- wlug - list.wlug.org.nz

PHP's Git Server Hacked To Add Backdoors To PHP Source Code
by Peter Reutemann 30 Mar '21

30 Mar '21

'Late Sunday night, on March 28, 2021, Nikita Popov, a core PHP committer, released a statement indicating that two malicious commits had been pushed to the php-src Git repository. These commits were pushed to create a backdoor that would have effectively allowed attackers to achieve remote code execution through PHP and an HTTP header. "The incident is alarming considering PHP remains the server-side programming language to power over 79% of the websites on the Internet," adds BleepingComputer. "In the malicious commits [1, 2] the attackers published a mysterious change upstream, 'fix typo' under the pretense this was a minor typographical correction. However, taking a look at the added line 370 where zend_eval_string function is called, the code actually plants a backdoor for obtaining easy Remote Code Execution (RCE) on a website running this hijacked version of PHP." According to Popov, the first commit was detected a couple hours after it was made, and the changes were reverted right away. "Although a complete investigation of the incident is ongoing, according to PHP maintainers, this malicious activity stemmed from the compromised git.php.net server, rather than compromise of an individual's Git account," reports BleepingComputer. "As a precaution following this incident, PHP maintainers have decided to migrate the official PHP source code repository to GitHub."' -- source: https://developers.slashdot.org/story/21/03/29/2111200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fairphone suggests Qualcomm is the biggest barrier to long-term Android support
by Peter Reutemann 29 Mar '21

29 Mar '21

'Fairphone—the sustainable, modular smartphone company—is still shipping updates to the 5-year-old Fairphone 2. The company won't win any awards for speed, but the phone—which launched in 2015 with Android 5—is now being updated to Android 9.0. The most interesting part of this news is a video from Fairphone detailing the update process the company went through, which offers more transparency than we normally get from a smartphone manufacturer. To hear Fairphone tell the story of Android updates, the biggest barrier to longer-term support is—surprise!—Qualcomm. Fairphone wants consumers to keep their phones for longer, creating less e-waste and carbon emissions via modular replacement parts that are easily upgradeable and repairable. A big challenge for designing a long-lasting phone like this is software support. Even if Fairphone wanted to support a phone forever, Android software updates do not work that way, and major OS updates normally rely on a relay race of companies that all need to hand-off a build of Android before it reaches your phone.' -- source: https://arstechnica.com/gadgets/2021/03/the-fairphone-2-hits-five-years-of-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

UNIX's Founders Created Another OS at Bell Labs: 'Plan 9'
by Peter Reutemann 29 Mar '21

29 Mar '21

'The team behind UNIX also built another operating system at Bell Labs, writes the corporate CTO and president of Nokia Bell Labs: Starting in the late 1980s, a group led by Rob Pike and UNIX co-creators Ken Thompson and Dennis Ritchie developed "Plan 9". Their motivation was two-fold: to build an operating system that would fit an increasingly distributed world, and to do so in a clean and elegant manner. The plan was not to build directly on the Unix foundation but to implement a new design from scratch. The result was named Plan 9 from Bell Labs — the name an inside joke inspired by the cult B-movie "Plan 9 from Outer Space." Plan 9 is built around a radically different model from that of conventional operating systems. The OS is structured as a collection of loosely coupled services, which may be hosted on different machines. Another key concept in its design is that of a per-process name space: services can be mapped on to local names fixed by convention, so that programs using those services need not change if the current services are replaced by others providing the same functionality. Despite the groundbreaking innovations in Plan 9, the operating system did not take off — at least not enough to justify Bell Labs continued investment in Plan 9 development. But Plan 9's innovations found their way into many commercial OSes: the concept of making OS services available via the file system is now pervasive in Linux; Plan 9's minimalist windowing system design has been replicated many times; the UTF-8 character encoding used universally today in browsers was invented for, and first implemented in, Plan 9; and the design of Plan 9 anticipated today's microservice architectures by more than a decade...! Starting this week, Plan 9 will have a new home in the space it helped define: cyberspace. We are transferring the copyright in Plan 9 software to the Plan 9 Foundation for all future development, allowing them to carry on the good work that Bell Labs and many other Plan 9 enthusiasts have undertaken over the past couple of decades. Indeed, there is an active community of people who have been working on Plan 9 and who are interested in the future evolution of this groundbreaking operating system. That community is organizing itself bottom-up into the new Plan 9 Foundation, which is making the OS code publicly available under a suitable open-source software license. We at Nokia and Bell Labs are huge advocates for the power of open-source communities for such pioneering systems that have the potential to benefit the global software development community. Who knows, perhaps Plan 9 will become a part of the emerging distributed cloud infrastructure that will underpin the coming industrial revolution?' -- source: https://tech.slashdot.org/story/21/03/28/192227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

New Android malware with full range of spying capabilities has been found
by Peter Reutemann 29 Mar '21

29 Mar '21

'Researchers have discovered a new advanced piece of Android malware that finds sensitive information stored on infected devices and sends it to attacker-controlled servers. The app disguises itself as a system update that must be downloaded from a third-party store, researchers from security firm Zimperium said on Friday. In fact, it’s a remote-access trojan that receives and executes commands from a command-and-control server. It provides a full-featured spying platform that performs a wide range of malicious activities. Zimperium listed the following capabilities: - Stealing instant messenger messages - Stealing instant messenger database files (if root is available) - Inspecting the default browser’s bookmarks and searches - Inspecting the bookmark and search history from Google Chrome, Mozilla Firefox, and Samsung Internet Browser - Searching for files with specific extensions (including .pdf, .doc, .docx, and .xls, .xlsx) - Inspecting the clipboard data - Inspecting the content of the notifications - Recording audio - Recording phone calls - Periodically take pictures (either through the front or back cameras) - Listing of the installed applications - Stealing images and videos - Monitoring the GPS location - Stealing SMS messages - Stealing phone contacts - Stealing call logs - Exfiltrating device information (e.g., installed applications, device name, storage stats) - Concealing its presence by hiding the icon from the device’s drawer/menu' -- source: https://arstechnica.com/gadgets/2021/03/new-android-malware-with-full-range… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

cURL's 20th Anniversary Celebrated With 3D-Printed 'GitHub Steel' Contribution Graph
by Peter Reutemann 29 Mar '21

29 Mar '21

'This week Swedish developer Daniel Stenberg posted a remarkable reflection on the 20th anniversary of his command-line data tool, cURL: curl was adopted in Red Hat Linux in late 1998, became a Debian package in May 1999, shipped in Mac OS X 10.1 in August 2001. Today, it is also shipped by default in Windows 10 and in iOS and Android devices. Not to mention the game consoles, Nintendo Switch, Xbox and Sony PS5. Amusingly, libcurl is used by the two major mobile OSes but not provided as an API by them, so lots of apps, including many extremely large volume apps bundle their own libcurl build: YouTube, Skype, Instagram, Spotify, Google Photos, Netflix etc. Meaning that most smartphone users today have many separate curl installations in their phones. Further, libcurl is used by some of the most played computer games of all times: GTA V, Fortnite, PUBG mobile, Red Dead Redemption 2 etc. libcurl powers media players and set-top boxes such as Roku, Apple TV by maybe half a billion TVs. curl and libcurl ships in virtually every Internet server and is the default transfer engine in PHP, which is found in almost 80% of the world's almost two billion websites. Cars are Internet-connected now. libcurl is used in virtually every modern car these days to transfer data to and from the vehicles. Then add media players, kitchen and medical devices, printers, smart watches and lots of "smart"; IoT things. Practically speaking, just about every Internet-connected device in existence runs curl. I'm convinced I'm not exaggerating when I claim that curl exists in over ten billion installations world-wide... Those 300 lines of code in late 1996 have grown to 172,000 lines in March 2021. Stenberg attributes cURL's success to persistence. "We hold out. We endure and keep polishing. We're here for the long run. It took me two years (counting from the precursors) to reach 300 downloads. It took another ten or so until it was really widely available and used." But he adds that 22 different CPU architectures and 86 different operating systems are now known to have run curl. In a later blog post titled "GitHub Steel," Stenberg also reveals that GitHub gave him a 3D-printed steel version of his 2020 GitHub contribution matrix — accompanied by a friendly note. "Please accept this small gift as a token of appreciation on behalf of all of us here at GitHub, and everyone who benefits from your work."' -- source: https://tech.slashdot.org/story/21/03/28/0143206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Attackers Breach 21,000 Microsoft Exchange Servers, Install Malware Implicating Brian Krebs
by Peter Reutemann 29 Mar '21

29 Mar '21

'Security researcher Brian Krebs wants you to know... "New data suggests someone has compromised more than 21,000 Microsoft Exchange Server email systems worldwide and infected them with malware that invokes both KrebsOnSecurity and Yours Truly by name. Let's just get this out of the way right now: It wasn't me." The Shadowserver Foundation, a nonprofit that helps network owners identify and fix security threats, says it has found 21,248 different Exchange servers which appear to be compromised by a backdoor and communicating with [a domain that begins with brian . krebsonsecurity... Not a safe domain.] Shadowserver has been tracking wave after wave of attacks targeting flaws in Exchange that Microsoft addressed earlier this month in an emergency patch release. The group looks for attacks on Exchange systems using a combination of active Internet scans and "honeypots" — systems left vulnerable to attack so that defenders can study what attackers are doing to the devices and how. David Watson, a longtime member and director of the Shadowserver Foundation Europe, says his group has been keeping a close eye on hundreds of unique variants of backdoors (a.k.a. "web shells") that various cybercrime groups worldwide have been using to commandeer any unpatched Exchange servers. These backdoors give an attacker complete, remote control over the Exchange server (including any of the server's emails)... Shadowserver's honeypots saw multiple hosts with the Babydraco backdoor doing the same thing: Running a Microsoft Powershell script that fetches the file "krebsonsecurity.exe"... Oddly, none of the several dozen antivirus tools available to scan the file at Virustotal.com currently detect it as malicious. The Krebsonsecurity file also installs a root certificate, modifies the system registry, and tells Windows Defender not to scan the file. Watson said the Krebsonsecurity file will attempt to open up an encrypted connection between the Exchange server and the above-mentioned IP address, and send a small amount of traffic to it each minute. Shadowserver found more than 21,000 Exchange Server systems that had the Babydraco backdoor installed. But Watson said they don't know how many of those systems also ran the secondary download from the rogue Krebsonsecurity domain. "Despite the abuse, this is potentially a good opportunity to highlight how vulnerable/compromised MS Exchange servers are being exploited in the wild right now, and hopefully help get the message out to victims that they need to sign up our free daily network reports," Watson said.' -- source: https://it.slashdot.org/story/21/03/28/1924206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Open Source Initiative' Stops Collaboration With FSF Over Richard Stallman's Return
by Peter Reutemann 28 Mar '21

28 Mar '21

'The Open Source Initiative's board of directors recently issued the following statement: Richard M. Stallman recently announced that he will be returning to the board of directors of the Free Software Foundation (FSF), a statement that the FSF has not denied. We believe it is inappropriate for Stallman to hold any leadership position in the free and open source software community. If we do not speak out against this, our silence may be misinterpreted as support. The Open Source Initiative calls upon the Free Software Foundation to hold Stallman responsible for past behavior, remove him from the organization's leadership and work to address the harm he caused to all those he has excluded: those he considers less worthy, and those he has hurt with his words and actions. We will not participate in any events that include Richard M. Stallman and we cannot collaborate with the Free Software Foundation until Stallman is removed from the organization's leadership. Free and open source software will not be accessible to all until it is safe for everyone to participate, and we therefore call upon our peers in the broader software community to join us in making these commitments. Another perspective turns up in the "This Week in Programming" column: YouTuber Brodie Roberston offers his take on the return of RMS, saying "Like it or not, Richard Stallman is the face of free software. When you think about the free software movement, he is the one person that comes to mind." He then goes on to argue that the FSF is essentially the "ideological arm" of Stallman himself and that he is essentially irreplaceable not only because of his thoughts around free software but his passion for it, before going on to list the things that are "part of his charm."' -- source: https://news.slashdot.org/story/21/03/27/0347246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Open Collective Launches Funds that Financially Support Open-Source Communities
by Peter Reutemann 28 Mar '21

28 Mar '21

'"Introducing Funds for Open Source!" reads a blog post on the site for Open Collective. Back in 2018 TechCrunch called them "a non-profit platform that provides tools to 'collectives' to receive money while also offering mechanisms to allow the members of those collectives to spend their money in a democratic and transparent way." But while they're currently serving 2500+ projects, now SD Times reports that Open Collective "is trying to make working full-time for an open-source project an alternative to a career developing for a for-profit company." It believes the steps to achieve this goal include eliminating friction between projects, the communities that support them, and the corporations that depend on them. It is introducing Funds to its open funding management platform to make it easier for companies to invest in open-source projects by making a one-time payment to a Fund, which then redistributes the money to different projects and contributors, rather than paying those projects individually... According to Open Collective, more and more companies are now becoming aware of the need to compensate developers for their work on open-source projects and are willing to fund them. There are a few reasons for this, such as developers taking pride in working at a company that supports open source, access to creators, building a positive reputation within the community, ensuring their own open-source dependencies are being properly maintained, and ensuring open-source projects can scale with their needs.' -- source: https://news.slashdot.org/story/21/03/27/2136248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fwd: Re: [ANNOUNCE] WireGuard for FreeBSD in development for 13.y – and a note of how we got here
by Eric Light 27 Mar '21

