are at <https://wiki.blender.org/wiki/Reference/Release_Notes/3.0>.

1 0

Regulators Flocking To Block Nvidia’s ARM Acquisition
by Lawrence D'Oliveiro 04 Dec '21

04 Dec '21

The US FTC has joined in <https://arstechnica.com/tech-policy/2021/12/ftc-sues-nvidia-to-preserve-arm…> the growing list of Government regulators from various countries looking askance at Nvidia’s plans to buy ARM. I like their description of ARM as being the “Switzerland” of semiconductors. Also found this interesting fact mentioned: Last year, companies sold 25 billion ARM chips, an increase of more than four-fold since 2010. That’s nearly four chips for every person on the planet. Per year.

2 1

JupyterHub 2.0 Is Out
by Lawrence D'Oliveiro 03 Dec '21

03 Dec '21

Just saw this report <https://devclass.com/2021/12/02/jupyterhub-2/> on the new release of JupyterHub. This is the version of Jupyter designed to support multiuser deployments with proper access control. The new version supports role-based access control with delegation of admin responsibilities, so you can have group admins with control over their particular users but no privileges outside of that. For those new to Jupyter: <https://jupyter.org>.

1 0

70 Years Ago, LEO
by Lawrence D'Oliveiro 01 Dec '21

01 Dec '21

Seventy years ago, in 1951, the world’s first computer built for business use was put into production <https://www.theregister.com/2021/11/30/leo_70/>. It was called “LEO”, short for “Lyons Electronic Office”. The J Lyons company ran a string of teashops across the UK, and an ongoing problem that the shop managers (and central office) faced was how to accurately predict the supplies needed for the next day’s business, given that much of it (cakes etc) was highly perishable, and so had to be manufactured on a few hours’ notice. This “bakery valuation” was a statistical problem, based on crunching a lot of raw data, looking at past demand, seasonal variations etc, and it was still a novel concept that a computer turned out to be better than humans at doing the necessary calculations. The computer turned out to be so useful that the UK Ministry of Supply hired it to get some ballistic calculations done. Later it also did other jobs at the company, like payroll. Actually, a lot of this (except the payroll) sounds to me very much like number-crunching, which would surely have been considered more of a “scientific” than a “business” computing application. Remember, there was this dichotomy between “scientific” and “business” computing use back then, that continued right into about the 1970s. This division existed in hardware (e.g. decimal arithmetic for “business” use, binary for “scientific”) and software (COBOL being the preferred programming language for “business” use, things like FORTRAN and ALGOL for “scientific”). The teashop company spun off the computer business as a separate operation in 1954, which went on to bring out the LEO II and LEO III machines before being acquired by English Electric, which in turn later merged with ICT to create ICL. According to the article linked above, the last LEO machine was decommissioned in 1981, and the last Lyons teashop closed that same year. I first learned about LEO and the Lyons teashops some decades ago, from a book called “Early British Computers”, by Simon Lavington, published in 1980.

1 0

Raspberry Pi Trading Could Go Public This Spring
by Peter Reutemann 30 Nov '21

30 Nov '21

'"According to a report in The Telegraph, Raspberry Pi Trading, the arm responsible for the creation of the Raspberry Pi 4, Raspberry Pi Pico and the new Raspberry Pi Zero 2 W could soon be listed with a value of more than £370m ($493m)," reports Tom's Hardware: Raspberry Pi Trading has hired advisors from two investment banks, Stifel and Liberum to advise on floating the company in spring 2022. The news comes just a few months after Raspberry Pi received a £45m ($60m) investment from Lansdowne Partners and the Ezrah Charitable Trust which was used to fund the development of new products as demand increased during the global pandemic. A source close to The Telegraph has valued Raspberry Pi at a premium of $500m... "Obviously, the $45m we raised in September takes away some of the urgency around figuring out how we fund the future. On the other hand, we have great plans for what we are going to do over the next five years." Eben Upton, talking to The Telegraph.' -- source: https://hardware.slashdot.org/story/21/11/28/2328201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Google Play apps downloaded 300,000 times stole bank credentials
by Peter Reutemann 30 Nov '21

