- wlug - list.wlug.org.nz

Bye-Bye DB2, Bye-Bye Oracle, Hello Postgres
by Lawrence D'Oliveiro 09 Dec '20

09 Dec '20

A report on how a couple of companies -- German IT outfit BG Phoenics and Indian one TransUnion CIBIL -- migrated their entire mass of internal company database deployments off proprietary DBMSes -- IBM DB2 in one case, Oracle in the other -- to Postgres EDB: <https://www.theregister.com/2020/12/08/leaving_ibm_db2_for_postgres/>. In both cases, a big factor was the licensing conditions, which made it very complicated to do any changes to database usage. The improvement in agility was major: Since going live, the user found the deployment of new instances in Postgres much faster than it had been in Db2, down from around 20 hours spread over two weeks to 40 to 60 minutes. Of course an Oracle advocate has to say “[Postgres] is not as scalable as a proprietary database like Oracle or SQL Server”. But I would suggest they think twice about such a pronouncement. Remember that Facebook runs its entire multi-billion-user operation on MySQL, and I’m sure Postgres can scale to that level as well. Where is there an Oracle or DB2 deployment of that size and throughput requirement? I don’t think such a thing exists.

1 0

Amazon, Amex To Fund Software Developers in New GitHub Program
by Peter Reutemann 09 Dec '20

09 Dec '20

'Amazon.com, American Express, Daimler AG and Stripe are among those joining a new GitHub program that will let companies directly fund open-source projects and software developers that are key to their businesses. From a report: It's an expansion of GitHub's Sponsors program, which previously let individuals support software projects and the millions of developers who use the digital platform to collaborate on, share and store code. GitHub, whose parent company Microsoft will also participate in the new service announced Tuesday, expects the change to dramatically increase the number of contributions. The year-old sponsors service has already generated enough money for some developers to rely on it as full-time work, said Devon Zuegel, GitHub's director of product for the communities department.' -- source: https://developers.slashdot.org/story/20/12/08/1821203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GE Puts Default Password In Radiology Devices, Leaving Healthcare Networks Exposed
by Peter Reutemann 09 Dec '20

09 Dec '20

'Ars Technica: Dozens of radiology products from GE Healthcare contain a critical vulnerability that threatens the networks of hospitals and other health providers that use the devices, officials from the US government and a private security firm said on Tuesday. The devices -- used for CT scans, MRIs, X-Rays, mammograms, ultrasounds, and positron emission tomography -- use a default password to receive regular maintenance. The passwords are available to anyone who knows where on the Internet to look. A lack of proper access restrictions allows the devices to connect to malicious servers rather than only those designated by GE Healthcare. Attackers can exploit these shortcomings by abusing the maintenance protocols to access the devices. From there, the attackers can execute malicious code or view or modify patient data stored on the device or the hospital or healthcare provider servers. Aggravating matters, customers can't fix the vulnerability themselves. Instead, they must request that the GE Healthcare support team change the credentials. Customers who don't make such a request will continue to rely on the default password. Eventually, the device manufacturer will provide patches and additional information. The flaw has a CVSS severity rating of 9.8 out of 10 because of the impact of the vulnerability combined with the ease of exploiting it. Security firm CyberMDX discovered the vulnerability and privately reported it to the manufacturer in May. The US Cyber Security and Infrastructure Security Agency is advising affected healthcare providers to take mitigation steps as soon as possible. In a statement, GE Healthcare officials wrote: "We are not aware of any unauthorized access to data or incident where this potential vulnerability has been exploited in a clinical situation. We have conducted a full risk assessment and concluded that there is no patient safety concern. Maintaining the safety, quality, and security of our devices is our highest priority. We are providing on-site assistance to ensure credentials are changed properly and confirm proper configuration of the product firewall. Additionally, we are advising the facilities where these devices are located to follow network management and security best practices." ' -- source: https://it.slashdot.org/story/20/12/08/2034217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FireEye, a Top Cybersecurity Firm, Says It Was Hacked By a Nation-State
by Peter Reutemann 09 Dec '20

09 Dec '20

'The New York Times : For years, the cybersecurity firm FireEye has been the first call for government agencies and companies around the world who have been hacked by the most sophisticated attackers, or fear they might be. Now it looks like the hackers -- in this case, evidence points to Russia's intelligence agencies -- may be exacting their revenge. FireEye revealed on Tuesday that its own systems were pierced by what it called "a nation with top-tier offensive capabilities." The company said hackers used "novel techniques" to make off with its own tool kit, which could be useful in mounting new attacks around the world. It was a stunning theft, akin to bank robbers who, having cleaned out local vaults, then turned around and stole the F.B.I.'s investigative tools. In fact, FireEye said on Tuesday, moments after the stock market closed, that it had called in the F.B.I. The $3.5 billion company, which partly makes a living by identifying the culprits in some of the world's boldest breaches -- its clients have included Sony and Equifax -- declined to say explicitly who was responsible. But its description, and the fact that the F.B.I. has turned the case over to its Russia specialists, left little doubt who the lead suspects were and that they were after what the company calls "Red Team tools." These are essentially digital tools that replicate the most sophisticated hacking tools in the world. FireEye uses the tools — with the permission of a client company or government agency -- to look for vulnerabilities in their systems. Most of the tools are based in a digital vault that FireEye closely guards. The hack raises the possibility that Russian intelligence agencies saw an advantage in mounting the attack while American attention -- including FireEye's -- was focused on securing the presidential election system. At a moment that the nation's public and private intelligence systems were seeking out breaches of voter registration systems or voting machines, it may have a been a good time for those Russian agencies, which were involved in the 2016 election breaches, to turn their sights on other targets. The hack was the biggest known theft of cybersecurity tools since those of the National Security Agency were purloined in 2016 by a still-unidentified group that calls itself theShadowBrokers. [...] The N.S.A.'s tools were most likely more useful than FireEye's since the U.S. government builds purpose-made digital weapons. FireEye's Red Team tools are essentially built from malware that the company has seen used in a wide range of attacks. Still, the advantage of using stolen weapons is that nation-states can hide their own tracks when they launch attacks.' -- source: https://it.slashdot.org/story/20/12/08/2247219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Next Step In DNS Privacy
by Lawrence D'Oliveiro 09 Dec '20

09 Dec '20

We already have mechanisms called “DNS-over-HTTPS” (DoH) and “DNS-over-TLS” (DoT) to encrypt your DNS queries so intermediaries cannot eavesdrop on them. However, the DNS server you are querying still knows what you are asking for, and can tie that to the IP address that you are querying from. So the next step is called “Oblivious DNS” (“over HTTPS”?) or “ODoH” <https://arstechnica.com/information-technology/2020/12/cloudflare-apple-and…>. This one interposes a proxy to relay the encrypted query and response between the client machine and DNS server. The proxy cannot decrypt the communications, and its presence hides the client’s IP address from the server, further increasing your privacy. To recap: the DNS server knows what you are asking for, but not who is asking. The proxy knows who is asking, but not what they are asking for. Given the controversy from some parties over the existing mechanisms (remember when the British Internet Service Providers’ Association dubbed Mozilla a “villain” for implementing DoH <https://www.theregister.com/2019/07/10/ispa_clears_mozilla/>?), I wonder what kind of hoo-hah this further development will trigger...

1 0

Will Businesses Make 2021 The Year of the Linux Desktop?
by Peter Reutemann 08 Dec '20

08 Dec '20

'Writing for TechRepublic, open source advocate Jack Wallen predicts 2021 will be a year where open source technology dominates the world of big data even more than 2021 (with a big role predicted for SUSE). But he also sees businesses cutting costs by switching to open source solutions — including a big move to Linux on enterprise desktops, thanks to enterprise-ready options now available from System76, Lenovo, and Dell: This will have the added benefit of even more companies jumping into the mix and offering more and more desktops and laptops, all powered by Linux and open source technology. One added bonus for this movement is that System76 will finally gain the recognition they've deserved for so many years. Linux on the desktop would not be where it is today, had it not been for their stalwart support for open source technology. Year after year, System76 has proved that high-quality, business-class systems, powered by Linux, can be produced at a level befitting the enterprise. That success within the realm of business will start trickling down to consumers. As more and more people start using Linux at their place of business, they'll begin seeing the benefits of the open source operating system and desire to adopt it for their home computers. I suspect that by the end of 2021, we'll see Linux desktop market share to finally break the 10% bubble. It may not sound like much, but given how Linux has hovered around 2% and maxed out at 5%, that 10% figure is like a dream come true. That's only the tip of the iceberg. Although Linux will max out at around 10% by the end of the year, it will lead to continued growth over the coming years.' -- source: https://linux.slashdot.org/story/20/12/07/0332259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Should Qualcomm Feel Threatened By Apple's M1 Macs?
by Peter Reutemann 07 Dec '20

07 Dec '20

'PCMag.com's lead mobile analyst calls Qualcomm "a little too unbothered by Apple's M1 Macs" Qualcomm executives brushed off a question about Apple's new M1-based Macs during a question-and-answer session at the company's Snapdragon Summit today, where Qualcomm announced a new flagship smartphone chipset but no upgrades to its year-old chips for PCs... In general, reviews of Qualcomm-powered laptops such as the Microsoft Surface Pro X have celebrated the devices' long battery life, but lamented problems with third-party apps that were originally coded for Intel processors. That stands in stark contrast to Apple's new M1-based Macs, which don't seem to be slowed down as badly by older software... "It's a great validation of what we've been doing for the past few years and [Qualcomm's product line] is just going to get stronger and stronger as we broaden our scope," said Alex Katouzian, Qualcomm SVP for mobile. Katouzian made sure to subtly call out ways in which Qualcomm's always-connected PCs are superior to Apple's newest Macs. The Macs lack 4G connectivity and still have poor-quality, 720p front-facing cameras... Katouzian also pointed out that (presumably unlike Apple) Qualcomm addresses "many tiers...and many price points" with its 7c, 8c, and 8cx laptop chipsets, letting Windows laptop makers drive prices well below the MacBook Air's $999 list price. The core problem with Qualcomm's always-connected PC strategy is one that Qualcomm itself can't fix. While Qualcomm could, and probably will, soon announce a laptop chip that's based on the new Snapdragon 888 and has a level of raw power closer to Apple's M1, it's really down to Microsoft, as well as peripheral and app makers to solve the platform incompatibilities that have frustrated PC reviewers. Hot Hardware cites Microsoft's promises of changes come in future updates to Windows 10, arguing that "with the arrival of x64 emulation and a growing library of native Arm64 apps, Windows 10 on Arm is going to be an even more powerful platform." >From a performance perspective, while running Windows 10 on Arm, these [Snapdragon 8cx] chips may currently be at a disadvantage to the Apple M1, but some day in the not so distant future that might not be the case. We have no doubt that Qualcomm is likely working on a new Windows PC-centric SoC that is based on Snapdragon 888 or similar architecture. Qualcomm has promised a 25 percent uplift in CPU and a 35% lift in GPU performance over the Snapdragon 865, with the Snapdragon 888, which already offers a big boost over the previous gen Snapdragon 855/8cx. So, Qualcomm has the potential to put up a strong showing against the Apple M1, whenever its next-generation Snapdragon PC chip launches. That may be, but John Gruber at Daring Fireball argues that currently "M1 Macs embarrass all other PCs — all Intel-based Macs, including automobile-priced Mac Pros, and every single machine running Windows or Linux." Those machines are just standing around in their underwear now because the M1 stole all their pants. Well, that just doesn't happen, your instincts tell you. One company, even a company like Apple, doesn't just embarrass the entire rest of a highly-competitive longstanding industry. But just because something hasn't happened — or hasn't happened in a very long while — doesn't mean it can't happen. And in this case, it just happened... M1 Macs completely upend what we can and should expect from PCs. It's a breakthrough along the lines of the iPhone itself in 2007.' -- source: https://hardware.slashdot.org/story/20/12/06/060238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Richard Stallman Answers Questions at EmacsConf 2020
by Peter Reutemann 07 Dec '20

07 Dec '20

'All the videos have now appeared online for the talks at this year's virtual EmacsConf 2020, "the conference about the joy of Emacs, Emacs Lisp, and memorizing key sequences." And among them are an appearance by 67-year-old Richard Stallman, reminding the audience he'd created the first Emacs editor in 1976 "with some help from Guy Steele," then created GNU Emacs in 1984. Stallman was there to tell the history of the GNU Emacs Lisp Package Archive (and the licensing issues involved) — and how it's ultimately led to the creation of the NonGNU ELPA. "The fundamental plan of NonGNU ELPA is that we won't ask for copyright assignments for those packages, so we won't be able to put them into core Emacs, at least not easily — but we will have some control over how we distribute them. We can put any package into NonGNU ELPA as long as its free software. "If we like it, we can set up that way for users to get it. We can put the package in exactly as it is, if there's no problem at all with it. We can make an arrangement with the package's developers to work on it with us and maintain it directly for distribution by NonGNU ELPA. But if they are not interested, we can put it in ourselves, and if we need to make any changes we can do so. So NonGNU ELPA is not meant to be just a way that others can distribute their packages. Its meant at least in a minimal, technical sense to work with GNU Emacs, and we will make changes if necessary so that it works smoothly with GNU Emacs... "The idea is to have a single Git repository where you can download various packages, but they won't be maintained there. Each of those packages will be copied automatically from some other place, probably some other people have the right access to work on it. This way we can avoid giving a gigantic number of people access to it. "So far NonGNU ELPA is just a plan. We need people to implement the plan, so if you'd like to help, please write to me. I think this is a very important step for progress, and it's got to be implemented. Thanks, and happy hacking." Stallman provided a status update on NonGNU ELPA as part of the 46-minute Q&A that followed. ' -- source: https://news.slashdot.org/story/20/12/06/1957219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

OpenZFS 2.0 release unifies Linux, BSD and adds tons of new features
by Peter Reutemann 04 Dec '20

