- wlug - list.wlug.org.nz

Attackers Don't Bother Brute-forcing Long Passwords, Microsoft Engineer Says
by Peter Reutemann 23 Nov '21

23 Nov '21

'According to data collected by Microsoft's network of honeypot servers, most brute-force attackers primarily attempt to guess short passwords, with very few attacks targeting credentials that are either long or contain complex characters. From a report: "I analysed the credentials entered from over -- million brute force attacks against SSH. This is around 30 days of data in Microsoft's sensor network," said Ross Bevington, a security researcher at Microsoft. "77% of attempts used a password between 1 and 7 characters. A password over 10 characters was only seen in 6% of cases," said Bevington, who works as Head of Deception at Microsoft, a position in which he's tasked with creating legitimate-looking honeypot systems in order to study attacker trends.' -- source: https://it.slashdot.org/story/21/11/22/2036243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

GoDaddy Security Breach Exposes WordPress Users' Data
by Peter Reutemann 23 Nov '21

23 Nov '21

'Web hosting company GoDaddy said on Monday email addresses of up to 1.2 million active and inactive Managed WordPress customers had been exposed in an unauthorized third-party access. From a report: The company said the incident was discovered on Sept. 6 and the third-party accessed the system using a compromised password.' -- source: https://it.slashdot.org/story/21/11/22/1523234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A German State is Switching Its 25,000 Computers From Windows to Linux
by Peter Reutemann 22 Nov '21

22 Nov '21

'The north-German state of Schleswig-Holstein plans to switch to open source software..." reports Mike Saunders from LibreOffice. "By the end of 2026, Microsoft Office is to be replaced by LibreOffice on all 25,000 computers used by civil servants and employees (including teachers), and the Windows operating system is to be replaced by GNU/Linux." The tech site Foss Force writes: This seems to be a done deal, as the steps for the transition from proprietary to open have already been codified by the Schleswig-Holstein state parliament, and explained in plain language in an interview with Jan Philipp Albrecht, the state's digital minister, that was published in c't, a German language computer magazine (Google Translate version here). In the interview, Albrecht said that part of the transition to open source is already in the works, and pointed out that 90% of state administration conferencing is conducted using the open source video conferencing platform Jitsi. "We have been testing LibreOffice in our IT department for two years, and our experience is clear: it works," he said. "This also applies, for example, when editing Microsoft Word documents with comments... No Linux distribution has been chosen yet to use as a standard, although Albrecht said they're currently looking at five distributions that suit their purposes.' -- source: https://linux.slashdot.org/story/21/11/21/0231218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Thousands of Firefox Users Accidentally Commit Login Cookies On GitHub
by Peter Reutemann 19 Nov '21

19 Nov '21

'Thousands of Firefox cookie databases containing sensitive data are available on request from GitHub repositories, data potentially usable for hijacking authenticated sessions. The Register reports: These cookies.sqlite databases normally reside in the Firefox profiles folder. They're used to store cookies between browsing sessions. And they're findable by searching GitHub with specific query parameters, what's known as a search "dork." Aidan Marlin, a security engineer at London-based rail travel service Trainline, alerted The Register to the public availability of these files after reporting his findings through HackerOne and being told by a GitHub representative that "credentials exposed by our users are not in scope for our Bug Bounty program." Marlin then asked whether he could make his findings public and was told he's free to do so. "I'm frustrated that GitHub isn't taking its users' security and privacy seriously," Marlin told The Register in an email. "The least it could do is prevent results coming up for this GitHub dork. If the individuals who uploaded these cookie databases were made aware of what they'd done, they'd s*** their pants." Marlin acknowledges that affected GitHub users deserve some blame for failing to prevent their cookies.sqlite databases from being included when they committed code and pushed it to their public repositories. "But there are nearly 4.5k hits for this dork, so I think GitHub has a duty of care as well," he said, adding that he's alerted the UK Information Commissioner's Office because personal information is at stake. Marlin speculates that the oversight is a consequence of committing code from one's Linux home directory. "I imagine in most of the cases, the individuals aren't aware that they've uploaded their cookie databases," he explained. "A common reason users do this is for a common environment across multiple machines."' -- source: https://news.slashdot.org/story/21/11/18/2227206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Has a Serious Security Problem That Once Again Enables DNS Cache Poisoning
by Peter Reutemann 18 Nov '21

18 Nov '21

'As much as 38 percent of the Internet's domain name lookup servers are vulnerable to a new attack that allows hackers to send victims to maliciously spoofed addresses masquerading as legitimate domains, like bankofamerica.com or gmail.com. The exploit, unveiled in research presented today, revives the DNS cache-poisoning attack that researcher Dan Kaminsky disclosed in 2008. He showed that, by masquerading as an authoritative DNS server and using it to flood a DNS resolver with fake lookup results for a trusted domain, an attacker could poison the resolver cache with the spoofed IP address. >From then on, anyone relying on the same resolver would be diverted to the same imposter site. The sleight of hand worked because DNS at the time relied on a transaction ID to prove the IP number returned came from an authoritative server rather than an imposter server attempting to send people to a malicious site. The transaction number had only 16 bits, which meant that there were only 65,536 possible transaction IDs. Kaminsky realized that hackers could exploit the lack of entropy by bombarding a DNS resolver with off-path responses that included each possible ID. Once the resolver received a response with the correct ID, the server would accept the malicious IP and store the result in cache so that everyone else using the same resolver -- which typically belongs to a corporation, organization, or ISP -- would also be sent to the same malicious server.' -- source: https://linux.slashdot.org/story/21/11/17/1856235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

meeting next Monday
by Peter Reutemann 18 Nov '21

18 Nov '21

Hi everyone We have a WLUG meeting next week on Monday: 'For the last meeting of the year, let's have general get-together. Ian Stewart will demo the latest Ubuntu 21.10 and Peter Reutemann will try to show what you can use the frp fast reverse proxy for (https://github.com/fatedier/frp) And of course, general Linux related troubleshooting and questions answered.' -- source: https://www.meetup.com/WaikatoLinuxUsersGroup/events/274861098/ This is once again an online event, so make sure to RSVP on meetup to get the link (you only need a browser). Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Latency Numbers Every Programmer Should Know
by Lawrence D'Oliveiro 17 Nov '21

17 Nov '21

Somebody did a nice chart a while back <https://gist.github.com/hellerbarde/2843375> of the time it takes to perform many common data transfer operations on contemporary hardware. And note the multi-part figure, where the basic unit in each block is a bit more than an order of magnitude greater than the one in the previous block. And if the figure isn’t dramatic enough, a commenter has said “let’s multiply all the numbers by a billion” (just to bring them into more human-comprehensible scales), and then liken them to common things that people do, from making a cup of coffee, all the way up to completing a bachelor’s degree.

2 5

Scientists Send Data Using Nuclear Radiation
by Lawrence D'Oliveiro 16 Nov '21

16 Nov '21

A research group has used fast neutrons <https://www.theregister.com/2021/11/15/wireless_information_transfer_with_f…> as a communication channel, to send legible data between a transmitter and a receiver. Their proof of concept is very low-bandwidth and requires a lot of complicated equipment, but at least it does show (safety issues aside) that it is theoretically possible. The issue with high-energy subatomic particles is, how do you turn them on and off at will -- i.e. modulate the intensity of the beam to convey information? This group used some kind of shutter system (“neutron chopper”) in conjunction with some quantity of radioactive californium-252 as their neutron source. But they mention that someone else has come up with a device that is basically a particle accelerator on a chip, able to produce a stream of neutrons from non-radioactive starting components on demand.

1 0

Microsoft Fixes An Issue
by Lawrence D'Oliveiro 16 Nov '21

16 Nov '21

The latest Windows 11 update <https://www.theregister.com/2021/11/15/windows_11_insiders_bug_fixes/> gets ever closer to perfection. I like this one: We fixed an issue that prevents your device from starting up, and it becomes unresponsive because of licensing API calls. Because what would that good old “enrichment of the user experience” be like without licensing API calls ... The writer’s verdict on the new OS sounds more like damning with faint praise: We have been running Windows 11 for daily work since official release and are happy to report that it is usable and stable in our experience so far, though useful improvements over its predecessor are hard to identify.

1 0

DDR4 memory protections are broken wide open by new Rowhammer technique
by Peter Reutemann 16 Nov '21

16 Nov '21

'Rowhammer exploits that allow unprivileged attackers to change or corrupt data stored in vulnerable memory chips are now possible on virtually all DDR4 modules due to a new approach that neuters defenses chip manufacturers added to make their wares more resistant to such attacks. Rowhammer attacks work by accessing—or hammering—physical rows inside vulnerable chips millions of times per second in ways that cause bits in neighboring rows to flip, meaning 1s turn to 0s and vice versa. Researchers have shown the attacks can be used to give untrusted applications nearly unfettered system privileges, bypass security sandboxes designed to keep malicious code from accessing sensitive operating system resources, and root or infect Android devices, among other things. All previous Rowhammer attacks have hammered rows with uniform patterns, such as single-sided, double-sided, or n-sided. In all three cases, these “aggressor” rows—meaning those that cause bitflips in nearby “victim” rows—are accessed the same number of times. Research published on Monday presented a new Rowhammer technique. It uses non-uniform patterns that access two or more aggressor rows with different frequencies. The result: all 40 of the randomly selected DIMMs in a test pool experienced bitflips, up from 13 out of 42 chips tested in previous work from the same researchers.' -- source: https://arstechnica.com/gadgets/2021/11/ddr4-memory-is-even-more-susceptibl… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

topics for next month?
by Peter Reutemann 15 Nov '21

15 Nov '21

Hi everyone Next month will be the last meeting for the year and I'm once again looking for presenters. I can give a short introduction/show'n'tell of frp (fast reverse proxy) and what it can be used for: https://github.com/fatedier/frp Who else is willing to talk about something? It doesn't have to be admin-type stuff at all, but instead useful applications that you use/have come across. If you have something, even just for 5-10 min, please reply in this thread or contact me off-list. Have a great and safe weekend! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 2

Ask Slashdot: Why Is Firefox Losing Users?
by Peter Reutemann 05 Nov '21

05 Nov '21

'This weekend finds some long-time Slashdot readers debating why research shows Firefox losing market share. Long-time Slashdot reader chiguy shares one theory: "Firefox keeps losing users, according to this rant, because it arrogantly refuses to listen to its users." Slashdot reader BAReFO0t countered that that can't be the reason, "because Google does that too." (They blame Chrome's "feature" addition treadmill, where "they keep adding stupid kitchen sinks for the sole and only purpose to make others unable to keep up.") Long-time Slashdot reader Z00L00K thinks that "All those totally unnecessary UI changes are what REALLY annoys users. Not only the immediately visible things in the header but also the renaming of items in the menus just bugs people." But long-time Slashdot reader AmiMoJo argues that "the most popular browser, Chrome, has all those things. In fact all the browsers that are more popular than Firefox do, so the idea that those are unpopular and driving people away doesn't really hold up... Firefox's decline is mostly due to Chrome just being really good, and [Firefox] not having a decent mobile version." I'm still a loyal Firefox user. (Although the thing that annoyed me was when Firefox suddenly changed the keyboard shortcut for copying a link from CNTRL-A to CNTRL-L.) The "rant" at ItsFoss argues that Firefox's original sin was in 2009 when it decided to move tabs to the top of the browser, and when favorite features could no longer be re-enabled in Firefox's about:config file. But that's what I like about Firefox -- at it's best, it's ultimately customizable, with any feature you want easily enabled in what's essentially an incredibly detailed "preferences" menu. Maybe other browsers are just better at attracting new users through purely mechanical advantages like default placement on popular systems? Long-time Slashdot reader zenlessyank is also a long-time Firefox user -- "Been using it since Netscape" -- and countered all the doubters with a comment headlined "Firefox rocks!" "Doesn't matter to me how many other users there are or aren't I will still use it as long as it stays updated." But what are your thoughts? Feel free to share your own opinions and experiences with Firefox in the comments.' -- source: https://news.slashdot.org/story/21/09/12/181257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 7

The Booming Underground Market for Bots That Steal Your 2FA Codes
by Peter Reutemann 04 Nov '21

04 Nov '21

'The bots convincingly and effortlessly help hackers break into Coinbase, Amazon, PayPal, and bank accounts. From a report: The call came from PayPal's fraud prevention system. Someone had tried to use my PayPal account to spend $58.82, according to the automated voice on the line. PayPal needed to verify my identity to block the transfer. "In order to secure your account, please enter the code we have sent your mobile device now," the voice said. PayPal sometimes texts users a code in order to protect their account. After entering a string of six digits, the voice said, "Thank you, your account has been secured and this request has been blocked. Don't worry if any payment has been charged to your account: we will refund it within 24 to 48 hours. Your reference ID is 1549926. You may now hang up," the voice said. But this call was actually from a hacker. The fraudster used a type of bot that drastically streamlines the process for hackers to trick victims into giving up their multi-factor authentication codes or one-time passwords (OTPs) for all sorts of services, letting them log in or authorize cash transfers. Various bots target Apple Pay, PayPal, Amazon, Coinbase, and a wide range of specific banks. Whereas fooling victims into handing over a login or verification code previously would often involve the hacker directly conversely with the victim, perhaps pretending to be the victim's bank in a phone call, these increasingly traded bots dramatically lower the barrier of entry for bypassing multi-factor authentication.' -- source: https://yro.slashdot.org/story/21/11/03/1842245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft's Edge Browser for Linux is Now Available for All Users
by Peter Reutemann 03 Nov '21

03 Nov '21

'A year after releasing the first preview build of its Chromium-based Edge browser for Linux, Microsoft is announcing its general availability. From a report: The new release supports a variety of Linux distributions, including Ubuntu, Debian, Fedora and openSUSE. Microsoft announced Linux on Edge's availability milestone during the first day of its Ignite IT Pro conference. As of the release of Edge for Linux to the "stable" (mainstream user) channel, Edge is now available on Windows, Mac, iOS, Android and Linux. As it did when introducing the new Edge on macOS, Microsoft has been positioning Edge on Linux as more of an offering for IT pros and developers who want to test web sites than as a browser for "normal" users on those platforms. However, any user on any supported platform can use the new Edge.' -- source: https://linux.slashdot.org/story/21/11/02/1627250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

'Trojan Source' Bug Threatens the Security of All Code
by Peter Reutemann 02 Nov '21