27 Mar '21

Further to the list conversations about Wireguard and FreeBSD, it looks like things have become much, much worse. Conversation between Jason Donenfeld (Wireguard) and Scott Long (Netgate) below - ew. As LDO mentioned, Netgate don't seem to be particularly friendly members of the open source community :-/ E -------------------------------------------- Q: Why is this email five sentences or less? A: http://five.sentenc.es ----- Original message ----- From: "Jason A. Donenfeld" <Jason(a)zx2c4.com> To: wireguard(a)lists.zx2c4.com, Scott Long <scottl(a)netgate.com> Cc: secteam(a)FreeBSD.org, cperciva(a)FreeBSD.org Subject: Re: [ANNOUNCE] WireGuard for FreeBSD in development for 13.y – and a note of how we got here Date: Tuesday, 16 March 2021 14:18 Hi Scott, It's certainly disappointing to receive your email like that. I see that you're really upset, and I think we have a shared interest in deescalating this. You've mentioned the desire to talk about this in public, so I'm responding in the announcement thread to you, as this seems like the appropriate venue for discussion. I've also CC'd the FreeBSD Security Officer. I've responded to your email and its threats in line mailing-list style below: On Mon, Mar 15, 2021 at 6:08 PM Scott Long <scottl(a)netgate.com> wrote: > What you and Kyle did was tell the world that there are a number of > zero-day exploits in the code. You gave us no details until after the > fact, gave us no time to mitigate, correct, and publish before your > announcement and Kyle's code drop, and used the opportunity to > bash the code, and by extension us, for your own self-gain. I have no idea how you possibly have arrived at this here. FreeBSD 13 is currently at RC2 or RC3, if I recall correctly. Our whole motivation for working on this so tirelessly and with so much energy and devotion over the week was to get things fixed up before 13 was actually released. I dropped everything else I was working on to focus on this. I'm actually with my folks in Colorado and should be spending more time with them but the idea of FreeBSD 13 shipping with all those bugs seemed like a really important thing to address. Here's what we did, step by step: 1. We made a clone of the freebsd git repo where we could all push changes to master, to git.zx2c4.com like everything else. 2. We took turns taking big passes at the codebase, reading it, auditing it, fixing things. We did a lot of syncing and comparison with the OpenBSD code base. For example, in one step, we reordered the functions to match the flow of OpenBSD so we could see it more easily side by side. 3. We kept pushing commits like this in that manner. 4. We didn't know where we'd end up, but after a few days of this, the number of changes we had accumulated and fishy business we had observed was massive. 5. When we thought we reached a good resting point -- and when it became clear that our rapid fire changes were becoming too numerous -- we squashed that down to a summary commit, and Kyle committed it. 6. Seeing that the crypto needed to be re-accelerated, I published a call for help here -- https://lists.freebsd.org/pipermail/freebsd-hackers/2021-March/057076.html 7. I published wireguard-tools with the improved wg(8) command here -- https://lists.zx2c4.com/pipermail/wireguard/2021-March/006493.html 8. I sent a summary of everything to the mailing list here -- https://lists.zx2c4.com/pipermail/wireguard/2021-March/006494.html I also made sure to email a FreeBSD Security Officer, Colin, to keep him posted about the state of this, so he was kept apprised. Again, the whole idea was: two weeks until release! If I suggest the code is just disabled, people will be really upset, so instead we'll try to fix as much as fast as possible before the release. And actually, really focused sprints like that are fun and stimulating. We were all really enjoying writing code until the torrents of anger started coming from you about our efforts. (And I also learned that this isn't the first time you guys tried to intimidate an open source project -- see this summary of the opnSense defamatory website Netgate created -- https://opnsense.org/opnsense-com/ .) And in the process, too, I've tried to be in contact with you and Jim and let you know what our intentions are and to diffuse tensions. I spent time on a video call trying to describe to you some of the security things we found, in case it wasn't possible for you to use the new code right away. I've also made it abundantly clear to you how much I want to work WITH Netgate. When that Reddit thread cropped up, I offered to you multiple times to send a message to it telling people that we've spoken and it looks like you have a good plan and every things going to be okay, but you didn't respond to my offer. On Mon, Mar 15, 2021 at 6:08 PM Scott Long <scottl(a)netgate.com> wrote: > None > of these actions reflect good-faith collaboration, and your statements > that you think that our work is "really cool" ring hollow. Maybe you > and Kyle are really naive and thought that this was how people > normally collaborate in the security and business worlds, and that > everyone would rush to praise you and shower you with contracts > and funding. And hey, maybe that’ll happen, you certainly have > made a splash. That of course, comes at our expense, and it’s > likely to be a pretty damaging one. Now with the Ars article, I’m > starting to wonder if this was a coordinated smear campaign. > Normally we don’t get this kind of attention. It’s going to be painful > to navigate our way out. I'm not sure how to address these types of... theories. I certainly AM acting in good faith. I can't possibly see how it benefits anybody to have WireGuard and Netgate at odds with one another. You guys make a neat product based on open source software, and I think it's great you're planning to add WireGuard to it. My interest is in making sure the underlying operating system -- FreeBSD 13 -- does that well. (Or, I think you mentioned to me this morning that you're actually planning to base it on FreeBSD 12 for some time, but same idea for the backport you're working on, I guess.) And there's no "smear campaign" -- that's outrageous. I have no idea how that would help anybody at all. I should point out, again to you, how grateful I am that Netgate got the initial work on this started. Had you guys not gotten if_wg rolling, it's not clear to me that it'd exist in the first place. >From your end, it's very disappointing that you're (below) planning to attack security researchers and kernel programmers who took the time to rewrite code to make it better, hustling to get it in before FreeBSD 13 is released. On Mon, Mar 15, 2021 at 6:08 PM Scott Long <scottl(a)netgate.com> wrote: > I’ll be writing an article tonight outlining the mistakes that we made > and what we will be doing to correct it. I’ll also be highlighting that > this incident has been a textbook example of the wrong way for > people to collaborate in the security community, and that extreme > caution should be taken in any future dealings with you. Your > actions are self serving and in bad faith, and your words are > hollow and untrustworthy. I don’t care if you disagree or don’t see > it this way, this is the effect that you’ve had. It makes sense to communicate with your customers about things with your upcoming products if you feel it's necessary. But threatening that you're going to highlight "that extreme caution should be taken in any future dealings with you" sounds to me like a threat of some intense slander. And again, attacking security researchers and kernel programmers who took time to rewrite code to make it better before a release deadline... That's ...wow. I wish you would not go on the attack like that. Instead, it seems like we can both be glad that we're on the path to having better code! And that there's a team of people volunteering to do this and enjoying writing that code. We're all working together to make things better. We worked really super hard on fixing up this code base. It was a LOT of work. And I would like to keep working on it and feeling good about it. So I'm just disappointed that somehow this has devolved for you into making threats like that. On Mon, Mar 15, 2021 at 6:08 PM Scott Long <scottl(a)netgate.com> wrote: > I’ve also spoken with the FreeBSD Security Officer, and we’ve > agreed that wireguard will be removed from all branches of FreeBSD > until further notice. I’ve also informed Kyle of this. I do not support > its reintroduction into FreeBSD, whether in the src tree or in the > ports tree, at this time. As for pfSense, we are conducting an > audit and will decide on the best course of action for our customers > and our company. I actually think that's a great idea. I was under the impression initially that removing it would be a total non-starter and would just make people upset, hence this hurried mad dash to turn things around. But having an opportunity to take it out of tree and develop it slowly and carefully, like we did for Linux and OpenBSD, sounds a lot better. This also meshes well with what we had planned to do, which I mentioned in the announcement email this morning -- have this available as an out of tree module that people can try out. Then, after we've got it really solid, reintroduce it in the normal FreeBSD ways of doing that. (I'm not so familiar with that latter process, but I trust that Kyle & folks know that part well.) On Mon, Mar 15, 2021 at 6:08 PM Scott Long <scottl(a)netgate.com> wrote: > > Scott So, that's where we are. You're upset and making threats to slander security researchers and kernel programmers. That's really disappointing. All I can do is ask you: please don't? We have much more to gain by supporting each other than being in conflict. I just want to make sure FreeBSD 13 (or 14) gets a great WireGuard implementation. And you want to make sure your customers get great products. I see no reason why these are conflicting goals. I hope this can deescalate, and we can work together on this. I'm confident that our goals are ultimately aligned very well. Regards, Jason

2 2

WSL start up script
by Matthew Skiffington 26 Mar '21

26 Mar '21

For heathens like me that use the windows linux subsystem (wsl): https://askubuntu.com/questions/978977/windows-subsystem-for-linux-display-… Cheers, Matthew

2 1

Alan Turing On UK £50 Note
by Lawrence D'Oliveiro 26 Mar '21

26 Mar '21

The Bank Of England has shown off the upcoming £50 note featuring computing pioneer Alan Turing <https://www.theregister.com/2021/03/25/turing_50_quid/>. The rhyming slang for this denomination is apparently “bullseyes”, but the linked page gives no explanation of the derivation ...

2 1

OpenSSL fixes high-severity flaw that allows hackers to crash servers
by Peter Reutemann 26 Mar '21

26 Mar '21

'On Thursday, OpenSSL maintainers disclosed and patched a vulnerability that causes servers to crash when they receive a maliciously crafted request from an unauthenticated end user. CVE-2021-3449, as the denial-of-server vulnerability is tracked, is the result of a null pointer dereference bug. Cryptographic engineer Filippo Valsorda, said on Twitter that the flaw could probably have been discovered earlier than now. “Anyway, sounds like you can crash most OpenSSL servers on the Internet today,” he added.' -- source: https://arstechnica.com/gadgets/2021/03/openssl-fixes-high-severity-flaw-th… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds On Where Rust Will Fit Into Linux
by Peter Reutemann 25 Mar '21

25 Mar '21

'ZDNet article, written by Steven J. Vaughan-Nichols: Linux is the poster-child for the C language. But times change. The Rust language has been slowly gathering support for use as a system language in Linux. For example, at the 2020 Linux Plumbers Conference, developers gave serious thought to using the Rust language for new Linux inline code. So, where is it today? I asked Linux's creator, Linus Torvalds, and the Linux stable kernel maintainer Greg Kroah-Hartman for their thoughts. [...] What does Torvalds make of all this? He's in "the 'wait and see' camp -- I'm interested in the project, but I think it's driven by people who are very excited about Rust, and I want to see how it actually then ends up working in practice." "Personally," Torvalds is "in no way "pushing" for Rust, [but] I'm open to it considering the promised advantages and avoiding some safety pitfalls, but I also know that sometimes promises don't pan out." Torvalds thinks "Rust's primary first target seems to be drivers, simply because that's where you find just a lot of different possible targets, and you have these individual parts of the kernel that are fairly small and independent. That may not be a very interesting target to some people, but it's the obvious one." Another point is taking on drivers first for "any initial trials to drivers is simply the architecture side," said Torvalds. "Lots of drivers are only relevant on a couple of target architectures, so the whole issue with Rust code not being supported on some architectures is less of an issue." Kroah-Hartman agrees that "drivers are probably the first place for an attempt like this as they are the 'end leafs' of the tree of dependencies in the kernel source. They depend on core kernel functionality, but nothing depends on them." Torvalds knows some people don't like the idea of Rust in userspace at all. "People complain[ing] about "Rustification" in userspace isn't a great sign for any future kernel use, but hey, we'll see. The kernel is different from userspace projects -- more difficult in some respects (we use a lot of very odd header files that pushes the boundary of what can be called "C"), but easier in many other respects (mainly in the sense that the kernel is fairly self-contained, and then doesn't rely on other projects for the final binary)." From where Kroah-Hartman sits, "it will all come down to how well the interaction between the kernel core structures and lifetime rules that are written in C can be mapped into Rust structures and lifetime rules for drivers in Rust to be able to use them properly. That's going to take a lot of careful work by the developers wanting to hook this all up and I wish them the best of luck."' -- source: https://linux.slashdot.org/story/21/03/24/2115238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GNOME 40 Released
by Peter Reutemann 25 Mar '21

25 Mar '21

'The GNOME 40 desktop update has been released with a bunch of new improvements. Phoronix summarizes the major changes: GNOME 40 is out with the GTK4 toolkit in tow, many improvements and alterations to the GNOME Shell including major changes to the dash and workspaces, Mutter has continued refining its Wayland support, Mutter also added a native headless back-end for testing, atomic mode-setting is now supported, input handling is now done in a separate thread, and a wide variety of other improvements. And, yes, there is also the big shift in GNOME's versioning practices moving forward while still sticking to the same six month release regiment. ' -- source: https://tech.slashdot.org/story/21/03/24/1957215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Free software advocates seek removal of Richard Stallman and entire FSF board
by Peter Reutemann 24 Mar '21

24 Mar '21

'Richard Stallman's return to the Free Software Foundation's board of directors has drawn condemnation from many people in the free software community. An open letter signed by hundreds of people today called for Stallman to be removed again and for the FSF's entire board to resign. The open letter said: "Richard M. Stallman, frequently known as RMS, has been a dangerous force in the free software community for a long time. He has shown himself to be misogynist, ableist, and transphobic, among other serious accusations of impropriety. These sorts of beliefs have no place in the free software, digital rights, and tech communities. With his recent reinstatement to the Board of Directors of the Free Software Foundation, we call for the entire Board of the FSF to step down and for RMS to be removed from all leadership positions." Letter signers include Neil McGovern, GNOME Foundation executive director and former Debian Project Leader; Deb Nicholson, general manager of the Open Source Initiative; Matthew Garrett, a former member of the FSF board of directors; seven of the eight members of the X.org Foundation board of directors; Elana Hashman of the Debian Technical Committee, Open Source Initiative, and Kubernetes project; Molly de Blanc of the Debian Project and GNOME Foundation; and more than 300 others. That number has been rising quickly today: the open letter contains instructions for signing it.' -- source: https://arstechnica.com/tech-policy/2021/03/free-software-advocates-seek-re… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

WiMAX Is Dead
by Lawrence D'Oliveiro 23 Mar '21

23 Mar '21

Linux hardware guru Greg Kroah-Hartman is inching closer to dumping all support for WiMAX from the Linux kernel <https://www.theregister.com/2021/03/22/wimax_linux/>. If you’ve never heard of it, you’re not missing anything. I remember reading about it in the earliest days of wireless networking: while Wi-Fi (IEEE 802.11) was about wireless connectivity with mobile endpoints, WiMAX (IEEE 802.16) was designed for connecting between fixed stations. Clearly Wi-Fi can also be used with the latter, though maybe there were some obscure technical reasons why WiMAX was a better fit in the stationary situation. In the early days of Wi-Fi, creative users found ways to transmit it over long distances using high-gain antennas constructed from such low-tech components as Pringles cans. I suspect that Wi-Fi gear, being such a big seller to consumers, was always much cheaper than WiMAX, which is why the latter was never able to gain a foothold.

1 0

Mozilla Firefox Tweaks Referrer Policy To Shore Up User Privacy
by Peter Reutemann 23 Mar '21

23 Mar '21

'Mozilla Firefox will soon include a revised Referrer Policy to tighten up queries and better protect user information. From a report: Firefox 87, due to ship on March 23, will cut back on path and query string information from referrer headers "to prevent sites from accidentally leaking sensitive user data." In a blog post on Monday, developer Dimi Lee and security infrastructure engineering manager Christoph Kerschbaumer said the latest browser version will include a "stricter, more privacy-preserving default Referrer Policy." Browsers send HTTP Referrer headers to websites to indicate which location has 'referred' a user to a website server. Full URLs of referring documents are often sent in the HTTP Referrer header with other subresource requests, and while this may contain innocent information used for purposes including analytics, private user data may also be included. Referrer policies aim to protect this data, but if no policy is set by a website, this often defaults to "no-referrer-when-downgrade," an element that Firefox says does trim down the referrer when navigating to a less secure resource, but still "sends the full URL including path and query information of the originating document as the referrer."' -- source: https://tech.slashdot.org/story/21/03/22/1959256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Richard Stallman Says He Has Returned To the Free Software Foundation Board of Directors and Doesn't Intend To Resign Again
by Peter Reutemann 23 Mar '21

23 Mar '21

'Richard M Stallman, founder and former president of the Free Software Foundation (FSF), announced at the organisation's LibrePlanet virtual event that he has rejoined the board and does not intend to resign again. From a report: Stallman spoke at the event yesterday on the subject of unjust computing -- covering locked-down operating systems, non-free client software, user-restricting app stores, and more. Before the talk he stated: "I have an announcement to make. I'm now on the Free Software Foundation Board of Directors once again. We were working on a video to announce this with, but that turned out to be difficult, we didn't have experience doing that sort of thing so it didn't get finished but here is the announcement. Some of you will be happy at this, and some might be disappointed, but who knows? In any case, that's how it is, and I'm not planning to resign a second time." Stallman resigned both as president and FSF board member in September 2019, saying: "I am doing this due to pressure on the Foundation and me over a series of misunderstandings and mischaracterizations of what I have said." This followed remarks he made concerning MIT professor Marvin Minsky, who died in 2016, and his association with sex offender Jeffrey Epstein. Stallman's resignation was welcomed at the time by some prominent free software advocates including GNOME executive director Neil McGovern and FSF sister organisation FSF Europe.' -- source: https://news.slashdot.org/story/21/03/22/1557250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Rust Takes 'Tentative First Step' Toward Linux Kernel
by Peter Reutemann 21 Mar '21

21 Mar '21

'In his This Week in Programming column, Mike Melanson writes: Rustaceans' dreams of Rust's inclusion in the Linux kernel are one tiny, ever so slight step closer to becoming a reality, with this week's "intentionally bare-bones" inclusion in Linux-next, the development branch of the Linux kernel... Curb your enthusiasm, however, as this remains a rather tentative first step of many necessary steps before Rust fully lands in the Linux kernel. A rather brief post on LWN.net summarizes where we are rather succinctly: Followers of the linux-next integration tree may have noticed a significant addition: initial support for writing device drivers in the Rust language. There is some documentation in Documentation/rust, while the code itself is in the rust top-level directory. Appearance in linux-next generally implies readiness for the upcoming merge window, but it is not clear if that is the case here; this code has not seen a lot of wider review yet. It is, regardless, an important step toward the ability to write drivers in a safer language. Indeed, Miguel Ojeda, a software developer and maintainer of the Rust for Linux project writes that the proposed inclusion "does not mean we will make it into mainline, of course, but it is a nice step to make things as smooth as possible," with some changes expected before any decision as to Rust's inclusion are made. For those of you less familiar with Rust, part of the appeal here comes with Rust's memory safety features, especially in comparison to C, which the Linux kernel is currently coded in. Part of the problem, however, is that Rust is compiled based on LLVM, as opposed to GCC, and subsequently supports fewer architectures. This is a problem we've seen play out recently, as the Python cryptography library has replaced some old C code with Rust, leading to a situation where certain architectures will not be supported. Presently, the proposal to include Rust in the Linux kernel limits this issue by saying that Rust would be used, at least initially, for writing drivers that, as noted in another LWN.net article on the topic, "would never be used on the more obscure architectures anyway."' -- source: https://linux.slashdot.org/story/21/03/20/0321230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Purism Says Unfair iOS Policies Forced it to Remove Its VPN Tunnel from IOS Store
by Peter Reutemann 21 Mar '21

21 Mar '21

'In 2019 Purism launched a suite of privacy-protecting, no-tracking apps and services named Librem One. And it included an encrypted, no-logging, virtual private network tunnel named Librem Tunnel. Unfortunately, "Recently we've been forced to remove Librem Tunnel from iOS due to their unfair policies," explains a post this week on Purism's blog: Apple's policy is that applications that make in-app purchases or offer subscriptions using Apple's payment platform pay Apple 30% of their revenue. The justification behind that fee is that companies are benefiting from all of the work Apple has put into its payments platform and so the fee helps them maintain that payments infrastructure while saving app developers from having to implement their own payment or subscription infrastructure... Recently our VPN endpoints have changed, which required us to update the Librem Tunnel application. Unfortunately our attempts to push an update were blocked, because Apple saw that the application was a VPN, which flagged it to check whether it was a subscription service (which VPNs frequently are). Even though Librem Tunnel is just part of the overall Librem One offering, because it's part of a subscription service, Apple is requiring us to add the ability to sign up and pay for Librem One subscriptions within the Librem Tunnel app before they will allow updated versions into the App Store. Why are they making that requirement even though we already have our own independent payment infrastructure? Because once that app allows in-app purchases, Apple can then automatically take their 30% cut. We do not accept these kinds of monopolistic practices, nor do we want to fund them through our own customers. Since Apple does not allow alternatives to the App Store on their platform, we have no choice but to remove Librem Tunnel from iOS, until such time Apple changes their policies either on their own, or through government intervention. For their existing users on iOS, "Because Librem Tunnel uses the standard, open, OpenVPN protocol, we have been working with customers to apply their OpenVPN configuration to a different iOS OpenVPN client."' -- source: https://apple.slashdot.org/story/21/03/20/0413228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Audacity 3.0 Released
by Lawrence D'Oliveiro 20 Mar '21

20 Mar '21

One thing that’s new <https://www.theregister.com/2021/03/19/audacity_3/> is the file format is now an SQLite database. This integrates everything, including audio data, into a single file, unlike the older .aup file format. Also I hadn’t heard of the “Nyquist” sound-processing system before. Its home page is here <http://www.cs.cmu.edu/~music/nyquist/>. Might be fair to say it’s the world’s most popular audio editor.