04 Dec '20

'This Monday, ZFS on Linux lead developer Brian Behlendorf published the OpenZFS 2.0.0 release to GitHub. Along with quite a lot of new features, the announcement brings an end to the former distinction between "ZFS on Linux" and ZFS elsewhere (for example, on FreeBSD). This move has been a long time coming—the FreeBSD community laid out its side of the roadmap two years ago—but this is the release that makes it official.' -- source: https://arstechnica.com/gadgets/2020/12/openzfs-2-0-release-unifies-linux-b… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

One of the Internet’s most aggressive threats could take UEFI malware mainstream
by Peter Reutemann 04 Dec '20

04 Dec '20

'One of the Internet’s most aggressive threats has just gotten meaner, with the ability to infect one of the most critical parts of any modern-day computer. Trickbot is a piece of malware that’s notable for its advanced capabilities. Its modular framework excels at gaining powerful administrator privileges, spreading rapidly from computer to computer in networks and performing reconnaissance that identifies infected computers belonging to high-value targets. It often uses readily available software like Mimikatz or exploits like EternalBlue stolen from the National Security Agency. Once a simple banking fraud trojan, Trickbot over the years has evolved into a full-featured malware-as-a-service platform. Trickbot operators sell access to their vast number of infected machines to other criminals, who use the botnet to spread bank trojans, ransomware, and a host of other malicious software. Rather than having to go through the hassle of ensnaring victims themselves, customers have a ready-made group of computers that will run their crimeware. Now, Trickbot has acquired a new power: the ability to modify a computer’s UEFI. Short for Unified Extensible Firmware Interface, UEFI is the software that bridges a computer’s device firmware with its operating system. As the first piece of software to run when virtually any modern machine is turned on, it’s the first link in the security chain. Because the UEFI resides in a flash chip on the motherboard, infections are difficult to detect and remove.' -- source: https://arstechnica.com/information-technology/2020/12/dangerous-uefi-malwa… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FBI Warns of Email Forwarding Rules Being Abused in Recent Hacks
by Peter Reutemann 03 Dec '20

03 Dec '20

'The US Federal Bureau of Investigation says that cyber-criminals are increasingly relying on email forwarding rules in order to disguise their presence inside hacked email accounts. From a report: In a PIN (Private Industry Notification) alert sent last week and made public today, the FBI says the technique has been seen and abused in recent BEC (Business Email Compromise) attacks reported over the summer. The hackers' technique relies on a feature found in some email services called "auto-forwarding email rules." As its name implies, the feature allows the owner of an email address to set up "rules" that forward (redirect) an incoming email to another address if a certain criteria is met. Threat actors absolutely love email auto-forwarding rules as they allow them to receive copies of all incoming emails without having to log into an account each day -- and be at risk of triggering a security warning for a suspicious login.' -- source: https://it.slashdot.org/story/20/12/02/1944205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Malicious npm Packages Caught Installing Remote Access Trojans
by Peter Reutemann 03 Dec '20

03 Dec '20

'The security team behind the "npm" repository for JavaScript libraries removed two npm packages this Monday for containing malicious code that installed a remote access trojan (RAT) on the computers of developers working on JavaScript projects. From a report: The name of the two packages was jdb.js and db-json.js., and both were created by the same author and described themselves as tools to help developers work with JSON files typically generated by database applications. Both packages were uploaded on the npm package registry last week and were downloaded more than 100 times before their malicious behavior was detected by Sonatype, a company that scans package repositories on a regular basis. According to Sonatype's Ax Sharma, the two packages contained a malicious script that executed after web developers imported and installed any of the two malicious libraries. The post-install script performed basic reconnaissance of the infected host and then attempted to download and run a file named patch.exe that later installed njRAT, also known as Bladabindi, a very popular remote access trojan that has been used in espionage and data theft operations since 2015.' -- source: https://tech.slashdot.org/story/20/12/02/1939247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

iPhone Zero-Click Wi-Fi Exploit is One of the Most Breathtaking Hacks Ever
by Peter Reutemann 03 Dec '20

03 Dec '20

'Dan Goodin, writing for ArsTechnica: Earlier this year, Apple patched one of the most breathtaking iPhone vulnerabilities ever: a memory corruption bug in the iOS kernel that gave attackers remote access to the entire device -- over Wi-Fi, with no user interaction required at all. Oh, and exploits were wormable -- meaning radio-proximity exploits could spread from one nearby device to another, once again, with no user interaction needed. This Wi-Fi packet of death exploit was devised by Ian Beer, a researcher at Project Zero, Google's vulnerability research arm. In a 30,000-word post published on Tuesday afternoon, Beer described the vulnerability and the proof-of-concept exploit he spent six months developing single-handedly. Almost immediately, fellow security researchers took notice. "This is a fantastic piece of work," Chris Evans, a semi-retired security researcher and executive and the founder of Project Zero, said in an interview. "It really is pretty serious. The fact you don't have to really interact with your phone for this to be set off on you is really quite scary. This attack is just you're walking along, the phone is in your pocket, and over Wi-Fi someone just worms in with some dodgy Wi-Fi packets." Beer's attack worked by exploiting a buffer overflow bug in a driver for AWDL, an Apple-proprietary mesh networking protocol that makes things like Airdrop work. Because drivers reside in the kernel -- one of the most privileged parts of any operating system -- the AWDL flaw had the potential for serious hacks. And because AWDL parses Wi-Fi packets, exploits can be transmitted over the air, with no indication that anything is amiss.' -- source: https://apple.slashdot.org/story/20/12/02/1933245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Greg Kroah-Hartman: 'Don't Make Users Mad'
by Peter Reutemann 01 Dec '20

01 Dec '20

'Greg Kroah-Hartman, the Linux Foundation fellow currently responsible for stable Linux kernel releases, shared the lessons he's learned as a kernel developer that are applicable to other developers at this year's Linux App Summit. He started by showing how he could succinctly distill the essence of the talk into a single five-word slide: "Don't make your users mad...." Kroah-Hartman explains that one of Linus Torvalds' most deeply-held convictions: don't break userspace. "Other operating systems have this rule as well — it's a very solid rule — because we always want you to upgrade. And we want you to upgrade without worrying about it. We don't want you to feel scared. If you see a new release, and we say, 'Hey, this fixes a bunch of problems,' we don't want you to feel worried about taking that. That's really really important — especially with security...." If you do make a change, make sure there truly is a compelling reason. "You have to provide enough reason and enough goodness to force somebody to take the time to learn to do something else. That's very rare." His example of this was systemd, which unified a variety of service configurations and initialization processes. "They did it right. They provided all the functionality, they solved a real problem that was there. They unified all these existing tools and problems in such a way that it was just so much better to use, and it provided enough impetus that everybody was willing to do the work to modify their own stuff and move to the new model. It worked. People still complain about it, but it worked. Everybody switched... It works well. It solves a real problem. "That was an example of how you can provide a compelling reason to move on — and make the change."' -- source: https://linux.slashdot.org/story/20/11/28/0714229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi Used To Hack Tesla Model X SUV Key Fob
by Peter Reutemann 29 Nov '20

29 Nov '20

'According to this Tom's Hardware story, a Belgian PhD student managed to wrest full control of a Tesla Model X SUV, by way of hijacking the Bluetooth keyfob and reprogramming it, using a Raspberry Pi. Tesla has since issued a software update to protect against that kind of attack Since the attack is done via Bluetooth, control could be gained wirelessly from 5 meters away. According to the article this is the third time the same student "has managed to exploit the key fob and gain access to the car. Previously he was able to clone the fob..." Computer Weekly also got an interesting quote from a senior security consultant at the electronic design automation company Synopsys, who argues that the research "demonstrates the impacts of security requirements and security features not having proper validation."' -- source: https://tech.slashdot.org/story/20/11/28/2325210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

PHP 8.0 Brings Major (And Breaking) Changes to a 25-Year-Old Language
by Peter Reutemann 29 Nov '20

29 Nov '20

'"PHP version 8.0 has arrived, bringing with it a major update to the 25-year-old programming language..." writes Tech Republic. New language features include the nullsafe operator and attributes (commonly known as annotations in other languages) to add metadata to classes — and more: The JIT compiler is designed to bring performance improvements to web applications by turning code into instructions for the CPU at runtime. Meanwhile, union types is a feature that allows data of more than one type to be held by a variable. Named arguments allow developers to assign values to a function by specifying the value name, allowing optional parameters to be ignored. Alongside these, version 8.0 of PHP brings optimizations and enhancements to the language's type system, syntax, error handling and consistency.... Commenting on PHP 8.0, PHP programmer and stitcher.io developer, Brent Roose, noted that the latest version of the language may require developers to review code for any breaking changes.' -- source: https://developers.slashdot.org/story/20/11/28/1030246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Developer Successfully Virtualizes Windows for Arm on M1 Mac
by Peter Reutemann 29 Nov '20

29 Nov '20

'Developer Alexander Graf has successfully virtualized the Arm version of Windows on an M1 Mac, proving that the M1 chip is capable of running Microsoft's operating system. From a report: Currently, Macs with the M1 chip do not support Windows and there is no Boot Camp feature as there is on Intel Macs, but support for Windows is a feature that many users would like to see. Using the open-source QEMU virtualizer, Graf was able to virtualize the Arm version of Windows on Apple's M1 chip, with no emulation. Since the M1 chip is a custom Arm SoC, it is no longer possible to install the x86 version of Windows or x86 Windows apps using Boot Camp, as was the case with previous Intel-based Macs. However, he said in a Tweet that when virtualized on an M1 Mac, "Windows ARM64 can run x86 applications really well. It's not as fast as Rosetta 2, but close."' -- source: https://apple.slashdot.org/story/20/11/27/2343223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AGM in January
by Peter Reutemann 28 Nov '20

28 Nov '20

Hi everyone Since we had our last meeting for the year, I just want to announce our upcoming AGM on January 25th. Agenda (preliminary) • President's Report • Treasurer's Report • Election of 2021 Committee • General business • Consumption of pizza Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/274861121/ Don't worry, there will be another announcement closer to the date. ;-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft's 'Project Latte' Aims To Bring Android Apps To Windows 10
by Peter Reutemann 28 Nov '20

28 Nov '20

'Windows Central reports: Microsoft is working on a software solution that would allow app developers to bring their Android apps to Windows 10 with little to no code changes by packaging them as an MSIX and allowing developers to submit them to the Microsoft Store. According to sources familiar with the matter, the project is codenamed 'Latte' and I'm told it could show up as soon as next year. The company has toyed with the idea of bringing Android apps to Windows 10 before via a project codenamed Astoria that never saw the light of day. Project Latte aims to deliver a similar product, and is likely powered by the Windows Subsystem for Linux (WSL.) Microsoft will need to provide its own Android subsystem for Android apps to actually run, however. Microsoft has announced that WSL will soon get support for GUI Linux applications, as well as GPU acceleration which should aid the performance of apps running through WSL. It's unlikely that Project Latte will include support for Play Services, as Google doesn't allow Play Services to be installed on anything other than native Android devices and Chrome OS. This means that apps which require Play Services APIs will need to be updated to remove those dependencies before they can be submitted on Windows 10.' -- source: https://tech.slashdot.org/story/20/11/27/2027234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

2FA Bypass Discovered In Web Hosting Software cPanel
by Peter Reutemann 26 Nov '20

26 Nov '20

'ZDNet: Security researchers have discovered a major security flaw in cPanel, a popular software suite used by web hosting companies to manage websites for their customers. The bug, discovered by security researchers from Digital Defense, allows attackers to bypass two-factor authentication (2FA) for cPanel accounts. These accounts are used by website owners to access and manage their websites and underlying server settings. Access to these accounts is critical, as once compromised, they grant threat actors full control over a victim's site. On its website, cPanel boasts that its software is currently used by hundreds of web hosting companies to manage more than 70 million domains across the world. But in a press release today, Digital Defense says that the 2FA implementation on older cPanel & WebHost Manager (WHM) software was vulnerable to brute-force attacks that allowed threat actors to guess URL parameters and bypass 2FA -- if 2FA was enabled for an account. While brute-forcing attacks, in general, usually take hours or days to execute, in this particular case, the attack required only a few minutes, Digital Defense said today. Exploiting this bug also requires that attackers have valid credentials for a targeted account, but these can be obtained from phishing the website owner. The good news is that Digital Defense has privately reported the bug, tracked as SEC-575, to the cPanel team, which has already released patches last week.' -- source: https://it.slashdot.org/story/20/11/25/2227200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

WireGuard for Windows 0.3.1 is the release you’ve been waiting for
by Peter Reutemann 26 Nov '20

26 Nov '20

'This Monday, WireGuard founder and lead developer Jason Donenfeld announced a new WireGuard release for the Windows platform. The release is something of a godsend for administrators hoping to implement WireGuard as a replacement for more traditional end-user VPNs in a business environment, adding several new features that will make their lives easier—or simply make its implementation possible, in environments where it otherwise would not. If you haven't heard about WireGuard yet, it's a relatively new VPN protocol featuring advanced cryptography. It's implemented from the ground up as an exercise in cleanly written, minimalist, maximally secure and performant code—and it succeeded at those goals well enough to get Linus Torvalds' own rarely-seen stamp of approval. ' -- source: https://arstechnica.com/gadgets/2020/11/wireguard-for-windows-0-3-1-is-the-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linus Torvalds Would Like To Use An M1 Mac For Linux, But...
by Peter Reutemann 25 Nov '20