02 Nov '21

'"Virtually all compilers -- programs that transform human-readable source code into computer-executable machine code -- are vulnerable to an insidious attack in which an adversary can introduce targeted vulnerabilities into any software without being detected," warns cybersecurity expert Brian Krebs in a new report. An anonymous reader shares an excerpt: Researchers with the University of Cambridge discovered a bug that affects most computer code compilers and many software development environments. At issue is a component of the digital text encoding standard Unicode, which allows computers to exchange information regardless of the language used. Unicode currently defines more than 143,000 characters across 154 different language scripts (in addition to many non-script character sets, such as emojis). Specifically, the weakness involves Unicode's bi-directional or "Bidi" algorithm, which handles displaying text that includes mixed scripts with different display orders, such as Arabic -- which is read right to left -- and English (left to right). But computer systems need to have a deterministic way of resolving conflicting directionality in text. Enter the "Bidi override," which can be used to make left-to-right text read right-to-left, and vice versa. "In some scenarios, the default ordering set by the Bidi Algorithm may not be sufficient," the Cambridge researchers wrote. "For these cases, Bidi override control characters enable switching the display ordering of groups of characters." Bidi overrides enable even single-script characters to be displayed in an order different from their logical encoding. As the researchers point out, this fact has previously been exploited to disguise the file extensions of malware disseminated via email. Here's the problem: Most programming languages let you put these Bidi overrides in comments and strings. This is bad because most programming languages allow comments within which all text -- including control characters -- is ignored by compilers and interpreters. Also, it's bad because most programming languages allow string literals that may contain arbitrary characters, including control characters. "So you can use them in source code that appears innocuous to a human reviewer [that] can actually do something nasty," said Ross Anderson, a professor of computer security at Cambridge and co-author of the research. "That's bad news for projects like Linux and Webkit that accept contributions from random people, subject them to manual review, then incorporate them into critical code. This vulnerability is, as far as I know, the first one to affect almost everything." The research paper, which dubbed the vulnerability "Trojan Source," notes that while both comments and strings will have syntax-specific semantics indicating their start and end, these bounds are not respected by Bidi overrides. [...] Anderson said such an attack could be challenging for a human code reviewer to detect, as the rendered source code looks perfectly acceptable. "If the change in logic is subtle enough to go undetected in subsequent testing, an adversary could introduce targeted vulnerabilities without being detected," he said. Equally concerning is that Bidi override characters persist through the copy-and-paste functions on most modern browsers, editors, and operating systems.' -- source: https://it.slashdot.org/story/21/11/01/2147254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi Zero 2 W: 5x faster than the original for $5 more
by Peter Reutemann 01 Nov '21

01 Nov '21

'The diminutive Raspberry Pi Zero is getting its first upgrade in nearly five years. Today, Raspberry Pi founder Eben Upton announced the Raspberry Pi Zero 2 W, a new $15 product that puts the processor from the Raspberry Pi 3 into a board the exact same size as the original Zero. The new board swaps the old Zero's 1 GHz single-core ARM11 processor for a quad-core Cortex A53-based Broadcom BCM2710A1 processor, also clocked at 1 GHz—the same processor used in the original Raspberry Pi 3 released back in 2016, albeit clocked slightly lower. This is a substantial increase in power and capability for the Pi Zero, going from one core to four and from 32 bits to 64. Upton said that the performance increase over the original Zero "varies across workloads" but that for multithreaded tasks like those simulated by sysbench, "it is almost exactly five times faster." Heat dissipation is provided by "thick internal copper layers" in the board, which should help prevent thermal throttling without the use of additional fans or heatsinks.' -- source: https://arstechnica.com/gadgets/2021/10/raspberry-pi-zero-2-w-crams-pi-3-pa… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Newly-Discovered 'AbstractEmu' Malware Rooted Android Devices, Evaded Detection
by Peter Reutemann 01 Nov '21

01 Nov '21

'"New Android malware can root infected devices to take complete control and silently tweak system settings, as well as evade detection using code abstraction and anti-emulation checks," reports BleepingComputer. Cybersecurity company Lookout said on its blog that they'd spotted the malware on Google Play "and prominent third-party stores such as the Amazon Appstore and the Samsung Galaxy Store.... To protect Android users, Google promptly removed the app as soon as we notified them of the malware." We named the malware "AbstractEmu" after its use of code abstraction and anti-emulation checks to avoid running while under analysis. A total of 19 related applications were uncovered, seven of which contain rooting functionality, including one on Play that had more than 10,000 downloads... This is a significant discovery because widely-distributed malware with root capabilities have become rare over the past five years. As the Android ecosystem matures there are fewer exploits that affect a large number of devices, making them less useful for threat actors... By using the rooting process to gain privileged access to the Android operating system, the threat actor can silently grant themselves dangerous permissions or install additional malware — steps that would normally require user interaction. Elevated privileges also give the malware access to other apps' sensitive data, something not possible under normal circumstances... AbstractEmu does not have any sophisticated zero-click remote exploit functionality used in advanced APT-style threats, it is activated simply by the user having opened the app. As the malware is disguised as functional apps, most users will likely interact with them shortly after downloading... By rooting the device, the malware is able to silently modify the device in ways that would otherwise require user interaction and access data of other apps on the device. "Apps bundling the malware included password managers and tools like data savers and app launchers," reports BleepingComputer, "all of them providing the functionality they promised to avoid raising suspicions..." Lookout's blog post said they'd spotted people affected by the malware in 17 different countries.' -- source: https://it.slashdot.org/story/21/10/31/1253225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Sprite Fright: Not Your Father’s Blender Open Movie
by Lawrence D'Oliveiro 31 Oct '21

31 Oct '21

The latest short feature from the Blender Studio is now out <https://www.blender.org/>. While past efforts have had the occasional sombre, not to say dark, elements, this one just takes the darkness to the next level. It’s an out-and-out horror story, with overtones of environmental retribution in its plot. Carnage, gore, deaths, and just plain ickiness in full measure, packed into a mere 10 minutes. I just hope the script writer is getting therapy ...

1 0

Protonmail Celebrates Swiss Court Victory Exempting it From Telco Data Retention Laws
by Peter Reutemann 28 Oct '21

28 Oct '21

'Encrypted email provider Protonmail has hailed a recent Swiss legal ruling as a "victory for privacy," after winning a lawsuit that sees it exempted from data retention laws in the mountainous realm. From a report: Referring to a previous ruling that exempted instant messaging services from data capture and storage laws, the Protonmail team said this week: "Together, these two rulings are a victory for privacy in Switzerland as many Swiss companies are now exempted from handing over certain user information in response to Swiss legal orders." Switzerland's Federal Administrative Court ruled on October 22 that email providers in Switzerland are not considered telecommunications providers under Swiss law, thereby removing them from the scope of data retention requirements imposed on telcos. The victory comes after controversy over a previous (and not directly related) Swiss court order that forced the company to collect mobile device push notification identifiers from a specified user's account. That user was later arrested by French police, who had asked their Swiss counterparts to obtain the surveillance order. Protonmail chief exec Andy Yen told The Register his business doesn't routinely collect such data on its users.' -- source: https://yro.slashdot.org/story/21/10/27/147224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel Core i9 11900K: Five Linux Distros Show Sizable Lead Over Windows 11
by Peter Reutemann 28 Oct '21

28 Oct '21

'Phoronix: Now that Windows 11 has been out as stable and the initial round of updates coming out, I've been running fresh Windows 11 vs. Linux benchmarks for seeing how Microsoft's latest operating system release compares to the fresh batch of Linux distributions. First up is the fresh look at the Windows 11 vs. Linux performance on an Intel Core i9 11900K Rocket Lake system. Microsoft Windows 11 Pro with all stable updates as of 18 October was used for this round of benchmarking on Intel Rocket Lake. The Windows 11 performance was being compared to all of the latest prominent Linux distributions, including: Ubuntu 20.04.3 LTS, Ubuntu 21.10, Arch Linux (latest rolling), Fedora Workstation 35, Clear Linux 35150. All the testing was done on the same Intel Core i9 11900K test system at stock speeds (any frequency differences reported in the system table come down to how the information is exposed by the OS, i.e. base or turbo reporting) with 2 x 16GB DDR4-3200 memory, 2TB Corsair Force MP600 NVMe solid-state drive, and an AMD Radeon VII graphics card. Each operating system was cleanly installed and then run at its OS default settings for seeing how the out-of-the-box OS performance compares for these five Linux distributions to Microsoft Windows 11 Pro. But for the TLDR version... Out of 44 tests run across all six operating systems, Windows 11 had just three wins on this Core i9 11900K system. Meanwhile Intel's own Clear Linux platform easily dominated with coming in first place 75% of the time followed by Fedora Workstation 35 in second place with first place finishes 9% of the time. The geometric mean for all 44 tests showed Linux clearly in front of Windows 11 for this current-generation Intel platform. Ubuntu / Arch / Fedora were about 11% faster overall than Windows 11 Pro on this system. Meanwhile, Clear Linux was about 18% faster than Windows 11 and enjoyed about 5% better performance overall than the other Linux distributions.' -- source: https://linux.slashdot.org/story/21/10/27/1625217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Setback for Nvidia's $54 Billion ARM Bid as EU Regulators Open Probe
by Peter Reutemann 28 Oct '21

28 Oct '21

'Nvidia suffered a setback on Wednesday as EU antitrust regulators opened a full-scale investigation into its $54 billion bid for British chip designer ARM on concerns the deal could lead to higher prices, less choice and reduced innovation. From a report: Britain's competition agency is also probing the deal for the country's most important technology company, warning that it could damage competition and weaken rivals. Reuters reported the European Commission viewed as insufficient concessions offered by the world's biggest maker of graphics and artificial intelligence (AI) chips during its preliminary review. Nvidia has not disclosed what these are but it has previously said it would maintain ARM as a neutral technology supplier to sooth concerns from customers such as Qualcomm, Samsung and Apple. The Commission said it would decide by March 15 whether to clear or block the deal. "Whilst Arm and Nvidia do not directly compete, Arm's IP is an important input in products competing with those of Nvidia, for example in datacentres, automotive and in Internet of Things," EU competition chief Margrethe Vestager said in a statement.' -- source: https://slashdot.org/story/21/10/27/1648229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android's 12L Feature Drop Aims To Be a Big Improvement for Folding Phones
by Peter Reutemann 28 Oct '21

28 Oct '21

'At this year's Android Dev Summit, Google announced an upcoming update for devices with larger screens, which includes tablets, foldables, and devices that run ChromeOS. From a report: Google is calling the update 12L, and it's supposed to make Android 12 run smoother on big screens. We first heard the possibility of a "12.1" update in late September, and it looks like many of the rumored features are true. 12L optimizes the layout of a device's UI, adjusting the placement of the home screen, lock screen, notifications, Quick Settings, and more. Google notes that any screen 600 density-independent pixels (dp) and above will display a two-column layout that makes use of the entire screen. In the example Google shows, the Quick Settings menu is pushed towards the left side of the screen, while the notifications panel is locked to the right, giving you the ability to access both simultaneously -- all without opening one app and closing another. 12L also introduces a new taskbar that makes it easier for users to quickly switch between different apps. Dragging and dropping an app from the taskbar opens it up in split-screen mode, which Google notes it has enabled for all apps, whether they're resizable or not.' -- source: https://tech.slashdot.org/story/21/10/27/1821200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Trying To Cripple Its Own Open-Source Project
by Lawrence D'Oliveiro 23 Oct '21

23 Oct '21

Microsoft is trying to remove a feature called “Hot Reload” from Dotnet, saying it is something that should only be available through Visual Studio <https://www.theregister.com/2021/10/22/microsoft_net_hot_reload_visual_stud…>. Trouble is, this is the (supposedly) Open-Source version of Dotnet. And you do not take away useful features from Open-Source projects. You can do that to proprietary products, where the users have no choice but to put up with it. As of this writing, the commit that removes the feature has already been merged, but a follow up request to revert that change, while gathering a lot of support, has not been accepted into the official code base yet. As one of the commenters says: “This is the PR that is truly going to decide .NET is really an OSS or not!”. This is just one in a long line of incidents <https://www.theregister.com/2021/10/18/net_foundation_gnome/> casting doubt on the independence of Dotnet as an Open-Source project.

1 0

App Telemetry For Developers
by Lawrence D'Oliveiro 23 Oct '21

23 Oct '21

Here’s an interesting idea <https://www.theregister.com/2021/10/22/new_relic_codestream/>: if an app should crash during a production run, it can send telemetry data back to the developer providing some program state and pinpointing exact locations in the source code. This is done using eBPF (Extended Berkeley Packet Filter), which is able to collect information about running applications with minimal impact. You thought packet-filtering was only about managing network activity, but no, it is more useful than that. Yes, there is potential for this sort of thing to be misused, if it is not correctly managed. With great power comes great responsibility etc. By the way, while eBPF may have its roots in the older BPF as found in the BSDs, it is nevertheless a Linux-only technology <https://ebpf.io/>. Though Microsoft is trying to port some parts of it to Windows <https://cloudblogs.microsoft.com/opensource/2021/05/10/making-ebpf-work-on-…>.