1 0

Security Researcher Hides ZIP, MP3 Files Inside PNG Files On Twitter
by Peter Reutemann 19 Mar '21

19 Mar '21

'A security researcher has discovered a novel steganography technique for hiding data inside a Portable Network Graphics (.PNG) image file posted on Twitter, a tactic that could be exploited by threat actors to hide malicious activity. Threatpost reports: Researcher David Buchanan heralded his discovery on Twitter earlier this week, accompanied by a photo declaring: "Save this image and change the extension to .zip!" He made the source code for his method available in a ZIP/PNG file attached to the image as well as on a post on GitHub that explains his methodology. Specifically, Buchanan demonstrated how he could hide both MP3 audio files and ZIP archives within the PNG images hosted on Twitter. The reason he was successful is because while Twitter strips unnecessary data from PNG uploads, they don't remove trailing data from the DEFLATE stream inside the IDAT chunk if the overall image file meets the requirements to avoid being re-encoded, he explained. There are some requirements for both the images used to obscure files and the files being hidden inside them for his method to work, Buchanan explained. "The cover image must compress well, such that the compressed filesize is less than (width * height) -- size_of_embedded_file," he wrote in his post. "If the cover image does not have a palette, then it must have at least 257 unique colors (otherwise Twitter will optimize it to use a palette)." Resolution on images can be up to 4096 x 4096, although Twitter will serve a downscaled version by default for images greater than 680 x 680 depending on certain factors, Buchanan wrote. The image also should not have any unnecessary "metadata chunks," he added. For embedded files, the total output file size must be less than potentially 5MB, but kept under 3MB to be on the safe side, otherwise Twitter will convert the PNG to a JPEG file, Buchanan explained. Moreover, if the embedded file is a ZIP, then the offsets are automatically adjusted so that the overall file is still a valid ZIP, he said. "For any other file formats, you're on your own," Buchanan added, noting that many will work without special parameters, including PDF and MP3 files. ' -- source: https://it.slashdot.org/story/21/03/18/2127257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Topic for next meeting: audio/video
by Peter Reutemann 18 Mar '21

18 Mar '21

Hi everyone Before the last meeting, Ian looked into ffmpeg and was wondering whether it would a good idea for a presentation. I think that widening the topic to general audio/video processing (command line or GUI) would be a rally useful session for people new to Linux (and probably also for more experienced users, finding out about little neat tricks!). Rather than a super in-depth presentation for one application, we can cover a bigger range with a 5-10min show-and-tell per application. I'll assume that Ian will talk about ffmpeg, Lawrence about the other tools that come with ffmpeg, and I will show OBS (Open Broadcaster Software) and Handbrake. Just reply to this thread with your application that you'd like to present. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

4 5

~4,300 publicly reachable servers are posing a new DDoS hazard to the Internet
by Peter Reutemann 18 Mar '21

18 Mar '21

'Criminals are upping the potency of distributed denial-of-service attacks with a technique that abuses a widely used Internet protocol that drastically increases the amount of junk traffic directed at targeted servers. DDoSes are attacks that flood a website or server with more data than it can handle. The result is a denial of service to people trying to connect to the service. As DDoS-mitigation services develop protections that allow targets to withstand ever-larger torrents of traffic, the criminals respond with new ways to make the most of their limited bandwidth. In so-called amplification attacks, DDoSers send requests of relatively small data sizes to certain types of intermediary servers. The intermediaries then send the targets responses that are tens, hundreds, or thousands of times bigger. The redirection works because the requests replace the IP address of the attacker with the address of the server being targeted. Other well-known amplification vectors include the memcached database caching system with an amplification factor of an astounding 51,000, the Network Time Protocol with a factor of 58, and misconfigured DNS servers with a factor of 50. DDoS mitigation provider Netscout said on Wednesday that it has observed DDoS-for-hire services adopting a new amplification vector. The vector is the Datagram Transport Layer Security, or D/TLS, which (as its name suggests) is essentially the Transport Layer Security for UDP data packets. Just as TLS prevents eavesdropping, tampering, or forgery of TLS packets, D/TLS does the same for UDP data. DDoSes that abuse D/TLS allow attackers to amplify their attacks by a factor of 37. Previously, Netscout saw only advanced attackers using dedicated DDoS infrastructure abusing the vector. Now, so-called booter and stressor services—which use commodity equipment to provide for-hire attacks—have adopted the technique. The company has identified almost 4,300 publicly reachable D/LTS servers that are susceptible to the abuse.' -- source: https://arstechnica.com/gadgets/2021/03/mainstream-ddosers-are-abusing-d-tl… Cheers, peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

In-kernel WireGuard is on its way to FreeBSD and the pfSense router
by Peter Reutemann 18 Mar '21

18 Mar '21

'This morning, WireGuard founding developer Jason Donenfeld announced a working, in-kernel implementation of his WireGuard VPN protocol for the FreeBSD 13 kernel. This is great news for BSD folks—and users of BSD-based routing appliances and distros such as pfSense and opnSense.' -- source: https://arstechnica.com/gadgets/2021/03/in-kernel-wireguard-is-on-its-way-t… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

WeLeakInfo Leaked Customer Payment Info
by Peter Reutemann 16 Mar '21

16 Mar '21

'A lapsed domain registration tied to WeLeakInfo, a wildly popular service that sold access to more than 12 billion usernames and passwords from thousands of hacked websites, "let someone plunder and publish account data on 24,000 customers who paid to access the service with a credit card," reports Krebs on Security. This comes after the service was seized a little over a year ago by the FBI and law enforcement partners overseas. From the report: In a post on the database leaking forum Raidforums, a regular contributor using the handle "pompompurin" said he stole the WeLeakInfo payment logs and other data after noticing the domain wli[.]design was no longer listed as registered. "Long story short: FBI let one of weleakinfo's domains expire that they used for the emails/payments," pompompurin wrote. "I registered that domain, & was able to [password] reset the stripe.com account & get all the Data. [It's] only from people that used stripe.com to checkout. If you used paypal or [bitcoin] ur all good." Cyber threat intelligence firm Flashpoint obtained a copy of the data leaked by pompompurin, and said it includes partial credit card data, email addresses, full names, IP addresses, browser user agent string data, physical addresses, phone numbers, and amount paid. One forum member commented that they found their own payment data in the logs. ' -- source: https://it.slashdot.org/story/21/03/15/2117240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Redesign Drops Compact Density Option
by Peter Reutemann 16 Mar '21

16 Mar '21

'Firefox's "Compact density" option, which reduces the size of the user interface, is set to disappear when Mozilla rolls out its Proton visual redesign for the browser later this year. PCMag reports: A bug was posted on Mozilla's bug tracking system entitled "Remove compact mode inside Density menu of customize palette." The reasons given for its removal include the fact it's "currently fairly hard to discover" and "we assume gets low engagement." The development team wants to "make sure that we design defaults that suit most users and we'll be retiring the compact mode for this reason." The Bugzilla thread highlights a desire for compact density to be retained as an option, but it doesn't seem likely to survive right now. When Proton arrives, the Normal and Touch density options are expected to remain, with Touch increasing the size of the user interface to make it more finger-friendly. Meanwhile, the development team is optimizing the Normal density for displays that use 768 pixels for height, while most displays now use a higher resolution than that. Hopefully this doesn't mean the UI will be larger than it is now by default.' -- source: https://news.slashdot.org/story/21/03/15/2122201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Tim Berners-Lee Says Too Many Young People Are Excluded From Web
by Peter Reutemann 16 Mar '21

16 Mar '21

'Too many young people around the world are excluded from accessing the web, and getting them online should be a priority for the post-Covid era, Tim Berners-Lee has said. From a report: In a letter published to mark the 32nd birthday of the web, its founder says the opportunity "to reimagine our world and create something better" in the aftermath of Covid-19 must be channelled to getting internet access to the third of people aged between 15 and 24 who are offline. "The influence of young people is felt across their communities and online networks," Berners-Lee writes. "But today we're seeing just a fraction of what's possible. Because while we talk about a generation of 'digital natives,' far too many young people remain excluded and unable to use the web to share their talents and ideas. "A third of young people have no internet access at all. Many more lack the data, devices and reliable connection they need to make the most of the web. In fact, only the top third of under-25s have a home internet connection, according to Unicef, leaving 2.2 billion young people without the stable access they need to learn online, which has helped so many others continue their education during the pandemic." Even though young people are more likely than the typical global citizen to have internet access -- roughly half the world is online, but the figure rises to 70% of people aged between 15 and 25 -- Berners-Lee argues that aiming to connect every young person in the world to the web would reap dividends. He also says doing so would be relatively cheap compared with the cost of many government programmes launched over the last 12 months. He estimates that an investment of $428bn over the next decade would provide everyone with a quality broadband connection.' -- source: https://tech.slashdot.org/story/21/03/15/1948259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'A Hacker Got All My Texts For $16'
by Peter Reutemann 16 Mar '21

16 Mar '21

'A report from Motherboard, written by Joseph Cox: I didn't expect it to be that quick. While I was on a Google Hangouts call with a colleague, the hacker sent me screenshots of my Bumble and Postmates accounts, which he had broken into. Then he showed he had received texts that were meant for me that he had intercepted. Later he took over my WhatsApp account, too, and texted a friend pretending to be me. Looking down at my phone, there was no sign it had been hacked. I still had reception; the phone said I was still connected to the T-Mobile network. Nothing was unusual there. But the hacker had swiftly, stealthily, and largely effortlessly redirected my text messages to themselves. And all for just $16. I hadn't been SIM swapped, where hackers trick or bribe telecom employees to port a target's phone number to their own SIM card. Instead, the hacker used a service by a company called Sakari, which helps businesses do SMS marketing and mass messaging, to reroute my messages to him. This overlooked attack vector shows not only how unregulated commercial SMS tools are but also how there are gaping holes in our telecommunications infrastructure, with a hacker sometimes just having to pinky swear they have the consent of the target. "I used a prepaid card to buy their $16 per month plan and then after that was done it let me steal numbers just by filling out LOA info with fake info," said Lucky225, the pseudonymous hacker who carried out the attack, referring to a Letter of Authorization, a document saying that the signer has authority to switch telephone numbers. In a statement to Motherboard, Senator Ron Wyden said: "Itâ(TM)s not hard to see the enormous threat to safety and security this kind of attack poses. The FCC must use its authority to force phone companies to secure their networks from hackers. Former Chairman Paiâ(TM)s approach of industry self-regulation clearly failed."' -- source: https://yro.slashdot.org/story/21/03/15/1950245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

IBM's Patent Income Slips as Companies Resist 'Godfather' Deals
by Peter Reutemann 15 Mar '21

15 Mar '21

'"Even as IBM has sued an increasing number of companies, its IP income has shrunk," reports Bloomberg: Intellectual property rights historically brought in more than $1 billion a year, on average, helping offset massive research and development costs and shrinking revenue. Last year, IBM's income from intellectual property was $626 million, its lowest point since 1996, and 2019 wasn't much higher. While it continues to secure license deals, they are fewer and harder-won, with companies like Airbnb Inc. and Chewy Inc. waging battles in court... In February, online pet-food seller Chewy requested a court order to block a $36 million patent fee IBM is demanding. Chewy accused IBM of "seeking exorbitant licensing fees for early internet patents having no value." IBM's claims against Chewy include years-old inventions such as targeted advertising and content resizing based on cursor activity, both ubiquitous on the web. Chewy said IBM doesn't make or sell products covered by the vast majority of the thousands of patents it has received over the past 20 years, but instead just threatens to sue if companies don't agree to pay for licenses. IBM has not answered Chewy's complaint, and no trial date has been set. Companies that use their IP licensing aggressively as a way to make money are often referred to as patent trolls. However, IBM's position as the largest aggregator of U.S. intellectual property is more akin to being a patent godfather, says Robin Feldman, a law professor at the University of California, Hastings. With more than 38,000 active patents in its portfolio, and thousands of license agreements bolstering its legitimacy, IBM's demands have traditionally gone unchallenged, Feldman said. Such patent godfathers, with large portfolios, are "able to make offers that can't be refused." Even some of the most innovative technology giants have licensed IBM patents over the years. Alphabet Inc.'s Google, Amazon.com Inc. and LinkedIn are among countless companies that have had to pony up. IBM also has long served as a patent bank for young companies to jump-start their portfolios. Facebook Inc. was not yet public in 2012 when it bought 750 patents on software and networking from IBM. As Instacart Inc. prepares to go public, it purchased almost 300 IBM patents in January ranging from e-commerce to smart shopping bags. Noting a series of Supreme Court verdicts making it easier to invalidate a patent, Feldman, the law professor, told Bloomberg that "Being the godfather isn't what it used to be. It's not that patent aggregation as a business is over. You just make less money."' -- source: https://yro.slashdot.org/story/21/03/13/2120248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Decentralized Routing Protocol Aims To Replace BGP
by Peter Reutemann 15 Mar '21

15 Mar '21

'"The Border Gateway Protocol was first described in 1989...," according to Wikipedia, "and has been in use on the Internet since 1994." But now long-time Slashdot reader jovius reports that a startup named Syntropy "aims to replace BGP as the default routing method of the internet, by using nodes around the world to constantly gather data of the inefficiencies of the current network." The intelligence is then used to route data via the most efficient routes. Actual tests with hundreds of servers have proved that latencies can be reduced by tens to hundreds of milliseconds. The connections are by default encrypted, and jitter is also reduced. Eventually, the company-run servers are augmented with tens of thousands of nodes run by users/smart devices, who are rewarded for their work. The team was recently joined by former SVP at Verizon Shawn Hakl and former Chief Product Officer at AT&T Roman Pacewicz. One of the founders of Syntropy is the co-founder of Equinix and NANOG Bill Norton. Syntropy is an Oracle and Microsoft partner, and transforming into a foundation and DAO to govern the protocol work. Decentralised autonomous routing protocol (or DARP) has just been opened for community testing, and the system is live on https://darp.syntropystack.com/. ' -- source: https://tech.slashdot.org/story/21/03/14/1910257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Three Flaws in the Linux Kernel Since 2006 Could Grant Root Privileges
by Peter Reutemann 14 Mar '21