30 Nov '21

'Researchers said they’ve discovered a batch of apps downloaded from Google Play more than 300,000 times before the apps were revealed to be banking trojans that surreptitiously siphoned user passwords and two-factor authentication codes, logged keystrokes, and took screenshots. The apps—posing as QR scanners, PDF scanners, and cryptocurrency wallets—belonged to four separate Android malware families that were distributed over four months. They used several tricks to sidestep restrictions that Google has devised in an attempt to rein in the unending distribution of fraudulent apps in its official marketplace. Those limitations include restricting the use of accessibility services for sight-impaired users to prevent the automatic installation of apps without user consent.' -- source: https://arstechnica.com/information-technology/2021/11/google-play-apps-dow… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Nvidia's DLSS Has Come To Linux Gaming
by Peter Reutemann 29 Nov '21

29 Nov '21

'Years after its failed Steam Machines, Valve is slowly but surely improving the state of Linux gaming. From a report: The company's upcoming Steam Deck handheld runs atop Linux, and its Proton compatibility layer lets it -- and other computers -- play Windows games as well. Now, Valve has officially added support for Nvidia's DLSS machine learning temporal upscaling technique to Proton, potentially bringing big FPS boosts and less flicker in games that support the technology. Proton 6.3-8 is the first stable release to include support for DLSS, after the feature previously hit experimental builds in October, though it appears you'll still need to set PROTON_ENABLE_NVAPI=1 and dxgi.nvapiHack = False to turn it on. DLSS won't come to the AMD-powered Steam Deck, of course, since it requires proprietary Nvidia machine learning silicon, but we recently learned the Steam Deck will support AMDâ(TM)s arguably much less capable FSR.' -- source: https://linux.slashdot.org/story/21/11/27/0325250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AWS Embraces Fedora Linux for Its Cloud-Based 'Amazon Linux'
by Peter Reutemann 29 Nov '21

29 Nov '21

'ZDNet reports: By and large, the public cloud runs on Linux. Most users, even Microsoft Azure customers, run Linux on the cloud. In the case of market giant Amazon Web Services (AWS), the cloud provider will let you run many Linux distros or their own homebrew Linux, Amazon Linux. Now, AWS has released an early version of its next distro, Amazon Linux 3, which is based on Red Hat's community Linux, Fedora. AWS has long tried to incorporate Red Hat Enterprise Linux (RHEL) compatibility into Amazon Linux, but this latest release takes that to new heights. By using Fedora as its upstream, the new Amazon distro, also called AL2022, is a stable distribution. It's gone through extensive testing to offer package stability, and it also includes all available security updates.... TechRadar adds some more details: The distro has had two major releases till now; the first in 2010, and the second in 2017. However, with the third AL2022 release the service is committing to a two year release cycle, with each release supported for a period of five years... AWS argues that the two year major release cycle, with updates shipped quarterly via minor releases, will help keep the software current, while the five year support commitment for each major release will give customers the stability they need to manage long project lifecycles. ' -- source: https://linux.slashdot.org/story/21/11/27/0328223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Addressing 'Bus Factor', PHP Gets a Foundation
by Peter Reutemann 29 Nov '21