1 0

GPSD Bug Will Switch Your Time-Keeping Systems To March 2002 This Weekend, Unless You Update
by Peter Reutemann 22 Oct '21

22 Oct '21

'"Apparently a bug in GPSD, the daemon responsible for deriving time from the GPS system, is going to trigger on October 24, 2021, jumping the time back to March of 2002," writes Slashdot reader suutar. "There's a fix that's been committed since August, but of course not everything is up to date." ZDNet's Steven J. Vaughan-Nichols writes: This will be ugly. Or, as Stephen Williams, who uncovered the bug put it, "I have a feeling that there will be some 'interesting moments' in the early morning when a bunch of the world's stratum 1 NTP servers using GPSD take the long strange trip back to 2002." GPSD maintainer Gary E. Miller has acknowledged the problem, and a fix has been made to the code. To be exact, the fix is in August 2021's GPSD 3.23 release. So, what's the problem if the fix is already in? Well, there are two problems. First, it won't be backported to previous releases. If you're still using an older version, you may be out of luck. Second, as Miller observed, not all distros "pick up GPSD updates or upstream their patches. [This] is a very sore spot with me." So, just because your operating system is up to date does not mean that it will have the necessary GPSD fix. Miller suggests that you check it and do it yourself: "I [am] gonna fall back on Greg K_H's dictum: All users must update." Oh, wondering what the mysterious root cause of all this commotion GPS Week Rollover? It's a legacy GPS problem. The GPS signal GPS week number uses a 10-bit code with a maximum value of 1,023. This means every 19.7 years; the GPS week number rolls over to zero. Or, as Miller noted, "This code is a 1024 week time warp waiting to happen." So, check your systems now for this problem. And, if, like most of us, you're relying on someone upstream from you for the correct time, check with them to make sure they've taken care of this forthcoming trouble.' -- source: https://it.slashdot.org/story/21/10/21/2053248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Software Freedom Conservancy Sues Vizio for GPL Violations
by Peter Reutemann 21 Oct '21

21 Oct '21

'Jeremy Allison - Sam writes: Software Freedom Conservancy, a non-profit organization that promotes open-source software and defends the free software General Public License (GPL), announced today it has filed a lawsuit against Vizio for what it calls repeated failures to fulfill even the basic requirements of the GPL. The lawsuit alleges that Vizio's TV products, built on its SmartCast system, contain software that Vizio unfairly appropriated from a community of developers who intended consumers to have very specific rights to modify, improve, share, and reinstall modified versions of the software.' -- source: https://yro.slashdot.org/story/21/10/19/2043203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Intel Versus The Chip Foundries
by Lawrence D'Oliveiro 21 Oct '21

21 Oct '21

Nice backgrounder <https://arstechnica.com/tech-policy/2021/10/intel-slipped-and-its-future-no…> on how Intel (and American chipmakers generally) slipped from their leadership position by overlooking an important new business: manufacturing chips according to other people’s designs. We’ve all heard of Taiwan-based TSMC, which is the world leader in this area; when it was founded way back in 1987 (with help from the Taiwanese Government and from Philips), none of the US companies would take such an idea seriously. They didn’t think it would amount to a very profitable business, and anyway they wanted to control their own Intellectual Property. Plus, a company that made chips both for its own internal businesses and for others could never be seen to be entirely above accusations of conflict of interest. Note also the role played by Carver Mead, basically the father of the whole concept of RISC. He wanted a place to go to, where his students (and those of other teachers) could get their designs turned into actual working chips. He had special personal connections with Intel to get access to their fabs, but he knew others were not so lucky. So he played an influential part in getting TSMC started.

1 0

Google Removes Support for FTP and Old-gen U2F Security Keys in Chrome 95
by Peter Reutemann 21 Oct '21

21 Oct '21

'Google today released Chrome v95, the latest version of its popular web browser and a version that contains several changes that will likely cause problems for a considerable part of its users. The problematic changes include: removing support for File Transfer Protocol (FTP) URLs -- ftp:// removing support for the Universal 2nd Factor (U2F) standard, used in old-generation security keys (Chrome will only support FIDO2/WebAuth security keys going forward) adding file size limits for browser cookies removing support for URLs with non-IPv4 hostnames ending in numbers, such as http://example.0.1 In addition to breaking changes, Chrome 95 also comes with a new UI component called the "Side Panel," which can be used to view the Chrome browser's Reading List and Bookmarks.' -- source: https://tech.slashdot.org/story/21/10/20/206210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Supply chain woes lead to a “temporary” Raspberry Pi 4 price hike
by Peter Reutemann 21 Oct '21

21 Oct '21

'Pandemic-driven supply chain problems have prompted the first-ever price increase for a Raspberry Pi product, according to Raspberry Pi founder Eben Upton. Acknowledging that the 2GB configuration of the Raspberry Pi 4 and the Raspberry Pi Zero had been particularly hard-hit by shortages, Upton announced that the price of the 2GB Pi 4 would increase from $35 to $45 and that a previously discontinued version of the Pi 4 with 1GB of RAM would be reintroduced at $35.' -- source: https://arstechnica.com/gadgets/2021/10/supply-chain-woes-lead-to-a-tempora… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Linux laptop offers RTX 3080 and 144 Hz 17-inch screen
by Peter Reutemann 20 Oct '21

20 Oct '21

'Linux users like to game, too, and the Juno Neptune 17-inch V3 laptop announced this week ensures that people on Ubuntu can play their favorite titles on the go. Keeping up with the Alienwares, Asus ROGs, and other Windows-focused gaming brands, the new portable packs up to an RTX 3080 discrete graphics card and the 8-core Intel Core i7-11800H. And it lets you experience all the action on a spacious, 17.3-inch screen with a 144 Hz refresh rate. A colorfully backlit keyboard completes the package.' -- source: https://arstechnica.com/gadgets/2021/10/new-linux-laptop-offers-rtx-3080-an… Well, if you have a spare USD3,699, then the maxed out version can be yours... ;-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Brave Removes Google as its Default Search Engine
by Peter Reutemann 20 Oct '21

20 Oct '21

'As Paul Thurrott reports, Brave is removing Google Search as its default search engine. From the report: Going forward, the Brave web browser will default to Brave Search. "Brave Search has grown significantly since its release last June, with nearly 80 million queries per month," Brave CEO and co-founder Brendan Eich says. "Our users are pleased with the comprehensive privacy solution that Brave Search provides against Big Tech by being integrated into our browser. As we know from experience in many browsers, the default setting is crucial for adoption, and Brave Search has reached the quality and critical mass needed to become our default search option, and to offer our users a seamless privacy-by-default online experience." Brave Search is built on top of an independent index, and doesn't track users, their searches, or their clicks, the firm says. And starting with Brave 1.3 on desktop and Android, and Brave 1.32 on iOS, it will be the default search engine in the browser, instead of Google, in the United States, Canada, and the United Kingdom. It is also replacing Qwant in France and DuckDuckGo in Germany, and Brave says that more locales will be added in the next several months. Existing users can keep their chosen search engine default, of course, and new users who prefer other search engines can configure as needed. Brave Search doesn't display ads today, but the free version of the service will soon be ad-supported. An ad-free Premium version is coming "in the near future," Brave says. Along with this search engine news, Brave announced the Web Discovery Project (WDP), "which it describes as a privacy-preserving system for users to anonymously contribute data to improve Brave Search results," writes Thurrott. "The WDP is an opt-in feature that protects user privacy and anonymity by ensuring that contributed data is not linked to individuals, their devices, or any set of users." It has a GitHub repo available to help you learn more about this system.' -- source: https://tech.slashdot.org/story/21/10/19/2121251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

(virtual) meeting next Monday
by Peter Reutemann 19 Oct '21

19 Oct '21

Hi everyone We have a meeting coming up next week. Due to the small venue size, we will still hold it in a virtual manner, even if Hamilton should go back to level 2 (though we will record it): 'Peter Reutemann will demo Syncthing (https://syncthing.net/) a continuous file synchronization program. It synchronizes files between two or more computers in real time, respecting your privacy. Runs on Linux, Windows, Mac and Android among other platforms.' Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/274861093/ You will get access to the meeting link when RSVPing on meetup. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Quote Of The Week
by Lawrence D'Oliveiro 18 Oct '21

18 Oct '21

From <https://arstechnica.com/gadgets/2021/10/fixes-for-amd-ryzen-performance-oth…>: Now that Windows 11 is out, the arduous process of fixing the new operating system's bugs can begin. So goodbye Windows 10, no PrintNightmare fix for you...

1 0

PowerPC Fork of Firefox Reaches End of the Road
by Peter Reutemann 15 Oct '21

15 Oct '21

'Ars Technica: It has been well over a decade since PowerPC Macs roamed the earth -- so long that the Intel Macs that replaced them are themselves being replaced by something else. But to this day, there's a small community of people still developing software for PowerPC Macs and Mac OS 9. One of those projects was TenFourFox, a fork of the Firefox browser for G3, G4, and G5-based PowerPC Macs running Mac OS X 10.4 or 10.5. Maintained primarily by Cameron Kaiser, the TenFourFox project sprang up in late 2010 after Mozilla pulled PowerPC support from Firefox 4 during its development. And amazingly, the browser has continued to trundle on ever since. But continuing to backport Firefox features to aging, stuck-in-time PowerPC processors only got more difficult as time went on. And in March of this year, Kaiser announced that TenFourFox updates would be ending after over a decade of development. The final planned release of TenFourFox was earlier this month. Kaiser's full post is long, but it's worth a read for vintage-computer enthusiasts or anyone who works on software -- Kaiser expresses frustration with the realities of developing and supporting a niche app, but he also highlights TenFourFox's impressive technical achievements and ruminates on the nature of the modern Internet and open source software development [...]. Kaiser doesn't intend to fully halt work on the browser, but he is downshifting it into what he calls "hobby mode." He will continue to backport security patches from newer ESR releases of Firefox and post them to the TenFourFox Github page, but anyone who wants to use these will need to build the app themselves. Kaiser also won't commit to providing support for these additions or providing them on any kind of schedule. Other developers are also welcome to continue to release TenFourFox builds on their own. ' -- source: https://news.slashdot.org/story/21/10/14/2116255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Modular Framework Laptop Gets Marketplace For All Those Modules
by Peter Reutemann 15 Oct '21

15 Oct '21

'Framework, makers of the modular 13.5-inch Framework laptop that's designed to be easily repaired and upgraded, has launched a dedicated marketplace filled with replacement parts and upgrades for its portable computer. The Verge reports: Writing in a blog post, the company said the marketplace is currently focused on replacement parts and expansion cards, but that it hopes to add more customization modules like additional language keyboards later this year, as well as third-party and community developed modules in 2022. The marketplace already includes a range of expansion cards for the laptop, which are designed to slot into its four modular compartments to add everything from extra storage to features like MicroSD card slots or more USB ports. There's also user upgradeable RAM and storage for sale. But the store is clearly a work in progress, and lists a host of other items like replacement CPU-equipped mainboards, keyboards, and spare parts like batteries and displays as "coming soon." ' -- source: https://hardware.slashdot.org/story/21/10/14/2110258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

OpenBSD 7.0 Released
by Peter Reutemann 15 Oct '21

15 Oct '21

'Everyone's favorite security-focused operating system, OpenBSD, released version 7.0 today. In addition to the usual bug fixes and performance enhancements, support for RISC-V processors has been added. The changelog and mirrors can be found at their respective links.' -- source: https://bsd.slashdot.org/story/21/10/14/217206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Canonical Releases Ubuntu Linux 21.10 Impish Indri
by Peter Reutemann 15 Oct '21

15 Oct '21

'Following a brief beta-testing period, Ubuntu 21.10 has finally become available to download in the "final" stable form. BetaNews: Code-named "Impish Indri," this version of Ubuntu is not a Long Term Support (LTS) version, so it is only supported for nine months. Ubuntu 21.10 features Linux kernel 5.13 and a Snap variant of the Mozilla Firefox browser. "Ubuntu 21.10 brings the all-new PHP 8 and GCC 11 including full support for static analysis, greatly improving everyday developer security awareness in low-level programming. With Gnome 40 desktop users gain dynamic workspaces and touchpad gestures. The new Firefox snap, published by Mozilla, improves security and guarantees access to both the latest and the extended support release versions of the browser. The exact same versions of the browser are available on multiple different versions of Ubuntu, simplifying enterprise developer platform management," says Canonical.' -- source: https://linux.slashdot.org/story/21/10/14/2013235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

LibreOffice, OpenOffice Bug Allows Hackers To Spoof Signed Docs
by Peter Reutemann 12 Oct '21

12 Oct '21

'LibreOffice and OpenOffice have pushed updates to address a vulnerability that makes it possible for an attacker to manipulate documents to appear as signed by a trusted source. Although the severity of the flaw is classified as moderate, the implications could be dire. BleepingComputer reports: The discovery of the flaw, which is tracked as CVE-2021-41832 for OpenOffice, was the work of four researchers at the Ruhr University Bochum. The same flaw impacts LibreOffice, which is a fork of OpenOffice spawned from the main project over a decade ago, and for their project is tracked as CVE-2021-25635. If you're using either of the open-source office suites, you're advised to upgrade to the latest available version immediately. For OpenOffice, that would be 4.1.10 and later, and for LibreOffice, 7.0.5 or 7.1.1 and later. Since neither of these two applications offer auto-updating, you should do it manually by downloading the latest version from the respective download centers -- LibreOffice, OpenOffice. If you're using Linux and the aforementioned versions aren't available on your distribution's package manager yet, you are advised to download the "deb", or "rpm" package from the Download center or build LibreOffice from source. If updating to the latest version is not possible for any reason, you can always opt to completely disable the macro features on your office suite, or avoid trusting any documents containing macros. ' -- source: https://it.slashdot.org/story/21/10/11/212215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New 'FontOnLake' Malware Family Can Target Linux Systems
by Peter Reutemann 11 Oct '21

11 Oct '21

'Security Week reports: A previously unknown, modular malware family that targets Linux systems has been used in targeted attacks to collect credentials and gain access to victim systems, ESET reported on Thursday. Dubbed FontOnLake, the malware family employs a rootkit to conceal its presence and uses different command and control servers for each sample, which shows how careful its operators are to maintain a low profile. What's more, the malware developers are constantly modifying the FontOnLake modules, and use three categories of components that have been designed to work together, namely trojanized applications, backdoors, and rootkits. Evidence suggests that FontOnLake has been used in attacks aimed at organizations in Southeast Asia. The first malware samples related to this family emerged last May. The malware was previously described by Avast and Lacework as the HCRootkit / Sutersu Linux rootkit, as well as by Tencent Security Response Center in a February report. The various trojanized applications that ESET's researchers have identified during their investigation are used to load custom backdoor or rootkit modules, but also to collect sensitive data when needed. Posing as standard Linux utilities, these files were also designed to achieve persistence on the compromised systems. What the researchers haven't figured out yet is the manner in which the trojanized applications are delivered to the victims. ESET's analysis of FontOnLake has revealed the use of three different backdoors, all written in C++, all using the same Asio library from Boost, and all capable of exfiltrating sshd credentials and bash command history. The simplest of the three was designed to launch and mediate access to a local SSH server, update itself, and transmit collected credentials. The malware appears to be under development. The second backdoor was also capable of file manipulation, updating itself, and uploading and downloading files, according to the article, while the third backdoor "accepts remote connections, serves as a proxy and can download and run Python scripts, in addition to exfiltrating credentials."' -- source: https://linux.slashdot.org/story/21/10/10/000240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

All Linux and Mac Computers Get Their Time Zones From the Same Database
by Peter Reutemann 11 Oct '21