14 Mar '21

'"Three recently unearthed vulnerabilities in the Linux kernel, located in the iSCSI module used for accessing shared data storage facilities, could allow root privileges to anyone with a user account," reports SC Media: "If you already had execution on a box, either because you have a user account on the machine, or you've compromised some service that doesn't have repaired permissions, you can do whatever you want basically," said Adam Nichols, principal of the Software Security practice at GRIMM. While the vulnerabilities "are in code that is not remotely accessible, so this isn't like a remote exploit," said Nichols, they are still troublesome. They take "any existing threat that might be there. It just makes it that much worse," he explained. "And if you have users on the system that you don't really trust with root access it, it breaks them as well." Referring to the theory that 'many eyes make all bugs shallow,' Linux code "is not getting many eyes or the eyes are looking at it and saying that seems fine," said Nichols. "But, [the bugs] have been in there since the code was first written, and they haven't really changed over the last 15 years...." That the flaws slipped detection for so long has a lot to do with the sprawl of the the Linux kernel. It "has gotten so big" and "there's so much code there," said Nichols. "The real strategy is make sure you're loading as little code as possible." The bugs are in all Linux distributions, Nichols said, although the kernel driver is not loaded by default. Whether a normal user can load the vulnerable kernel module varies. They can, for instance, on all Red Hat based distros that GRIMM tested, he said. "Even though it's not loaded by default, you can get it loaded and then of course you can exploit it without any trouble...." The bugs have been patched in the following kernel releases: 5.11.4, 5.10.21, 5.4.103, 4.19.179, 4.14.224, 4.9.260, and 4.4.260. All older kernels are end-of- life and will not receive patches. ' -- source: https://linux.slashdot.org/story/21/03/13/0118217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi Foundation Launches $4 Microcontroller With Custom Chip
by Peter Reutemann 14 Mar '21

14 Mar '21

'Meet the Raspberry Pi Pico, a tiny little microcontroller that lets you build hardware projects with some code running on the microcontroller. Even more interesting, the Raspberry Pi Foundation is using its own RP2040 chip, which means that the foundation is now making its own silicon. From a report: If you're not familiar with microcontrollers, those devices let you control other parts or other devices. You might think that you can already do this kind of stuff with a regular Raspberry Pi. But microcontrollers are specifically designed to interact with other things. They're cheap, they're small and they draw very little power. You can start developing your project with a breadboard to avoid soldering. You can pair it with a small battery and it can run for weeks or even months. Unlike computers, microcontrollers don't run traditional operating systems. Your code runs directly on the chip. Like other microcontrollers, the Raspberry Pi Pico has dozens of input and output pins on the sides of the device. Those pins are important as they act as the interface with other components. For instance, you can make your microcontroller interact with an LED light, get data from various sensors, show some information on a display, etc. The Raspberry Pi Pico uses the RP2040 chip. It has a dual-core Arm processor (running at 133MHz), 264KB of RAM, 26 GPIO pins including 3 analog inputs, a micro-USB port and a temperature sensor. It doesn't come with Wi-Fi or Bluetooth. And it costs $4.' -- source: https://hardware.slashdot.org/story/21/01/21/1258214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 4

Critics fume after Github removes exploit code for Exchange vulnerabilities
by Peter Reutemann 13 Mar '21

13 Mar '21

'Github has ignited a firestorm after the Microsoft-owned code-sharing repository removed a proof-of-concept exploit for critical vulnerabilities in Microsoft Exchange that have led to as many as 100,000 server infections in recent weeks. ProxyLogon is the name that researchers have given both to the four Exchange vulnerabilities under attack in the wild and the code that exploits them. Researchers say that Hafnium, a state-sponsored hacking group based in China, started exploiting ProxyLogon in January, and within a few weeks, five other APTs—short for advanced persistent threat groups—followed suit. To date, no fewer than 10 APTs have used ProxyLogon to target servers around the Microsoft issued emergency patches last week, but as of Tuesday, an estimated 125,000 Exchange servers had yet to install it, security firm Palo Alto Networks said. The FBI and the Cybersecurity and Infrastructure Security Agency have warned that ProxyLogon poses a serious threat to businesses, nonprofits, and government agencies that remain vulnerable. On Wednesday, a researcher published what’s believed to be the first largely working proof-of-concept (PoC) exploit for the vulnerabilities. Based in Vietnam, the researcher also published a post on Medium describing how the exploit works. With a few tweaks, hackers would have most of what they needed to launch their own in-the-wild RCEs, security speak for remote code execution exploits. Publishing PoC exploits for patched vulnerabilities is a standard practice among security researchers. It helps them understand how the attacks work so that they can build better defenses. The open source Metasploit hacking framework provides all the tools needed to exploit tens of thousands of patched exploits and is used by black hats and white hats alike. Within hours of the PoC going live, however, Github removed it. By Thursday, some researchers were fuming about the takedown. Critics accused Microsoft of censoring content of vital interest to the security community because it harmed Microsoft interests. Some critics pledged to remove large bodies of their work on Github in response.' -- source: https://arstechnica.com/gadgets/2021/03/critics-fume-after-github-removes-e… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

7-Zip Developer Releases the First Official Linux Version
by Peter Reutemann 13 Mar '21

13 Mar '21

'An official version of the popular 7-zip archiving program has been released for Linux for the first time. Bleeping Computer reports: Linux already had support for the 7-zip archive file format through a POSIX port called p7zip but it was maintained by a different developer. As the p7zip developer has not maintained their project for 4-5 years, 7-Zip developer Igor Pavlov decided to create a new official Linux version based on the latest 7-Zip source code. Pavlov has released 7-Zip for Linux in AMD64, ARM64, x86, and armhf versions, which users can download [via their respective links]. "These new 7-Zip binaries for Linux were linked (compiled) by GCC without -static switch. And compiled 32-bit executables (x86 and armhf) didn't work on some arm64 and amd64 systems, probably because of missing of some required .so files." "Please write here, if you have some advices how to compile and link binaries that will work in most Linux systems," Pavlov stated on his release page. ' -- source: https://hardware.slashdot.org/story/21/03/12/2144238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

emergency mode
by thomas 11 Mar '21

11 Mar '21

Hello everybody hope all are well... but not me. This mail is from an old lappi with 12.04. because my current lap 18.04. is in emergency mode and I tried all advice from google and ubuntu to no success. Luckily I found you and hope you can help. I am not an IT expert just a normal user but this is business related and quite urgent. I am in Raglan and wheelchair bound but able to come to Hamilton any time and will pay any cost incurred. Thank you very much for your response Kind Regards Thomas Koppen

1 0

Up To 60,000 Computer Systems Exposed In Germany To Microsoft Flaw
by Peter Reutemann 11 Mar '21

11 Mar '21

'As many as 60,000 computer systems in Germany were exposed to a flaw that allows unauthorized users to access systems in Microsoft's email software, the head of its cybersecurity watchdog said on Wednesday. Reuters reports: More than half of the vulnerabilities were addressed following a warning last weekend by the Federal Office for Information Security (BSI), but around 25,000 systems still need to be fixed, BSI chief Arne Schoenbohm said. "The warning has worked. In Germany, many Exchange servers have been secured by downloading patches," Schoenbohm said in written comments to Reuters. "Every vulnerable system is one too many and can lead to harm." In a 14-page report on the Microsoft vulnerability, the BSI said the behavior of hackers exploiting it had changed sharply since it was publicly revealed. Initially, most targets had been think tanks, universities, non-governmental organizations, law firms and defense companies - mostly in the United States. "Now, these exploits are being deployed at mass scale against thousands of targets - apparently worldwide," the report said. At least 10 different hacking groups were using the latest flaw in Microsoft's mail server software to break into targets around the world, according to researchers at cybersecurity company ESET. In Germany, two federal authorities have been affected by the hack, the BSI said, declining to say which. ' -- source: https://it.slashdot.org/story/21/03/10/2230234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers access security cameras inside Cloudflare, jails, and hospitals
by Peter Reutemann 11 Mar '21

11 Mar '21

'Hackers say they broke into the network of Silicon Valley startup Verkada and gained access to live video feeds from more than 150,000 surveillance cameras the company manages for Cloudflare, Tesla, and a host of other organizations. The group published videos and images they said were taken from offices, warehouses, and factories of those companies as well as from jail cells, psychiatric wards, banks, and schools. Bloomberg News, which first reported the breach, said footage viewed by a reporter showed staffers at Florida hospital Halifax Health tackling a man and pinning him to a bed. Another video showed a handcuffed man in a police station in Stoughton, Massachusetts, being questioned by officers. “I don’t think the claim ‘we hacked the internet’ has ever been as accurate as now,” Tillie Kottmann, a member of a hacker collective calling itself APT 69420 Arson Cats, wrote on Twitter.' -- source: https://arstechnica.com/information-technology/2021/03/hackers-access-secur… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Foundation Debuts Sigstore Project for Software Signing
by Peter Reutemann 11 Mar '21

11 Mar '21

'The Linux Foundation has announced the launch of Sigstore, a new nonprofit initiative that aims to improve open source software supply chain security by making it easier for developers to adopt cryptographic signing for different components of the software development process. From a report: Sigstore will be free for software providers and developers, who can use it to securely sign software artifacts such as release files, container images, binaries, and bill-of-material manifests. Signing materials are then stored in a tamper-proof public log. The service's code and operation tooling will be fully open source and maintained and developed by the Sigstore community. Founding members include Red Hat, Google, and Purdue University. The idea for the service came from Luke Hinds, security engineering lead in Red Hat's Office of the CTO. He pitched the concept to Google software engineer Dan Lorenc, and the two began to work on it. Now the Sigstore project has a "small but agile community" working on its development, Lorenc says.' -- source: https://linux.slashdot.org/story/21/03/10/1446201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome OS Did Lots of Growing Up in Its First Decade -- and There's More To Come
by Peter Reutemann 10 Mar '21

10 Mar '21

'FastCompany has a feature story on Chrome OS, which has turned 10. The story talks about a new feature of Chrome OS: A new version of Chrome OS rolling out starting today will introduce a long-under-development Phone Hub feature that'll let you see and interact with notifications from your Android phone on your Chromebook, without any complex configuration or clunky software required. You'll also be able to silence your phone, adjust some of its settings, and see and access recent Chrome browser tabs you had open on the device right from your Chrome OS desktop. Carefully examined clues in Google's open-source Chromium code suggest the system could eventually do even more -- with some indications that full-fledged phone-mirroring that would let you get access to all the apps and files on your phone from your Chromebook could be in the cards. I asked John Solomon's (VP and GM of Chrome OS at Google) colleague, Chrome OS Product Manager, Engineering, and UX Lead John Maletis, if and when such a capability might come online, and while he wouldn't outright confirm any future plans, he did allow that what we're seeing now is only scratching the surface. "You're just seeing the beginning," he says. "That little tiny Phone Hub real estate -- I would put a big 'Watch This Space' on it, because there's a lot of stuff we can and will do there." The publication also touched on Fuchsia, a new operating system that Google has been working on for several years: My final pressing question about the future of Chrome OS is simply how much of it there will be. In a familiar twist, the Android- and Chrome-OS-watching communities are once again filled with speculation that Google could be working to bring the two platforms together -- this time by way of a mysterious underdeveloped Google operating system known as Fuchsia. Officially, Google says only that Fuchsia is an "open-source effort to create a production-grade operating system that prioritizes security, updatability, and performance" across a "broad range of devices." But the vague nature of its ultimate purpose along with some eyebrow-raising bits of progress in its development -- such as the recent move to allow the operating system to support both Android and Linux apps as native programs -- raise some interesting questions about what, exactly, Google is actually up to with the effort. Solomon declined to answer directly about if or how Fuchsia might one day replace or otherwise relate to Chrome OS (and there are certainly more nuanced, less black-and-white possibilities to consider), but he did offer up some broad thoughts on what Google hopes to accomplish as time wears on.' -- source: https://tech.slashdot.org/story/21/03/09/2014247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

MIPS Technologies Joins RISC-V, Moves To Open-Source ISA Standard
by Peter Reutemann 09 Mar '21

09 Mar '21

'MIPS Technologies, the company that had been synonymous with the MIPS processor architecture, will now be developing processors based on RISC-V architecture. TuxPhones reports: The MIPS silicon manufacturer is one of the oldest RISC chip manufacturers, used in several systems since the late 80s. Characterized by clean and efficient designs, allowing adaption in varied applications, this company has been considered one of the most innovative in the market during its golden age - to the point that the Windows OS had a MIPS port in the early 90s. However, the company has been struggling with an increasingly lower market share and risked bankruptcy in recent years, ultimately leading to acquisition by start-up Wave Computing, which faced bankruptcy last year. How this company was reborn just weeks ago, exiting the state of bankruptcy, is surprising, but not at all irrational: in its official statement, (the new) MIPS has become a member of RISC-V International, the non-profit organization managing the fully open-hardware ISA, substantially replacing their current architecture with the de facto open chip standard in its entirety. Licensing of the original MIPS architecture to third parties will probably be managed as before, so that the "old" architecture will remain available upon need. This is officially known as the "8th generation" of MIPS chips, indicating a total architectural gap from the previous seven iterations, essentially leaving the old architecture and fully embracing the new one. The Electronic Engineering Journal says it's likely that the new MIPS will continue to honor pre-existing licensing agreements, but it's unclear what level of support the company will offer for older MIPS-based chip designs.' -- source: https://hardware.slashdot.org/story/21/03/08/2117238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Demand for fee to use password app LastPass sparks backlash
by Peter Reutemann 09 Mar '21

09 Mar '21

'A popular app that promised to eliminate the burden of remembering passwords has sparked a backlash by demanding, weeks after it was acquired by two private equity firms, that users pay up or face restrictions on access to their online accounts. LastPass has encouraged millions of people to replace weak passwords on retail websites, Internet banks and other online services. Instead, the software handles authentication automatically using long, complex passwords that are impossible to guess—or remember. Two investment firms, Elliott Management and Francisco Partners, acquired the service as part of their $4.3 billion buyout of Internet software group LogMeIn in September last year. Now, the app is warning users that they must pay as much as $36 a year if they want access to those cumbersome passwords on all their devices. Those who refuse to pay will have to choose between synching only to their desktop computers, or only to mobile devices such as phones.' -- source: https://arstechnica.com/gadgets/2021/03/demand-for-fee-to-use-password-app-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Ask Slashdot: What Do You Use for Backups at Home?
by Peter Reutemann 09 Mar '21

09 Mar '21

'"I am curious as to what other Slashdotters use for backing up of home machines," asks long-time Slashdot reader serviscope_minor: I moved away from the "bunch of disks with some off site" method. I found most of the methods generally had one or more of the following problems: poor Linux support, weak security (e.g. leaking file names), outrageously expensive, hard to set up, tied to a single storage supplier I don't fully trust, entirely proprietary (which makes me doubt long term stability), lack of file history, reputation for slowness, and so on. My current solution is Unixy: separate tools for separate jobs. Borg for backups to a local machine. Rclone for uploading to business cloud storage, versioned cloud storage to provide resistance against bitrot and other corruption. They're interested in "what other Slashdotters use," as well as "why and what your experience has been given more than superficial testing." So share you own thoughts in the comments. What do you use for backups at home? ' -- source: https://ask.slashdot.org/story/21/03/07/1716224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hamilton Astronomical Society - Telescope Software
by Peter Reutemann 09 Mar '21

09 Mar '21

Hi everyone Please see email below from Charles Cooper, the president of the astronomical society here in Hamilton, looking for volunteers (I don't think so that he will turn away non-students!). If you are interested, please contact me off-list and I can put you in touch. Cheers, Peter === Hi Alvin Hope all is well with you and the team. Quick email to reach out to ask if you would be able to point me in the right direction regarding getting some CS students engaged in supporting the current telescope software upgrades at the Hamilton Observatory. I'm the president of the society, outside of my other jobs and we are currently renovating and repairing the custom, 24" Telescope built by members in the 90s. The scope hardware is now back up and running and we are working with some of our members to get the software in place to be able to steer the scope. We are 80% of the way there and I'm trying to get it finished off but we're in need of some volunteers with a background in Arduino and C (simplified arduino C++ not fully fledged C) that can help us finalise the code. We're a volunteer organisation so there is no payment we're all just working towards getting the scope up and running again. We have 2 devs / technical people working on the scope code but they only have so much time between them so I said that I would reach out to the uni to see if any student's might be interested. Potentially we could offer reduced fees on events or memberships as an incentive but we are hoping that the project is interesting enough to attract some attention. If any of your students have an interest in astronomy it would be a good way to get involved with the society and meet some like minded people. There is a git repo and 2 lead devs to help with the onboarding / learning process. Any assistance you could provide would be much appreciated. cheers Charlie -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

What's the Best Linux Distro for Enhanced Privacy and Security?
by Peter Reutemann 08 Mar '21