29 Nov '21

'How many members of your team are so irreplaceable that if they were hit by a bus, your project would grind to a halt? For PHP, that number is: two. (According to a post by PHP contributor Joe Watkins earlier this year that's now being cited in Mike Melanson's "This Week in Programming" column.) "Maybe as few as two people would have to wake up this morning and decide they want to do something different with their lives in order for the PHP project to lack the expertise and resources to move it forward in its current form, and at current pace," Watkins wrote at the time, naming Dmitry Stogov and Nikita Popov as those two. Well, last week, Nikita Popov was thankfully not hit by a bus, but he did decide to move on from his role with PHP to instead focus his activities on LLVM. Also thankfully, Watkins' article earlier this year opened some eyes to the situation at hand and, as he writes in a follow-up article this week, JetBrains (Popov's employer) reached out to him at the time regarding starting a PHP Foundation. This week, with Popov's departure, the PHP Foundation was officially launched with the goal of funding part/full-time developers to work on the PHP core in 2022. At launch, the PHP Foundation will count 10 companies — Automattic, Laravel, Acquia, Zend, Private Packagist, Symfony, Craft CMS, Tideways, PrestaShop, and JetBrains — among its backers, with an expectation to raise $300,000 per year, and with JetBrains contributing $100,000 annually. Alongside that, the foundation is being launched using foundation-as-a-service provider Open Collective, and just under 700 contributors have already raised more than $40,000 for the foundation. One of the key benefits to creating a foundation, rather than sticking with the status quo, goes beyond increasing the bus factor — it diversifies the influences on PHP. Watkins points out that, for much of the history of PHP, Zend, the employer of Dmitry Stogov, has been a primary financial backer, and as such has had some amount of influence on the language's direction. Similarly, JetBrains had increased influence during its time employing Popov on PHP."To say they have not influenced the direction of the language as a whole would just not be true...." While Watkins says that everything has been above board and gone through standard processes to ensure so, influence is nonetheless indisputable, and that "The Foundation represents a new way to push the language forward..." The current RFC process, JetBrains writes, "will not change, and language decisions will always be left to the PHP Internals community." And in addition, Watkins adds, "It provides us the mechanism by which to raise the bus factor, so that we never face the problems we face today, and have faced in the past."' -- source: https://developers.slashdot.org/story/21/11/27/0225217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Computation-Intensive Research And The Quest For Scientific Reproducibility
by Lawrence D'Oliveiro 26 Nov '21

26 Nov '21

The fruits of scientific research are supposed to be open to all. A key part of this is the need for reproducibility -- the idea that somebody else can repeat the same experiments and analysis and (hopefully) come to the same conclusions. It has long been a common expectation that researchers will make their raw data available to others for this purpose, but nowadays even that is likely no longer enough. The analysis of the data usually requires some particular piece of computer software, even if this was just some in-house scripting done on top of a commonly-available toolkit or package. Two different reports on this subject have come out recently, this one <https://www.theregister.com/2021/11/25/research_software_inquiry/> from the UK and this <https://arstechnica.com/science/2021/11/keeping-science-reproducible-in-a-w…> with examples from the US and elsewhere. The latter goes into a lot more detail, including good news (the rise of publicly-available data sets which get heavily used for many different analyses), and bad: From 2017 through 2019, Tsuyoshi Miyakawa, the editor-in-chief of the journal Molecular Brain, replied to 41 article submissions by requesting that the authors provide their complete source data for review, as per the stated policy of the journal. Only one author did so. ... Based on his efforts to replicate papers from other statisticians, Thomas Lumley, a professor of biostatistics at the University of Auckland in New Zealand, says of the phrase data available upon request: "When people put it in their papers, what they typically mean is 'data not available.'" As for making code available, that has its own challenges: often the scripts/programs are hastily thrown together, and the creators may be embarrassed to have others see it in this state. Or it’s not likely to work properly anyway, outside of the original systems where it was developed. The good news is, bodies that fund the research and the journals that publish the results are becoming more aware of such issues, and increasingly trying to ensure that procedures for dealing with them are built into the projects from the beginning.

3 2

Bye-Bye MIPS
by Lawrence D'Oliveiro 26 Nov '21

26 Nov '21

You know a CPU architecture is really dead when the Linux kernel drops support for it. I just learned that MIPS64 has joined this club as of the 5.15 kernel, according to <https://www.theregister.com/2021/11/25/alpine_3_15/> (presumably “MIPS32” vanished some time before?). Even the company formerly known as “MIPS” is now rebranding (at least its parent) as “Wave”, and is going to base its future products on the RISC-V architecture instead.