11 Oct '21

'"All Linux and Mac-based computers pull their time zones from a massively important database — the time zone database," explains Medium's tech site OneZero. And this vastly crucial project is ultimately overseen by one man who Medium calls "The Time Zone King." The process of defining time zones is centralized. This is actually quite a big deal in its own right because people tend to grossly underestimate how pivotal Linux is to ... the entire internet and technology as we know it... The time zone database — which is sometimes called the Olson data or zoneinfo database — has a fascinating history... Not only are time zones apparently a longstanding menace for computer developers, but the time zone maintenance community is currently, it seems, mired among some procedural dispute regarding how this essential database should best be maintained. Of course that's an interesting fact in its own right: there is a world time zone data community. In fact, The Register recently described them as being no less than " up in arms " about the direction the project was proceeding down... A difference of vision among time zone enthusiasts might be the neatest summary anybody can advance.... Not only can't the time zone titans currently agree on the best way to carry the timezone database forward, it seems. But the entire process of codifying and standardizing time zones is also decidedly contentious political business with a long and tumultuous history to go with it. Those who enter the fray need to be therefore not only technical heavyweights but also prepared to have the occasional audacity to stand up to countries like the Hashemite Republic of Jordan and tell them that their attempt to prematurely end DST is unacceptable and will not be promulgated in the database... Weary time zone mavericks are bursting to the seams with horror stories of African states who made rash time zone decisions on only four days' notice... Time zone data insiders say that every single one of these high stakes deliberations represents a near Y2K disaster that must be averted... At the helm of this project is one individual. One guy. Paul Eggert, a computer scientist who teaches at the Department of Computer Science at the University of California's LA Campus... This is a man, after all, whose codebase helps hundreds of millions of users know what time zone they're in and who — for the past ten years — has gone to bed knowing that hundreds of millions of computers are using his code to know what time zone they're in. He's lived under that pressure for over a decade. And by all accounts thrived... Untold millions have been made by startups announcing dubious advents upon existing technologies heralded with the breathless fanaticism of companies announcing that they have found a way to turn air water into oil. Many of these will vanish into oblivion within a few short years. The time zone database won't. Because it can't. And those at the very bottom of the tech stack — those tirelessly and thanklessly maintaining open source projects upon which so much of the world's computing derives — languish in comparable obscurity... In recent years, the project has fallen under the purview of ICANN [through its Internet Assigned Numbers Authority]. Its code reads like a cross between a JSON file and a historical novel. And while I'm sure the project has many noteworthy contributors, there's ultimately one guy who's responsible for maintaining it. The Time Zone King. His name is Paul Eggert. And he's a computer scientist based out of UCLA. We probably all owe him a 'thank you'.' -- source: https://tech.slashdot.org/story/21/10/10/1950239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

I can't log into trademe and entering an URL dosen't work
by Michelle 10 Oct '21

10 Oct '21

Hi, I bought on disc the new version of Manjaro Plasma 64 bit KDE because the old Manjaro Illyria 18.0 64 bit I was using stopped working with various things. The new one won't allow me to log into tradme. I enter my email and password and it won't work just like the old one wouldn't. Plasma allows me to see pictures on tumblr whereas the old one stopped allowing that about 2 months ago. And youtube still works. But the new one has another big problem. For security issues I run a computer off a DVD and have no hard drive. When I want to go into any site that requires a password like email or trademe, this is what I do. I boot up, I pull up firefox, I type in the URL for trademe or what have you, and press enter, then and only then do I connect to the internet and click to 'retry' that site and then once at the site the first thing I do is log in. But this new Plasma won't allow me to do that. So could I please have some suggestions for two things: How to make this new one work in those two circumstances AND/OR Some specific names of Operating Systems that will actually allow logging into trademe and will allow URL's to be typed in. Thanks for any help.

3 11

Firefox Now Sends Your Address Bar Keystrokes To Mozilla
by Peter Reutemann 10 Oct '21

10 Oct '21

'How-To Geek reports: Firefox now sends more data than you might think to Mozilla. To power Firefox Suggest, Firefox sends the keystrokes you type into your address bar, your location information, and more to Mozilla's servers. Here's exactly what Firefox is sharing and how to control it. This change was made as part of the introduction of Firefox Suggest in Firefox 93, released on October 5, 2021. As part of Firefox Suggest, Firefox is getting ads in your search bar -- but that's not the only thing that will be news to longtime Firefox users. According to Mozilla, "Firefox Suggest acts as a trustworthy guide to the better web, surfacing relevant information and sites to help people accomplish their goals." In reality, what that means is, when you start typing in your address bar, you won't just see the standard search suggestions from Google or your current search default engine. You'll also see "Firefox Suggest" results pointing to web pages. Some of them are sponsored ads, but you can disable the ads. Firefox Suggest is on by default. Mozilla's blog post on the subject says Firefox Suggest is an "opt-in experience," which was the case in September 2021 -- but it's now enabled by default in Firefox 93. However, as of Firefox 93's release in October 2021, Firefox Suggest is only enabled in the USA -- for now. It's worth noting that, for many years, Firefox and other web browsers have had search suggestions in their address bar. So, when you start typing "win" in your address bar, you may see suggestions for "Windows 11" and "Window repair." This is accomplished by sending keystrokes to your default search engine as you type in the search bar, as Mozilla's support site explains. Mozilla is also providing contextual suggestions, for which it needs more data, including the city you're located in and whether you're clicking its suggestions. You can disable Firefox's suggested results, if you like. This will stop Mozilla from collecting the data you type in your search bar, and it will also disable the suggested results and ads. To do so, open Firefox and click menu [and then] Settings. Select "Privacy [and] Security" in the left pane, and scroll down to "Address Bar -- Firefox Suggest." Disable "Contextual suggestions" and "Include occasional sponsored suggestions" to stop Firefox from sending data to Mozilla.' -- source: https://news.slashdot.org/story/21/10/08/2225217 I saw that "Firefox suggest" popping up with the latest 93 as well and, when I tried to turn it off, didn't find the "Firefox suggest" option in the settings dialog that got mentioned in various articles. Something that p...ed me off somewhat... However, looking through the slashdot comments, I came across this github gist called "Silent Firefox": https://gist.github.com/AetherEternity/5a6bb6e493a3d34988fc7342013f2ea6 The top of the file lists where to place this "user.js" file. NB: You might already have such a file, so check before you overwrite it... Personally, I like suggestions from my history (which is turned off in this gist, key: "browser.urlbar.suggest.history"), so I forked the gist and enabled it: https://gist.github.com/fracpete/408ce83d3ce48f9f95b2fea30ddf5403 I'm not particularly fond of this move by Mozilla, but at least you can still tweak its browser (though it's become harder for non-technical people). Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Now Shows Ads As Sponsored Address Bar Suggestions
by Peter Reutemann 08 Oct '21

08 Oct '21

'Mozilla is now showing ads in the form of sponsored Firefox contextual suggestions when U.S. users type in the URL address bar. Mozilla says the feature was introduced with Firefox 92 in September to fund development and optimization. Mozilla describes Firefox Suggest contextual suggestions as opt-in, in BleepingComputer's tests and from what users have reported, the feature is on by default. Furthermore, Firefox doesn't tag the ads displayed via Firefox Suggest. There is no clear way to identify what a sponsored suggestion and what a regular unsponsored suggestion should look like. The only way Firefox users will know whether a sponsored suggestion is an ad would be by looking at the URL, but, in many cases, the URL is not clearly visible.' -- source: https://news.slashdot.org/story/21/10/07/1844254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apache Fixes Actively Exploited Web Server Zero-day
by Peter Reutemann 06 Oct '21

06 Oct '21

'The Apache Software Foundation has released a security patch to address a vulnerability in its HTTP Web Server project that has been actively exploited in the wild. From a report: Tracked as CVE-2021-41773, the vulnerability affects only Apache web servers running version 2.4.49 and occurs because of a bug in how the Apache server converts between different URL path schemes (a process called path or URI normalization). "An attacker could use a path traversal attack to map URLs to files outside the expected document root," the ASF team said in the Apache HTTP Server 2.4.50 changelog. "If files outside of the document root are not protected by 'require all denied' these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts," Apache engineers added. More than 120,000 servers currently exposed online to attacks.' -- source: https://apache.slashdot.org/story/21/10/05/1538213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Company That Routes Billions of Text Messages Quietly Discloses It Was Hacked
by Peter Reutemann 05 Oct '21

05 Oct '21

'A company that is a critical part of the global telecommunications infrastructure used by AT&T, T-Mobile, Verizon and several others around the world such as Vodafone and China Mobile, quietly disclosed that hackers were inside its systems for years, impacting more than 200 of its clients and potentially millions of cellphone users worldwide. From a report: The company, Syniverse, revealed in a filing dated September 27 with the U.S. Security and Exchange Commission that an unknown "individual or organization gained unauthorized access to databases within its network on several occasions, and that login information allowing access to or from its Electronic Data Transfer (EDT) environment was compromised for approximately 235 of its customers." A former Syniverse employee who worked on the EDT systems told Motherboard that those systems have information on all types of call records. [...] The company wrote that it discovered the breach in May 2021, but that the hack began in May of 2016.' -- source: https://tech.slashdot.org/story/21/10/04/1827246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds On Community, Rust and Linux's Longevity
by Peter Reutemann 04 Oct '21

04 Oct '21

'This week saw the annual check-in with Linux creator Linus Torvalds at the Open Source Summit North America, this year held in Seattle (as well as virtually). Torvalds took the stage for the event's traditional half-hour of questions from Dirk Hohndel, an early Linux contributor (now also the chief open source officer and vice president at VMware) in an afternoon keynote session.... And the theme of community seemed to keep coming up — notably about what that community has ultimately taught Linus Torvalds. (For example, while Torvalds said he'd originally planned on naming the operating system Freax, "I am eternally grateful for two other people for having more taste than I did.") But even then Linux was a project that "I probably would've left behind," Torvalds remembered, "if it was only up to me." Torvalds credits the larger community for its interest (and patches) "that just kept the motivation going. And here we are 30 years later, and it's still what keeps the motivation going. Because as far as I'm concerned, it's been done for 29 of those 30 years, and every single feature ever since has been about things that other people needed or wanted or were interested in." Torvalds also says "I'm very proud of the fact that there's actually a fair number of people still involved with the kernel that came in in 1991 — I mean, literally 30 years ago.... I think that's a testament to how good the community, on the whole, has been, and how much fun it's been." And Torvalds says you can see that sense of fun in discussions about writing some Linux kernel modules using Rust. "From a technical angle, does that make sense?" Torvalds asked. "Who knows. That's not the point. The point is for a project to stay interesting — and to stay fun — you have to play with it.... "Probably next year, we'll start seeing some first intrepid modules being written in Rust, and maybe being integrated in the mainline kernel." "I really love C," Torvalds said at one point. "I think C is a great language, and C is, to me, is really a way to control the hardware at a fairly low level..." Yet Torvalds also saw Hohndel's analogy that it can be like juggling chainsaws. As a long-time watcher of C, Torvalds knows that C's subtle type interactions "are not always logical" and "are pitfalls for pretty much anybody. And they're easy to overlook, and in the kernel that's not always a good thing." Torvalds called Rust "the first language I saw which looked like this might actually be a solution"' -- source: https://linux.slashdot.org/story/21/10/02/004213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Millions Experience Browser Problems After Long-Anticipated Expiration of 'Let's Encrypt' Certificate
by Peter Reutemann 04 Oct '21

04 Oct '21

'"The expiration of a key digital encryption service on Thursday sent major tech companies nationwide scrambling to deal with internet outages that affected millions of online users," reports the Washington Examiner. The expiring certificate was issued by Let's Encrypt — though ZDNet notes there's been lots of warnings about its pending expiration: Digital Shadows senior cyber threat analyst Sean Nikkel told ZDNet that Let's Encrypt put everyone on notice back in May about the expiration of the Root CA Thursday and offered alternatives and workarounds to ensure that devices would not be affected during the changeover. They have also kept a running forum thread open on this issue with fairly quick responses, Nikkel added. Thursday night the Washington Examiner describes what happened when the big day arrived: Tech giants — such as Amazon, Google, Microsoft, and Cisco, as well as many smaller tech companies — were still battling with an endless array of issues by the end of the night... At least 2 million people have seen an error message on their phones, computers, or smart gadgets in the past 24 hours detailing some internet connectivity problems due to the certificate issue, according to Scott Helme, an internet security researcher and well-known cybersecurity expert. "So many people have been affected, even if it's only the inconvenience of not being able to visit certain websites or some of their apps not working," Helme said. "This issue has been going on for many hours, and some companies are only just getting around to fixing it, even big companies with a lot of resources. It's clearly not going smoothly," he added. There was an expectation before the certificate expired, Helme said, that the problem would be limited to gadgets and devices bought before 2017 that use the Let's Encrypt digital certificate and haven't updated their software. However, many users faced issues on Thursday despite having the most cutting-edge devices and software on hand. Dozens of major tech products and services have been significantly affected by the certificate expiration, such as cloud computing services for Amazon, Google, and Microsoft; IT and cloud security services for Cisco; sellers unable to log in on Shopify; games on RocketLeague; and workflows on Monday.com. Security researcher Scott Helme also told ZDNet he'd also confirmed issues at many other companies, including Guardian Firewall, Auth0, QuickBooks, and Heroku — but there might be many more beyond that: "For the affected companies, it's not like everything is down, but they're certainly having service issues and have incidents open with staff working to resolve. In many ways, I've been talking about this for over a year since it last happened, but it's a difficult problem to identify. it's like looking for something that could cause a fire: it's really obvious when you can see the smoke...!" Digital certificates expert Tim Callan added that the popularity of DevOps-friendly architectures like containerization, virtualization and cloud has greatly increased the number of certificates the enterprise needs while radically decreasing their average lifespan. "That means many more expiration events, much more administration time required, and greatly increased risk of a failed renewal," he said. ' -- source: https://it.slashdot.org/story/21/10/02/2318202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FSF Announces 'JShelter' Browser Privacy Extension to Block Fingerprinting, Tracking, and Malware
by Peter Reutemann 04 Oct '21