08 Mar '21

'Slashdot reader b-dayyy quotes the Linux Security blog: While all Linux 'distros' — or distributed versions of Linux software — are secure by design, certain distros go above and beyond when it comes to protecting users' privacy and security. We've put together a list of our favorite specialized secure Linux distros and spoken with some of their lead developers to find out first-hand what makes these distros so great. This "favorites" list cites six "excellent specialized secure Linux distros." Some highlights from the article: In a conversation with the LinuxSecurity editors, Qubes OS Community Manager Andrew David Wong elaborated, "Rather than attempting to fix all of the security bugs in software, Qubes assumes that all software is buggy and compartmentalizes it accordingly, so that when flaws are inevitably exploited, the damage is contained and the user's most valuable data is protected." A Kali Linux contributor provides some insight into the distro's history and the benefits it offers users: "Named after a Hindu goddess, Kali has been around for a long time — but it's still updated weekly, can be run in live mode or installed to a drive, and can also be used on ARM devices like Raspberry Pi." Obviously there's strong opinions among Slashdot readers. So share your own thoughts in the comments. What's the best Linux distro for enhanced privacy and security?' -- source: https://linux.slashdot.org/story/21/03/06/0445226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How a Malicious Actor Targeted a Go Package On GitHub
by Peter Reutemann 08 Mar '21

08 Mar '21

'ArghBlarg (Slashdot reader #79,067) shares some research from a senior application security engineer at GitLab: Michael Henrikson describes his investigations into Go package manager "supply chain" attacks and found at least one very suspicious package, typosquatting on one of the most popular logging libraries. The imposter package phones home to an IP he alleges belongs to the Chinese company Tencent, a good case for always going over your package imports, in any language, and ensuring you're either a) auditing them regularly, or b) keeping frozen vendored copies which you can trust. >From the article: I honestly expected the list to be bigger, but I was of course happy to see that the Go ecosystem isn't completely infested (yet) with malicious typosquat packages... It looks like the author utfave wants to know the hostname, operating system, and architecture of all the machines using their version of urfave/cli. The function extracts the system information and then calls out to the IP address 122.51.124.140 belonging to the Chinese company Shenzhen Tencent Computer Systems via HTTP with the system information added as URL parameters. While this code won't give them any access to systems, it's highly suspicious that they collect this information and the actor can quickly change this code to call back with a reverse shell if they identify a system to be valuable or interesting... I think Go is in a better situation than other programming languages because the source of packages is always explicitly written every time they are used, but code editor automation could make typosquat attacks more likely to happen as the developer doesn't write the import paths manually as often. ' -- source: https://it.slashdot.org/story/21/03/06/2123250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Retired Microsoft OS Engineer's Comparison of Linux with Windows
by Peter Reutemann 08 Mar '21

08 Mar '21

'David Plummer is a retired Microsoft operating systems engineer, "going back to the MS-DOS and Windows 95 days." (He adds that in the early '90s he'd fixed a few handle leaks in the early source code of Linux, "and sent my changes off to Linus at Rutgers.") This weekend on YouTube he shared his thoughts on "the classic confrontation: Windows versus Linux," promising an "epic operating systems face-off." Some highlights: On Usability: "Linux's itself lacks a proper user interface beyond the command line. That command line can be incredibly powerful, particularly if you're adept with Bash or Zsh or similar, but you can't really describe it as particularly usable. Of course most distributions do come with a desktop user interface of some kind if you prefer, but as a bit of a shell designer myself, if I might be so bold, they're generally pretty terrible. At least the Mint distribution looks pretty nice. "Windows, on the other hand, includes by default a desktop shell interface that, if you set aside the entirely subjective design aesthetics, is professionally designed, usability tested and takes into consideration the varying levels of accessibility required by people with different limitations. In terms of usability, particularly if you do include accessibility in that metric, Windows comes out ahead..." On Updates: "Windows users are well served by a dedicated Windows Update team at Microsoft, but the process has occasionally had its hiccups and growing pains. It's very easy to update a Linux system, and while there's no professional team sitting by the big red phone ready to respond to Day Zero exploits, the updates do come out with reasonable alacrity, and in some cases you can even update the kernel without rebooting. "Keep in mind, however, that Linux is a monolithic kernel, which means that it's all one big happy kernel. Almost everything is in there. If they hadn't started to add that ability a few years back, you'd be rebooting for every driver install. The reality is that some parts of the Linux kernel are just going to require a reboot, just as some parts of the Windows system are going to as well. I think we can likely all agree, however, that Windows software is hardly selective about rebooting the system, and you're asked to do it far too often. "While we're on the topic of upgrades, we can't overlook the fact that upgrades are generally free in the Open Source world, unless you're using a pre-built distribution from a vendor. To it's credit, though, I don't remember the last time Microsoft actually charged for an operating system upgrade if you were just a normal end user or enthusiast. Still, this point goes to Linux." Plummer also says he agrees with that argument that open source software is more open to security exploits, "simply because, all else equal, it's easy to figure out where the bugs are to exploit in the first place," while proprietary software has professional test organizations hunting for bugs. "I think it's a bit of a fallacy to rely on the 'many eyeballs' approach..." Yet he still ultimately concludes Linux is more secure simply because the vast universe of Windows makes it a much more attractive target. Especially since most Windows users retain full administrator privileges...' -- source: https://tech.slashdot.org/story/21/03/07/2030221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AI Confusing Pictures And Words
by Lawrence D'Oliveiro 07 Mar '21

07 Mar '21

A machine-learning model that has been trained to recognize both text and pictures can sometimes mix them up <https://www.theregister.com/2021/03/05/openai_writing_attack/>. So, for example, if the word “pizza” occurs in a picture, it can conclude that it is a picture of pizza. As the subhead suggests, “Trick future robot overlords by scribbling ‘superuser’ on your forehead”.

1 0

Can Users Poison the Data Big Tech Uses to Surveil Them?
by Peter Reutemann 07 Mar '21

07 Mar '21

'"Algorithms are meaningless without good data. The public can exploit that to demand change," argues a new article in MIT's Technology Review (shared by long-time Slashdot reader mspohr): Data is fed into machine-learning algorithms to target you with ads and recommendations. Google cashes your data in for over $120 billion a year of ad revenue. Increasingly, we can no longer opt out of this arrangement... Now researchers at Northwestern University are suggesting new ways to redress this power imbalance by treating our collective data as a bargaining chip... In a new paper being presented at the Association for Computing Machinery's Fairness, Accountability, and Transparency conference next week, researchers including PhD students Nicholas Vincent and Hanlin Li propose three ways the public can exploit this to their advantage: Data strikes, inspired by the idea of labor strikes, which involve withholding or deleting your data so a tech firm cannot use it — leaving a platform or installing privacy tools, for instance. Data poisoning, which involves contributing meaningless or harmful data. AdNauseam, for example, is a browser extension that clicks on every single ad served to you, thus confusing Google's ad-targeting algorithms. Conscious data contribution, which involves giving meaningful data to the competitor of a platform you want to protest, such as by uploading your Facebook photos to Tumblr instead. Will we someday see "white-hat data poisoners" trying to convince tech companies that the best place to advertise is the classified sections of small local newspapers? While the researchers believe sporadic individual actions have little impact, the article takes this to its ultimate conclusion. "What if millions of people were to coordinate to poison a tech giant's data well...? That might just give them some leverage to assert their demands."' -- source: https://yro.slashdot.org/story/21/03/06/0149242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Why the 'Small Internet' Movement Wants to Revive Gopher
by Peter Reutemann 07 Mar '21

07 Mar '21

'Linux magazine: The danger and irritations of the modern web have unleashed a movement dedicated to creating a safer and simpler alternative. The old Gopher network and the new Gemini protocol have emerged as building blocks for this new "small Internet." Anyone who has used the World Wide Web (WWW) lately knows that something bad is happening to it. It does not resemble the WWW of the early years, with enthusiastic amateurs freely sharing ideas and information. These things still exist, and the web is still an indispensable medium connecting the world. But the web experience is now encumbered with advertising, invasions of privacy in the form of pervasive tracking, enormous file sizes, CPU straining JavaScript, the danger of exploits, and door slams asking you to subscribe to a newsletter before viewing a site. This unpleasant environment has led to a backlash. There are now some communities of developers and computer users who still desire a connected information system, but who seek a refuge from the noise, danger, and increasingly resource-hungry WWW. They feel that web technology does too much, and that since it makes various forms of abuse too easy, no lasting reform is possible. The solution is to use or create a separate protocol that is simply not capable of supporting the technologies that enable advertising networks, user fingerprinting, or the myriad of other things that exploit users rather than helping them. This small movement has approached the problem from two directions that in practice are often merged: the revival of the Gopher protocol and the creation of a new protocol called Gemini. Gemini would support its own lightweight hypertext format, and would co-exist with Gopher and HTTP as an alternative client-server protocol with built-in privacy-assuring features like mandatory Transport Layer Security and a "Trust On First Use" public-key security model. ("Connections are closed at the end of a single transaction and cannot be reused," notes the Project Gemini home page.) "You may think of Gemini as 'the web, stripped right back to its essence,'" explains its FAQ, "or as 'Gopher, souped up and modernised just a little', depending upon your perspective..." "Gemini is also intended to be very privacy conscious, to be difficult to extend in the future (so that it will *stay* simple and privacy conscious), and to be compatible with a 'do it yourself' computing ethos."' -- source: https://tech.slashdot.org/story/21/03/06/014255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The One-Week Hijacking of Perl.com - Explained
by Peter Reutemann 07 Mar '21

07 Mar '21

'"For a week we lost control of the Perl.com domain," a long-running site offering news and articles about the programming language, writes the site's senior editor, brian d foy. "Now that the incident has died down, we can explain some of what happened and how we handled it." This incident only affected the domain ownership of Perl.com and there was no other compromise of community resources. This website was still there, but DNS was handing out different IP numbers... Recovering the domain wasn't the end of the response though. While the domain was compromised, various security products had blacklisted Perl.com and some DNS servers had sinkholed it. We figured that would naturally work itself out, so we didn't immediately celebrate the return of Perl.com. We wanted it to be back for everyone. And, I think we're fully back. However, if you have problems with the domain, please raise an issue so we at least know it's not working for part of the internet. What we think happened This part veers into some speculation, and Perl.com wasn't the only victim. We think that there was a social engineering attack on Network Solutions, including phony documents and so on. There's no reason for Network Solutions to reveal anything to me (again, I'm not the injured party), but I did talk to other domain owners involved and this is the basic scheme they reported. John Berryhill provided some forensic work in Twitter that showed the compromise actually happened in September. The domain was transferred to the BizCN registrar in December, but the nameservers were not changed. The domain was transferred again in January to another registrar, Key Systems, GmbH. This latency period avoids immediate detection, and bouncing the domain through a couple registrars makes the recovery much harder... Once transferred to Key Systems in late January, the new, fraudulent registrant listed the domain (along with others), on Afternic (a domain marketplace). If you had $190,000, you could have bought Perl.com. This was quickly de-listed after the The Register made inquiries. "I think we were very fortunate here and that many people with a soft spot in their hearts for Perl did a lot of good work for us," the article notes. "All sides understood that Perl.com belonged to Tom and it was a simple matter of work to resolve it. A relatively unknown domain name might not fare as well in proving they own it..." But again, the incident ended happily, foy writes, and "The Perl.com domain is back in the hands of Tom Christiansen and we're working on the various security updates so this doesn't happen again. The website is back to how it was and slightly shinier for the help we received."' -- source: https://developers.slashdot.org/story/21/03/06/0510239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

CentOS Is Gone -- But RHEL Is Now Free For Up To 16 Production Servers
by Peter Reutemann 06 Mar '21

06 Mar '21

'Ars Technica: Last month, Red Hat caused a lot of consternation in the enthusiast and small business Linux world when it announced the discontinuation of CentOS Linux. Long-standing tradition -- and ambiguity in Red Hat's posted terms -- led users to believe that CentOS 8 would be available until 2029, just like the RHEL 8 it was based on. Red Hat's early termination of CentOS 8 in 2021 cut eight of those 10 years away, leaving thousands of users stranded. Red Hat's December announcement of CentOS Stream -- which it initially billed as a "replacement" for CentOS Linux -- left many users confused about its role in the updated Red Hat ecosystem. As of February 1, 2021, Red Hat will make RHEL available at no cost for small-production workloads -- with "small" defined as 16 systems or fewer. This access to no-cost production RHEL is by way of the newly expanded Red Hat Developer Subscription program, and it comes with no strings -- in Red Hat's words, "this isn't a sales program, and no sales representative will follow up." Red Hat is also expanding the availability of developer subscriptions to teams, as well as individual users. Moving forward, subscribing RHEL customers can add entire dev teams to the developer subscription program at no cost. This allows the entire team to use Red Hat Cloud Access for simplified deployment and maintenance of RHEL on well-known cloud providers, including AWS, Google Cloud, and Microsoft Azure.' -- source: https://linux.slashdot.org/story/21/01/20/2016202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

Torvalds warns the world: Don’t use the Linux 5.12-rc1 kernel
by Peter Reutemann 06 Mar '21

06 Mar '21

'In a message to the Linux Kernel Mailing List yesterday, founding developer Linus Torvalds warned the world not to use the 5.12-rc1 kernel in his public git tree. Hey peeps - some of you may have already noticed that in my public git tree, the "v5.12-rc1" tag has magically been renamed to "v5.12-rc1-dontuse". It's still the same object, it still says "v5.12-rc1" internally and it is still is signed by me, but the user-visible name of the tag has changed. As it turns out, when Linus Torvalds flags some code dontuse, he really means it—the problem with this 5.12 release candidate broke swapfile handling in a very unpleasant way. Specifically, the updated code would lose the proper offset pointing to the beginning of the swapfile. Again, in Torvalds' own words, "swapping still happened, but it happened to the wrong part of the filesystem, with the obvious catastrophic end results."' -- source: https://arstechnica.com/gadgets/2021/03/psa-linux-folks-stay-away-from-the-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Windows.com Bitsquatting Hack Can Wreak 'Unknown Havoc' On PCs
by Peter Reutemann 05 Mar '21

05 Mar '21

'Ars Technica: Bitflips are events that cause individual bits stored in an electronic device to flip, turning a 0 to a 1 or vice versa. Cosmic radiation and fluctuations in power or temperature are the most common naturally occurring causes. Research from 2010 estimated that a computer with 4GB of commodity RAM has a 96 percent chance of experiencing a bitflip within three days. An independent researcher recently demonstrated how bitflips can come back to bite Windows users when their PCs reach out to Microsoft's windows.com domain. Windows devices do this regularly to perform actions like making sure the time shown in the computer clock is accurate, connecting to Microsoft's cloud-based services, and recovering from crashes. Remy, as the researcher asked to be referred to, mapped the 32 valid domain names that were one bitflip away from windows.com. Of the 32 bit-flipped values that were valid domain names, Remy found that 14 of them were still available for purchase. This was surprising because Microsoft and other companies normally buy these types of one-off domains to protect customers against phishing attacks. He bought them for $126 and set out to see what would happen. Over the course of two weeks, Remy's server received 199,180 connections from 626 unique IP addresses that were trying to contact ntp.windows.com. By default, Windows machines will connect to this domain once per week to check that the time shown on the device clock is correct. What the researcher found next was even more surprising. "The NTP client for windows OS has no inherent verification of authenticity, so there is nothing stopping a malicious person from telling all these computers that it's after 03:14:07 on Tuesday, 19 January 2038 and wreaking unknown havoc as the memory storing the signed 32-bit integer for time overflows," he wrote in a post summarizing his findings. "As it turns out though, for ~30% of these computers doing that would make little to no difference at all to those users because their clock is already broken."' -- source: https://tech.slashdot.org/story/21/03/04/2152239 I wonder whether anyone has tested apt-get in regards to this... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

US Issues Warning After Microsoft Says China Hacked Its Mail Server Program
by Peter Reutemann 05 Mar '21

05 Mar '21

'NBC News: The U.S. has issued an emergency warning after Microsoft said it caught China hacking into its mail and calendar server program, called Exchange. The perpetrator, Microsoft said in a blog post, is a hacker group that the company has "high confidence" is working for the Chinese government and primarily spies on American targets. The latest software update for Exchange blocks the hackers, prompting the U.S. Cybersecurity and Infrastructure Security Agency to issue a rare emergency directive that requires all government networks do so. CISA, the U.S.'s primary defensive cybersecurity agency, rarely exercises its authority to demand the entire U.S. government take protective steps to protect its cybersecurity. The move was necessary, the agency announced, because the Exchange hackers are able "to gain persistent system access." All government agencies have until noon Friday to download the latest software update. In a separate blog post, Microsoft Vice President Tom Burt wrote that the hackers have recently spied on a wide range of American targets, including disease researchers, law firms and defense contractors. There was no immediate indication that the hack led to significant exploitation of U.S. government computer networks. But the announcement marks the second instance in recent months that the U.S. scrambled to address a widespread hacking campaign believed be the work of foreign government spies.' -- source: https://it.slashdot.org/story/21/03/04/022226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome Switches Its Release Cycle for First Time in a Decade
by Peter Reutemann 05 Mar '21