1 0

Mozilla Is Ending Support For Its Firefox Password Manager Sync App
by Peter Reutemann 24 Nov '21

24 Nov '21

'Mozilla announced last week via a support article that its Firefox Lockwise password manager app will reach end-of-life on December 13th. The final release versions are 1.8.1 (iOS) and 4.0.3 (Android) and will no longer be available to download or reinstall after that date. The Verge reports: What started in 2018 as a small experimental mobile app called Lockbox ended up bringing a way to access saved passwords and perform autofills on iOS, Android, and desktop devices to a small but enthusiastic following of Firefox fans. The app was also later adapted as a Firefox extension. It seemed like it was apt to stick around for the long run. The support article recommends that users continue accessing passwords using the native Firefox browsers on desktop and mobile. In an added note on the support site, Mozilla suggests that later in December, the Firefox iOS app will gain the ability to manage Firefox passwords systemwide. The note alludes to Mozilla adopting the features of Lockwise and eventually integrating them into the Firefox browser apps natively on all platforms. ' -- source: https://tech.slashdot.org/story/21/11/23/2157244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Trying To Reclaim The Word “Crypto”
by Lawrence D'Oliveiro 24 Nov '21

24 Nov '21

For decades, the word “crypto” has been synonymous with “cryptography”. But increasingly now, some are using it to mean “cryptocurrency” instead. Naturally this is annoying some who have been working in the crypto field for years, and they are demanding that this new (mis)usage be stopped. What do you think? <https://www.theregister.com/2021/11/23/crypto_graphy_or_currency/>

2 2

Attackers Don't Bother Brute-forcing Long Passwords, Microsoft Engineer Says
by Peter Reutemann 23 Nov '21

23 Nov '21

'According to data collected by Microsoft's network of honeypot servers, most brute-force attackers primarily attempt to guess short passwords, with very few attacks targeting credentials that are either long or contain complex characters. From a report: "I analysed the credentials entered from over -- million brute force attacks against SSH. This is around 30 days of data in Microsoft's sensor network," said Ross Bevington, a security researcher at Microsoft. "77% of attempts used a password between 1 and 7 characters. A password over 10 characters was only seen in 6% of cases," said Bevington, who works as Head of Deception at Microsoft, a position in which he's tasked with creating legitimate-looking honeypot systems in order to study attacker trends.' -- source: https://it.slashdot.org/story/21/11/22/2036243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

GoDaddy Security Breach Exposes WordPress Users' Data
by Peter Reutemann 23 Nov '21

23 Nov '21

'Web hosting company GoDaddy said on Monday email addresses of up to 1.2 million active and inactive Managed WordPress customers had been exposed in an unauthorized third-party access. From a report: The company said the incident was discovered on Sept. 6 and the third-party accessed the system using a compromised password.' -- source: https://it.slashdot.org/story/21/11/22/1523234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A German State is Switching Its 25,000 Computers From Windows to Linux
by Peter Reutemann 22 Nov '21

22 Nov '21

'The north-German state of Schleswig-Holstein plans to switch to open source software..." reports Mike Saunders from LibreOffice. "By the end of 2026, Microsoft Office is to be replaced by LibreOffice on all 25,000 computers used by civil servants and employees (including teachers), and the Windows operating system is to be replaced by GNU/Linux." The tech site Foss Force writes: This seems to be a done deal, as the steps for the transition from proprietary to open have already been codified by the Schleswig-Holstein state parliament, and explained in plain language in an interview with Jan Philipp Albrecht, the state's digital minister, that was published in c't, a German language computer magazine (Google Translate version here). In the interview, Albrecht said that part of the transition to open source is already in the works, and pointed out that 90% of state administration conferencing is conducted using the open source video conferencing platform Jitsi. "We have been testing LibreOffice in our IT department for two years, and our experience is clear: it works," he said. "This also applies, for example, when editing Microsoft Word documents with comments... No Linux distribution has been chosen yet to use as a standard, although Albrecht said they're currently looking at five distributions that suit their purposes.' -- source: https://linux.slashdot.org/story/21/11/21/0231218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Thousands of Firefox Users Accidentally Commit Login Cookies On GitHub
by Peter Reutemann 19 Nov '21