04 Oct '21

'This week the Free Software Foundation (FSF) announced JShelter, "an anti-malware Web browser extension to mitigate potential threats from JavaScript, including fingerprinting, tracking, and data collection." The browser add-on — supported by NLnet Foundation's Next Generation Internet (NGI) Zero Privacy & Trust Enhancing Technologies fund — is currently "in development and the first release is available." This browser add-on will limit the potential for JavaScript programs to do harmful actions by restricting default behavior and adding a layer of control... Accessing cookies, performing fingerprinting to track users across multiple sites, revealing the local network address, or capturing the user's input before they submit a form are some examples of JavaScript's capabilities that can be used in harmful ways. JShelter adds a safety layer that allows the user to choose if a certain action should be forbidden on a site, or if it should be allowed with restrictions, such as reducing the accuracy of geolocation to the city area. This layer can also aid as a countermeasure against attacks targeting the browser, operating system, or hardware levels... [The extension] will ask — globally or per site — if specific native functions provided by the JavaScript engine and the Document Object Model (DOM) are allowed by the user. It will also link to an explanatory page for each function, to raise awareness of related threats. Depending on the function being addressed, the user will have the option to allow it, block it, or have it return a custom value... "Our browsers have become perhaps the most critical of tools we depend on, and yet the browser environment is far from healthy," says Michiel Leenaars, director of strategy at NLnet Foundation and coordinator of NGI Zero. "Dominant corporate behavior from a small amount of actors has been aggressively reshaping the evolution of the Web, and that is starting to wreak havoc. Despite an enormous systemic dependency, we as users have very little control over what browsers allow and share — leading to significant risk as the most powerful tools in the shed are essentially left unprotected for every casual Web site to abuse. JShelter is a great initiative to help empower us all, to help us gain better understanding and to better safeguard ourselves from obvious and otherwise unavoidable harm." The effort is part of a larger, multi-year campaign from FSF on JavaScript on the Web started in 2013, which among others includes the development of GNU LibreJS and outreach to users and developers about nonfree software inside the browser. The GNU LibreJS extension detects JavaScript web labels and assists users with running only JavaScript distributed under a free software license, according to their ethical convictions and individual preferences. "JShelter will help protect users from critical threats now, and contribute significantly to progress on the necessary longer-term cultural shift of moving away from nonfree JavaScript," said Ruben Rodriguez, former FSF chief technology officer. "This is a project I've been looking forward to for years, tired of dealing with all kinds of potential antifeatures in the browsers I use and distribute, and having to figure out some countermeasure for them with configuration changes, patches or extensions. Being able to wrap the JavaScript engine in a layer of protection is a game changer."' -- source: https://news.slashdot.org/story/21/10/03/0150251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Let's Encrypt's Root Certificate is expiring!
by Peter Reutemann 01 Oct '21

01 Oct '21

'On 30th September 2021, the root certificate that Let's Encrypt are currently using, the IdentTrust DST Root CA X3 certificate, will expire. You may or may not need to do anything about this Root CA expiring, but I'm betting a few things will probably break on that day so here's what you need to know!' -- source: https://scotthelme.co.uk/lets-encrypt-old-root-expiration/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

People Will Pay For Privacy, And Take Rewards To Give It Up
by Lawrence D'Oliveiro 01 Oct '21

01 Oct '21

British consumer magazine “Which?” has published the results of a survey <https://www.theregister.com/2021/09/30/which_data_survey/> which found that people would pay companies like Google and Facebook an average of £1.09 a month to avoid collection of their personal data and its use for targeted advertising. On the other hand, while a quarter of people were happy to receive targeted advertising to begin with, that proportion went up quite substantially if a basic reward like an Amazon voucher were offered.

1 0

Social Media Companies Can’t Be Trusted To Police Themselves -- Who Knew?
by Lawrence D'Oliveiro 29 Sep '21

29 Sep '21

>From a hearing at the US House of Representatives <https://www.theregister.com/2021/09/29/facebook_research_congress/> which received submissions from academics trying to study Facebook’s effect on its users in the face of active hostility from the company: “Tobacco companies don't get to decide who does research on smoking and the idea that social media companies get to decide who studies them is perverse.” -- Laura Edelson

1 0

With HTTPS Everywhere, EFF Begins Plans to Eventually Deprecate 'HTTPS Everywhere' Extension
by Peter Reutemann 27 Sep '21

27 Sep '21

'The Record reports: The Electronic Frontier Foundation said it is preparing to retire the famous HTTPS Everywhere browser extension after HTTPS adoption has picked up and after several web browsers have introduced HTTPS-only modes." "After the end of this year, the extension will be in 'maintenance mode' for 2022," said Alexis Hancock, Director of Engineering at the EFF. Maintenance mode means the extension will receive minor bug fixes next year but no new features or further development. No official end-of-life date has been decided, a date after which no updates will be provided for the extension whatsoever. Launched in June 2010, the HTTPS Everywhere browser extension is one of the most successful browser extensions ever released. The extension worked by automatically switching web connections from HTTP to HTTPS if websites had an HTTPS option available. At the time it was released, it helped upgrade site connections to HTTPS when users clicked on HTTP links or typed domains in their browser without specifying the "https://" prefix. The extension reached cult status among privacy advocates and was integrated into the Tor Browser and, after that, in many other privacy-conscious browsers. But since 2010, HTTPS is not a fringe technology anymore. Currently, around 86.6% of all internet sites support HTTPS connections. Browser makers such as Chrome and Mozilla previously reported that HTTPS traffic usually accounts for 90% to 95% of their daily connections. >From EFF's announcement: The goal of HTTPS Everywhere was always to become redundant. That would mean we'd achieved our larger goal: a world where HTTPS is so broadly available and accessible that users no longer need an extra browser extension to get it. Now that world is closer than ever, with mainstream browsers offering native support for an HTTPS-only mode. With these simple settings available, EFF is preparing to deprecate the HTTPS Everywhere web extension as we look to new frontiers of secure protocols like SSL/TLS... We know many different kinds of users have this tool installed, and want to give our partners and users the needed time to transition. The announcement also promises to inform users of browser-native HTTPS-only options before the day when the extension reaches its final sunsetting — and ends with instructions for how to activate the native HTTPS-only features in Firefox, Chrome, Edge, and Safari, "and celebrate with us that HTTPS is truly everywhere for users."' -- source: https://it.slashdot.org/story/21/09/27/008226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds Recognizes Linux's 'True' 30th Anniversary Date
by Peter Reutemann 26 Sep '21

26 Sep '21

'While it's been argued that Linux has four different "birthdays," last Friday saw the 30th anniversary of Linux's very, very first release — version 0.01. That special first release "was never publicly announced, and I only emailed a handful of people in private about the upload," Torvalds remembered on the Linux kernel mailing list. He no longer has copies of those announcement emails, "so there's no real record of that. The only record of the date is in the Linux-0.01 tar-file itself, I suspect." "Alas, the dates in that tar-file are for the last modification dates, not the actual creation of the tar-file," Torvalds wrote, "but it does seem to have happened around 7:30pm (Finnish time), so the exact anniversary was technically a couple of hours ago." So when the exact moment arrived for its 30th anniversary, Torvalds couldn't resist sharing the moment on the Linux kernel mailing list. "Just thought I'd mention it, since while unannounced, in many ways this is the true 30th anniversary date of the actual code."' -- source: https://linux.slashdot.org/story/21/09/25/0333233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting tomorrow
by Peter Reutemann 26 Sep '21

26 Sep '21

Hi everyone Apologies for the late reminder, things have been a bit hectic at my end... We have a "virtual" meeting tomorrow: "Peter Reutemann will demo Syncthing (https://syncthing.net/) a continuous file synchronization program. It synchronizes files between two or more computers in real time, respecting your privacy. Runs on Linux, Windows, Mac and Android among other platforms." Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/274861089/ Meeting link will be available to people that RSVP on meetup.com. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

First RISC-V Computer Chip Lands At the European Processor Initiative
by Peter Reutemann 23 Sep '21

23 Sep '21

'The Register reports: The European Processor Initiative (EPI) has run the successful first test of its RISC-V-based European Processor Accelerator (EPAC), touting it as the initial step towards homegrown supercomputing hardware. EPI, launched back in 2018, aims to increase the independence of Europe's supercomputing industry from foreign technology companies. At its heart is the adoption of the free and open-source RISC-V instruction set architecture for the development and production of high-performance chips within Europe's borders. The project's latest milestone is the delivery of 143 samples of EPAC chips, accelerators designed for high-performance computing applications and built around the free and open-source RISC-V instruction set architecture. Designed to prove the processor's design, the 22nm test chips -- fabbed at GlobalFoundries, the not-terribly-European semiconductor manufacturer spun out of AMD back in 2009 -- have passed initial testing, running a bare-metal "hello, world" program as proof of life. It's a rapid turnaround. The EPAC design was proven on FPGA in March and the project announced silicon tape-out for the test chips in June -- hitting a 26.97mm2 area with 14 million placeable instances, equivalent to 93 million gates, including 991 memory instances. While the FPGA variant, which implemented a subset of the functions of the full EPAC design, was shown booting a Linux operating system, the physical test chips have so far only been tested with basic bare-metal workloads -- leaving plenty of work to be done. Earlier today, the UK government released its 10-year plan to make the country a global "artificial intelligence superpower," seeking to rival the likes of the U.S. and China. "The so-called 'National Artificial Intelligence Strategy' is designed to boost the use of AI among the nation's businesses, attract international investment into British AI companies and develop the next generation of homegrown tech talent," reports CNBC.' -- source: https://hardware.slashdot.org/story/21/09/22/2057258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Security audit raises severe warnings on Chinese smartphone model
by Peter Reutemann 23 Sep '21

23 Sep '21

'The Lithuanian National Cyber Security Centre (NCSC) recently published a security assessment of three recent-model Chinese-made smartphones—Huawei's P40 5G, Xiaomi's Mi 10T 5G, and OnePlus' 8T 5G. Sufficiently determined US shoppers can find the P40 5G on Amazon and the Mi 10T 5G on Walmart.com—but we will not be providing direct links to those phones, given the results of the NCSC's security audit. The Xiaomi phone includes software modules specifically designed to leak data to Chinese authorities and to censor media related to topics the Chinese government considers sensitive. The Huawei phone replaces the standard Google Play application store with third-party substitutes the NCSC found to harbor sketchy, potentially malicious repackaging of common applications. The OnePlus 8T 5G—arguably, the best-known and most widely marketed phone of the three—was the only one to escape the NCSC's scrutiny without any red flags raised.' -- source: https://arstechnica.com/information-technology/2021/09/security-audit-raise… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Finally Shifting To 'Upstream First' Linux Kernel Approach For Android Features
by Peter Reutemann 23 Sep '21

23 Sep '21

'Phoronix reports: Google's Android had been notorious for all of its downstream patches carried by the mobile operating system as well as various vendor/device kernel trees while in recent years more of that code has been upstreamed. Google has also been shifting to the Android Generic Kernel Image (GKI) as the basis for all their product kernels to further reduce the fragmentation. Looking ahead, Google is now talking of an "upstream first" approach for pushing new kernel features into mainline Linux before deploying them on Android. Google's Todd Kjos talked today during Linux Plumbers Conference (LPC2021) around their Generic Kernel Image initiative. With Android 12 and their Linux 5.10 based GKI image they have further cut down the fragmentation to the extent that it's "nearly eliminated." With the Android 12 GKI, most of the vendor/OEM kernel features have now either been upstreamed into the Linux kernel, isolated to vendor modules/hooks, or merged into the Android Common Kernel. They are making good progress on the GKI front and also ensuring vendors adapt to the new approach to cut down on the kernel mess. But perhaps most exciting is their outlook for 2023 to 2024 for further reducing technical debt. They are going to pursue an "upstream first development model for new features" in making sure new code first lands into the mainline Linux kernel rather than aiming straight for lodging within the Android source tree. ' -- source: https://tech.slashdot.org/story/21/09/22/1920258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Upcoming NAS workshop
by 51miked 22 Sep '21

22 Sep '21

Anyone interested in a NAS workshop can register at: https://www.qnap.com/static/landing/en-us/workshop/workshop-09.html. I’ve found these very informative. Michael -- Kind regards Michael

2 2

Ubuntu 14.04 and 16.04 Each Get a Decade of Support from Canonical
by Peter Reutemann 22 Sep '21

22 Sep '21

'Canonical has announced that it is extending the life of Ubuntu 14.04 and 16.04 to a decade. BetaNews: In other words, Ubuntu 14.04 and 16.04 are getting longer Extended Security Maintenance (ESM) periods as Canonical pushes back their End of Life (EoL) dates. The former will now get security updates until 2024, while the latter will receive them until 2026. "This lifecycle extension enables organizations to balance their infrastructure upgrade costs, by giving them additional time to implement their upgrade plan. The prolonged Extended Security Maintenance (ESM) phase of Ubuntu 14.04 LTS and 16.04 LTS enables a secure and low-maintenance infrastructure with security updates and kernel livepatches provided by Canonical. The announcement represents a significant opportunity for the organizations currently implementing their transition to new applications and technologies," says Canonical.' -- source: https://linux.slashdot.org/story/21/09/21/1443254 That could help IoT devices to stay up to date for longer (at least OS-wise). Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Over-Elaborate Shell Scripting
by Lawrence D'Oliveiro 21 Sep '21

21 Sep '21

When using a computer, laziness is a virtue. This is why we have command lines, to help automate the boring and repetitive tasks. This article <https://arstechnica.com/gadgets/2021/09/command-line-wizardry-part-two-vari…> continues the author’s intro to basic command-line concepts. But it repeats a failing I see all too often in shell scripting: doing complex parsing of the output of some command, when the command itself offers an option to produce something closer to the exact output you need. In this case, he is extracting the names of datasets from the “zfs list” command. And while I have zero experience with ZFS, I can look at documentation <https://docs.oracle.com/cd/E18752_01/html/819-5461/gazsu.html>, and discover that the command offers the “-o” option where you can select exactly that information you want it to output. It even has “-H” to simplify the output format right down, specifically to make it easier to parse. Sure, it’s fun to write code. But it can be even more fun to _avoid_ writing code. RTFM helps.