05 Mar '21

'Google Chrome releases will soon arrive more frequently than ever. >From a report: In an announcement today, Google said it is updating the Chrome release schedule for the first time in over a decade. For a cool 10+ years now, Chrome stable releases have shipped every 6 weeks with new features, security fixes, etc. With improvements to testing and release processes, Google has realized that it can shorten the release cycle and will do so in Q3 of this year. Starting with Chrome 94, Google will move to a 4-week milestone release cycle. Freaked out at the possibility that Google might break features, remove things you like, or cause other issues with so many releases? Don't worry, Google is also introducing an Extended Stable release that will see milestone updates every 8 weeks. Now, it will still get updates every 2 weeks to address "important issues," but none of the new features or all security fixes that the 4-week milestones see will be included.' -- source: https://tech.slashdot.org/story/21/03/04/1924223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Privacy-first Browser Brave Now Has Its Own Google Search Rival
by Peter Reutemann 04 Mar '21

04 Mar '21

'Two years after publicly launching a privacy-focussed browser, Brave, founded by former Mozilla executive Brendan Eich, is taking on Google's search business, too. From a report: The announcement of Brave Search puts the upstart in the rare position of taking on both Google's browser and search dominance. Eich says that Brave Search, which has opened a waitlist and will launch in the first half of this year, won't track or profile people who use it. "Brave already has a default anonymous user model with no data collection at all," he says adding this will continue in its search engine. No IP addresses will be collected and the company is exploring how it can create both a paid, ad-free search engine and one that comes with ads. But building a search engine isn't straightforward. [...] Eich says Brave isn't starting its search engine or index from scratch and won't be using indexes from Bing or other tech firms. Instead Brave has purchased Tailcat, an offshoot of German search engine Cliqz, which was owned by Hubert Burda Media and closed down last year. The purchase includes an index of the web that's been created by Tailcat and the technology that powers it. Eich says that some users will be given the ability to opt-in to anonymous data collection to help fine-tune search results. "What Tailcat does is it looks at a query log and a click log anonymously," Eich says. "These allow it to build an index, which Tailcat has done and already did at Cliqz, and it's getting bigger." He admits that the index will not be anywhere near as deep as Google's but that the top results it surfaces are largely the same.' -- source: https://search.slashdot.org/story/21/03/03/1643231 Interesting that they didn't simply use DuckDuckGo... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Launches Power Fx, a New Open Source Low-Code Language
by Peter Reutemann 03 Mar '21

03 Mar '21

'Microsoft today announced Power Fx, a new low-code language that "will become the standard for writing logic customization across Microsoft's own low-code Power Platform," reports TechCrunch. "[S]ince the company is open-sourcing the language, Microsoft also hopes others will implement it as well and that it will become the de facto standard for these kinds of use cases." From the report: Microsoft says the language was developed by a team led by Vijay Mital, Robin Abraham, Shon Katzenberger and Darryl Rubin. Beyond Excel, the team also took inspiration from tools and languages like Pascal, Mathematica and Miranda, a functional programming language developed in the 1980s. Microsoft plans to bring Power Fx to all of its low-code platforms, but given the focus on community, it'll start making appearances in Power Automate, Power Virtual Agents and elsewhere soon. But the team clearly hopes that others will adopt it as well. Low-code developers will see it pop up in the formula bars of products like Power Apps Studio, but more sophisticated users will also be able to use it to go to Visual Studio Code and build more complex applications with it. As the team noted, it focused on not just making the language Excel-like but also having it behave like Excel -- or like a REPL, for you high-code programmers out there. That means formulas are declarative and instantly recalculate as developers update their code. ' -- source: https://news.slashdot.org/story/21/03/02/2126228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux On Mars
by Lawrence D'Oliveiro 03 Mar '21

03 Mar '21

One of many accounts of the NASA “Perseverance” rover landing on Mars is this one <https://www.youtube.com/watch?v=mfgzTfw_J6o> by ever-dependable space nerd Scott Manley. He mentions that the umbilical carrying those camera images from the skycrane back to the lander is Ethernet, and that camera connections are done via USB 3. And yes, apparently there is Linux running on there somewhere as well.

1 1

Google-free /e/ OS is now selling preloaded phones in the US, starting at $380
by Peter Reutemann 03 Mar '21

03 Mar '21

'/e/ OS, the "open-source, pro-privacy, and fully degoogled" fork of Android, is coming to Canada and the USA. Of course, you've always been able to download the software in any region, but now (as first spotted by It's Foss News) the e Foundation will start selling preloaded phones in North America. Previously, /e/ only did business in Europe. Like normal, the e Foundation's smartphone strategy is to sell refurbished Samsung devices with /e/ preloaded. In the US, there are only two phones right now: the Galaxy S9 for $379.99 or a Galaxy S9+ for $429.99. North Americans still have reason to be jealous of Europe, where you can get /e/ preloaded on a Fairphone, which is also Europe-exclusive. These Samsung phones are used devices, but the site says the devices have "been checked and reconditioned to be fully working at our partner's facilities." The phones have a one-year warranty and are described as "Good-as-New" with "no surprises." An /e/ device means you'll be getting a fork of Android 10, and for ongoing support, the e Foundation says, "We aim to support with at least 3 years of software updates and security patches."' -- source: https://arstechnica.com/gadgets/2021/03/google-free-e-os-is-now-selling-pre… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds Went Six Days Without Electricity, Swears Smaller 5.12 Kernel Is Co-Incidental
by Peter Reutemann 03 Mar '21

03 Mar '21

'Linux overlord Linus Torvalds has revealed that inclement weather in the USA meant he recently endured six electricity-free days in his Portland, Oregon, home during which he was unable to tend to the kernel. As a result he therefore pondered adding an extra week to the merge window for version 5.12 of the Linux kernel. The Register reports: "As you can tell, I didn't do that," he said in his State of The Kernel update that announced release candidate one of the new kernel cut. "To a large part because people were actually very good about sending in their pull requests, so by the time I finally got power back, everything was nicely lined up and I got things merged up ok." It wasn't just penguinistas behaving well that helped. Torvalds said this version of the kernel has received around 10,000 commits. That's rather fewer than the 12,000 or 13,000 he usually sees. In case anyone was inconvenienced by blackout-induced inability to merge, Torvalds said he's open to help any kernel devs for whom his unavailability caused problems but is not open to all late pulls. Torvalds rated the new release as offering "a fair amount of historical cleanup" on account of "removing the legacy OPROFILE support (the user tools have been using the "perf" interface for years), and removing several legacy SoC platforms and various drivers that no longer make any sense." Among the big inclusions in 5.12 are Clang Link-Time Optimizations, which make for better compiler performance, and support for Intel's eASIC NX5 silicon that aims to offer an alternative to FPGAs in edge and cloud applications. Qualcomm's Snapdragon 888 5G SoC also gains support. ' -- source: https://linux.slashdot.org/story/21/03/01/2237246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Go Malware is Now Common, Having Been Adopted by Both APTs and E-crime Groups
by Peter Reutemann 02 Mar '21

02 Mar '21

'The number of malware strains coded in the Go programming language has seen a sharp increase of around 2,000% over the last few years, since 2017, cybersecurity firm Intezer said in a report published recently. From a report: The company's findings highlight and confirm a general trend in the malware ecosystem, where malware authors have slowly moved away from C and C++ to Go, a programming language developed and launched by Google in 2007. While the first Go-based malware was detected in 2012, it took, however, a few years for Golang to catch on with the malware scene. "Before 2019, spotting malware written in Go was more a rare occurrence and during 2019 it became a daily occurrence," Intezer said in its report. But in the new report, Golang (as it's often also referred to instead of Go) has broken through and has been widely adopted. It is used by nation-state hacking groups (also known as APTs), cybercrime operators, and even security teams alike, who often used it to create penetration-testing toolkits.' -- source: https://it.slashdot.org/story/21/03/01/1545257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

First Fully Weaponized Spectre Exploit Discovered Online
by Peter Reutemann 02 Mar '21

02 Mar '21

'Catalin Cimpanu, reporting for The Record: A fully weaponized exploit for the Spectre CPU vulnerability was uploaded on the malware-scanning website VirusTotal last month, marking the first time a working exploit capable of doing actual damage has entered the public domain. The exploit was discovered by French security researcher Julien Voisin. It targets Spectre, a major vulnerability that was disclosed in January 2018. [...] The vulnerability, which won a Pwnie Award in 2018 for one of the best security bug discoveries of the year, was considered a milestone moment in the evolution and history of the modern CPU. Its discovery, along with the Meltdown bug, effectively forced CPU vendors to rethink their approach to designing processors, making it clear that they cannot focus on performance alone, to the detriment of data security. Software patches were released at the time, but the Meltdown and Spectre disclosures forced Intel to rethink its entire approach to CPU designs going forward. At the time, the teams behind the Meltdown and Spectre bugs published their work in the form of research papers and some trivial proof-of-concept code to prove their attacks. Shortly after the Meltdown and Spectre publications, experts at AV-TEST, Fortinet, and Minerva Labs spotted a spike in VirusTotal uploads for both CPU bugs. While initially there was a fear that malware authors might be experimenting with the two bugs as a way to steal data from targeted systems, the exploits were classified as harmless variations of the public PoC code published by the Meltdown and Spectre researchers and no evidence was found of in-the-wild attacks. But today, Voisin said he discovered new Spectre exploits -- one for Windows and one for Linux -- different from the ones before. In particular, Voisin said he found a Linux Spectre exploit capable of dumping the contents of /etc/shadow, a Linux file that stores details on OS user accounts.' -- source: https://it.slashdot.org/story/21/03/01/1851240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Mint Developers Will Force Updates on Users Like Microsoft Does with Windows 10
by Peter Reutemann 02 Mar '21

02 Mar '21

'Last month, the Linux Mint team published a post on the organization's official blog about the importance of installing security updates on machines running the Linux distribution. The essence of the post was that a sizeable number of Linux Mint devices was running outdated applications, packages or even an outdated version of the operating system itself. A sizeable number of devices run on Linux Mint 17.x, according to the blog post, a version of Linux Mint that reached end of support in April 2019. A new blog post, published yesterday, provides information on how the team plans to reduce the update reluctance of Linux Mint users. Next to showing reminders to users, Linux Mint's Update Manager may enforce some of the updates according to the blog post. "In some cases the Update Manager will be able to remind you to apply updates. In a few of them it might even insist." Upcoming versions will provide information on the implementation, how the "insisting" part may look like, and whether the installation of updates will be enforced. All of this boils down to a single question: how far should operating system developers go when it comes to updates? BetaNews adds: "And now, it seems the Linux Mint developers are taking a page out of Microsoft's playbook by planning to force some updates on its users. Yes, folks, Linux Mint is becoming more like Windows 10."' -- source: https://linux.slashdot.org/story/21/03/01/2032216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Exploring the Open Source That Really Goes Into a RISC-V Chip
by Peter Reutemann 01 Mar '21

01 Mar '21

'"Maker Andreas Spiess talks about the Open Source that really goes into a RISC-V chip and the ESP32-C3," writes Slashdot reader nickwinlund77 — sharing a link to this article from Hackaday: It's an exciting time in the world of microprocessors, as the long-held promise of devices with open-source RISC-V cores is coming to fruition. Finally we might be about to see open-source from the silicon to the user interface, or so goes the optimistic promise. In fact the real story is considerably more complex than that, and it's a topic [Andreas Speiss] explores in a video that looks at the issue with a wide lens... nickwinlund77 writes: The YouTube video starts out with a good general history of competition between large businesses over architectures and embracing the standards for tech which many of us have depended on throughout the years. The video then gets into the technical specifics of the ESP32-C3. Hackaday adds: His conclusion is that while a truly open-source RISC-V chip is entirely possible (as demonstrated with a cameo Superconference badge appearance), the importance of the RISC-V ISA is in its likely emergence as a heavyweight counterbalance to ARM's dominance in the sector. ' -- source: https://hardware.slashdot.org/story/21/02/28/195212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Red Hat Introduces Free RHEL for Open-Source Organizations
by Peter Reutemann 01 Mar '21

01 Mar '21

'ZDNet brings an update about the future of Red Hat Enterprise Linux: When Red Hat, CentOS's Linux parent company, announced it was "shifting focus from CentOS Linux, the rebuild of Red Hat Enterprise Linux (RHEL), to CentOS Stream," CentOS users were not happy. Now, in an effort to mollify them and to keep its promise to open-source organizations, Red Hat is introducing a new, free RHEL for Open Source Infrastructure. If your non-profit organization, project, standard body, or foundation is "engaged with open source," you can get a free RHEL subscription via this program. Earlier this year, Red Hat introduced no-cost RHEL for small production workloads and for customer development teams... Jason Brooks, a Red Hat Open Source Program Office Manager explained: Supporting the open-source software ecosystem is a core objective for Red Hat... We know that we are part of a larger, interdependent ecosystem that we benefit from and which we do our best to foster and support. This support comes in many forms, but often includes helping open source software projects, foundations, and standards bodies access enterprise technologies for development and testing. We frequently provide no-cost access to RHEL to these groups, but the process isn't as formalized, consistent, accessible, or transparent as we'd like it to be. With the announcement that we will be shifting our resources to CentOS Stream at the end of 2021, we want to make sure that those organizations engaged with open source have access to RHEL as they build and test the future of open-source software... The GNOME Foundation's executive director Neil McGovern, said: As a non-profit, we rely on donations to help us achieve our goal of a world where everyone is empowered by technology they can trust. RHEL subscriptions are an essential part of this. With full operating system management and security updates, we can concentrate on the services we provide to GNOME users and developers without having to worry about the underlying systems. Red Hat has generously provided these services to GNOME at zero cost for years, and we look forward to continuing our relationship for a long time to come. GNOME is also the default desktop in RHEL Workstation.' -- source: https://linux.slashdot.org/story/21/02/27/0235247 Chdeers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Kali Linux 2021.1 Released: Tweaked DEs and Terminals, New Tools, Silicon Macs
by Peter Reutemann 01 Mar '21

01 Mar '21

'Offensive Security has released Kali Linux 2021.1, the latest version of its popular open source penetration testing platform. You can download it or upgrade to it. Kali NetHunter, the distro's mobile pentesting platform, now has an upgraded BusyBox engine and tools updated to the latest version (or, in some cases, completely rewritten). There are two new Kali ARM images: one that can be used with VMs on Apple Silicon Macs (Apple M1) and the other for the Raspberry Pi 400's wireless card.' -- source: https://linux.slashdot.org/story/21/02/27/043218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Brave Privacy Bug Exposed Tor Onion URLs To Your DNS Provider
by Peter Reutemann 01 Mar '21

01 Mar '21

'Brave Browser had a privacy issue that leaked the Tor onion URL addresses you visited to your locally configured DNS server, "exposing the dark web websites you visit...", writes Bleeping Computer. Long-time Slashdot reader AmiMoJo quotes their report: To access Tor onion URLs, Brave added a "Private Window with Tor" mode that acts as a proxy to the Tor network. When you attempt to connect to an onion URL, your request is proxied through volunteer-run Tor nodes who make the request for you and send back the returned HTML. Due to this proxy implementation, Brave's Tor mode does not directly provide the same level of privacy as using the Tor Browser. When using Brave's Tor mode, it should forward all requests to the Tor proxies and not send any information to any non-Tor Internet devices to increase privacy. However, a bug in Brave's "Private window with Tor" mode is causing the onion URL for any Tor address you visit to also be sent as a standard DNS query to your machine's configured DNS server. This bug was first reported in a Reddit post and later confirmed by James Kettle, the Director of Research at PortSwigger. BleepingComputer has also verified the claims by using Wireshark to view DNS traffic while using Brave's Tor mode. Brave has since released an update which fixes the bug.' -- source: https://yro.slashdot.org/story/21/02/27/221208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Introducing Crowdsec: a Modernized, Collaborative Massively Multiplayer Firewall
by Peter Reutemann 01 Mar '21