19 Nov '21

'Thousands of Firefox cookie databases containing sensitive data are available on request from GitHub repositories, data potentially usable for hijacking authenticated sessions. The Register reports: These cookies.sqlite databases normally reside in the Firefox profiles folder. They're used to store cookies between browsing sessions. And they're findable by searching GitHub with specific query parameters, what's known as a search "dork." Aidan Marlin, a security engineer at London-based rail travel service Trainline, alerted The Register to the public availability of these files after reporting his findings through HackerOne and being told by a GitHub representative that "credentials exposed by our users are not in scope for our Bug Bounty program." Marlin then asked whether he could make his findings public and was told he's free to do so. "I'm frustrated that GitHub isn't taking its users' security and privacy seriously," Marlin told The Register in an email. "The least it could do is prevent results coming up for this GitHub dork. If the individuals who uploaded these cookie databases were made aware of what they'd done, they'd s*** their pants." Marlin acknowledges that affected GitHub users deserve some blame for failing to prevent their cookies.sqlite databases from being included when they committed code and pushed it to their public repositories. "But there are nearly 4.5k hits for this dork, so I think GitHub has a duty of care as well," he said, adding that he's alerted the UK Information Commissioner's Office because personal information is at stake. Marlin speculates that the oversight is a consequence of committing code from one's Linux home directory. "I imagine in most of the cases, the individuals aren't aware that they've uploaded their cookie databases," he explained. "A common reason users do this is for a common environment across multiple machines."' -- source: https://news.slashdot.org/story/21/11/18/2227206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Has a Serious Security Problem That Once Again Enables DNS Cache Poisoning
by Peter Reutemann 18 Nov '21

18 Nov '21

'As much as 38 percent of the Internet's domain name lookup servers are vulnerable to a new attack that allows hackers to send victims to maliciously spoofed addresses masquerading as legitimate domains, like bankofamerica.com or gmail.com. The exploit, unveiled in research presented today, revives the DNS cache-poisoning attack that researcher Dan Kaminsky disclosed in 2008. He showed that, by masquerading as an authoritative DNS server and using it to flood a DNS resolver with fake lookup results for a trusted domain, an attacker could poison the resolver cache with the spoofed IP address. >From then on, anyone relying on the same resolver would be diverted to the same imposter site. The sleight of hand worked because DNS at the time relied on a transaction ID to prove the IP number returned came from an authoritative server rather than an imposter server attempting to send people to a malicious site. The transaction number had only 16 bits, which meant that there were only 65,536 possible transaction IDs. Kaminsky realized that hackers could exploit the lack of entropy by bombarding a DNS resolver with off-path responses that included each possible ID. Once the resolver received a response with the correct ID, the server would accept the malicious IP and store the result in cache so that everyone else using the same resolver -- which typically belongs to a corporation, organization, or ISP -- would also be sent to the same malicious server.' -- source: https://linux.slashdot.org/story/21/11/17/1856235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

meeting next Monday
by Peter Reutemann 18 Nov '21

18 Nov '21

Hi everyone We have a WLUG meeting next week on Monday: 'For the last meeting of the year, let's have general get-together. Ian Stewart will demo the latest Ubuntu 21.10 and Peter Reutemann will try to show what you can use the frp fast reverse proxy for (https://github.com/fatedier/frp) And of course, general Linux related troubleshooting and questions answered.' -- source: https://www.meetup.com/WaikatoLinuxUsersGroup/events/274861098/ This is once again an online event, so make sure to RSVP on meetup to get the link (you only need a browser). Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Latency Numbers Every Programmer Should Know
by Lawrence D'Oliveiro 17 Nov '21

17 Nov '21

Somebody did a nice chart a while back <https://gist.github.com/hellerbarde/2843375> of the time it takes to perform many common data transfer operations on contemporary hardware. And note the multi-part figure, where the basic unit in each block is a bit more than an order of magnitude greater than the one in the previous block. And if the figure isn’t dramatic enough, a commenter has said “let’s multiply all the numbers by a billion” (just to bring them into more human-comprehensible scales), and then liken them to common things that people do, from making a cup of coffee, all the way up to completing a bachelor’s degree.