2 3

Linux Foundation Survey Shows Companies Desperate To Hire Open-Source Talent
by Peter Reutemann 21 Sep '21

21 Sep '21

'ZDNet reports: At the Open Source Summit in Seattle, The Linux Foundation, and edX, the leading massive open online course (MOOC) provider released the 2021 Open Source Jobs Report. In this survey of 200 technical hiring managers and 750 open-source pros, the organizations found more demand for top open-source workers than ever. On top of that, 92% of managers are having trouble finding enough talent and many of them are also having fits holding on to their existing senior open-source staffers. In short, if you've got open-source skills, whether you're a developer, a sysadmin, a DevOps expert, or a cloud-native pro, there's a good-paying job waiting for you out there. And, where before the Covid-19 pandemic, you might have been stuck with only jobs in your area, these days, thanks to the rise of working from home, you can still live at the old homestead instead of moving to Silicon Valley or Manhattan. On top of this 50% of employers surveyed stated they are increasing hires this year. The jobs are out there. The difficulty for companies is, as 92% of managers report, finding enough talent and hanging onto existing talent in the face of fierce competition. This is especially true for cloud-native application development and operations skills. Cloud-native tops the list of skills needed with over 46% of hiring managers looking for people with Kubernetes smarts. Indeed, for the first time in the survey's history, cloud and container technology skills are more in demand by hiring managers than Linux. Indeed, cloud and container skills rank far above Linux in this go around with 41% over 32%. [T]he survey also found that DevOps has become the standard method for developing software: Virtually all open-source professionals (88%) report using DevOps practices in their work, a 50% increase from three years ago. In other words, it's all DevOps all the time. "The survey also revealed that a majority of employers, 88%, now say that hiring certified professionals is a priority," the report adds. "That's an 87% increase in only three years, 57% in 2020, and 47% in 2018." Sadly, discrimination has also become more of an issue. "18% of open-source professionals now report they have been discriminated against or made to feel unwelcome in the community," the report says. "That's a 125% increase over the past three years."' -- source: https://news.slashdot.org/story/21/09/20/2031215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Home Computing Pioneer Sir Clive Sinclair Dies Aged 81
by Peter Reutemann 20 Sep '21

20 Sep '21

'Sir Clive Sinclair, the man behind the Sinclair Spectrum and the first computer to retail for under a hundred dollars (the Sinclair ZX-81, A.K.A. The Timex/Sinclair 1000), died September 15 after battling a long illness. His daughter, Belinda, said he died at home in London on Thursday morning after a long illness. Sinclair invented the pocket calculator but was best known for popularising the home computer, bringing it to British high-street stores at relatively affordable prices. Many modern-day titans of the games industry got their start on one of his ZX models. For a certain generation of gamer, the computer of choice was either the ZX Spectrum 48K or its rival, the Commodore 64. Belinda Sinclair, 57, told the Guardian: "He was a rather amazing person. Of course, he was so clever and he was always interested in everything. My daughter and her husband are engineers so he'd be chatting engineering with them." He left school at 17 and worked for four years as a technical journalist to raise funds to found Sinclair Radionics.' -- source: https://news.slashdot.org/story/21/09/16/1936235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

Mozilla Experiment: Set Default Search Engine to Bing for 1% of Firefox Users
by Peter Reutemann 20 Sep '21

20 Sep '21

'"Mozilla is running an experiment on 1% of the Firefox desktop population currently, which sets the default search engine to Bing in the web browser," reports Ghacks: [I]n most regions, it is Google Search. Mozilla and Google extended the search deal in 2020 for another three years. Google is paying Mozilla "between $400 and $450 million per year" so that its search engine is the default in Firefox in most regions. Google has been Firefox's default search engine since 2017, when Mozilla ended its search deal with Yahoo early. Firefox users may change the default search engine to one of the other engines that are included by default, or an engine that is not included but can be added... The study started on September 6 and it will run until early 2022, likely January 2022. About 1% of Firefox desktop users may notice that the default search engine is changed when the installation of Firefox is picked for the experiment. Tip: load about:studies in the Firefox address bar to list the studies that the browser us currently taking part in and has completed already. Firefox users who don't want to participate in studies can disable the preference "Allow Firefox to install and run studies" on about:preferences#privacy. ' -- source: https://news.slashdot.org/story/21/09/18/1914227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Is 2021 The Year of the Linux Desktop?
by Peter Reutemann 20 Sep '21

20 Sep '21

'"2021 Is the Year of Linux on the Desktop," writes PC Magazine. "No, really..." Walk into any school now, and you'll see millions of Linux machines. They're called Chromebooks. For a free project launched 30 years ago today by one man in his spare time, it's an amazing feat.... Linux found its real niche — not as a political statement about "free software," but as a practical way to enable capable, low-cost machines for millions... Chrome OS and Android are both based on the Linux kernel. They don't have the extra GNU software that distributions like Ubuntu have, but they're descended from Linus Torvalds' original work. Chromebooks are the fastest growing segment of the traditional PC market, according to Canalys. IDC points out that Canalys' estimates of 12 million Chromebooks shipped in Q1 2021 are only a fraction of the 63 million notebooks sold that quarter, but once again, they're where the growth is. Much of that is driven by schools, where Chromebooks dominate now. Schoolkids don't generally need a million apps' worth of generic computing power. They need inexpensive, rugged ways to log into Google Classroom. Linux came to the rescue, enabling cheap, light, easy-to-manage PCs that don't have the Swiss Army Knife cruft of Windows or the premium price of Macs... One great thing about open-source hacker projects is that they can be taken in unexpected directions. Linux isn't controlled, so it can adapt, Darwinian-style. It was a little scurrying mammal in the time of the dinosaurs, and then the mobile-computing asteroid hit. Linux could evolve. Windows couldn't. When you're building something that fits in your hand and has to sip battery, you can't just keep throwing processors and storage at it. Microsoft had a tough time adapting its monstrous megakernel OS to the new, tiny world. But *nix platforms thrive there: Android (based on Linux) and iOS. "Android and Chrome water down the Linux philosophy," the article argues, "but they are Linux..." Does this make any long-time geeks feel vindicated? In the original submission wiredog (Slashdot reader #43,288) looks back to 1995, remembering that "my first Linux was RedHat 2.0 in the beige box, running the 0.95(?) kernel and the F Virtual Window Manager... "It came with 2 books, a CD, and a boot floppy disk."' -- source: https://linux.slashdot.org/story/21/09/18/0050255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hi, I have parcels going missing. Does anyone know of technology to trace parcels?
by Michelle 18 Sep '21

18 Sep '21

It would presumably use GPS. It would involve a very small device put in the parcel that a thief would very possibly not even see when the parcel is scanned at customs. The icing on the cake would be if the route of the parcel was able to be recorded as evidence. I will give more details later like it going on for 3 months and involving parcels posted in NZ as well. But this is trial run email because I haven't posted in a long time and I want to make sure I am doing it right. I am hoping that if anyone replies to this that there is a convenient reply to button or link that I can reply back to. Oh well, after I send this email I want to go to the site and see if it has posted. Thanks for any help.

5 13

Ransomware Scammers Preying On Krita Users
by Lawrence D'Oliveiro 16 Sep '21

16 Sep '21

Some ne’er-do-wells are targeting users of the open-source paint app Krita, purporting to offer payment for advertising the app on their YouTube channels. But when they download the referenced media “asset” pack, they get a ransomware attack instead. <https://www.theregister.com/2021/09/14/krita_users_targeted_by_ransomware/>

1 0

UN Calls For Moratorium On AI That Threatens Human Rights
by Lawrence D'Oliveiro 16 Sep '21

16 Sep '21

The UN human rights office has released a report <https://www.aljazeera.com/economy/2021/9/15/warning-of-risk-un-rights-chief…> on the risks of AI technologies to human rights. Its head, Michelle Bachelet, wants safeguards against the abuse of such technologies before they get too widely deployed. Such technologies are increasingly being used for automated decision making by both companies and governments, in ways that can impact people’s lives in a major way: for example, to control access to social security benefits, health, education, or to identify criminal suspects for arrest. When mistakes are made in these areas, the consequences can be catastrophic for the individuals concerned. And the tendency to secrecy on the part of those using such technologies doesn’t help.

1 0

More On The NZ Reserve Bank Breach
by Lawrence D'Oliveiro 15 Sep '21

15 Sep '21

Seems hackers broke into a secure file-sharing service called Accellion, based in California. The RBNZ was using that to exchange documents with the likes of banks and insurance companies. <https://www.stuff.co.nz/business/123911764/reserve-bank-reveals-more-detail…>

2 5

Travis CI flaw exposed secrets of thousands of open source projects
by Peter Reutemann 15 Sep '21

15 Sep '21

'A security flaw in Travis CI potentially exposed the secrets of thousands of open source projects that rely on the hosted continuous integration service. Travis CI is a software-testing solution used by over 900,000 open source projects and 600,000 users. A vulnerability in the tool made it possible for secure environment variables—signing keys, access credentials, and API tokens of all public open source projects—to be exfiltrated. Worse, the dev community is upset about the poor handling of the vulnerability disclosure process and the brief "security bulletin" it had to force out of Travis.' -- source: https://arstechnica.com/information-technology/2021/09/travis-ci-flaw-expos… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Another Day, Another DDoS ...
by Lawrence D'Oliveiro 14 Sep '21

14 Sep '21

A bunch of NZ banks, also NZ Post and MetService, are currently having online trouble <https://www.nzherald.co.nz/business/live-cyber-attack-fears-kiwibank-anz-nz…>. For Kiwibank, this is about the second or third outage this week.

1 1

PHP maintains an enormous lead in server-side programming languages
by Peter Reutemann 14 Sep '21

14 Sep '21

'The venerable web programming language PHP is a source of frequent complaints and frustration, but according to a report W3Techs released today, it doesn't seem to be going away anytime soon. W3Techs' web server survey looks for technologies in use by sites in Alexa's top 10 million list; today's report includes a year-on-year chart beginning with January 2010, running all the way through 2021. The survey only includes top sites not out of elitism, but as one part of its effort to avoid data-skewing returns from domain-parking services and spammers, which would otherwise dominate legitimate websites through sheer volume. Within that dataset, the story told is clear. Apart from PHP—which held a 72.5 percent share in 2010 and holds a 78.9 percent share as of today—only one other server-side language ever broke a 10 percent share. That one competitor is ASP.NET, which held an impressive 24.4 percent share in 2010 but was down to 9.3 percent in January and 8.3 percent this month. Amongst the small fry, the only truly impressive growth to be seen is in Ruby—which at 5.2 percent this month is still seeing continued, uninterrupted growth in W3Techs' survey. This might come as a shock if you're mostly familiar with Ruby on Rails, which itself remains viable but seems to be on the decline in popularity.' -- source: https://arstechnica.com/gadgets/2021/09/php-maintains-an-enormous-lead-in-s… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

EU Study On Impact Of Open Source
by Lawrence D'Oliveiro 14 Sep '21

14 Sep '21

The European Commission’s Directorate-General for Communications Networks, Content and Technology has released a report <https://www.theregister.com/2021/09/13/eu_open_source_study_highlights/> on the economic impact of open source, both software and hardware, within the EU. The report’s authors talked to companies and developers, looked at existing research, surveyed repos on GitHub and ran economic analyses, among other things. Conclusion: there is economic value in open source, but corresponding business investment in it is lacking (though smaller companies tend to be better at this). Also adoption in the public sector can be quite difficult. Further conclusion: if businesses are happy to take but not so keen to give back, then it may be up to Government to give them a nudge in the right direction. One of the authors offered this encouragement: "There are companies that do see the value of contributing back, and some less so… those companies that contribute a lot and are very active in communities see that as an advantage, because when you contribute to it, you can also steer it, know how to fix it… if you have standing in that community, you are more likely to have the community respond to your need."

1 0

Facebook’s Special Rules For VIPs
by Lawrence D'Oliveiro 14 Sep '21

14 Sep '21

A report on some leaked documents <https://arstechnica.com/tech-policy/2021/09/leaked-documents-reveal-the-spe…> detailing Facebook’s “XCheck” system for exempting certain user accounts from its normal content-moderation rules. The sole reason for the exemption is that, regardless of the rights and wrongs of what they are saying, such users (e.g. politicians, celebrities) can raise a PR storm that can make Facebook look bad, and of course the company wants to avoid that. Except that the list of such special users has now grown to about 5.8 million accounts, which is getting a bit unwieldy. Note this: In the meantime, Facebook plans to assume “good intent” on the part of high-profile users in the program and take an approach of “innocent until proven guilty,” a product manager on Facebook’s Mistakes Prevention Team wrote. Does that sound like basic fairness, rather than arbitrary treatment, to you? If only all their users were treated that way ...