25 Nov '20

'Yes, Torvalds said he'd love to have one of the new M1-powered Apple laptops, but it won't run Linux and, in an exclusive interview he explains why getting Linux to run well on it isn't worth the trouble. Steven J. Vaughan-Nichols writes via ZDNet: Recently, on the Real World Technologies forum, Linux's creator Linus Torvalds was asked what he thought of the new M1-powered Apple laptops. Torvalds replied, "I'd absolutely love to have one if it just ran Linux." You may think, "what's the problem? Doesn't Linux run on practically every processor on the planet from 80386s to IBM s390x to the ARM family of which Apple's M1 chip is a child?" Well, yes, yes it does. But it takes more than a processor to run a computer. Torvalds would like to run Linux on these next-generation Macs. As he said, "I've been waiting for an ARM laptop that can run Linux for a long time. The new Air would be almost perfect, except for the OS. And I don't have the time to tinker with it, or the inclination to fight companies that don't want to help." Aye, there's the rub. In an exclusive interview, Torvalds expanded on why he can't see porting Linux to the M1-based Macs. "The main problem with the M1 for me is the GPU and other devices around it, because that's likely what would hold me off using it because it wouldn't have any Linux support unless Apple opens up." Still, while Torvalds knows Apple opening up their chipsets "seems unlikely, but hey, you can always hope." Even if that "wasn't an issue," Torvalds continued, "My personal hope would be more cores. Even in a laptop, I don't care about 20-hour battery life (and I wouldn't get it building kernels anyway). I'd rather plug it in a bit more often, and have 8 big cores." As for the Mac's limited RAM -- no more than 16GBs on current models -- he can live with that. "16GBs is actually ok by me because I don't tend to do things that require a lot more RAM. All I do is read email, do git and kernel compiles. And yes, I have 64GB in my desktop, but that's because I have 32 cores and 64 threads, and I do hugely parallel builds. Honestly, even then 32GB would be sufficient for my loads." That said, other developers and power users may want more from the new Macs, Torvalds thinks. "The people who really want tons of memory are the ones doing multiple VMs or huge RAW file photography and video." ' -- source: https://hardware.slashdot.org/story/20/11/24/2225209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fwd: [NZLUG] CFP: LCA2021 Systems Administration Miniconf
by Peter Reutemann 25 Nov '20

25 Nov '20

Apologies for cross-posting, but since the event is down-under/online some people on this list might want to present/attend. Cheers, Peter ---------- Forwarded message --------- From: Ewen McNeill Date: Wed, Nov 25, 2020 at 11:33 AM Subject: [NZLUG] CFP: LCA2021 Systems Administration Miniconf To: NZ Linux Users Group <nzlug(a)lists.nzoss.org.nz> linux.conf.au 2021 is being held in an "Online Only" format from 23-25 January 2021 (Saturday through Monday!), starting with a Miniconf day on Saturday 2021-01-23. Based in UTC+11 (AEDT), it makes for a "sleep in" schedule for attending from New Zealand! Tickets are extra affordable this year (AU $125/$70/$30), and on sale now: https://lca2021.linux.org.au/attend/tickets/ (Sadly NZers don't get the electronic badge option :-( ) The Systems Administration Miniconf is one of four Miniconfs being held on Saturday 2021-01-23, and would welcome your presentation proposals now (closes 2020-12-18 AoE). For details see: https://sysadmin.miniconf.org/cfp21.html or read on, as the CFP is repeated below for your convenience. Ewen -=- cut here -=- LCA2021 Systems Administration Miniconf: Call for Presentations Saturday 2021-01-23 10:45-17:30 UTC+11 at Linux.conf.au 2021, Online Virtualisation has won! As of 2021, they have even virtualised our Systems Administration Miniconf! TL;DR: If you know our Miniconf, and know online presenting, you can propose your 15-20 minute Linux-related operations talk via the LCA2021 Dashboard *before* 2020-12-18: https://linux.conf.au/dashboard We'd particularly love your 2020 War Stories! Read on to find out more :-) Introduction ============ The linux.conf.au Systems Administration Miniconf returns for the 15th time as part of the very online linux.conf.au 2021, to be held without a venue (Venueless!), online on Saturday 2021-01-23, based in UTC+11 (AEDT -- Australian Eastern Daylight Time). The Systems Administration Miniconf focuses on tips, tricks, tools, and best practices used to manage real-world Linux environments both large and small. From single small servers through to 2,000 node Kubernetes Clusters. The organisers of the Systems Administration Miniconf would like to invite proposals for presentations to be delivered at the Miniconf. Please forward this CFP to your colleagues, peers, social networks, and other relevant mailing lists. Please help by encouraging submissions from people you would like to hear present at this Miniconf. We are open to presentations from speakers anywhere in the world, but please be mindful of the need to present during daytime in UTC+11 which may not be daytime in your local timezone (presenting late at night or very early in your morning is tricky!). More information and details of previous presentations at the Miniconf can be found at the website: https://sysadmin.miniconf.org/ Presentation Topics =================== 2020 has been a surprising year, and not the least for systems administration -- remote *everything* came with a rush, leaving many officeless, and dependent on the Internet and video conferencing. We would be particularly interested in talks about how 2020 has gone for your systems, how you dealt with the rapid changes in operating environment, and what your plans look like for a world where touching physical hardware frequently seems increasingly unlikely. Tell us your war stories :-) We would be very interested in retrospectives and "lessons learned" from the past year. We of course also welcome the usual range of talks on systems technology, automation, monitoring, troubleshooting, best current practices and so on. Presentations should be of a technical nature and speakers should assume that members of the audience have at least a couple of years experience in professional Linux administration (many in the audience will have decades of experience). Format of Presentations ======================= Due to the online only format, and its increased demands on the AV team, we have to fit into a more fixed structure within the LCA2021 Miniconf day. So we have less flexibility in our choice of presentations, that usual. We have openings for 15 and 20 minute short presentations (ie, each approximately half of a 45-minute "session", with a 10 minute gap in between). LCA2021 have indicated they have a strong preference for presentations to be given live, which will be easier if your local time zone is close to UTC+11 and you have an Internet connection with good upload speeds. For accepted Miniconf speakers the LCA2021 AV Team will want to check in with you *early* January 2021 to help ensure your presentation audio and visuals come across as well as possible. You may wish to watch the AV Team advice from PyConline AU 2020 to get some advanced hints on small changes you could make to help your presentation look and sound great: https://www.youtube.com/watch?v=C1TBqdULp4E Submitting talks ================ Please note that in order to give a presentation or attend the Miniconf you must be registered (and paid up by the time the conference happens) for the main linux.conf.au conference. Either for the full conference (Sat/Sun/Mon), or at least for the Miniconf day (Saturday 2021-01-23). As a one off "online only, LCA2021 only" special we have access to a small pool of "Miniconf Speaker" tickets, so if your employer will not pay for your ticket and the conference cost makes it difficult for you to attend/present please get in touch and we will see if we can help. To submit a talk to the LCA2021 Sysadmin Miniconf, create an account on the LCA2021 website: https://linux.conf.au/dashboard create a speaker profile, and then select "Systems Administration Miniconf Talk" (in the "New Proposal" section of the Dashboard), or while logged into the LCA2021 site, go directly to: https://linux.conf.au/proposals/submit/sysadmin-miniconf/ Questions should be sent to: lca2021 at sysadmin.miniconf.org Dates and Deadlines =================== To encourage early submissions, priority (both of inclusion and scheduling) will be given to presentations submitted by 23:59 (AoE -- ie any time zone) on Sunday 6 December 2020. If you have a good presentation idea, please let us know early, even if you need time to finalise the presentation abstract. 2020-12-06 - Deadline for early submissions 2020-12-11 - early acceptances 2020-12-18 - Deadline for all submissions 2020-12-21 - final acceptances 2020-12-24 - LCA2021 Sysadmin Miniconf initial programme published 2021-01-21 - LCA2021 Sysadmin Miniconf held (Online, UTC+11) Contact and Questions ===================== Please see our website at https://sysadmin.miniconf.org for more information on the miniconf, past presentations and presenting at it. If you have any questions please feel free to email the organisers at: lca2021 at sysadmin.miniconf.org -=- cut here -=- _______________________________________________ NZLUG mailing list NZLUG(a)lists.nzoss.org.nz http://lists.nzoss.org.nz/mailman/listinfo/nzlug -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

LISP presentation uploaded to WLUG github.
by Ian Stewart 25 Nov '20

25 Nov '20

Hi Folks, For last night's LISP presentation, the slide show file and the LISP demonstration programs have been uploaded to: https://github.com/WLUG/meetings/tree/master/2020/2020-11-23 The slide show is available in both .odp and .pdf formats. The demonstration programs all have shebangs for CLISP, but these may be changed to be for SBCL. The programs have been tested to work under both CLISP and SBCL. Note that SBCL seems to be fussier than CLISP and, for example, requires (defvar) functions before the variable could be loaded via a (setf) function. At the meeting Jake demonstrated the apropos function to help with finding symbols. An appendix slide has been added to the presentation to show this function. I have also added my first attempt at something resembling a real a LISP program, package-symbols.lisp. This program will list packages that are available to either SBCL or CLISP. Upon selecting a package, it will display all the symbols the package has. If the command line argument "function" is used (E.g., $ sbcl --script package-symbols function) then the symbols displayed will be filtered to only displaying symbols that are functions. cheers, Ian.

1 1

Gimp Turns 25
by Peter Reutemann 24 Nov '20

24 Nov '20

'The General Image Manipulation Program, GIMP, has turned 25. A brief celebration post detailed how the package started life as a July 1995 Usenet thought bubble by then-student Peter Mattis, who posted the following to several newsgroups: Suppose someone decided to write a graphical image manipulation program (akin to photoshop). Out of curiosity (and maybe something else), I have a few (2) questions: What kind of features should it have? (tools, selections, filters, etc.) What file formats should it support? (jpeg, gif, tiff, etc.)" Four months later, Mattis and fellow University of California Berkeley student Spencer Kimball delivered what they described as software "designed to provide an intuitive graphical interface to a variety of image editing operations." The software ran on Linux 1.2.13, Solaris 2.4, HPUX 9.05, and SGI IRIX. The answer to the file format support question turned out to be GIF, JPEG, PNG, TIFF, and XPM. The rest is history. Richard Stallman gave Mattis and Kimball permission to change the "General" in its name to "GNU", reflecting its open-source status. Today the program is released under the GNU General Public License. As the program added features such as layers, it grew more popular and eventually became a byword for offering a FOSS alternative to Photoshop even though the project pushes back against that description. The project's celebration page says volunteers did their "best to provide a sensible workflow to users by using common user interface patterns. That gave us a few questionable monikers like 'Photoshop for Linux', 'free Photoshop', and 'that ugly piece of software'. We still can wholeheartedly agree with the latter one only!"' -- source: https://it.slashdot.org/story/20/11/23/1946252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Mass-Produced, Librem 5 Linux Smartphone Begins Shipping to Customers
by Peter Reutemann 23 Nov '20

23 Nov '20

'This week Purism began shipping its mass-produced Librem 5 phone to customers, according to announcement from the company: The Librem 5 is a one-of-a-kind general-purpose computer in a phone form-factor that Purism has designed and built from scratch following a successful crowdfunding campaign that raised over $2.2 million. Both the hardware and software design is focused on respecting the end user's freedom and giving them control over their privacy and security. The Librem 5 doesn't run Android nor iOS but instead runs the same PureOS operating system as Purism's laptops and mini PC. The Librem 5 has unique hardware features including a user-removable cellular modem, WiFi card, and battery. Like with Librem laptops, the Librem 5 also features external hardware kill switches that cut power to the cellular modem, WiFi/Bluetooth, and front and back cameras and microphone so that the user can control when these devices are in use. All hardware switches can also be triggered together to enable "lockdown mode" which also disables the GPS, accelerometer and all other sensors... Another unique feature of the Librem 5 is convergence: the ability to connect the Librem 5 to a monitor or laptop dock and use it as a desktop computer running the same full-sized desktop applications as on Librem laptops. When in a phone form-factor, applications behave much like "responsive websites" and change their appearance for the smaller screen. This allows you to use the Librem 5 as a phone, a desktop, or a laptop with the same applications and same files. Their announcement notes their work on software making desktop applications "adaptive" to phone form factors, adding "This suite of software has now become the most popular software stack to use on other handheld Linux hardware." And they close with an appreciative comment from Purism's founder and CEO Todd Weaver: "Shipping the Librem 5 has been an immense multi-year developmental effort. It is the culmination of people's desire to see an alternative to Android and iOS and fund it, coupled with dedication from a team of experts addressing hardware, kernel, operating system, and applications that has turned a lofty near-impossible goal into reality. We have built a strong foundation and with the continued support of customers, the community, and developers, we will continue to deliver revolutionary products like the Librem 5 running PureOS."' -- source: https://mobile.slashdot.org/story/20/11/23/025228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Ubuntu Web Remix' Distro Offers Firefox-Based Chrome OS Alternative
by Peter Reutemann 23 Nov '20

23 Nov '20

'Rudra Saraswat is the creator of the Ubuntu Unity distro (which uses the Unity interface in place of Ubuntu's GNOME shell). But this week they released Ubuntu Web Remix, "a privacy-focused, open source alternative to Google Chrome OS/Chromium OS" using Firefox instead of Google Chrome/Chromium. Liliputing reports: If the name didn't give it away, this operating system is based on Ubuntu, but it's designed to offer a Chrome OS-like experience thanks to a simplified user interface and a set of pre-installed apps including the Firefox web browser, some web apps from /e/, and Anbox, a tool that allows you to run Android apps in Linux... You don't get the long battery life, cloud backup, and many other features that make Chromebooks different from other laptops (especially other cheap laptops). But if you're looking for a simple, web-centric operating system that isn't made by a corporate giant? Then I guess it's nice to have the option. Rudra Saraswat writes: An easy web-app (wapp) format has been created to package web-apps for the desktop. You can now create your own web apps using web technologies, package them for the desktop and install them easily. An experimental wapp store can be found at store.ubuntuweb.co, for distributing web apps. Developers and packagers can do pull requests at gitlab.com/ubuntu-web/ubuntu-web.gitlab.io to contribute wapps. ' -- source: https://news.slashdot.org/story/20/11/22/0226213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How Firefox Boosted Its JavaScript Performance
by Peter Reutemann 23 Nov '20