2 5

Scientists Send Data Using Nuclear Radiation
by Lawrence D'Oliveiro 16 Nov '21

16 Nov '21

A research group has used fast neutrons <https://www.theregister.com/2021/11/15/wireless_information_transfer_with_f…> as a communication channel, to send legible data between a transmitter and a receiver. Their proof of concept is very low-bandwidth and requires a lot of complicated equipment, but at least it does show (safety issues aside) that it is theoretically possible. The issue with high-energy subatomic particles is, how do you turn them on and off at will -- i.e. modulate the intensity of the beam to convey information? This group used some kind of shutter system (“neutron chopper”) in conjunction with some quantity of radioactive californium-252 as their neutron source. But they mention that someone else has come up with a device that is basically a particle accelerator on a chip, able to produce a stream of neutrons from non-radioactive starting components on demand.

1 0

Microsoft Fixes An Issue
by Lawrence D'Oliveiro 16 Nov '21

16 Nov '21

The latest Windows 11 update <https://www.theregister.com/2021/11/15/windows_11_insiders_bug_fixes/> gets ever closer to perfection. I like this one: We fixed an issue that prevents your device from starting up, and it becomes unresponsive because of licensing API calls. Because what would that good old “enrichment of the user experience” be like without licensing API calls ... The writer’s verdict on the new OS sounds more like damning with faint praise: We have been running Windows 11 for daily work since official release and are happy to report that it is usable and stable in our experience so far, though useful improvements over its predecessor are hard to identify.

1 0

DDR4 memory protections are broken wide open by new Rowhammer technique
by Peter Reutemann 16 Nov '21

16 Nov '21

'Rowhammer exploits that allow unprivileged attackers to change or corrupt data stored in vulnerable memory chips are now possible on virtually all DDR4 modules due to a new approach that neuters defenses chip manufacturers added to make their wares more resistant to such attacks. Rowhammer attacks work by accessing—or hammering—physical rows inside vulnerable chips millions of times per second in ways that cause bits in neighboring rows to flip, meaning 1s turn to 0s and vice versa. Researchers have shown the attacks can be used to give untrusted applications nearly unfettered system privileges, bypass security sandboxes designed to keep malicious code from accessing sensitive operating system resources, and root or infect Android devices, among other things. All previous Rowhammer attacks have hammered rows with uniform patterns, such as single-sided, double-sided, or n-sided. In all three cases, these “aggressor” rows—meaning those that cause bitflips in nearby “victim” rows—are accessed the same number of times. Research published on Monday presented a new Rowhammer technique. It uses non-uniform patterns that access two or more aggressor rows with different frequencies. The result: all 40 of the randomly selected DIMMs in a test pool experienced bitflips, up from 13 out of 42 chips tested in previous work from the same researchers.' -- source: https://arstechnica.com/gadgets/2021/11/ddr4-memory-is-even-more-susceptibl… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

topics for next month?
by Peter Reutemann 15 Nov '21

15 Nov '21

Hi everyone Next month will be the last meeting for the year and I'm once again looking for presenters. I can give a short introduction/show'n'tell of frp (fast reverse proxy) and what it can be used for: https://github.com/fatedier/frp Who else is willing to talk about something? It doesn't have to be admin-type stuff at all, but instead useful applications that you use/have come across. If you have something, even just for 5-10 min, please reply in this thread or contact me off-list. Have a great and safe weekend! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 2