1 0

Mozilla Has Defeated Microsoft's Default Browser Protections in Windows
by Peter Reutemann 14 Sep '21

14 Sep '21

'Mozilla has quietly made it easier to switch to Firefox on Windows recently. From a report: While Microsoft offers a method to switch default browsers on Windows 10, it's more cumbersome than the simple one-click process to switch to Edge. This one-click process isn't officially available for anyone other than Microsoft, and Mozilla appears to have grown tired of the situation. In version 91 of Firefox, released on August 10th, Mozilla has reverse engineered the way Microsoft sets Edge as default in Windows 10, and enabled Firefox to quickly make itself the default. Before this change, Firefox users would be sent to the Settings part of Windows 10 to then have to select Firefox as a default browser and ignore Microsoft's plea to keep Edge. Mozilla's reverse engineering means you can now set Firefox as the default from within the browser, and it does all the work in the background with no additional prompts. This circumvents Microsoft's anti-hijacking protections that the company built into Windows 10 to ensure malware couldn't hijack default apps. Microsoft tells us this is not supported in Windows.' -- source: https://news.slashdot.org/story/21/09/13/1527222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Torvalds Merges Support for Microsoft's NTFS File System, Complains GitHub 'Creates Absolutely Useless Garbage Merges'
by Peter Reutemann 13 Sep '21

13 Sep '21

'"Linux creator Linus Torvalds has agreed to include Paragon Software's NTFS3 kernel driver, giving the Linux kernel 5.15 release improved support for Microsoft's NTFS file system..." reports ZDNet, adding that the driver "will make working with Windows' NTFS drives in Linux an easier task — ending decades of difficulties with Microsoft's proprietary file system that succeeded FAT...." "But he also had some process and security lessons to offer developers about how to code submissions to the kernel should be made." "I notice that you have a GitHub merge commit in there," wrote Torvalds. He continued: "That's another of those things that I *really* don't want to see — GitHub creates absolutely useless garbage merges, and you should never ever use the GitHub interfaces to merge anything...GitHub is a perfectly fine hosting site, and it does a number of other things well too, but merges are not one of those things." Torvalds' chief problem with it was that merges need "proper commit messages with information about [what] is being merged and *why* you merge something." He continued: "But it also means proper authorship and committer information etc. All of which GitHub entirely screws up." TechRadar supplies some more context: One of the shortcomings Torvalds highlighted are GitHub's concise, factually correct, but functionally useless, commit messages. For instance, GitHub's commit message for Paragon's merge read "Merge branch 'torvalds:master' into master", which didn't impress Torvalds one bit... Torvalds also had some pertinent security advice, perhaps useful in light of recent software supply chain cyberattacks that the Linux Foundation wants to address by improving supply chain integrity through tools that make it easier to sign software cryptographically. As Torvalds points out, this is particularly important for new contributors to the Linux kernel. "For GitHub accounts (or really, anything but kernel.org where I can just trust the account management), I really want the pull request to be a signed tag, not just a plain branch," Torvalds explains... Torvalds suggests Paragon do future merges from the command-line.' -- source: https://linux.slashdot.org/story/21/09/11/2316216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux For Apple Silicon Macs Gets Closer To Reality
by Peter Reutemann 13 Sep '21

13 Sep '21

'"Asahi Linux for Apple M1 Macs is moving closer to reality," writes Slashdot reader TroysBucket. An Asahi developer posted a detailed status update on Twitter. Linux enthusiast Bryan Lunduke offers this succinct summary: - The Asahi Linux team has Linux (Debian, in this case) booting and usable with network support. - They now have (very early) display drivers which "take full advantage of the display hardware." - They have at least two base distributions — both Arch and Debian — working and functional (to some extent). They also have, according to their latest update, "boot picker" support so that you can manually select which OS / Drive to boot from on the M1 Macs... I, for one, can't wait to see the first public, functional release of Asahi Linux — and will be following it extremely closely.' -- source: https://linux.slashdot.org/story/21/09/12/0044227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Strange Tale of the Freedom Phone
by Peter Reutemann 08 Sep '21

08 Sep '21

'A 22-year-old Bitcoin millionaire wants Republicans to ditch their iPhones for a low-end handset that he hopes to turn into a political tool. From a report: It was a pitch tuned for a politically polarized audience. Erik Finman, a 22-year-old who called himself the world's youngest Bitcoin millionaire, posted a video on Twitter for a new kind of smartphone that he said would liberate Americans from their "Big Tech overlords." His splashy video, posted in July, had stirring music, American flags and references to former Presidents Abraham Lincoln and Donald J. Trump. Conservative pundits hawked Mr. Finman's Freedom Phone, and his video amassed 1.8 million views. Mr. Finman soon had thousands of orders for the $500 device. Then came the hard part: Building and delivering the phones. First, he received bad early reviews for a plan to simply put his software on a cheap Chinese phone. And then there was the unglamorous work of shipping phones, hiring customer-service agents, collecting sales taxes and dealing with regulators. "I feel like practically I was prepared for anything," he said in a recent interview. "But I guess it's kind of like how you hope for world peace, in the sense you don't think it's going to happen." For even the most lavishly funded start-ups, it is hard to compete with tech industry giants that have a death grip on their markets and are valued in the trillions of dollars. Mr. Finman was part of a growing right-wing tech industry taking on the challenge nonetheless, relying more on their conservative customers' distaste for Silicon Valley than expertise or experience. [...] To make a smartphone, however, he had to rely on Google. The company's Android software already works with millions of apps, and Google makes a free, open version of the software for developers to modify. So Mr. Finman hired engineers to strip it of any sign of Google and load it with apps from conservative social networks and news outlets. Then he uploaded the software on phones he bought from China. To unveil the phone, he recorded an infomercial in which he cast the tech companies as enemies of the American way. "Imagine if Mark Zuckerberg banned MLK or Abraham Lincoln," he said in the video. "The course of history would have been altered forever." [...] Thousands of people bought the $500 phone. Others, including some conservatives, quickly panned the animated pitch. Quickly, news outlets reported that the Freedom Phone was based on a low-cost handset from Umidigi, a Chinese manufacturer that had used chips shown to be vulnerable to hacks. Mr. Finman, who marketed the device as "the best phone in the world," was on the defensive. In an interview in July, Mr. Finman admitted that Umidigi made the phone but still said he was "100 percent" sure it was more secure than the latest iPhone. Apple has tens of thousands of engineers. Mr. Finman said he employed 15 people in Utah and Idaho.' -- source: https://hardware.slashdot.org/story/21/09/07/1450242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ghostscript Zero-Day Allows Full Server Compromises
by Peter Reutemann 08 Sep '21

08 Sep '21

'Proof-of-concept exploit code was published online over the weekend for an unpatched Ghostscript vulnerability that puts all servers that rely on the component at risk of attacks. From a report: Published by Vietnamese security researcher Nguyen The Duc, the proof-of-concept code is available on GitHub and was confirmed to work by several of today's leading security researchers. Released back in 1988, Ghostscript is a small library that allows applications to process PDF documents and PostScript-based files. While its primary use is for desktop software, Ghostscript is also used server-side, where it is typically included with image conversion and file upload processing toolkits, such as the popular ImageMagick. The proof-of-concept code released by Nguyen on Sunday exploits this latter scenario, allowing an attacker to upload a malformed SVG file that escapes the image processing pipeline and runs malicious code on the underlying operating system. While Nguyen released the public exploit for this bug, he is not the one who discovered the vulnerability.' -- source: https://it.slashdot.org/story/21/09/07/1532205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds Jokes About Celebrations for Linux's 30th Anniversary
by Peter Reutemann 05 Sep '21

05 Sep '21

'Despite Linux reaching its 30th anniversary, "most outside the tech industry will be unaware that Linux has reached such a milestone," writes ZDNet, "even though the project has had a huge impact on everything from smartphones to cloud computing." They add that Linus Torvalds "poked fun at that lack of recognition in his usual Sunday release note for a new stable version of the Linux kernel." "So I realize you must all still be busy with all the galas and fancy balls and all the other 30th anniversary events, but at some point you must be getting tired of the constant glitz, the fireworks, and the champagne," Torvalds said. "That ball gown or tailcoat isn't the most comfortable thing, either. The celebrations will go on for a few more weeks yet, but you all may just need a breather from them." Linux 5.14 includes additional features for Intel's Alder Lake mobile-ready CPUs, extra AMD support and better support for the Raspberry Pi 400 PC. "Because 5.14 is out there, just waiting for you to kick the tires and remind yourself what all the festivities are about," notes Torvalds... Torvalds is upbeat about Linux's future, predicting decades more work for the kernel's several thousand contributors who help shape the Linux kernel and drivers. "Of course, the poor tireless kernel maintainers won't have time for the festivities, because for them, this just means that the merge window will start tomorrow. We have another 30 years to look forward to, after all. But for the rest of you, take a breather, build a kernel, test it out, and then you can go back to the seemingly endless party that I'm sure you just crawled out of," he wrote.' -- source: https://linux.slashdot.org/story/21/09/04/2037241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Vocus DDoS
by Lawrence D'Oliveiro 04 Sep '21

04 Sep '21

Vocus, which owns Orcon, Slingshot, Flip and Stuff Fibre (totalling 15% of NZ broadband users), has suffered a DDoS attack, possibly still ongoing <https://www.nzherald.co.nz/nz/widespread-internet-outages-across-nz-vocus-h…>. Users in Auckland, Wellington and Christchurch were affected from 1:30pm, though some reported services returning by 2:10pm. This has also hit EFTPOS payments.

2 2

Cloudflare Says Intel is Not Inside Its Next-Gen Servers
by Peter Reutemann 02 Sep '21

02 Sep '21

'Internet-grooming company Cloudflare has revealed that it was unable to put Intel inside its new home-brew servers, because they just used too much energy. A Tuesday post by platform operations engineer Chris Howells reveals that Cloudflare has been working on designs for an eleventh-generation server since mid-2020. jaa101 writes: "We evaluated Intel's latest generation of 'Ice Lake' Xeon processors," Howells wrote. "Although Intel's chips were able to compete with AMD in terms of raw performance, the power consumption was several hundred watts higher per server -- that's enormous." Fatally enormous -- Cloudflare's evaluation saw it adopt AMD's 64-core Epyc 7713 for the servers it deploys to over 200 edge locations around the world. Power savings also influenced a decision to go from three disks to two in the new design. A pair of 1.92TB Samsung drives replaced the three of the Korean giant's 960GB units found in previous designs. The net gain was a terabyte of capacity, and six fewer watts of power consumption. Howellls's post also reveals that testing produced data showing that equipping its servers with 512GB of RAM did not produce enough of a performance boost to justify the expense. The company has therefore settled on 384GB of memory, but did jump from DDR4-2933 to DDR4-3200 as the slight cost increase delivered a justifiable performance boost.' -- source: https://slashdot.org/story/21/09/01/1917257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

On-Prem Windows Server: Are Its Days Numbered?
by Lawrence D'Oliveiro 31 Aug '21

31 Aug '21

Microsoft has released yet another typically confusing update on the future of its family of Windows Server products <https://www.theregister.com/2021/07/28/windows_server_2022_sac/>. What’s clear from the details is that development is primarily going into the cloudy versions of Windows Server, with those who prefer to manage their own instances on their own hardware being increasingly left behind: At a high level, it seems that Microsoft is investing in Azure and [Azure Kubernetes Service], and that on-premises Windows Server users are in some respects being left behind. It is notable, for example, that Active Directory's functional level has not changed since Windows Server 2016, and this remains the case in Server 2022. ... SMB over QUIC, which promises secure access to Windows file shares from anywhere, is another key feature which will be available only in Windows Server Azure Edition. The article notes that on-prem Windows Server being slowly moved to the back burner in this way “will not go down well with on-premises users, nor perhaps with rival clouds running Windows Server”. But then again, given that Microsoft’s own cloud offerings are predominantly Linux-based, I can’t see other cloud services doing any better with Windows.

1 2

ESR On GitHub
by Lawrence D'Oliveiro 29 Aug '21

29 Aug '21

NZ’s Institute of Environmental Science and Research (more commonly known as ESR) has a GitHub area at <https://github.com/ESR-NZ>. There are a few repos related to the SARS-CoV-2 virus that causes COVID-19. The data repo <https://github.com/ESR-NZ/NZ_COVID19_Data> in particular shows a nice attitude to openness: the data files are in CSV format, and the licence is CC-BY. I see quite a lot of use of Python and Jupyter there. Also some mention of .xlsx files ... hmmm ...

1 0

Software Microsoft Trusts To Run As Admin
by Lawrence D'Oliveiro 27 Aug '21

27 Aug '21

You may have heard of this security bug involving Razer gaming mice <https://arstechnica.com/information-technology/2021/08/need-to-get-root-on-…>. Basically, when you plug such a mouse into a Windows system, it automatically downloads and runs an installer “wizard”, which opens a File Explorer window to let you choose where to actually put the additional software. However, this File Explorer instance is running with full admin privileges, without the user’s prior knowledge or consent. How does this happen? Because the buggy version of the installer has been accepted as part of Microsoft’s “Windows Catalog”, which means your Windows installation trusts it with extra privileges purely on Microsoft’s say so. As if we needed another reminder that, with a proprietary OS, you are never really in control of your own systems ...

1 0

Happy Birthday, Linux: From a Bedroom Project To Billions of Devices in 30 Years
by Peter Reutemann 26 Aug '21

26 Aug '21

'On August 25, 1991, Linus Torvalds, then a student at the University of Helsinki in Finland, sent a message to the comp.os.minix newsgroup soliciting feature suggestions for a free Unix-like operating system he was developing as a hobby. Thirty years later, that software, now known as Linux, is everywhere. From a report: It dominates the supercomputer world, with 100 per cent market share. According to Google, the Linux kernel is at the heart of more than three billion active devices running Android, the most-used operating system in the world. Linux also powers the vast majority of web-facing servers Netcraft surveyed. It is even used more than Microsoft Windows on Microsoft's own Azure cloud. And then there are the embedded electronics and Internet-of-Things spaces, and other areas. Linux has failed to gain traction among mainstream desktop users, where it has a market share of about 2.38 per cent, or 3.59 per cent if you include ChromeOS, compared to Windows (73.04 per cent) and macOS (15.43 per cent). But the importance of Linux has more to do with the triumph of an idea: of free, open-source software. "It cannot be overstated how critical Linux is to today's internet ecosystem," Kees Cook, security and Linux kernel engineer at Google, told The Register via email. "Linux currently runs on everything from the smartphone we rely on everyday to the International Space Station. To rely on the internet is to rely on Linux." The next 30 years of Linux, Cook contends, will require the tech industry to work together on security and to provide more resources for maintenance and testing.' -- source: https://linux.slashdot.org/story/21/08/25/1751220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Software For Estimating Fertilizer, Effluent Leaches From Farmland Is Flawed
by Lawrence D'Oliveiro 23 Aug '21

23 Aug '21

In a report in this evening’s TV1 news, NZ farmers have been using a piece of software to help them estimate their environmental groundwater impact that, according to some reports, is giving wildly inaccurate results <https://1news.co.nz/one-news/new-zealand/software-estimating-much-fertilise…>. The minister is looking into whether it can be fixed, or whether it needs to be replaced. Given its taxpayer funding (at least in part), why isn’t it open-sourced? Stick it on GitHub, and watch the hordes of would-be fixers descend. ;)

2 3

Level 4
by Peter Reutemann 22 Aug '21

22 Aug '21

Hi everyone With NZ going into level 4 at midnight, we will follow the guidelines that the government and university implement next week. If we shouldn't be able to meet in person, we can fall back on a virtual meeting via BigBlueButton. Well keep you posted. Stay safe everyone! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/.