23 Nov '20

'InfoWorld reports: Firefox users can expect improved JavaScript performance in the Firefox 83 browser, with the Warp update to the SpiderMonkey JavaScript engine enabled by default. Also called WarpBuilder, Warp improves responsiveness and memory usage and speeds up page loads by making changes to JiT (just-in-time) compilers... Warp has been shown to be faster than Ion, SpiderMonkey's previous optimizing JiT, including a 20 percent improvement on Google Docs load time. Other JavaScript-intensive websites such as Netflix and Reddit also have shown improvement... Warp has replaced the front end — the MIR building phase — of the IonMonkey JiT... Mozilla also will continue to incrementally optimize the back end of the IonMonkey JiT, as Mozilla believes there is still room for improvement for JavaScript-intensive workloads.' -- source: https://news.slashdot.org/story/20/11/22/0412232 I agree, 83 feels snappier when browsing. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

After Restoring YouTube-dl, GitHub Revamps Its Copyright Takedown Policy
by Peter Reutemann 22 Nov '20

22 Nov '20

'On October 23rd GitHub initially complied with a takedown request for the open-source project youtube-dl — and then after 24 days, reinstated it. "If there's a silver lining to the episode, it's that GitHub is implementing new policies to avoid a repeat of a repeat situation moving forward," reports Engadget: First, it says a team of both technical and legal experts will manually evaluate every single section 1201 claim. In instances where there's any ambiguity to a claim, the company says it will err on the side of developers and leave their repository online. If the company's technical and legal teams ultimately find any issues with a project, GitHub will give its owners the chance to address those problems before it takes down their work. Following a takedown, it will continue to give people the chance to recover their data — provided it doesn't include any offending code. GitHub is also establishing a $1 million defense fund to provide legal aid to developers against suspect section 1201 claims, as well as doubling down on its lobbying work to amend the DMCA and other similar copyright laws across the world. ' -- source: https://yro.slashdot.org/story/20/11/21/0554250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fearing Drama, Mozilla Opens Public Consultation Before Worldwide Firefox DoH Rollout
by Peter Reutemann 20 Nov '20

20 Nov '20

'Mozilla has opened today a public comment and consultation period about the ways it could enable support for the controversial privacy-centric DNS-over-HTTPS (DoH) protocol inside Firefox. From a report: The browser maker's decision to open a rare public consultation period comes after the organization faced criticism last year in the UK for its plans to support DoH inside Firefox. UK government officials, law enforcement agencies, and local internet service providers criticized Mozilla for developing and wanting to roll out DoH, a feature they said could have helped suspects bypass enterprise firewalls and parental controls blocklists -- even earning the browser maker a nomination for an "Internet Villain" award from a local ISP. All last year's hoopla was caused by DoH, a web protocol developed as an alternative to the classic DNS (Domain Name System). DoH works by encrypting DNS queries (which are normally sent out in clear text) and hiding them inside normal-looking HTTPS web traffic.' -- source: https://tech.slashdot.org/story/20/11/19/1711200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

OpenStreetMap is Having a Moment
by Peter Reutemann 20 Nov '20

20 Nov '20

'Joe Morrison: The first time I spoke with Jennings Anderson, I couldn't believe what he was telling me. I mean that genuinely -- I did not believe him. He was a little incredulous about it himself. I felt like he was sharing an important secret with me that the world didn't yet know. The open secret Jennings filled me in on is that OpenStreetMap (OSM) is now at the center of an unholy alliance of the world's largest and wealthiest technology companies. The most valuable companies in the world are treating OSM as critical infrastructure for some of the most-used software ever written. The four companies in the inner circle -- Facebook, Apple, Amazon, and Microsoft -- have a combined market capitalization of over six trillion dollars. In almost every other setting, they are mortal enemies fighting expensive digital wars of attrition. Yet they now find themselves eagerly investing in and collaborating on OSM at an unprecedented scale (more on the scale later). What likely started as a conversation in a British pub between grad students in 2004 has spiraled out of control into an invaluable, strategic, voluntarily-maintained data asset the wealthiest companies in the world can't afford to replicate. I will admit that I used to think of OSM as little more than a virtuous hobby for over-educated Europeans living abroad -- a cutesy internet collectivist experiment somewhere on the spectrum between eBird and Linux. It's most commonly summarized with a variant of this analogy: OSM is to an atlas as Wikipedia is to an encyclopedia. OSM acolytes hate this comparison in the much same way baseball players resent when people describe the sport as "cricket for fat people." While vaguely truthful, it doesn't quite get to the spirit of the thing. OSM is incomparable. Over 1.5M individuals have contributed data to it. It averages 4.5M changes per day. The stats page on the OSM Wiki is a collection of hockey sticks. [...] ' -- source: https://slashdot.org/story/20/11/19/1935221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google is Rolling Out End-To-End Encryption for RCS in Android Messages Beta
by Peter Reutemann 20 Nov '20

20 Nov '20

'After two long, complicated years, every Android user worldwide (outside China) now has access to the next-gen texting standard that is replacing SMS. Google is directly offering RCS chat services through its Android Messages app to anybody who installs it and uses it as their default texting app, which partly bypasses a carrier rollout that, at times, has ranged from sluggish to incoherent to broken. From a report Just as importantly, Google has announced that it's finally beginning to enable a key privacy feature: end-to-end encryption. For Android users who use Android Messages, one-on-one chats will eventually be end-to-end encrypted by default, meaning neither carriers nor Google will be able to read the content of those messages. Even though encryption is only beginning to roll out to people who sign up for the public beta for Android Messages, turning on encryption for RCS is a very big deal. It's a massive privacy win, as it could mean that the de facto replacement for SMS will, by default, be private on the smartphone platform used by the vast majority of people worldwide. As for the people who use that other smartphone platform -- the iPhone -- we have no word on whether Apple intends to adopt the RCS standard. But as every carrier worldwide gets on board, and now that there is a clearer path to ensuring private communication with RCS, the pressure on Apple to participate is likely to build. Unfortunately, SMS becoming fully deprecated and replaced by RCS will only happen if all goes to plan for Google. Since initially announcing plans to transition to RCS as the primary texting platform for Android, the standard's rollout has been mired in confusion. In attempting to be neutral and make Android's texting a standard shared by carriers worldwide, Google set itself up with the job of herding multibillion-dollar cats -- with sadly predictable results.' -- source: https://tech.slashdot.org/story/20/11/19/1528230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

BBC Releases Doctor-Who-Themed RISC-V-Based Programming Kit
by Lawrence D'Oliveiro 20 Nov '20

20 Nov '20

The BBC has created a miniature computer, the “Doctor Who HiFive Inventor”, aimed at young ’uns trying to learn programming <https://www.theregister.com/2020/11/19/bbc_doctor_who_sifive/>. This uses a RISC-V processor from SiFive, includes quite a range of I/O interfaces, and comes with lessons narrated by Jodie “Thirteenth Doctor” Whittaker. Pricing looks comparable to Raspberry-π-based products, too.

1 0

Apple Silicon Performance
by Lawrence D'Oliveiro 20 Nov '20

20 Nov '20

You may have seen reports popping up everywhere as Apple’s new Macs running its ARM-based “Apple Silicon” chips get into the hands of the first buyers. They seem to offer remarkable performance while still managing good battery life, even while a lot of the software they are running is still written for x86 processors and being translated on the fly through the “Rosetta 2” emulator layer. One of the secrets to that performance is that the system RAM is integrated into the CPU chipset <https://www.theregister.com/2020/11/19/apple_m1_high_bandwidth_memory_perfo…>. Yup, that means RAM is not upgradeable on these machines.

1 0

Microsoft’s “Project Reunion” Leads To More Fragmentation
by Lawrence D'Oliveiro 20 Nov '20

20 Nov '20

If you thought the Microsoft Windows development landscape was already confusing enough, consider this update <https://www.theregister.com/2020/11/19/microsoft_winui_windows/> on “Project Reunion” ... which [Windows Developer VP] Gallo described as “a common platform for new apps and APIs so that they will work down-level across supported versions of Windows.” A developer asked: “For a new desktop app what is your recommendation, UWP? WinUI, WPF or WinForm?” To which there was no simple answer. Indeed, while the presentation introduced WinUI version 3, it appears WinUI 2.x will also continue to be developed. Instead, Gallo talked about no longer having binary choices, but being able to mix and match in the brave new Reunion world. I wonder if anybody at Microsoft really understands what “Reunion” means ...

1 0

Google's Native Version of Chrome For Apple's ARM Macs Is Out Now
by Peter Reutemann 19 Nov '20

19 Nov '20

'According to Chrome product manager Mark Chang, Google's version of Chrome that support ARM Macs is now available to download. The Verge reports: In theory, a native version of the notoriously resource-hungry browser might run more efficiently on Apple's Arm-based computers. In our reviews of the MacBook Air, MacBook Pro, and Mac mini equipped with the new M1 chip, though, we found that the version of Chrome built for Intel chips already runs well on Apple's new Macs, so hopefully this native version runs even better. You'll be able to pick which version of Chrome to download from the browser's website. Google began rolling out a new version of Chrome on Tuesday, touting the "the largest gain in Chrome performance in years" thanks to some under-the-hood changes. The company's blog about the new release didn't mention anything about a version optimized for Apple's Arm-based Macs.' -- source: https://apple.slashdot.org/story/20/11/18/2239226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Massive, China-State-Funded Hack Hits Companies Around the World, Report Says
by Peter Reutemann 19 Nov '20

19 Nov '20

'Ars Technica: Researchers have uncovered a massive hacking campaign that's using sophisticated tools and techniques to compromise the networks of companies around the world. The hackers, most likely from a well-known group that's funded by the Chinese government, are outfitted with both off-the-shelf and custom-made tools. One such tool exploits Zerologon, the name given to a Windows server vulnerability, patched in August, that can give attackers instant administrator privileges on vulnerable systems. Symantec uses the code name Cicada for the group, which is widely believed to be funded by the Chinese government and also carries the monikers of APT10, Stone Panda, and Cloud Hopper from other research organizations. The group has been active in espionage-style hacking since at least 2009 and almost exclusively targets companies linked to Japan. While the companies targeted in the recent campaign are located in the United States and other countries, all of them have links to Japan or Japanese companies. The attacks make extensive use of DLL side-loading, a technique that occurs when attackers replace a legitimate Windows dynamic-link library file with a malicious one. Attackers use DLL side-loading to inject malware into legitimate processes so they can keep the hack from being detected by security software. The campaign also makes use of a tool that's capable of exploiting Zerologon. Exploits work by sending a string of zeros in a series of messages that use the Netlogon protocol, which Windows servers use to let users log into networks. People with no authentication can use Zerologon to access an organization's crown jewels -- the Active Directory domain controllers that act as an all-powerful gatekeeper for all machines connected to a network. Microsoft patched the critical privilege-escalation vulnerability in August, but since then attackers have been using it to compromise organizations that have yet to install the update. Both the FBI and Department of Homeland Security have urged that systems be patched immediately. Among the machines compromised during attacks discovered by Symantec were domain controllers and file servers. Company researchers also uncovered evidence of files being exfiltrated from some of the compromised machines.' -- source: https://it.slashdot.org/story/20/11/19/0124204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

$6 Billion Linux Deal? SUSE IPO Rumored
by Peter Reutemann 18 Nov '20

18 Nov '20

'ZDNet: According to Bloomberg, EQT is planning an IPO for German Linux and enterprise software company SUSE. EQT is a Swedish-based private equity firm with 50 billion euros in raised capital. SUSE is the leading European Union (EU) Linux distributor. Over the years, SUSE has changed owners several times. First, it was acquired by Novell in 2004. Then, Attachmate, with some Microsoft funding, bought Novell and SUSE in 2010. This was followed in 2014 when Micro Focus purchased Attachmate and SUSE was spun off as an independent division. Then, EQT purchased SUSE from Micro Focus for $2.5 billion in March 2019. With an IPO of approximately $6 billion, EQT would do very well for itself in very little time. Bloomberg states that the IPO talks are in a very preliminary stage. Nothing may yet come of these conversations. As for SUSE, a company representative said, "As a company, we are constantly exploring ways to grow. But as a matter of corporate policy, we do not comment on rumor or speculation in the market."' -- source: https://linux.slashdot.org/story/20/11/17/2148202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 83 Arrives With HTTPS-Only Mode and Faster Performance
by Peter Reutemann 18 Nov '20

18 Nov '20

'Mozilla today launched Firefox 83 for Windows, Mac, and Linux. An anonymous reader shares a report: Firefox 83's highlight feature is HTTPS-Only Mode, in which the browser attempts to establish fully secure connections to every website (just like the EFF's HTTPS Everywhere). If it can't, Firefox asks for your permission before connecting to a website that doesn't support secure connections. To enable HTTPS-Only Mode, click on Firefox's menu button, hit Preferences, then Privacy & Security, scroll down to HTTPS-Only Mode, and choose "Enable HTTPS-Only Mode in all windows." [...] Firefox 83 also brings performance improvements (improved page load performance by up to 15%, page responsiveness by up to 12%, and reduced memory usage by up to 8%). Firefox 83 is also the penultimate version of the web browser that will run Flash software; Firefox 85 will completely disable it when it arrives on Jan. 12, 2021.' -- source: https://news.slashdot.org/story/20/11/17/1725230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome 87 Released With Fix for NAT Slipstream Attacks, Broader FTP Deprecation
by Peter Reutemann 18 Nov '20

18 Nov '20

'Google has released today version 87 of its Chrome browser, a release that comes with a security fix for the NAT Slipstream attack technique and a broader deprecation of the FTP protocol. From a report: Todays' release is available for Windows, Mac, Linux, Chrome OS, Android, and iOS. Users can update to the new version via Chrome's built-in update utility. While in previous versions, Google has shipped some changes to Chrome settings and UI elements, almost all the major new Chrome 87 features are aimed at web developers. In Chrome 87, we have new APIs and updates to Chrome's built-in Developer Tools, such as: Support for the new Cookie Store API; new features to allow easier modification of web fonts via CSS; a new feature to let websites enumerate all the locally installed fonts; support for pan, tilt, and zoom controls on webcam streams; and, support for debugging WebAuthn operations via the Chrome DevTools.' -- source: https://slashdot.org/story/20/11/17/1810248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday
by Peter Reutemann 18 Nov '20

18 Nov '20

Hi everyone We have a meeting coming up next Monday: "Introduction to the LISP programming language will be presented by Jake Waas and Ian Stewart. They will focus on the open source CLISP and SBCL dialects of the LISP language and the use of functions in the COMMON-LISP package. By the end of the presentation you will be able to write simple LISP programs." -- details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/266792044/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Interview With KDE Developers
by Lawrence D'Oliveiro 17 Nov '20

17 Nov '20

Talk with a couple of the KDE “maintainers” (?) <https://www.theregister.com/2020/11/16/kde_maintainers_speak_on_why/> on the origins of KDE and where it stands today. The fact that it is built on Qt, which is heavily used in many commercial projects, means “Qt has to work well with a small footprint because of embedded systems, and that means KDE’s Plasma desktop has had a fundamental change since the mindset of KDE 3 days, when it was considered bloated and heavy,” said Riddell. “Now it’s a really fast, lightweight desktop.” Some other worthwhile info there, including discussions of working with Wayland and systemd.