01 Mar '21

'CrowdSec is a massively multiplayer firewall designed to protect Linux servers, services, containers, or virtual machines exposed on the Internet with a server-side agent. It was inspired by Fail2Ban and aims to be a modernized, collaborative version of that intrusion-prevention tool. CrowdSec is free and open-source (under an MIT License), with the source code available on GitHub. It uses a behavior analysis system to qualify whether someone is trying to hack you, based on your logs. If your agent detects such aggression, the offending IP is then dealt with and sent for curation. If this signal passes the curation process, the IP is then redistributed to all users sharing a similar technological profile to 'immunize' them against this IP. The goal is to leverage the power of the crowd to create a real-time IP reputation database. As for the IP that aggressed your machine, you can choose to remedy the threat in any manner you feel appropriate. Ultimately, CrowdSec leverages the power of the community to create an extremely accurate IP reputation system that benefits all its users. It was clear to the founders that Open Source was going to be one of the main pillars of CrowdSec. The project's founders have been working on open-source projects for decades — they didn't just jump on the train. Rather, they are strong Open Source believers. They believe that the crowd is key to the mass hacking plague we are experiencing, and that Open Source is the best lever to create a community and have people contribute their knowledge to the project, ultimately make it better and more secure. The solution recently turned 1.x, introducing a major architectural change: the introduction of a local REST API.' -- source: https://linux.slashdot.org/story/21/02/27/2215223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox's Total Cookie Protection Aims To Stop Tracking Between Multiple Sites
by Peter Reutemann 24 Feb '21

24 Feb '21

'As part of its war on web tracking, Mozilla is adding a new tool to Firefox aimed at stopping cookies from keeping tabs on you across multiple sites. From a report: The "Total Cookie Protection" feature is included in the web browser's latest release -- alongside multiple picture-in-picture views -- and essentially works by keeping cookies isolated between each site you visit. Or, in Mozilla's words: "By creating a separate cookie jar for every website." Firefox's new feature pares with last month's network partitioning tool, which works by splitting the Firefox browser cache on a per-website basis to prevent tracking across the web, itself targeted at blocking more stubborn "supercookies." According to Mozilla, these types of cookies are more difficult to delete and block as they are stored in obscure parts of the browser, including in Flash storage, ETags, and HSTS flags. Both tools are available as part of Firefox's enhanced tracking protection suite in "strict mode" on desktop and Android.' -- source: https://news.slashdot.org/story/21/02/23/1513219 -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New TLD For Spammers
by Lawrence D'Oliveiro 21 Feb '21

21 Feb '21

Normally I get only a handful of spam e-mails per day -- greylisting is that effective at keeping most of them out. But over the past couple of days, this moved closer to being a flood like the bad old days, with several dozen coming in over the last 24 hours or so. Doing a quick check, all the ones I looked at were being sent from *.cyou domains. Yes, there really is such a top-level domain now. But given that it seems to be used entirely for spam, it’s easy enough to add a line to my block_sender file: /^.+(a).+\.cyou$/ REJECT

1 0

The world’s second-most popular desktop operating system isn’t macOS anymore
by Peter Reutemann 21 Feb '21

21 Feb '21

'For ages now, every annual report on desktop operating system market share has had the same top two contenders: Microsoft's Windows in a commanding lead at number one and Apple's macOS in distant second place. But in 2020, Chrome OS became the second-most popular OS, and Apple fell to third. That's according to numbers from market data firm IDC and a report on IDC's data by publication GeekWire. Chrome OS had passed macOS briefly in individual quarters before, but 2020 was the first full year when Apple's OS took third place. Despite the fact that macOS landed in third, viewing this as an example of Google beating out Apple directly might not be accurate. Rather, it's likely that Chrome OS has been primarily pulling sales and market share away from Windows at the low end of the market. Mac market share actually grew from 6.7 percent in 2019 to 7.5 percent in 2020. Meanwhile, Chrome OS skyrocketed from 6.4 percent in 2019 to 10.8 percent in 2020. Windows fell from 85.4 percent to 80.5 percent.' -- source: https://arstechnica.com/gadgets/2021/02/the-worlds-second-most-popular-desk… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New browser-tracking hack works even when you flush caches or go incognito
by Peter Reutemann 21 Feb '21

21 Feb '21

'The prospect of Web users being tracked by the sites they visit has prompted several countermeasures over the years, including using Privacy Badger or an alternate anti-tracking extension, enabling private or incognito browsing sessions, or clearing cookies. Now, websites have a new way to defeat all three. The technique leverages the use of favicons, the tiny icons that websites display in users’ browser tabs and bookmark lists. Researchers from the University of Illinois, Chicago said in a new paper that most browsers cache the images in a location that’s separate from the ones used to store site data, browsing history, and cookies. Websites can abuse this arrangement by loading a series of favicons on visitors’ browsers that uniquely identify them over an extended period of time. [...] The attack works against Chrome, Safari, Edge, and until recently Brave, which developed an effective countermeasure after receiving a private report from the researchers. Firefox would also be susceptible to the technique, but a bug prevents the attack from working at the moment.' -- source: https://arstechnica.com/information-technology/2021/02/new-browser-tracking… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Top Banks Join Linux and Open-Source Patent Protection Group
by Peter Reutemann 21 Feb '21

21 Feb '21

'ZDNet reports: When it comes to defending the intellectual property (IP) rights of Linux and open-source software, global leading banks aren't the first businesses to come to mind. Things have changed. Barclays, the London-based global corporate and investment bank, and the TD Bank Group, with its 26-million global customers, have joined the leading open-source IP defense group, the Open Invention Network (OIN). For years, the OIN, the largest patent non-aggression consortium, has protected Linux from patent attacks and patent trolls. Recently, it expanded its scope from core Linux programs and adjacent open-source code by expanding its Linux System Definition. In particular, that means patents relating to the Android Open Source Project (AOSP) 10 and the Extended File Allocation Table exFAT file system are now protected... Besides joining the OIN, Barclay is also joining the LOT Network. This is another fast-growing nonprofit group of companies that aims to stop patent trolls in their tracks. It has more than 1,100 member companies and covers over 2 million patent assets. Why? The "IP and Patentable Innovations Lead" at TD noted that activity from so-called patent assertion entities "continues to trend upward in the banking industry," according to ZDNet. He argues they "have become a tax on business and we're willing to explore any reasonable means to address such risks..."' -- source: https://news.slashdot.org/story/21/02/20/0244211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Is Now on Mars, Thanks to NASA's Perseverance Rover
by Peter Reutemann 21 Feb '21

21 Feb '21

'"When NASA's Perseverance rover landed on Mars this week, it also brought the Linux operating system to the Red Planet," reports PC Magazine: The tidbit was mentioned in an interview NASA software engineer Tim Canham gave to IEEE Spectrum. The helicopter-like drone on board the Perseverance rover uses a Linux-powered software framework the space agency open-sourced a few years ago. "This the first time we'll be flying Linux on Mars. We're actually running on a Linux operating system," Canham said. It also might be the first time NASA has brought a Linux-based device to Mars. "There isn't a previous use of Linux that I'm aware of, definitely on the previous rovers," Canham told PCMag in an email. Past Mars rovers have used proprietary OSes, largely from the software company Wind River Systems. The same is true for the Perseverance rover itself; the machine has been installed with Wind River's VxWorks, which was used on past Mars missions. The article also notes that the helicopter-like drone Ingenuity "was built using off-the-shelf parts, including Qualcomm's Snapdragon 801 processor, a smartphone chip." "Ingenuity is purely a technology demonstration," notes ZDNet. "It's not designed to support the Perseverance mission, which is searching for signs of ancient life and collecting rock and dirt samples for later missions to return to Earth. Its mission is to show that it's possible to fly on Mars using commercial off-the-shelf hardware and open-source software."' -- source: https://science.slashdot.org/story/21/02/20/1830240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Re: wlug Digest, Vol 356, Issue 12
by tom butz 20 Feb '21

20 Feb '21

I'll be away for a week, Tom Butz. On 20/02/2021, wlug-request(a)list.waikato.ac.nz <wlug-request(a)list.waikato.ac.nz> wrote: > Send wlug mailing list submissions to > wlug(a)list.waikato.ac.nz > > To subscribe or unsubscribe via email, send a message with subject or > body 'help' to > wlug-request(a)list.waikato.ac.nz > > You can reach the person managing the list at > wlug-owner(a)list.waikato.ac.nz > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of wlug digest..." > > Today's Topics: > > 1. WLUG meeting (Peter Reutemann) > > > ---------------------------------------------------------------------- > > Date: Fri, 19 Feb 2021 14:28:33 +1300 > From: Peter Reutemann <fracpete(a)gmail.com> > Subject: [wlug] WLUG meeting > To: wlug List <wlug(a)list.waikato.ac.nz> > Message-ID: <0C32B561-3ED3-4525-970F-7C0CACAEAE1F(a)gmail.com> > Content-Type: text/plain; charset=utf-8 > > Hi everyone > > We have a meeting next Monday: > "Roger Hardy and Lawrence D'Oliveiro will talk about experiences of a small > business with locally hosted server virtualisation using open source Xen > based hypervisors." > > Details: > https://www.meetup.com/WaikatoLinuxUsersGroup/events/274861044/ > > Cheers, Peter > -- > Peter Reutemann > Dept. of Computer Science > University of Waikato, NZ > +64 (7) 577-5304 > http://www.cms.waikato.ac.nz/~fracpete/ > http://www.data-mining.co.nz/ > > ------------------------------ > > Subject: Digest Footer > > _______________________________________________ > wlug mailing list -- wlug(a)list.waikato.ac.nz > To unsubscribe send an email to wlug-leave(a)list.waikato.ac.nz > > > ------------------------------ > > End of wlug Digest, Vol 356, Issue 12 > ************************************* >

1 0

WLUG meeting
by Peter Reutemann 19 Feb '21

19 Feb '21

Hi everyone We have a meeting next Monday: "Roger Hardy and Lawrence D'Oliveiro will talk about experiences of a small business with locally hosted server virtualisation using open source Xen based hypervisors." Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/274861044/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

LastPass' Free Tier Will Become a Lot Less Useful Next Month
by Peter Reutemann 17 Feb '21

17 Feb '21

'LastPass is adding new restrictions to its free subscription tier starting March 16th that'll only allow users to view and manage passwords on one category of devices: mobile or computer. From a report: Mobile users will be limited to iOS and Android phones, iPads, Android tablets, and smartwatches. Computer subscribers will be able to use their passwords from Windows, macOS, and Linux desktops and laptops, the LastPass browser extension, and Windows tablets. Users on LastPass' free tier will be asked to pick between the two options the first time they log in after March 16th, and the company says they'll be able to switch between categories up to three times after they've picked. Although customers are restricted to a single category of devices on the free tier, they'll still be able view and manage passwords from an unlimited number of devices within either the mobile or computer category. LastPass says no users will be locked out of their accounts or lose access to their passwords as a result of the changes. As well as restricting its device types, LastPass is also changing the kinds of customer support free tier users will be able to access. From May 17th, free users will lose access to email support, the company announced.' -- source: https://tech.slashdot.org/story/21/02/16/166221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Dev creeped out after he fired up Ubuntu VM on Azure, was immediately approached by Canonical sales rep
by Peter Reutemann 16 Feb '21

16 Feb '21

'An Azure customer was outraged after finding himself on the receiving end of an unexpected LinkedIn message from Ubuntu maker Canonical last night. The user, Luca Bongiorni, had spun up an instance of the Linux distro on an Azure corporate subscription in order to evaluate some tooling. Sensibly, the subscription is used as a sandbox for the purpose of testing. Upon clicking "Add new VM", the first option was Ubuntu 18.04, according to Bongiorni, which he selected in order to get his Linux kicks. Shortly after, however, a message turned up from an Enterprise Development representative at Ubuntu with the ominous phrase: "I saw that you spun up an Ubuntu image in Azure," and offering to be a point of contact.' -- source: https://www.theregister.com/2021/02/11/microsoft_azure_ubuntu_data_sharing/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Happy ENIAC Day
by Lawrence D'Oliveiro 16 Feb '21

16 Feb '21

75 years ago today, the University of Pennsylvania launched ENIAC, the first non-classified programmable digital computer <https://www.theregister.com/2021/02/15/eniac_day/>. (The UK Colossus preceded it, but the existence of that was kept secret for a few more decades.) This was not a “stored-program” machine, at least not at first: programming was initially done using patch cords and switches. You may also like this interview <https://www.youtube.com/watch?v=buAYHonF968> with the late Jean Jennings Bartik, about some of the fun she and her colleagues had programming the ENIAC, and the innovations they came up with. The electronics engineers who built the first computers didn’t think of programming as a very interesting activity, so they left it to women.

1 0

History Of VLC
by Lawrence D'Oliveiro 15 Feb '21

15 Feb '21

Found this <https://www.protocol.com/vlc-history-open-source> linked from a report on the new version of VLC, describing the history of the project back to its beginnings. Once upon a time there was “VideoLAN Server” and “VideoLAN Client”, but today everything has been rolled into a single “VLC” program. Of course it’s been in the sights of Intellectual Property lawyers for a long time: VLC's success also put it on the radar of patent lawyers, who started to send the VideoLAN team a growing number of legal threats, looking to extract licensing fees. Over the years, the VLC team received hundreds such legal threats over alleged patent violations. Virtually all of them were without merit, according to Kempf. Many were based on U.S. software patents that weren't easily enforceable in Europe. Others were citing technology that VLC was using even before companies tried to patent it. "No one is checking whether these patents are valid," Kempf said. "It's a complete mafia; it's protection money." The open-source x264 codec implementation was also an offshoot of VLC. And Jean-Baptiste Kempf says he could have done those software-bundling deals where unwary users get all kinds of things installed on their PCs in addition to the package they thought they were installing, and thereby earned tens of millions of dollars, but he didn’t want to. The project gets money from donations, but also from companies employing developers to build custom implementations for their set-top boxes.

3 8

Why NVidia Really Wants To Buy ARM
by Lawrence D'Oliveiro 13 Feb '21

13 Feb '21

From <https://arstechnica.com/gadgets/2021/02/nvidia-wants-to-buy-cpu-designer-ar…>: Owning Arm outright would also allow Nvidia much greater leeway to innovate upon the design. We've spoken to several vendors who described the sort of innovation that the RISC-V architecture allows as effectively impossible with Arm; the vendors have said "they just won't let you" make changes, like adjustments to the instruction set. If Nvidia owns Arm, it will no longer face such restrictions. And it will be the only company in such a position with respect to ARM. That may make it more competitive with RISC-V, but it will likely just drive other vendors away from ARM ... and towards RISC-V.

1 0

Hauwei router source code.
by Ian Stewart 10 Feb '21

10 Feb '21

Hi, I recently searched for the User Manual for a Huawei Model HG253s V2 Home Gateway. I found the document which is dated 2015. Google also found the HG253s V2 open source code.zip file from February 04, 2015 @117MB. Featuring the Linux kernel version 2.6.30 this file was available from huawei.com at... https://consumer-tkb.huawei.com/weknow/servlet/download/public?contextNo=S1… So, based on what I've heard from the CIA, MI6, GCSB and Five-Eyes, I'm now looking through the source code for the functions that send the messages back to the mothership in China 😉 ...Haven't found any code that does this so far ! In summary. I was surprised that Huawei release their source code. Admittedly it's for a device that's at least five years old and, for all I know, it may be the same code that OpenWRT use. I guess I'll still have to wait a while for the source code for the Huawei 5G routers. cheers, Ian.

2 2

Most Anti-Zoombombing Measures Are Futile
by Lawrence D'Oliveiro 05 Feb '21

05 Feb '21

How do you keep unwanted busybodies out of your videoconference meetings? This analysis <https://arstechnica.com/information-technology/2021/02/zoombombing-counterm…> concludes that common measures like password-protected meetings and waiting rooms are ineffective because they guard against the wrong threats. One thing that does help is giving each invited participant a unique join link. Ideally this link can only be used once. But even if not, it still allows organizers to identify the source of a leak to a zoombomber.