2 3

Musings On Symlinks And Security
by Lawrence D'Oliveiro 19 Aug '21

19 Aug '21

I published a Blender addon <https://github.com/ldo/blendgit/> that lets you use Git to track versions of Blender documents and associated files. This addon makes heavy use of both hard links and symlinks in order to set up the directory tree snapshots correctly. Every now and then a Windows user tries to run it, and it fails for them with the peculiar error “symbolic link privilege not held”. It seems Microsoft added the ability to create symlinks in Windows back around the time of Windows Vista or 7 or so. But it puts a major obstacle in the way of users attempting to use this facility: you need to enter yourself into a special privilege group <https://social.msdn.microsoft.com/Forums/en-US/cf9d0948-b80e-436e-b5c4-8ca8…>. Or take the standard Windows lazy way out, and simply “run as administrator”. On Linux and other POSIXy systems, creating links is just a routine operation; why does Windows treat it as such a sensitive issue? In fact, even in the POSIX world, symbolic links can be a source of security problems <https://en.wikipedia.org/wiki/Symlink_race>. Symlinks were invented at the University of California at Berkeley way back in the early days of their BSD work, and the security implications only became apparent later. By that time, I think, they had become so useful and commonplace that no one wanted to get rid of them. So the workarounds were created, as the holes were uncovered. These days, the techniques have become commonplace, embedded in various library/system routines that will work securely without you having to give them a second thought. But on Windows, the whole concept is still new and untried (even after over a decade!). Very few people know how to use them, because when they try, they encounter the privilege restrictions, and that puts them off. And so the application developers hardly ever encounter the need to deal with them. And so they never become a commonplace facility that application software can be trusted to deal with.

1 0

SerenityOS: Homage To The 1990s
by Lawrence D'Oliveiro 19 Aug '21

19 Aug '21

Here <https://arstechnica.com/gadgets/2021/08/not-a-linux-distro-review-serenityo…> is a review of SerenityOS, a complete open-source POSIXy OS that does not use any GNU, Linux or BSD code. The review spends a lot of time on the GUI, which is consciously designed around a 1990s aesthetic. As usual, this sort of thing leaves me wondering “you could implement that whole look and feel on top of a Linux kernel, so why make your own?”. Then, further down, we get to this: Some of the paradigm shifts Kling and fellow contributors have introduced are neither weird nor trivial, though. SerenityOS's kernel, for example, exposes its internals as JSON rather than unstructured text. System utilities consuming kernel information therefore have a much simpler time of formatting it for display and/or internal decisions. Aha! Now there is something which could very well have a point. Though the Linux approach is to have the information exposed in these kernel pseudo-files in a simple (not unstructured!) text format that is both easy to parse and also somewhat comprehensible to a human viewer (which is harder to say of JSON). If you want to pass around object streams in a Linux command line, jq <https://github.com/stedolan/jq> is available as a standard Debian package, for doing precisely this sort of manipulation of JSON-formatted data. (Is that someone in Microsoft’s PowerShell group saying “I told you so!” ... ?)

1 0

Google's Fuchsia OS Is Rolling Out Widely To 1st-Gen Nest Hubs
by Peter Reutemann 19 Aug '21

19 Aug '21

'More owners of the first-generation Nest Hub are receiving the update to Google's Fuchsia operating system as it expands beyond the Preview program. 9to5Google reports: Back in May, Google formally released Fuchsia, its effort to develop a "not Linux" operating system from scratch, which has been years in the making. The first device to receive the new OS was Google's 2018 smart display, the Nest Hub -- not to be confused with the second generation Nest Hub with sleep tracking released earlier this year -- taking it permanently off of the existing Linux based "Cast OS" without negatively affecting the UI or experience. At the time, the rollout of Fuchsia was limited to a select few devices that were enrolled in the "Preview program" available to all devices via the Google Home app. Over time, the number of Nest Hubs running Fuchsia was expanded, with Google no doubt watching carefully for any issues with the upgrade. Late last week, Google updated a support page to reflect that the Nest Hub has received a new firmware update for both the Preview program and all other devices. Specifically, the first-gen Nest Hub is now receiving firmware version 1.52.260996. Google confirmed to us that this update does indeed include the upgrade to Fuchsia. All goes well, this means in a matter of days, all first-gen Nest Hub devices in households around the world should be running Fuchsia. ' -- source: https://tech.slashdot.org/story/21/08/18/2056255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Firewalls and Middleboxes Can Be Weaponized For Gigantic DDoS Attacks
by Peter Reutemann 18 Aug '21

18 Aug '21

'In an award-winning paper last week, academics said they discovered a way to abuse the TCP protocol, firewalls, and other network middleboxes to launch giant distributed denial of service (DDoS) attacks against any target on the internet. Authored by computer scientists from the University of Maryland and the University of Colorado Boulder, the research is the first of its kind to describe a method to carry out DDoS reflective amplification attacks via the TCP protocol, previously thought to be unusable for such operations. Making matters worse, researchers said the amplification factor for these TCP-based attacks is also far larger than UDP protocols, making TCP protocol abuse one of the most dangerous forms of carrying out a DDoS attack known to date and very likely to be abused in the future.' -- source: https://it.slashdot.org/story/21/08/17/1941202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Glibc Security Fix Created a Nastier Linux Bug
by Peter Reutemann 17 Aug '21

17 Aug '21

'A fix that was made in early June to the GNU C Library (glibc) introduced a new and nastier problem. Steven J. Vaughan-Nichols writes via ZDNet: The first problem wasn't that bad. As Siddhesh Poyarekar, a Red Hat principal software engineer wrote, "In order to mount a minimal attack using this flaw, an attacker needs many pre-requisites to be able to even crash a program using this mq_notify bug." Still, it needed patching and so it was fixed. Alas, the fix contained an even nastier bug. While checking the patch, Nikita Popov, a member of the CloudLinux TuxCare Team, found the problem. It turns out that it is possible to cause a situation where a segmentation fault could be triggered within the library. This can lead to any application using the library crashing. This, of course, would cause a Denial-of-Service (DoS) issue. This problem, unlike the earlier one, would be much easier to trigger. Whoops. Red Hat gives the problem in its Common Vulnerability Scoring System (CVSS) a score of 7.5, which is "high." An attack using it would be easy to build and requires no privileges to be made. In short, it's bad news. Popov himself thinks "every Linux application including interpreters of other languages (python, PHP) is linked with glibc. It's the second important thing after the kernel itself, so the impact is quite high." [...] The good news is both the vulnerability and code fix have been submitted to the glibc development team. It has already been incorporated into upstream glibc. In addition, a new test has been submitted to glibc's automated test suite to pick up this situation and prevent it from happening in the future. The bottom line is sometimes changed in unrelated code paths can lead to behaviors changing elsewhere without the programmer realizing what's going on. This test will catch this situation. The Linux distributors are still working out the best way to deploy the fix. In the meantime, if you want to be extra careful -- and I think you should be -- you should upgrade to the newest stable version of glibc 2.34 or higher. ' -- source: https://it.slashdot.org/story/21/08/16/2131221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Debian 11 'Bullseye' Released As Stable
by Peter Reutemann 16 Aug '21

16 Aug '21

'"One of the oldest and most renowned distributions of Linux has been released!" âwrites Slashdot reader Washuu2. Phoronix reports it took "just over two years in development." Debian 11 brings many new features as outlined this morning with the big upgrade to Linux 5.10 LTS, exFAT file-system support, control groups v2, yescrypt for password hashing, and a plethora of updated packages. GNOME 3.38, KDE Plasma 5.20, and Xfce 4.16 are among the desktop options for Debian 11. Debian.org adds: Do you want to celebrate the release? We provide some bullseye artwork that you can share or use as base for your own creations. Follow the conversation about bullseye in social media via the #ReleasingDebianBullseye and #Debian11Bullseye hashtags... Around the world, there were even several in-person and online release parties — with a few more upcoming!' -- source: https://linux.slashdot.org/story/21/08/15/171228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

meeting this month
by Peter Reutemann 16 Aug '21

16 Aug '21

Hi everyone At this stage, we don't have any talk(s) lined up for our meeting this month. Anybody feeling like a quick show and tell about some software or project that they've been working on lately? Or another topic that they'd like to discuss? Thanks! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

“Androids”: A History Of The Development Of The Android Operating System
by Lawrence D'Oliveiro 15 Aug '21

15 Aug '21

Chet Haase, one of the Android engineers, has published a book called “Androids”, giving an account of the early development of the mobile OS. A review is here <https://arstechnica.com/gadgets/2021/08/review-androids-is-a-developer-comm…>, and an excerpt is here <https://arstechnica.com/information-technology/2021/08/excerpt-the-history-…>. Before Android the company got acquired by Google, they were shopping themselves around to various groups of venture capitalists. From the beginning, the platform was going to be built on Open Source components like the Linux kernel. So how were they going to make money, if the main part of the platform was being given away for free? The initial answer was to offer paid-for services that would be resold by the carriers. This whole idea went away after the Google acquisition. Interesting to review the state of play at the time Android Inc were pitching their new OS: Symbian had some support from different vendors, but surprisingly (to me, at least), it left the whole UI layer up to the device maker, with no attempt at standardization between vendors. How were you to write portable apps in that situation? No wonder it had limited uptake. Sun were offering Java ME for mobile devices, but again, this was subject to differing, not-quite-compatible “profiles” for different devices, further complicating the headache of writing code to run across those devices. As I understand it, it also ran just a single Java VM on the device which had to be shared across all applications, which made it totally unsuited to a modern multitasking OS. The Hiptop device from Danger, Inc also gets a mention. Not a few people considered it probably the best mobile device to come out up to that point. Not mentioned in the above is that Microsoft acquired Danger. But because its platform was built on Java, which Microsoft had an allergy to, they wasted 18 months of product development time excising the Java dependency, totally losing the window of opportunity for releasing a new device. When the Kin finally came out, it probably held the world record for some product category for the shortest time on the market before being heavily discounted in clearance sales (about a month). One key point is that, when Google acquired Android, they continued to let it run like an independent company, at least for the first few years. This allowed the innovation to continue to flourish ... at least for a while.

1 0

Fwd: [NZLUG] Call for Proposals - Sysadmin Miniconf at Linux.conf.au 2022
by Peter Reutemann 13 Aug '21

13 Aug '21

Apologies for cross-posting, but you might be interested in the call for papers outlined below. Cheers, Peter ---------- Forwarded message --------- From: Simon Lyall <simon(a)darkmere.gen.nz> Date: Thu, Aug 12, 2021 at 11:29 PM Subject: [NZLUG] Call for Proposals - Sysadmin Miniconf at Linux.conf.au 2022 To: NZ Linux Users Group <nzlug(a)lists.nzoss.org.nz> The Call for Proposals is now up for the Sysadmin Miniconf at Linux.conf.au 2022. The Miniconf is on January 14th and the rest of the conference is the 2 days afterwards. All events are online. We are looking for 30 minute long Operations-related talks. We'd particularly love your War Stories about responding to the global pandemic and general work for home, or how you avoided earning war stories. The good news is that all talks accepted to the Miniconf get a free ticket for the whole of the conference! The bad news is that the CFP closes in just over 3 weeks from now on September 5th. So don't delay getting your proposal in. See our long CFP for more details: https://sysadmin.miniconf.org/cfp22.html Then Register and Login the the Conference dashboard to submit a proposal: https://linux.conf.au/dashboard -- Simon Lyall | Very Busy | Web: http://www.simonlyall.com/ "To stay awake all night adds a day to your life" - Stilgar _______________________________________________ NZLUG mailing list NZLUG(a)lists.nzoss.org.nz http://lists.nzoss.org.nz/mailman/listinfo/nzlug -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Centralization Versus Decentralization On The Internet
by Lawrence D'Oliveiro 12 Aug '21

12 Aug '21

A thoughtful, at times somewhat technical article <https://www.theregister.com/2021/08/11/decentralized_internet/> on the original philosophy of the designers of the Internet that nothing should be centralized, and how that was modified somewhat with the concept of “Software-Defined Networking”, without compromising the robustness of a decentralized underlying framework. The World-Wide Web, on the other hand, is a very different matter: rampant centralization, not just at the level of social-media networks and cloud services, but also at the lower layer of “Content-Delivery Networks” (CDNs) has led to the creation of way too many of what the engineers call SPOFs (“Single Points Of Failure”), where a breakdown in any of these can lead to a complete failure of any number of services that have become crucially dependent on them. Is the pendulum swinging away from centralization now? The author seems to think so; but I suspect the fat profit margins are still driving things in the wrong direction.

1 0

Firefox 91 Pushes Privacy With Stronger New Cookie-clearing Option
by Peter Reutemann 11 Aug '21

11 Aug '21

'WIth the release of Firefox 91 on Tuesday, Mozilla has introduced a bigger hammer for smashing the cookies that websites, advertisers and tracking companies can use to record your online behavior. From a report: The new feature, called enhanced cookie clearing, is designed to block tracking not just from a website, but also from third parties whose code appears on the site. The technology is designed to let you clear cookies for a particular website but also the more aggressive "supercookies" designed to evade lesser privacy protections. The feature is an option if you enable Firefox's strict mode for cookie handling, which partitions website data into separate storage containers. "You can easily recognize and remove all data a website has stored on your computer, without having to worry about leftover data from third parties embedded in that website," Mozilla said in a blog post. ' -- source: https://news.slashdot.org/story/21/08/10/1637219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Re: DMARC enforced
by Lawrence D'Oliveiro 09 Aug '21

09 Aug '21

On Mon, 9 Aug 2021 13:09:11 +1200, Peter Reutemann via wlug wrote: > "The university will be changing the DMARC action for the domain space > waikato.ac.nz from quarantine to reject on Monday 16th August." Just been looking at the DMARC overview <https://dmarc.org/overview/>, and I think there is some confusion here. What the University is doing is changing the recommended action for other MTAs receiving mail purporting to come _from_ the waikato.ac.nz domain, not the action it takes on receiving mail sent _to_ the waikato.ac.nz domain. In other words, this shouldn’t really make any difference to members of this list. If the systems that pick up their mail do DMARC checks, this shouldn’t matter (assuming the Uni sysadmins haven’t misconfigured anything ;)); if they don’t, it doesn’t matter anyway.

2 1

Re: DMARC enforced
by Lawrence D'Oliveiro 09 Aug '21

09 Aug '21

On Mon, 9 Aug 2021 13:09:11 +1200, Peter Reutemann via wlug wrote: > Just received an email from the IT department: > "The university will be changing the DMARC action for the domain space > waikato.ac.nz from quarantine to reject on Monday 16th August." What was the effect of “quarantine” before? Would it have been causing delays in posts getting through? (Because I don’t think I noticed any on mine.) On a further look, I found the following header line in the echo of my last posting back to myself: spf=pass (google.com: best guess record for domain of ldo(a)geek-central.gen.nz designates 72.249.182.57 as permitted sender) So it seems like Google’s algorithms are smart enough to figure out that my mail is coming from an address associated with that domain.

2 1