1 0

GitHub Reinstates YouTube-dl Library After EFF Intervention
by Peter Reutemann 17 Nov '20

17 Nov '20

'GitHub has reinstated today the youtube-dl open-source project, a Python library that lets users download the source audio and video files behind YouTube videos. From a report: GitHub, a code-hosting repository, had previously removed the library from its portal after it received a controversial DMCA takedown request from the Recording Industry Association of America (RIAA) on October 23. In a DMCA takedown letter, RIAA argued that the library was being used to "circumvent the technological protection measures used by authorized streaming services such as YouTube" and to allow users to "reproduce and distribute music videos and sound recordings [...] without authorization." RIAA also noted that the project's source code "expressly suggests its use to copy and/or distribute the following copyrighted works." More specifically, RIAA used Section 1201 of the Digital Millennium Copyright Act (DMCA) to claim that the youtube-dl library was breaking copyright by providing a tool to circumvent copyrighted material -- even if the youtube-dl library didn't contain copyright-infringing code itself. But in a blog post today, GitHub said the library did not actually break Section 1201 of the DMCA, citing a letter it received from Electronic Frontier Foundation lawyers, who to take up the youtube-dl project's case. In the letter, the EFF team explained that Google does not have any technical measures in place to prevent the download of its videos -- all of which need to be made freely available to all kinds of apps, browsers, smart TVs, and more. Hence, EFF lawyers argued that the library could never be taken down under Section 1201 of the DMCA since the library doesn't actually circumvent any sort of copyright protection system in the first place.' -- source: https://yro.slashdot.org/story/20/11/16/1730250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ok Google: Please Publish Your DKIM Secret Keys
by Peter Reutemann 17 Nov '20

17 Nov '20

'Matthew Green, a cryptographer and professor at Johns Hopkins University, writes: The Internet is a dangerous place in the best of times. Sometimes Internet engineers find ways to mitigate the worst of these threats, and sometimes they fail. Every now and then, however, a major Internet company finds a solution that actually makes the situation worse for just about everyone. Today I want to talk about one of those cases, and how a big company like Google might be able to lead the way in fixing it. This post is about the situation with Domain Keys Identified Mail (DKIM), a harmless little spam protocol that has somehow become a monster. My request is simple and can be summarized as follows: Dear Google: would you mind rotating and publishing your DKIM secret keys on a periodic basis? This would make the entire Internet quite a bit more secure, by removing a strong incentive for criminals to steal and leak emails. The fix would cost you basically nothing, and would remove a powerful tool from hands of thieves.' -- source: https://tech.slashdot.org/story/20/11/16/1932234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

There’s Open Source, And There’s Open Source
by Lawrence D'Oliveiro 13 Nov '20

13 Nov '20

Vendors open-sourcing a bunch of code isn’t enough, if that code remains under the de-facto control of the vendor. It needs to be possible for a community to influence its development direction, rather than passively waiting for the next code drop from the vendor, according to Dave Airlie <https://www.theregister.com/2020/11/12/intel_igc_mesa/>. He says: “A warning then to anyone wishing for more vendor code sharing between OSes it generally doesn't end with Linux being better off, it ends up with Linux being more fragmented, harder to support and in the long run unsustainable.”

1 0

E-Cycle
by john 12 Nov '20

12 Nov '20

Hi All. Service industries now has a receiving warehouse offering all computers and paraphernalia can be dumped for free. Similarly any stuff that is salvageable is given away. Email ewasterecyclers(a)gmail.com Keily 021-526-4825 Adrian 020-256-2289 5 Johnson Street Dinsdale. Cheers John

1 0

Ubuntu fixes bugs that standard users could use to become root
by Peter Reutemann 12 Nov '20

12 Nov '20

'Ubuntu developers have fixed a series of vulnerabilities that made it easy for standard users to gain coveted root privileges. “This blog post is about an astonishingly straightforward way to escalate privileges on Ubuntu,” Kevin Backhouse, a researcher at GitHub, wrote in a post published on Tuesday. “With a few simple commands in the terminal, and a few mouse clicks, a standard user can create an administrator account for themselves.” The first series of commands triggered a denial-of-service bug in a daemon called accountsservice, which as its name suggests is used to manage user accounts on the computer. To do this, Backhouse created a Symlink that linked a file named .pam_environment to /dev/zero, changed the regional language setting, and sent accountsservice a SIGSTOP. With the help of a few extra commands, Backhouse was able to set a timer that gave him just enough time to log out of the account before accountsservice crashed. When done correctly, Ubuntu would restart and open a window that allowed the user to create a new account that—you guessed it—had root privileges.' -- source: https://arstechnica.com/information-technology/2020/11/ubuntu-fixes-bugs-th… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

No, the New MacBook Air is Not Faster Than 98% of PC Laptops
by Peter Reutemann 12 Nov '20

12 Nov '20

'Gordon Mah Ung, writing at PC World: Let me just say it outloud, OK? Apple is full of it. I'm referring to Apple's claim that its fanless, Arm-based MacBook Air is "faster than 98 percent of PC laptops." Yes, you read that correctly: Apple officials literally claimed that the new MacBook Air using Apple's custom M1 chip is faster than 98 percent of all PC laptops sold this year. Typically, when a company makes such a claim, it publishes a benchmark, a performance test or actual details on what it's basing that marketing claim on. This to prevent lawyers from launching out of missile silos across the world. Apple's website restates the claim by stating: "M1 is faster than the chips in 98 percent of PC laptops sold in the past year." The site also includes a detail note that states: "Testing conducted by Apple in October 2020 using preproduction 13-inch MacBook Pro systems with Apple M1 chip and 16GB of RAM. Performance measured using select industry-standard benchmarks. PC configurations from publicly available sales data over the last 12 months. Performance tests are conducted using specific computer systems and reflect approximate performance of MacBook Pro." So, not only does Apple not say what tests it's basing its claims on, it doesn't even say where it sources the comparable laptops. Does that mean the new fanless MacBook Air is faster than, say, Asus' stupidly fast Ryzen 4000 based, GeForce RTX 2060-based Zephyrus G14? Does it mean the MacBook Air is faster than Alienware's updated Area 51M? The answer, I'm going to guess is "no." Not at all. Is it faster than the miniLED-based MSI Creator 17? Probably not, either. And what is that "performance" claim hinged on? CPU performance? GPU performance? Performance running Windows? Is it using the same application running on both platforms? Is it experiential? Is this running Red Dead Redemption II or Call of Duty: Black Ops Cold War? Is it running CyberLink's PowerDirector? Is it running Fortnite? While I have absolutely no idea what Apple is basing its claims on, I can tell you that I am 98 percent sure that any of the above laptops listed will wreck the MacBook Air doing any of the tasks I just named. When Apple makes its claims, my guess is they are comparing the new M1 to Intel-based processors ranging from Atom to Celeron N to Core i3 and up, all with integrated graphics. But by not defining the word "performance," all this becomes just pure marketing spin. And is it really fair to compare a $999 MacBook to one that costs $150? Because $150 PCs are included in the 98 percent of laptops sold. Maybe Apple should compare its own $150 MacBook Air against a $150 Chromebook or Windows-based laptop. Of course, that would mean Apple would have to sell a product that most people can afford. I have no doubt the M1 will be impressive, but do I think it's going to compare to 8-cores of Ryzen 4000 performance or a GeForce RTX 2060? No.' -- source: https://apple.slashdot.org/story/20/11/11/2114225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome To Block Tab-Nabbing Attacks
by Peter Reutemann 12 Nov '20

12 Nov '20

'Google will deploy a new security feature in Chrome next year to prevent tab-nabbing, a type of web attack that allows newly opened tabs to hijack the original tab from where they were opened. From a report: The new feature is scheduled to go live with Chrome 88, to be released in January 2021. While the term "tab-nabbing" refers to a broad class of tab hijacking attacks [see OWASP, Wikipedia], Google is addressing a particular scenario. This scenario refers to situations when users click on a link, and the link opens in a new tab (via the "target=_blank" attribute). These new tabs have access to the original page that opened the new link. Via the JavaScript "window.opener" function, the newly opened tabs can modify the original page and redirect users to malicious sites. This type of attack has powered quite a few phishing campaigns across the years. To mitigate this threat, browser makers like Apple, Google, and Mozilla have created the rel="noopener" attribute.' -- source: https://tech.slashdot.org/story/20/11/11/1558242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi 4 Can Be Safely Overclocked To 2.15 GHz
by Peter Reutemann 12 Nov '20

12 Nov '20

'When the Raspberry Pi 400 (a keyboard form-factor single board computer) was released last week, the company hinted at overclocking. Testing has now shown that the heat spreader used in that design does an excellent job. The chip was already clocked at 1.8 GHz, versus the stock 1.5 GHz in the original Raspberry Pi 4 Model B board. But it can be safely overclocked to 2.15 GHz, as can the Compute Module 4 with an adequate heat sink. At 2.0 GHz, the Pi 400 got up above 60 C and showed signs of continuing to warm up even after 50 minutes, but it was nowhere near throttling. So I tried 2.2 GHz, at which speed the CPU refused to boot entirely. Backing down to 2.15 GHz, it ran just fine, so I left it for three hours. It settled in at a cozy 62.5 C, which is warm, but well within specs. I ran the CM4 with the larger heatsink at 1.8 GHz to give some basis for comparison to the cheap heatsinks. What a big difference a big hunk of aluminum makes! It settled in at a comfortable 68 C or so. Even pushing it up to 2.15 GHz and leaving it for a couple hours, it stayed just a hair below 70C (158F) -- a safe margin on the throttling threshold -- and only a few degrees warmer than that huge heat spreader in the Pi 400.' -- source: https://hardware.slashdot.org/story/20/11/11/182203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google's Play Store Identified as Main Distribution Vector For Most Android Malware
by Peter Reutemann 12 Nov '20

12 Nov '20

'The official Google Play Store has been identified as the primary source of malware installs on Android devices in a recent academic study -- considered the largest one of its kind carried out to date. >From a report: Using telemetry data provided by NortonLifeLock (formerly Symantec), researchers analyzed the origin of app installations on more than 12 million Android devices for a four-month period between June and September 2019. In total, researchers looked at more than 34 million APK (Android application) installs for 7.9 million unique apps. [...] The results showed that around 67% of the malicious app installs researchers identified came from the Google Play Store. Google did not respond to a request for comment made by ZDNet almost three weeks ago.' -- source: https://tech.slashdot.org/story/20/11/11/198244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Cricket NZ Makes Exclusive Deal With Amazon Prime For Indian Market
by Lawrence D'Oliveiro 11 Nov '20

11 Nov '20

Indian cricket fans (of which there are many) wanting to watch NZ matches will need to sign up for the Amazon Prime streaming service, according to this <https://www.theregister.com/2020/11/11/amazon_prime_new_zealand_cricket_dea…>. The deal will run for six years from late next year.