1 0

Firefox 85 Hammers the Final Nail Into the Adobe Flash Coffin
by Peter Reutemann 03 Feb '21

03 Feb '21

'With Mozilla's release of Firefox 85 on Tuesday, Adobe's once ubiquitous Flash technology is really gone for good. The software had been widely used to expand gaming, video and animation on the web, though Adobe stopped supporting it at the end of 2020. Firefox was the last major browser to support Flash. From a report: Apple, whose late boss Steve Jobs helped sink Flash by banning it from iPhones and iPads, ditched Flash with Safari 14 in September 2020. Google Chrome, the most widely used browser, completely excised it on Jan. 19 with version 88. Microsoft's Edge 88 followed suit on Jan. 21. The schedule of removals shows just how hard it is to advance technology foundations as widely used as the web. Browser makers for years wanted to remove Flash, replacing it with more advanced standards built directly into the web. Jobs' "Thoughts on Flash" letter in 2010 solidified the opposition, and Adobe started recognizing the software's doom by scrapping the Android version of Flash in 2011. It's taken years of effort to drop Flash completely. Adobe took until 2017 to announce that Flash would be completely unsupported at the end of 2020, and still some are willing to jump through lots of hoops to keep Flash around a little longer.' -- source: https://it.slashdot.org/story/21/01/26/1618254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

ActiveX All Over Again?
by Lawrence D'Oliveiro 02 Feb '21

02 Feb '21

Is Google repeating history, by pushing new browser features regardless of their security implications, like Microsoft did in the bad old days? This article <https://www.theregister.com/2021/02/01/chrome_89_beta_brings_desktop/> reports on Chrome adding some new capabilities that other browser developers (like Mozilla and Apple) feel are far too dangerous to allow, at least in their current form. The problem is, will most users fail to appreciate the security issues, see this feature omission as a bug in those browsers, and reinforce the dominance of Chrome as a result?

1 0

The End Of Itanium
by Lawrence D'Oliveiro 02 Feb '21

02 Feb '21

The latest Linux kernel will no longer include support for Intel/HP’s Itanium processors <https://www.theregister.com/2021/02/01/linux_pulls_itanium_support/>. Of course, prior Linux kernels up to 5.10 from December presumably still include such support, while the last version of HP’s own HP-UX 11i for its Itanium-based Integrity servers was v3 from 2007 <https://en.wikipedia.org/wiki/HP-UX#Release_history>. The last working version of Microsoft’s Windows Server for that platform, 2008 R2, came out just a couple of years later, and already dropped some features compared to editions for other platforms <https://en.wikipedia.org/wiki/Windows_Server_2008_R2#Editions>. Intel officially claims to be shipping new Itanium processors up to July this year, but it seems pretty clear the order book is empty. So it looks like the last OS still standing for that platform will be Linux.

1 0

Google Threatens To Remove Search in Australia as Spat Escalates
by Peter Reutemann 01 Feb '21

01 Feb '21

'Google has threatened to disable its search engine in Australia if it's forced to pay local publishers for news, a dramatic escalation of a months-long standoff with the government. From a report: The proposed law, intended to compensate publishers for the value their stories generate for the company, is "unworkable," Mel Silva, managing director for Australia and New Zealand, told a parliamentary hearing Friday. She specifically opposed the requirement that Google pay media companies for displaying snippets of articles in search results. The threat is Google's most potent yet as the digital giant tries to stem a flow of regulatory action worldwide. At least 94% of online searches in Australia go through the Alphabet unit, according to the local competition regulator. "We don't respond to threats," Australia Prime Minister Scott Morrison said Friday. "Australia makes our rules for things you can do in Australia. That's done in our parliament. It's done by our government. And that's how things work here in Australia."' -- source: https://tech.slashdot.org/story/21/01/22/0339236 However, in related news: "Google Agrees To Pay French News Sites To Send Them Traffic" -- source: https://tech.slashdot.org/story/21/01/21/2316209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

TinyPilot KVM Over IP
by Lawrence D'Oliveiro 31 Jan '21

31 Jan '21

Just been watching this review <https://www.youtube.com/watch?v=CyEpshm16HY> of the TinyPilot KVM-over-IP box. It’s purchasable from the maker’s website for US$300-plus, which is a fraction of the price of most other KVM-over-IP products. It’s built around a Raspberry π 4, using the camera adapter for HDMI in (no use made of the GPIO connector at all). Of course this means it can only support a connection to a single server machine. The source code is on GitHub if you want to build that yourself. The base product offers insecure HTTP-only access; if you want HTTPS, you have to pay extra for the TinyPilot Pro software licence. For comparison, some reader comments mention an alternative “PiKVM” product -- has anyone heard of this?

2 2

CERN Gets Its Open Hardware Licence Approved By OSI
by Lawrence D'Oliveiro 31 Jan '21

31 Jan '21

CERN wanted to come up with the hardware equivalent of open-source software licences. Such licences don’t really work well with hardware, because they use terms (like “linking” and “system libraries”) that aren’t applicable to hardware. So they worked with the Open Source Initiative (the custodians of the Open Source Definition) to come up with a selection of three licences, allowing for a choice of strong copyleft (GPL-equivalent), weak copyleft (LGPL-equivalent, I guess) and no copyleft at all. It seems these licences could actually be used for a combination of both hardware and software. <https://www.theregister.com/2021/01/29/cern_ohl_approved/>

1 0

Cloning SSD's
by Ian Stewart 31 Jan '21

31 Jan '21

FWIW: My recent experiences with copying SSD's... I recently installed Ubuntu Mate from USB stick to a 120GB SSD. I then updated with all the latest patches. This took about 30 minutes. I then tailored my preferences of Firefox, Terminal, Pluma, etc. Created a Guest account. Installed the NZ dictionary, and added some applications. This took me another 30 minutes. I then needed to do this to 5 more computers. So, to prepare six computers would have taken me a total of about 6 hours. I considered using the utility "dd" to copy a clone of my master disk. Looking through stackoverflow<https://unix.stackexchange.com/questions/144172/full-dd-copy-from-hdd-to-hdd> I found the suggestion to use "cat". I.e. Boot Ubuntu from a USB stick and assuming sda is my master disk and sdb is the clone, then issue the command... $ sudo sh -c 'cat /dev/sda >/dev/sdb' I found this copying took about 15 minutes. However, it didn't give me any progress report during the copying sequence. I then... $ sudo apt install pv ...pv stands for "Pipe Viewer". For the next SSD drive to be cloned I issued the command... $ sudo sh -c 'pv /dev/sda >/dev/sdb' ...which then provided a progress bar that updated every second. With Samsung SSD 120GB drives I found the operation took 13 minutes 13 seconds with a transfer rate of 153MB/s. I later had built another master SSD on a Kingston 120GB SSD and cloned this to another Kingston 120GB SSD which took 10 minutes and had a transfer rate of 200MB/s. I found with the system still powered on, I could unplug the cloned SSD and plug in another blank SSD and start another cloning. Probably not a recommended practice. After booting the clone, I edited /etc/hostname to make each clone unique. Maybe there's something else I should change??? In summary, allowing for a bit of time to physically move the SSD's between machines, I was effectively completing the installation/updating/tailoring at a rate of three PC's an hour. I dunno if this was the right way or the best way, but, so far, the masters and all the clones seem to be working OK. cheers, Ian.

2 1

Intel Iris Xe Video Cards Now Shipping To OEMs: DG1 Lands In Desktops
by Peter Reutemann 29 Jan '21

29 Jan '21

'Ryan Smith, writing at AnandTech: Following plans first unveiled last year during the launch of their DG1 GPU, Intel sends word this morning that the first Iris Xe video cards have finally begun shipping to OEMs. Based on the DG1 discrete GPU that's already being used in Intel's Iris Xe MAX laptop accelerators, the Iris Xe family of video cards are their desktop counterpart, implementing the GPU on a traditional video card. Overall, with specifications almost identical to Xe MAX, Intel is similarly positioning these cards for the entry-level market, where they are being released as an OEM-only part. As a quick refresher, the DG1 GPU is based on the same Xe-LP graphics architecture as Tiger Lake's integrated GPU. In fact, in broad terms the DG1 can be thought of as a nearly 1-to-1 discrete version of that iGPU, containing the same 96 EUs and 128-bit LPDDR4X memory interface as Tiger Lake itself. Consequently, while DG1 is a big first step for Intel -- marking the launch of their first discrete GPU of the modern era -- the company is planning very modestly for this generation of parts. The first DG1 GPUs were shipped in the fall as part of Intel's Iris Xe MAX graphics solution for laptops. At the time, Intel also indicated that a desktop card for OEMs would also be coming in 2021, and now, right on schedule, those desktop cards have begun shipping out.' -- source: https://hardware.slashdot.org/story/21/01/28/1649204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ProtonMail, Threema, Tresorit and Tutanota Warn EU Lawmakers Over 'Anti-Encryption' Push
by Peter Reutemann 29 Jan '21

29 Jan '21

'Four European apps which secure user data via end-to-end encryption, ProtonMail, Threema, Tresorit and Tutanota, have issued a joint-statement warning over recent moves by EU institutions that they say are setting lawmakers on a dangerous path to backdooring encryption. From a report: Last month the EU Council passed a resolution on encryption that's riven with contradiction -- calling for "security through encryption and security despite encryption" -- which the four e2e app makers believe is a thinly veiled call to backdoor encryption. The European Commission has also talked about seeking "improved access" to encrypted information, writing in a wide-ranging counter-terrorism agenda also published in December that it will "work with Member States to identify possible legal, operational, and technical solutions for lawful access." Simultaneously, the Commission has said it will "promote an approach which both maintains the effectiveness of encryption in protecting privacy and security of communications, while providing an effective response to crime and terrorism." And it has made it clear there will be no 'one silver bullet' as regards the e2e encryption security 'challenge.' But such caveats are doing nothing to alleviate the concerns of e2e encrypted app makers -- who are convinced proposals from the Council of the EU, which is involved in adopting the bloc's laws (though the Commission usually drafts legislation), sums to an push toward backdoors. "While it's not explicitly stated in the resolution, it's widely understood that the proposal seeks to allow law enforcement access to encrypted platforms via backdoors," the four app makers write, going on to warn that such a move would fatally underline the security EU institutions also claim to want to maintain. "The resolution makes a fundamental misunderstanding: Encryption is an absolute, data is either encrypted or it isn't, users have privacy or they don't," they go on. "The desire to give law enforcement more tools to fight crime is obviously understandable. But the proposals are the digital equivalent of giving law enforcement a key to every citizen's home and might begin a slippery slope towards greater violations of personal privacy."' -- source: https://yro.slashdot.org/story/21/01/28/1724250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Rocky Linux gets a parent company, with $4m Series A funding
by Peter Reutemann 29 Jan '21

29 Jan '21

'Gregory Kurtzer, co-founder of the now-defunct CentOS Linux distribution, has founded a new startup company called Ctrl IQ, which will serve in part as a sponsoring company for the upcoming Rocky Linux distribution. Rocky Linux is to be a beneficiary of Ctrl IQ's revenue, not its source—the company describes itself in its announcement as the suppliers of a "full technology stack integrating key capabilities of enterprise, hyper-scale, cloud and high-performance computing."' -- source: https://arstechnica.com/gadgets/2021/01/rocky-linux-gets-a-parent-company-w… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GitLab Reshuffles Its Paid Subscription Plans, Drops Its Bronze/Starter Tier
by Peter Reutemann 28 Jan '21

28 Jan '21

'GitLab, the increasingly popular DevOps platform, today announced a major update to its subscription model. The company is doing away with its $4/month Bronze/Starter package. Current users will be able to renew one more time at the existing price or move to a higher tier (and receive a significant discount for the first three years after they do so). The company's free tier, it is worth noting, is not going away and GitLab argues that it includes "89% of the features in Bronze/Starter." To ease the pain, Bronze users will be able to renew their existing subscription before January 26, 2022 for an additional year at the existing price. They can also opt to move to the Premium tier at a discounted price for the next three years, starting at $6/user/month in Year 1, but that price then goes up to $9/user/month and $15/user/month in Year 2 and 3 respectively. For new users, the Bronze package is no longer available, starting now. With this change, GitLab now offers three tiers: Free, Premium and Ultimate (it's also doing away with the "Silver/Premium" and "Gold/Ultimate" naming). "The Bronze tier, we were selling at a loss," GitLab founder and CEO Sid Sijbrandij told TechCrunch. "We were just losing money every time we sold it -- just on hosting and support. To be a sustainable business, this was a move we had to make. It's a big transition for our customers but we want to make sure we're a sustainable company and we can keep investing."' -- source: https://tech.slashdot.org/story/21/01/27/215226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Reddit 1: Wall Street 0
by Lawrence D'Oliveiro 28 Jan '21

28 Jan '21

Something very peculiar happened last week: a group of small-time stock traders who hang out on Reddit took on a well-funded Wall Street money manager, and won. What happened was, a company called Melvin Capital took out a “short position” on shares in GameStop--that is, they put money on a bet that the stock value would go down. The Redditors (part of a subreddit called “wallstreetbets”) figured out that this position was vulnerable, and bet against it by buying up GameStop shares. This drove up the price, forcing Melvin to either put up or shut up--put up a bunch of money to back up their position, or give up and lose an even bigger bunch of money. In other words, Melvin was caught in a “short squeeze”, which drove it to the verge of bankruptcy. A good, clear intro to the whole story is here <https://arstechnica.com/gaming/2021/01/the-complete-morons-guide-to-gamesto…>. A less-easy-to-understand analysis, with links to further articles, is here <https://www.aljazeera.com/economy/2021/1/27/bbgamestop-how-day-trader-reddi…>.

1 0

10-year-old Sudo Bug Lets Linux Users Gain Root-Level Access
by Peter Reutemann 28 Jan '21

28 Jan '21

'A major vulnerability impacting a large chunk of the Linux ecosystem has been patched today in Sudo, an app that allows admins to delegate limited root access to other users. From a report: The vulnerability, which received a CVE identifier of CVE-2021-3156, but is more commonly known as "Baron Samedit," was discovered by security auditing firm Qualys two weeks ago and was patched earlier today with the release of Sudo v1.9.5p2. In a simple explanation provided by the Sudo team today, the Baron Samedit bug can be exploited by an attacker who has gained access to a low-privileged account to gain root access, even if the account isn't listed in /etc/sudoers -- a config file that controls which users are allowed access to su or sudo commands in the first place.' -- source: https://linux.slashdot.org/story/21/01/27/1820205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Play Bans Video App For Standard “.ass” Subtitle Support
by Lawrence D'Oliveiro 27 Jan '21

27 Jan '21

libass <https://github.com/libass/libass> is an open-source library for decoding the .ass/.ssa subtitle formats for video files. However, the automated censor-bot in the Google Play Store decided that an app supporting this format was violating the “Sexual Content and Profanity Policy”, and suspended it. The app was only reinstated after an appeal. <https://arstechnica.com/gadgets/2021/01/googles-bots-decide-ass-subtitle-su…>

1 0

Browser Makers Launch New Project For Writing Documentation For Web APIs
by Peter Reutemann 26 Jan '21

26 Jan '21

'A coalition of tech companies announced today the launch of Open Web Docs, a new initiative to help write documentation for Web APIs, JavaScript, and other web tooling and platforms. From a report: The new project does not view itself as a replacement for MDN Web Docs, a website hosted by Mozilla, where all browser makers agreed to move the official Web API documentation back in October 2017, and stop developing their own, often diverging, documentation sites. Instead, in a press release and FAQ today, the Open Web Docs team said their role is to fund, coordinate, and contribute to MDN Docs going forward. The new initiative comes after Mozilla laid off 250 employees last summer, including many of its MDN Web Docs staff. Open Web Docs comes to fill this void and provide the labor force needed to continue updating the MDN Web Docs portal.' -- source: https://tech.slashdot.org/story/21/01/25/216208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hacker Leaks Data of 2.28 Million Dating Site Users
by Peter Reutemann 26 Jan '21

26 Jan '21

'ZDNet: A well-known hacker has leaked the details of more than 2.28 million users registered on MeetMindful.com, a dating website founded in 2014, ZDNet has learned this week from a security researcher. The dating site's data has been shared as a free download on a publicly accessible hacking forum known for its trade in hacked databases. The leaked data, a 1.2 GB file, appears to be a dump of the site's users database. The content of this file includes a wealth of information that users provided when they set up profiles on the MeetMindful site and mobile apps. Some of the most sensitive data points included in the file include: Real names; Email addresses; City, state, and ZIP details; Body details; Dating preferences; Marital status; Birth dates; Latitude and longitude; IP addresses; Bcrypt-hashed account passwords; Facebook user IDs; and Facebook authentication tokens. Messages exchanged by users were not included in the leaked file; however, this does not make the entire incident less sensitive. The data leak, which is still available for download, was released by a threat actor who goes by the name of ShinyHunters. They also were responsible for leaking the details of millions of users registered on Teespring. ' -- source: https://yro.slashdot.org/story/21/01/25/2124226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0