Ask Slashdot: Why Is Firefox Losing Users?
by Peter Reutemann 05 Nov '21

05 Nov '21

'This weekend finds some long-time Slashdot readers debating why research shows Firefox losing market share. Long-time Slashdot reader chiguy shares one theory: "Firefox keeps losing users, according to this rant, because it arrogantly refuses to listen to its users." Slashdot reader BAReFO0t countered that that can't be the reason, "because Google does that too." (They blame Chrome's "feature" addition treadmill, where "they keep adding stupid kitchen sinks for the sole and only purpose to make others unable to keep up.") Long-time Slashdot reader Z00L00K thinks that "All those totally unnecessary UI changes are what REALLY annoys users. Not only the immediately visible things in the header but also the renaming of items in the menus just bugs people." But long-time Slashdot reader AmiMoJo argues that "the most popular browser, Chrome, has all those things. In fact all the browsers that are more popular than Firefox do, so the idea that those are unpopular and driving people away doesn't really hold up... Firefox's decline is mostly due to Chrome just being really good, and [Firefox] not having a decent mobile version." I'm still a loyal Firefox user. (Although the thing that annoyed me was when Firefox suddenly changed the keyboard shortcut for copying a link from CNTRL-A to CNTRL-L.) The "rant" at ItsFoss argues that Firefox's original sin was in 2009 when it decided to move tabs to the top of the browser, and when favorite features could no longer be re-enabled in Firefox's about:config file. But that's what I like about Firefox -- at it's best, it's ultimately customizable, with any feature you want easily enabled in what's essentially an incredibly detailed "preferences" menu. Maybe other browsers are just better at attracting new users through purely mechanical advantages like default placement on popular systems? Long-time Slashdot reader zenlessyank is also a long-time Firefox user -- "Been using it since Netscape" -- and countered all the doubters with a comment headlined "Firefox rocks!" "Doesn't matter to me how many other users there are or aren't I will still use it as long as it stays updated." But what are your thoughts? Feel free to share your own opinions and experiences with Firefox in the comments.' -- source: https://news.slashdot.org/story/21/09/12/181257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 7

The Booming Underground Market for Bots That Steal Your 2FA Codes
by Peter Reutemann 04 Nov '21

04 Nov '21

'The bots convincingly and effortlessly help hackers break into Coinbase, Amazon, PayPal, and bank accounts. From a report: The call came from PayPal's fraud prevention system. Someone had tried to use my PayPal account to spend $58.82, according to the automated voice on the line. PayPal needed to verify my identity to block the transfer. "In order to secure your account, please enter the code we have sent your mobile device now," the voice said. PayPal sometimes texts users a code in order to protect their account. After entering a string of six digits, the voice said, "Thank you, your account has been secured and this request has been blocked. Don't worry if any payment has been charged to your account: we will refund it within 24 to 48 hours. Your reference ID is 1549926. You may now hang up," the voice said. But this call was actually from a hacker. The fraudster used a type of bot that drastically streamlines the process for hackers to trick victims into giving up their multi-factor authentication codes or one-time passwords (OTPs) for all sorts of services, letting them log in or authorize cash transfers. Various bots target Apple Pay, PayPal, Amazon, Coinbase, and a wide range of specific banks. Whereas fooling victims into handing over a login or verification code previously would often involve the hacker directly conversely with the victim, perhaps pretending to be the victim's bank in a phone call, these increasingly traded bots dramatically lower the barrier of entry for bypassing multi-factor authentication.' -- source: https://yro.slashdot.org/story/21/11/03/1842245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft's Edge Browser for Linux is Now Available for All Users
by Peter Reutemann 03 Nov '21

03 Nov '21

'A year after releasing the first preview build of its Chromium-based Edge browser for Linux, Microsoft is announcing its general availability. From a report: The new release supports a variety of Linux distributions, including Ubuntu, Debian, Fedora and openSUSE. Microsoft announced Linux on Edge's availability milestone during the first day of its Ignite IT Pro conference. As of the release of Edge for Linux to the "stable" (mainstream user) channel, Edge is now available on Windows, Mac, iOS, Android and Linux. As it did when introducing the new Edge on macOS, Microsoft has been positioning Edge on Linux as more of an offering for IT pros and developers who want to test web sites than as a browser for "normal" users on those platforms. However, any user on any supported platform can use the new Edge.' -- source: https://linux.slashdot.org/story/21/11/02/1627250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1