1 0

Lightweight Linux Distros for Old Laptop (2020)
by Peter Reutemann 11 Nov '20

11 Nov '20

'Do not discard that old PC or laptop yet. You can use a lightweight Linux distro to make them as good as new. Some of these Linux distros are specifically for use in older machines. You can use any of the lightweight Linux distros and bring your old machine back to life. In as much we focus on the old distros, we do have some new releases that do not require many resources that can re-invent your old computers. Are you in any or all of the situations below? - Your computer is but still feel like you can revive it - Your computer is modern but runs on low power - You need to install a modern computer to reserve resources to other demanding tasks If you find yourself in any of the above situations, then the best choice of action would be to start looking for the best lightweight Linux distros for old computers.' -- source: https://linoxide.com/distros/lightweight-linux-distros-for-old-laptop/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Computer Scientists Achieve 'Crown Jewel' of Cryptography
by Peter Reutemann 11 Nov '20

11 Nov '20

'A cryptographic master tool called indistinguishability obfuscation has for years seemed too good to be true. Three researchers have figured out that it can work. Erica Klarreich, reporting for Quanta Magazine: In 2018, Aayush Jain, a graduate student at the University of California, Los Angeles, traveled to Japan to give a talk about a powerful cryptographic tool he and his colleagues were developing. As he detailed the team's approach to indistinguishability obfuscation (iO for short), one audience member raised his hand in bewilderment. "But I thought iO doesn't exist?" he said. At the time, such skepticism was widespread. Indistinguishability obfuscation, if it could be built, would be able to hide not just collections of data but the inner workings of a computer program itself, creating a sort of cryptographic master tool from which nearly every other cryptographic protocol could be built. It is "one cryptographic primitive to rule them all," said Boaz Barak of Harvard University. But to many computer scientists, this very power made iO seem too good to be true. Computer scientists set forth candidate versions of iO starting in 2013. But the intense excitement these constructions generated gradually fizzled out, as other researchers figured out how to break their security. As the attacks piled up, "you could see a lot of negative vibes," said Yuval Ishai of the Technion in Haifa, Israel. Researchers wondered, he said, "Who will win: the makers or the breakers?" "There were the people who were the zealots, and they believed in [iO] and kept working on it," said Shafi Goldwasser, director of the Simons Institute for the Theory of Computing at the University of California, Berkeley. But as the years went by, she said, "there was less and less of those people." Now, Jain -- together with Huijia Lin of the University of Washington and Amit Sahai, Jain's adviser at UCLA -- has planted a flag for the makers. In a paper posted online on August 18, the three researchers show for the first time how to build indistinguishability obfuscation using only "standard" security assumptions. All cryptographic protocols rest on assumptions -- some, such as the famous RSA algorithm, depend on the widely held belief that standard computers will never be able to quickly factor the product of two large prime numbers. A cryptographic protocol is only as secure as its assumptions, and previous attempts at iO were built on untested and ultimately shaky foundations. The new protocol, by contrast, depends on security assumptions that have been widely used and studied in the past. "Barring a really surprising development, these assumptions will stand," Ishai said. While the protocol is far from ready to be deployed in real-world applications, from a theoretical standpoint it provides an instant way to build an array of cryptographic tools that were previously out of reach. For instance, it enables the creation of "deniable" encryption, in which you can plausibly convince an attacker that you sent an entirely different message from the one you really sent, and "functional" encryption, in which you can give chosen users different levels of access to perform computations using your data. The new result should definitively silence the iO skeptics, Ishai said. "Now there will no longer be any doubts about the existence of indistinguishability obfuscation," he said. "It seems like a happy end."' -- source: https://science.slashdot.org/story/20/11/10/1922225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

And Now For Some Local Bork
by Lawrence D'Oliveiro 10 Nov '20

10 Nov '20

A laser projection mural in Christchurch goes slightly wrong, showing a Windows 10 message instead <https://www.theregister.com/2020/11/09/bork/>: There can be few of us who have not felt the clammy hand of a Windows update on our shoulder, but sticking it on a mural and declaring it "art"? That takes a New Zealander.

1 0

HP Replaces 'Free Ink for Life' Plan With '99 Cents a Month Or Your Printer Stops Working'
by Peter Reutemann 10 Nov '20

10 Nov '20

'In a new essay at EFF.org, Cory Doctorow re-visits HP's anti-consumer "security updates" that disabled third-party ink cartridges (while missing real vulnerabilities that could actually bypass network firewalls). Doctorow writes that it was just the beginning: HP's latest gambit challenges the basis of private property itself: a bold scheme! With the HP Instant Ink program, printer owners no longer own their ink cartridges or the ink in them. Instead, HP's customers have to pay a recurring monthly fee based on the number of pages they anticipate printing from month to month; HP mails subscribers cartridges with enough ink to cover their anticipated needs. If you exceed your estimated page-count, HP bills you for every page (if you choose not to pay, your printer refuses to print, even if there's ink in the cartridges). If you don't print all your pages, you can "roll over" a few of those pages to the next month, but you can't bank a year's worth of pages to, say, print out your novel or tax paperwork. Once you hit your maximum number of "banked" pages, HP annihilates any other pages you've paid for (but continues to bill you every month). Now, you may be thinking, "All right, but at least HP's customers know what they're getting into when they take out one of these subscriptions," but you've underestimated HP's ingenuity. HP takes the position that its offers can be retracted at any time. For example, HP's "Free Ink for Life" subscription plan offered printer owners 15 pages per month as a means of tempting users to try out its ink subscription plan and of picking up some extra revenue in those months when these customers exceeded their 15-page limit. But Free Ink for Life customers got a nasty shock at the end of last month: HP had unilaterally canceled their "free ink for life" plan and replaced it with "a $0.99/month for all eternity or your printer stops working" plan... For would-be robber-barons, "smart" gadgets are a moral hazard, an irresistible temptation to use those smarts to reconfigure the very nature of private property, such that only companies can truly own things, and the rest of us are mere licensors, whose use of the devices we purchase is bound by the ever-shifting terms and conditions set in distant boardrooms. From Apple to John Deere to GM to Tesla to Medtronic, the legal fiction that you don't own anything is used to force you to arrange your affairs to benefit corporate shareholders at your own expense. And when it comes to "razors and blades" business-model, embedded systems offer techno-dystopian possibilities that no shaving company ever dreamed of: the ability to use law and technology to prevent competitors from offering their own consumables. >From coffee pods to juice packets, from kitty litter to light-bulbs, the printer-ink cartridge business-model has inspired many imitators. HP has come a long way since the 1930s, reinventing itself several times, pioneering personal computers and servers. But the company's latest reinvention as a wallet-siphoning ink grifter is a sad turn indeed, and the only thing worse than HP's decline is the many imitators it has inspired.' -- source: https://hardware.slashdot.org/story/20/11/09/0221226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Tim Berners Lee's Startup Inrupt Releases Privacy Platform for Enterprises
by Peter Reutemann 10 Nov '20

10 Nov '20

'Inrupt, the startup from World Wide Web founder Tim Berners-Lee, announced an enterprise version of the Solid privacy platform today, which allows large organizations and governments to build applications that put users in control of their data . From a report: Berners-Lee has always believed that the web should be free and open, but large organizations have grown up over the last 20 years that make their money using our data. He wanted to put people back in charge of their data, and the Solid open source project, developed at MIT, was the first step in that process. Three years ago he launched Inrupt, a startup built on top of the open source project, and hired John Bruce to run the company. The two shared the same vision of shifting data ownership without changing the way websites get developed. With Solid, developers use the same standards and methods of building sites, and these applications will work in any browser. What Solid aims to do is alter the balance of data power and redirect it to the user. "Fast forward to today, and we're releasing the first significant technology as the fruits of our labor, which is an enterprise version of Solid to be deployed at scale by large organizations," Bruce explained. The core idea behind this approach is that users control their data in online storage entities called Personal Online Data Stores or Pods for short. The enterprise version consists of Solid Server to manage the Pods, and developers can build applications using an SDK to take advantage of the Pods and access the data they need to do a particular job like pay taxes or interact with a healthcare provider. Bruce points out that the enterprise version is fully compatible with the open source Solid project specifications. The company has been working with some major organizations prior to today's release including the BBC and National Health Service in the UK and the Government of Flanders in Belgium as they have been working to bring this to market.' -- source: https://yro.slashdot.org/story/20/11/09/1453252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Compal, the Second-Largest Laptop Manufacturer in the World, Hit By Ransomware
by Peter Reutemann 10 Nov '20

10 Nov '20

'Compal, a Taiwanese electronics company that builds laptops for some of the world's largest computer brands, suffered a ransomware attack over the weekend. From a report: Responsible for the breach is believed to be the DoppelPaymer ransomware gang, according to a screenshot of the ransom note shared by Compal employees with Yahoo Taiwan reporters. According to Taiwanese media, the incident was discovered on Sunday morning and is believed to have impacted around 30% of Compal's computer fleet. Employees arriving at work were greeted by a memo from Compal's IT staff, asking workers to check the status of their workstations and back up important files on systems that were not impacted.' -- source: https://it.slashdot.org/story/20/11/09/1615207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FTC Announces a Settlement With Zoom Over Security Issues
by Peter Reutemann 10 Nov '20

10 Nov '20

'Zoom will implement new security practices as part of a proposed settlement with the Federal Trade Commission, the agency announced on Monday. From a report: "Zoom has agreed to a requirement to establish and implement a comprehensive security program, a prohibition on privacy and security misrepresentations, and other detailed and specific relief to protect its user base, which has skyrocketed from 10 million in December 2019 to 300 million in April 2020 during the COVID-19 pandemic," the FTC said in a press release.' -- source: https://news.slashdot.org/story/20/11/09/1645233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Cyberattackers Now Also Make Linux Versions of Their Ransomware
by Peter Reutemann 09 Nov '20

09 Nov '20

'"Security firm Kaspersky said Friday that it discovered a Linux version of the RansomEXX ransomware," reports ZDNet, "marking the first time a major Windows ransomware strain has been ported to Linux to aid in targeted intrusions." RansomEXX is a relatively new ransomware strain that was first spotted earlier this year in June. The ransomware has been used in attacks against the Texas Department of Transportation, Konica Minolta, U.S. government contractor Tyler Technologies, Montreal's public transportation system, and, most recently, against Brazil's court system (STJ)... The RansomEXX gang creating a Linux version of their Windows ransomware is in tune with how many companies operate today, with many firms running internal systems on Linux, and not always on Windows Server. A Linux version makes perfect sense from an attacker's perspective; always looking to expand and touch as much core infrastructure as possible in their quest to cripple companies and demand higher ransoms. What we see from RansomEXX may soon turn out to be an industry-defining trend, with other big ransomware groups rolling out their Linux versions in the future as well. And, this trend appears to have already begun. According to cyber-security firm Emsisoft, besides RansomEXX, the Mespinoza (Pysa) ransomware gang has also recently developed a Linux variant from their initial Windows version.' -- source: https://linux.slashdot.org/story/20/11/07/0541223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Verdict After Hackaday's Teardown of a Raspberry Pi 400: 'Very, Very Slick'
by Peter Reutemann 09 Nov '20

09 Nov '20

'"You can't send Hackaday a piece of gear without us taking it apart," warns an article shared by Slashdot reader beggarwoman. Hackady's verdict? The new Raspberry Pi 400 "is very, very slick." Inside, there's a flat-flex that connects the keyboard, and you see that big aluminum heat sink. It's almost the full size of the keyboard, and it's thick and heat-taped to the CPU. You know it means business. It's also right up against the aluminum bottom of the keyboard, suggesting it could get radiative help that way, and maybe keep your fingers warm in the winter. (I didn't feel any actual heat, but it's gotta go somewhere, right? There are also vents in the underside of the case.) Four PZ1 screws and a little bit of courage to unstick the pad get you underneath the heat spreader to find, surprise!, a Raspberry Pi 4. This was a little anticlimactic, as I've just spent a couple weeks looking over the schematics for my review of the new Compute Module 4, and it's just exactly what you'd expect. It's a Raspberry Pi 4, with all the ports broken out, inside a nice keyboard, with a beefy heat spreader. Ethernet magnetics sit on one side, and the wireless module sits on the other. That's it! "[C]ombine this with a small touch screen, and run it all off of a 5 V power pack, and you've got a ton of portable computing in a very small package. "If you're not mousing around all the time anyway, there's a certain streamlined simplicity here that's mighty tempting."' -- source: https://hardware.slashdot.org/story/20/11/07/1938245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

On Older Versions of Android, Many Let's Encrypt-Secured Sites May Stop Working in 2021
by Peter Reutemann 09 Nov '20

09 Nov '20

'This year Let's Encrypt announced that it's issued a billion certificates, and it's been estimated they've made certs for almost 30% of web domains. But Friday they posted that "The DST Root X3 root certificate that we relied on to get us off the ground is going to expire — on September 1, 2021. Fortunately, we're ready to stand on our own, and rely solely on our own root certificate." "However, this does introduce some compatibility woes." Some software that hasn't been updated since 2016 (approximately when our root was accepted to many root programs) still doesn't trust our root certificate, ISRG Root X1. Most notably, this includes versions of Android prior to 7.1.1. That means those older versions of Android will no longer trust certificates issued by Let's Encrypt. Android has a long-standing and well known issue with operating system updates. There are lots of Android devices in the world running out-of-date operating systems. The causes are complex and hard to fix: for each phone, the core Android operating system is commonly modified by both the manufacturer and a mobile carrier before an end-user receives it. When there's an update to Android, both the manufacturer and the mobile carrier have to incorporate those changes into their customized version before sending it out. Often manufacturers decide that's not worth the effort. The result is bad for the people who buy these devices: many are stuck on operating systems that are years out of date. Currently, 66.2% of Android devices are running version 7.1 or above. The remaining 33.8% of Android devices will eventually start getting certificate errors when users visit sites that have a Let's Encrypt certificate. In our communications with large integrators, we have found that this represents around 1-5% of traffic to their sites. Hopefully these numbers will be lower by the time DST Root X3 expires next year, but the change may not be very significant. Let's Encrypt engineer Jacob Hoffman-Andrews explains that "In the time between now and September 29 we plan to start serving certificates with the 'alternate' link relation 186 to allow Automatic Certificate Management Environment (ACME) clients to programmatically select a chain they prefer." But Friday's blog post explains that won't solve everything: There will be site owners that receive complaints from users and we are empathetic to that being not ideal. We're working hard to alert site owners so you can plan and prepare. We encourage site owners to deploy a temporary fix (switching to the alternate certificate chain) to keep your site working while you evaluate what you need for a long-term solution: whether you need to run a banner asking your Android users on older OSes to install Firefox, stop supporting older Android versions, drop back to HTTP for older Android versions, or switch to a CA that is installed on those older versions. Gizmodo notes that Firefox will be unaffected "since it relies on its own certificate store that includes Let's Encrypt's root, though that wouldn't keep applications from breaking or ensure functionality beyond your browser." They describe Let's Encrypt as "the Mozilla-partnered nonprofit," and offers this succinct summary of the problem. "One of the world's top certificate authorities warns that phones running versions of Android prior to 7.1.1 Nougat will be cut off from large portions of the secure web starting in 2021."' -- source: https://it.slashdot.org/story/20/11/08/1654223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Generating Flag Emojis
by Lawrence D'Oliveiro 08 Nov '20

08 Nov '20

You may have seen our new Foreign Minister, Nanaia Mahuta, tweeting her congratulations to the next President of the USA, including a couple of country flag emojis. I was looking through the Unicode character list for the codes for country flags, and discovered that there aren’t any, as such. Instead, there is this range of special character codes (“Regional indicator symbols”): 1F1E6 REGIONAL INDICATOR SYMBOL LETTER A ... 1F1FF REGIONAL INDICATOR SYMBOL LETTER Z with a note saying These characters can be used in pairs to represent regional codes. In some emoji implementations, certain pairs may be recognized and displayed by alternate means; for instance, an implementation might recognize F + R and display this combination with a symbol representing the flag of France. So for example if I enter U+1F1F3 (the code for N in the above block) followed by U+1F1FF (the code for Z), being the ISO-3166 regional code for NZ, the text-rendering system could replace them with the NZ flag: 🇳🇿. Anyway, I found out this works in YouTube comments as well. (Not that I’m saying the YouTube commenting system is particularly fine -- but that’s another story...)

1 0

EFF Argues RIAA is 'Abusing DMCA' to Take Down YouTube-DL
by Peter Reutemann 08 Nov '20

08 Nov '20

'While the RIAA has objected to a tool for downloading online videos, EFF senior activist Elliot Harmon responds with this question. "Who died and put them in charge of YouTube?" He asks the question in a new video "explainer" on the controversy, and argues in a new piece at EFF.org that the youtube-dl tool "doesn't infringe on any RIAA copyrights." RIAA's argument relies on a different section of the DMCA, Section 1201. DMCA 1201 says that it's illegal to bypass a digital lock in order to access or modify a copyrighted work. Copyright holders have argued that it's a violation of DMCA 1201 to bypass DRM even if you're doing it for completely lawful purposes; for example, if you're downloading a video on YouTube for the purpose of using it in a way that's protected by fair use. (And thanks to the way that copyright law has been globalized via trade agreements, similar laws exist in many other jurisdictions too.) RIAA argues that since youtube-dl could be used to download music owned by RIAA-member labels, no one should be able to use the tool, even for completely lawful purposes. This is an egregious abuse of the notice-and-takedown system, which is intended to resolve disputes over allegedly infringing material online. Again, youtube-dl doesn't use RIAA-member labels' music in any way. The makers of youtube-dl simply shared information with the public about how to perform a certain task — one with many completely lawful applications. Harmon wants to hear from people using youtube-dl for lawful purposes. And he also links to an earlier EFF piece arguing that DMCA 1201 "is incredibly broad, apparently allowing rightsholders to legally harass any 'trafficker' in code that lets users re-take control of their devices from DRM locks..." And EFF's concern over DMCA 1201 has been ongoing: DMCA 1201 has been loaded with terrible implications for innovation and free expression since the day it was passed. For many years, EFF documented these issues in our "Unintended Consequences" series; we continue to organize and lobby for temporary exemptions to its provisions for the purposes of cellphone unlocking, restoring vintage videogames and similar fair uses, as well as file and defend lawsuits in the United States to try and mitigate its damage. We look forward to the day when it is no longer part of U.S. law. But due to the WIPO Copyright Treaty, the DMCA's anti-circumvention provisions infest much of the world's jurisdictions too, including the European Union via the Information Society Directive 2001/29/EC.' -- source: https://yro.slashdot.org/story/20/11/07/0313228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Brave Hits 20 Million Monthly Users a Year After 1.0 Release
by Peter Reutemann 06 Nov '20

06 Nov '20

'One year after its first 1.0 release, Brave says it has hit the milestone of 20.5 million active monthly users. "At the same time last year, the browser had 8.7 million active monthly users, and of the 20 million monthly users, 7 million are daily users, which represents more than a doubling of last year's 3 million," reports ZDNet. "Brave added that since Apple allowed browsers other than its own to be the default option on iOS, it has seen its iOS user base increase by a third." From the report: One of the touted features of the browser is that it hates ads, and will go out of its way to block them, unless users decide to see Brave-powered advertisements. To that end, Brave has hit "2 billion ad confirmation events" and completed 2,215 campaigns from over 460 companies. The browser maker says its users have a click-through rate of 9%, way and away outstripping industry averages. The browser also has its own cryptocurrency, Basic Attention Tokens, that users use to "tip" content creators. Thus far, 26 million of the tokens have been sent to creators. At the time of writing, the blockchain-based token is trading for just under 18 cents, meaning $4.6 million has been sent from users. ' -- source: https://tech.slashdot.org/story/20/11/05/0424253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

Why Do Printers Still Suck?
by Peter Reutemann 06 Nov '20

06 Nov '20

'Just when we need them the most, with print shops locked down, online schooling in session, and everyone working from home, they fail to step up. From a column: Printers have been my enemy ever since I can remember. My first office job involved an evil printer that suffered daily paper jams. Tasked with fixing it, I suffered frequent burns and paper cuts. It had a door you had to close just so, or it would immediately break again with the dreaded phantom paper jam. It tormented me for months, completely indifferent to my cries. There isn't even any paper in it! More than two decades later, printers haven't improved at all. It feels like printer companies stopped innovating sometime in the '90s when sales stopped climbing. In fact, it's almost as if they've regressed. Manufacturers tempt with unbelievably cheap deals on printers and then nail you on expensive ink. To make sure they get their pound of flesh, they focus an inordinate effort on making sure printers only work with proprietary ink cartridges. [...] Three years and a couple of printers later, sick of being gouged for ink cartridges that always seem to run out at the worst moment, I optimistically signed up for a printing subscription plan. The idea is you are charged a flat fee based on how many pages you print each month, and the printer automatically orders ink refills when it's running low. Reading this back, I can only cringe at my naivety. Things were fine for the first few weeks. Then I made the mistake of turning the printer off. It doesn't like to be turned off. It started emailing me, insisting that it needs to be turned on and connected to the internet so the subscription plan can work properly. Every time I turn it on, it prints an ink-heavy test page. It is incredibly good at printing test pages -- it just won't print the document you want. Things got worse when I made the mistake of changing my internet service provider. I forgot about the printer for a while. Then I suddenly needed it. I didn't have time to set up the Wi-Fi, so I plugged directly into the printer with a good old-fashioned cable. It refused to print. I refused to connect it to the internet, so it refused to print for me. To get it working again I had to completely uninstall everything related to the printer, update my drivers, install three separate programs, carry it to another room to plug directly into my desktop, carry it back again, hold down the correct button sequence at the stroke of midnight, spin around three times, and recite the printer incantation into a mirror. It's finally connected and working ... for now. But I know it's only a matter of time before it betrays me again.' -- source: https://hardware.slashdot.org/story/20/11/05/2049213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

LibreOffice: OpenOffice Should Give Up And Die, Already
by Lawrence D'Oliveiro 06 Nov '20

06 Nov '20

Seems OpenOffice still has the edge in brand recognition over LibreOffice, in spite of being a largely moribund project with no major releases in 6 years. Yet, in spite of occasional talk of shutting it down, it continues to lurk, unloved, in some obscure corner of the ASF Orbiting HQ. <https://www.theregister.com/2020/10/15/libreoffice_openoffice_taunts/>

1 1

AMD Ryzen 5000 Series Processors Set a New Performance Bar Over Intel
by Peter Reutemann 06 Nov '20

06 Nov '20

'AMD made bold claims when the company unveiled its new Zen 3-based Ryzen 5000 series processors early last month. Statements like "historic IPC uplift" and "fastest for gamers" were waved about like flags of victory. However, as with most things in the computing world, independent testing is always the best way to validate claims. Today AMD lifted the embargo on 3rd party reviews and, in testing, AMD's new Ryzen 5000 series CPUs set a new performance bar virtually across the board, and one that Intel currently can't touch. There are four processors in the initial Ryzen 5000 series lineup, though it's a safe bet more will be coming later. The current entry point is the Ryzen 5 5600X 6-core / 8-thread processor, followed by the 8-core / 16-thread Ryzen 7 5800X, 12-core / 24 thread Ryzen 9 5900X, and the flagship 16-core / 32-thread Ryzen 9 5950X. All of these new CPUs are backwards compatible with AMD socket AM4 motherboards. In comparison to Zen 2, Zen 3 has a larger L1 branch target buffer and improved bandwidth through multiple parts of its pipeline with additional load/store flexibility. Where Zen 2 could handle 2 load and 1 store per cycle, Zen 3 can handle 3 load and 2 stores. All told, AMD is claiming an average 19% increase in IPC with Zen 3, which is a huge uplift gen-over-gen. Couple that IPC uplift with stronger multi-core scaling and a new unified L3 cache configuration, and Zen 3's performance looks great across a wide variety of workloads for both content creation and gaming especially. AMD's Ryzen 9 5950X, Ryzen 9 5900X, Ryzen 7 5800X and Ryzen 5 5600X will be priced at $799, $549, $449 and $299, respectively and should be on retail and etail shelves starting today.' -- source: https://slashdot.org/story/20/11/05/208242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Dell Adding Hardware Privacy Driver For Linux
by Peter Reutemann 05 Nov '20

05 Nov '20

'According to Phoronix, a Dell privacy driver is is being prepared for the Linux kernel. From the report: Beginning in Dell's 2021 laptop models they are providing hardware-based "privacy buttons" to disable microphone and camera support. These new Dell privacy buttons are basically hardware kill switches for the microphone and web camera video stream. The Dell privacy driver sent out on Tuesday for the Linux kernel is about manipulating the relevant LEDs and tracking the status of the hardware-based controls where as the actual toggling of the audio/video support is handled by the hardware. The Dell privacy driver in its current form is talked about for the camera and microphone support but the patch does also note a "PRIVACY_SCREEN_STATUS" bit as well. Presumably they will be extending this privacy driver as well for privacy screen handling around reducing the horizontal/vertical viewing angles of the display. The dell-privacy Linux driver in its initial form can be found via the kernel mailing list. It's great seeing Dell working on this driver punctually for Linux ahead of their next-gen laptops. ' -- source: https://linux.slashdot.org/story/20/11/04/2216242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linux Mint Introduces Its Own Take On the Chromium Web Browser
by Peter Reutemann 05 Nov '20

05 Nov '20

'Mint's programmers, led by lead developer, Clement "Clem" Lefebvre, have built their own take on Google's open-source Chromium web browser. ZDNet reports: Some of you may be saying, "Wait, haven't they offered Chromium for years? Well, yes, and no. For years, Mint used Ubuntu's Chromium build. But then Canonical, Ubuntu's parent company, moved from releasing Chromium as an APT-compatible DEB package to a Snap. The Ubuntu Snap software packing system, along with its rivals Flatpak and AppImage, is a new, container-oriented way of installing Linux applications. The older way of installing Linux apps, such as DEB and RPM package management systems for the Debian and Red Hat Linux families, incorporate the source code and hard-coded paths for each program. While tried and true, these traditional packages are troublesome for developers. They require programmers to hand-craft Linux programs to work with each specific distro and its various releases. They must ensure that each program has access to specific libraries' versions. That's a lot of work and painful programming, which led to the process being given the name: Dependency hell. Snap avoids this problem by incorporating the application and its libraries into a single package. It's then installed and mounted on a SquashFS virtual file system. When you run a Snap, you're running it inside a secured container of its own. For Chromium, in particular, Canonical felt using Snaps was the best way to handle this program. [...] Lefebvre wrote, "The Chromium browser is now available in the official repositories for both Linux Mint and LMDE. If you've been waiting for this I'd like to thank you for your patience." Part of the reason was, well, Canonical was right. Building Chromium from source code is one really slow process. He explained, "To guarantee reactivity and timely updates we had to automate the process of detecting, packaging and compiling new versions of Chromium. This is an application which can require more than 6 hours per build on a fast computer. We allocated a new build server with high specifications (Ryzen 9 3900, 128GB RAM, NMVe) and reduced the time it took to build Chromium to a little more than an hour." That's a lot of power! Still, for those who love it, up-to-date builds of Chromium are now available for Mint users. ' -- source: https://linux.slashdot.org/story/20/11/03/2157255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GitHub Warns Users Reposting YouTube-DL They Could Be Banned
by Peter Reutemann 04 Nov '20

04 Nov '20

'On October 23, 2020, the RIAA decided on action to stunt the growth and potentially the entire future of popular YouTube-ripping tool YouTube-DL. The music industry group filed a copyright complaint with code repository Github, demanding that the project be taken down for breaching the anti-circumvention provisions of the DMCA. While this was never likely to be well received by the hoards of people who support the software, the response was unprecedented. [...] One of the responses was to repost the content to Github itself, where hundreds of YouTube-DL forks kept the flame alight. A copy even appeared in Github's DMCA notice repository where surprisingly it remains to this day. Now, however, Github is warning of consequences for those who continue to use the platform for deliberate breaches of the DMCA. As previously reported, Github is being unusually sympathetic to the plight of the YouTube-DL developers. Most platforms are very happy to simply follow the rules by removing content in response to a DMCA complaint and standing back while declaring "Nothing to do with us folks." Github, on the other hand, has actively become involved to try and get the project reinstated. Unfortunately, however, there is only so far Github can go, something the company made clear in a statement posted to its DMCA repository this weekend. "If you are looking to file or dispute a takedown notice by posting to this repository, please STOP because we do not accept Pull Requests or other contributions to this repository," wrote Jesse Geraci, Github's Corporate Counsel. "Please note that re-posting the exact same content that was the subject of a takedown notice without following the proper process is a violation of GitHub's DMCA Policy and Terms of Service. If you commit or post content to this repository that violates our Terms of Service, we will delete that content and may suspend access to your account as well," Geraci wrote. This statement caused an update to Github's earlier DMCA notice advice.' -- source: https://yro.slashdot.org/story/20/11/02/2250200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Wildly off topic but!!!
by john 03 Nov '20

03 Nov '20

Hi all, I know, but some light relief for those who have not seen these.. https://www.youtube.com/watch?v=4QsIQOevMLg https://www.youtube.com/watch?v=3MHDDSekvcE -- Cheers John

1 0

'youtube-dl' Downloading Software Removed From GitHub By RIAA Takedown Notice
by Peter Reutemann 03 Nov '20

03 Nov '20

'The GitHub repository for the popular youtube-dl utility is offline after GitHub received a DMCA takedown notice from the RIAA. The notice claims that "The clear purpose of this source code is to (i) circumvent the technological protection measures used by authorized streaming services such as YouTube, and (ii) reproduce and distribute music videos and sound recordings owned by our member companies without authorization for such use." "Whether you're looking to backup contents of your personal YouTube account or download some of your favorite YouTuber's videos for offline use, many turn to youtube-dl as the most reliable and in-depth tool for downloading videos from YouTube -- along with many, many other sites that have videos like Vimeo, CNN, etc," writes Kyle Bradshaw via 9to5Google. "Beyond simple downloading features, youtube-dl is also able to convert your download into nearly any format, including creating an mp3 of just a video's audio track." "One of the primary bases for the RIAA's claim is that youtube-dl appears to be developed with the explicit intention of enabling the downloading of copyrighted works, with music videos from the likes of Icona Pop, Justin Timberlake, and Taylor Swift being used to test the tool's functionality, a claim which we were able to independently verify." It's now up to the project's creators to file a counterclaim in the hopes of restoring youtube-dl's status on GitHub.' -- source: https://news.slashdot.org/story/20/10/23/2341202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

NetMarketShare Is Giving Up
by Lawrence D'Oliveiro 03 Nov '20

03 Nov '20

One of the two main companies that tracks web browser market share is leaving the business <https://www.theregister.com/2020/11/02/netmarketshare_to_end_browser_stats/>. The main reason given is that the “User-Agent” string that browsers send as part of HTTP requests is becoming less and less useful. But then, that was never a good way of detecting browser functionality anyway. An outfit called the Web Incubator Community Group (WICG) has a new proposal, called “Client Hints”, which is a much more granular way for the server to interrogate client-side capabilities.

1 0

The Raspberry Pi 400 is a Compact Keyboard With a Built-in Computer
by Peter Reutemann 03 Nov '20

03 Nov '20

'The Raspberry Pi Foundation has announced the Raspberry Pi 400, a compact keyboard with an ARM-based computer built in. Just plug it into a TV or monitor using one of its two micro HDMI ports, insert a microSD card, attach a power cord and mouse, and you've got yourself a basic computer for day-to-day tasks, coding, or media playback. It's available starting today as a standalone machine for $70 or in a bundle including a mouse, power supply, microSD card, HDMI cable, and beginner's guide for $100. From a report: The hope is the Pi 400's form factor, plus these optional bundled items, makes it more approachable and user-friendly. That's important when you're selling an affordable computer, and it's especially important when you're selling an accessible device to help children learn to code. It looks more like a piece of consumer electronics than the basis for a DIY project. [...] Aside from its keyboard and form factor, the Raspberry Pi 400 is a very similar computer to last year's Raspberry Pi 4. It's got a slightly faster quad-core 1.8GHz ARM Cortex-A72 CPU, up from 1.5GHz in the Pi 4, 4GB of RAM, Gigabit Ethernet, Bluetooth 5.0, and 802.11ac Wi-Fi. There are a pair of micro HDMI ports that can each output up to 4K / 60Hz, two USB 3.0 ports, and a single USB 2.0 port. Power is provided via a USB-C port, there's a microSD card slot for storage, and there's a GPIO header for attaching a variety of more niche devices.' -- source: https://hardware.slashdot.org/story/20/11/02/1437202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Chrome Will Soon Have Its Own Dedicated Certificate Root Store
by Peter Reutemann 03 Nov '20

03 Nov '20

'Google has announced plans to run its own certificate root program/store for Chrome, in a major architectural shift for the company's web browser program. From a report: A "root program" or a "root store" is a list of root certificates that operating systems and applications use to verify the identity of a software program during its installation routine. Browsers like Chrome use root stores to check the validity of an HTTPS connection. They do this by looking at the website's TLS certificate and checking if the root certificate that was used to generate the TLS cert is included in the local root program/store. Since its launch in late 2009, Chrome was configured to use the "root store" of the underlying platform. For example, Chrome on Windows checked a site's TLS certificate against the Microsoft Trusted Root Program, the root store that ships with Windows; Chrome on macOS relied on the Apple Root Certificate Program; and so on. But in a wiki page, shared with ZDNet by one of our readers, Google announced plans to create its own root store, named the Chrome Root Program, that will ship with all versions of Chrome, on all platforms, except iOS.' -- source: https://it.slashdot.org/story/20/11/02/1638225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Dr. Strangenet—or, how I stopped worrying and embraced the WFH IT apocalypse
by Peter Reutemann 03 Nov '20

03 Nov '20

'We are now a solid two quarters into our new work-from-home bizarro world. Many companies found themselves in a bit of a pickle as workforces went from occasional or limited to everyone all-the-time, throwing up whatever they could provision to allow for remote access and continued productivity (or at least some semblance of it). We're well past the emergency stage, folks. For many of us, this will be ongoing and potentially permanent. And the way we do business will have to change—including how we structure our IT operations.' -- source: https://arstechnica.com/features/2020/11/future-of-collaboration-03/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Could RISC-V Processors Compete With Intel, ARM, and AMD?
by Peter Reutemann 02 Nov '20

02 Nov '20

'As promised, SiFive has unveiled a new computer featuring the company's SiFive FU740 processor based on RISC-V architecture," reports Liliputing: The company, which has been making RISC-V chips for several years, is positioning its new SiFive HiFive Unmatched computer as a professional development board for those interested in working with RISC-V. But unlike the company's other HiFive boards, the new Unmatched model is designed so that it can be easily integrated into a standard PC... SiFive says the system can support GNU/Linux distributions including Yocto, Debian, and Fedora. "SiFive is releasing the HiFive Unleashed in an effort to afford developers the ability to build RISC-V based systems, using readily available, off-the-shelf parts," explains Forbes: SiFive says it built the board to address the market need for easily accessible RISC-V hardware to further advance development of new platforms, products, and software using the royalty-free ISA... A short video demo shows the HiFive Unmatched installed in a common mid-tower PC chassis, running the included Linux distro, with an AMD Radeon graphics card pushing the pixels. In the video, the HiFive Unmatched is compiling an application and is shown browsing the web and opening a PDF. SiFive also notes that video playback is accelerated in hardware with the included version of Linux. "At the moment, these development PCs are early alternatives, most likely targeted at hobbyists and engineers who may snap them up when they become available in the fourth quarter for $665," notes VentureBeat. But they add that "While it's still early days, it's not inconceivable that RISC-V processors could someday be alternatives to Intel-based PCs and PC processors." The startup has raised $190 million to date, and former Qualcomm executive Patrick Little recently joined SiFive as CEO. His task will be to establish the company's RISC-V processors as an alternative to ARM. This move comes in the wake of Nvidia's $40 billion acquisition of the world's leading processor architecture. If Little is also looking to challenge Intel and AMD in PCs, he'll have his work cut out for him. For starters, SiFive is currently focused on Linux-based PCs, not Microsoft Windows PCs. Secondly, SiFive wouldn't build these processors or computers on its own. Its customers — anyone brave enough to take on the PC giants — would have to do that. "I wouldn't see this as SiFive moving out of the box. It's more like they're expanding their box," said Linley Group senior analyst Aakash Jani. "They're using their core architecture to enable other chip designers to build PCs, or whatever they plan to build."' -- source: https://hardware.slashdot.org/story/20/11/01/0127253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Foundation Creates Its Own Versions of Apple/Google Coronavirus Tracing Apps
by Peter Reutemann 02 Nov '20

02 Nov '20

'"The Linux Foundation has formed a new group to provide public health authorities with free technology for tracking the spread of the coronavirus and future epidemics," writes Business Insider. Launched in July, the group has already released two apps "that notify users if they've been in contact with someone who has tested positive with COVID-19." Since these apps are open source, people can contribute code and customize them, allowing regions with similar needs to collaborate, general manager at Linux Foundation Public Health, Dan Kohn, told Business Insider. Developers that want to build an app off these projects can access or download the source code. These apps take advantage of technology launched by Apple and Google, which can be integrated into any app, that uses Bluetooth on people's smartphones to track who a user has been in close proximity with, without identifying the specific people. If anyone tests positive for COVID-19 and uploads that information to a database run by a local public health authority, any user who has been in close contact with that person will get a notification through their app saying they may have been exposed — again, without identifying who has COVID-19. If someone knows that they may have been exposed, they can either self-quarantine or get tested. "Essentially we think exposure notification could have a big impact on reducing the overall rate of exposure," Kohn said. An Oxford University study in April said that if about 60% of the population used a contact tracing app, it could grind the diseases spread to a halt. Researchers on the team also found that digital contact tracing can cut down spread even at much lower levels of usage.' -- source: https://linux.slashdot.org/story/20/11/01/0214201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Chinese Laptop Appears With 14nm Loongsoon Quad-Core 3A4000 CPU
by Peter Reutemann 01 Nov '20

01 Nov '20

'"BDY electronics, a Chinese laptop manufacturer, has unveiled an all-new 13.3-inch laptop sporting Longsoon's new Dragon Core 3A4000 quad-core 14nm CPU," reports Tom's Hardware: The biggest feature of this laptop is the CPU, featuring Longsoon's latest 14nm quad-core 3A4000 CPU. Longsoon claims the CPU is 100% faster than the previous generation 3A3000 and is comparable in performance to AMD's "Excavator" cores used in the A8-7680 Godavari architecture. Of course, this demonstrates how far behind Longsoon is from TSMC and Intel in performance, speed, and efficiency of its latest node. However, the chairman of Loongsoon Technologies, Hu Weiwu, says, "14nm and 28nm (for its GPU node) is enough for 90% of applications.," so it appears the company isn't too worried about catching up to the performance leaders like Intel and AMD. Due to this laptop being in the Chinese market, Windows is not supported at all. It only runs Chinese "domestic operating systems" that are typically modified versions of Linux. Fortunately, this does mean you can install any Linux flavor you want on the laptop, which can be handy if you don't want to run China-specific apps only. Slashdot reader Hmmmmmm points out that Loongson's upcoming 3a5000 CPU "will be a 12nm CPU that is 50% faster than the 3A4000."' -- source: https://hardware.slashdot.org/story/20/10/31/1926242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Software Freedom Conservancy: Microsoft Should Resign from RIAA Over Youtube-DL Takedown Demand
by Peter Reutemann 01 Nov '20

01 Nov '20

'"We believe that youtube-dl has substantial non-infringing uses," argues the non-profit Software Freedom Conservancy. But while that software faces a DMCA takedown notice from the Recording Industry Association of America (RIAA), GitHub's owner Microsoft is also a paying member of the RIAA. The Software Freedom Conservancy argues that this leaves Microsoft "stuck between their industry association's abuses of the law and the needs of FOSS projects for which they provide infrastructure." While under current law (which we object to), complying with the takedown notice is admittedly the fastest way to limit Microsoft's liability, we view Microsoft's membership in the RIAA as a much bigger liability to our community, now that Microsoft controls GitHub. We call on Microsoft to resign from the RIAA and remove their conflict of interest in this matter. This is an important opportunity for Microsoft to stand up for the values of software freedom... To build a strong community of FOSS developers, we need confidence that our software hosting platforms will fight for our rights. While we'd prefer that Microsoft would simply refuse to kowtow to institutions like the RIAA and reject their DMCA requests, we believe in the alternative Microsoft can take the easy first step of resigning from RIAA in protest. We similarly call on all RIAA members who value FOSS to also resign.' -- source: https://yro.slashdot.org/story/20/10/31/0416208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Registering An XSS Attack As A UK Company Name
by Lawrence D'Oliveiro 31 Oct '20

31 Oct '20

It is permissible under UK law <https://www.theregister.com/2020/10/30/companies_house_xss_silliness/> to register a company name that, when inserted without escapes into a web page, will trigger certain ... interesting ... behaviour. Companies House blocked such an attempt, but frankly I don’t see why they don’t just allow it. It would serve as a wake-up call to a whole lot of lazy/naïve web developers, anyway.

1 0

Is X.Org Server Abandonware?
by Peter Reutemann 31 Oct '20

31 Oct '20

'Phoronix ran a story this morning with this provocative headline: "It's Time To Admit It: The X.Org Server Is Abandonware." The last major release of the X.Org Server was in May 2018 but don't expect the long-awaited X.Org Server 1.21 to actually be released anytime soon. This should hardly be surprising but a prominent Intel open-source developer has conceded that the X.Org Server is pretty much "abandonware" with Wayland being the future. [Or, more specifically, that "The main worry I have is that xserver is abandonware without even regular releases from the main branch."] This comes as X.Org Server development hits a nearly two decade low, the X.Org Server is well off its six month release regimen in not seeing a major release in over two years, and no one is stepping up to manage the 1.21 release. A year ago was a proposal to see new releases driven via continuous integration testing but even that didn't take flight and as we roll into 2021 there isn't any motivation for releasing new versions of the X.Org Server by those capable of doing so. Red Hat folks have long stepped up to manage X.Org Server releases but with Fedora Workstation using Wayland by default and RHEL working that way, they haven't been eager to devote resources to new X.Org Server releases. Other major stakeholders also have resisted stepping up to ship 1.21 or commit any major resources to new xorg-server versions.' -- source: https://tech.slashdot.org/story/20/10/25/1523253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

NSA “Learned Its Lesson” About Crypto Backdoors -- Take Their Word For It
by Lawrence D'Oliveiro 29 Oct '20

29 Oct '20

Some years ago, the US National Security Agency was quite keen to see the “Dual EC DRBG” pseudorandom number generator become widely adopted for secure encryption purposes <https://www.theregister.com/2020/10/28/nsa_backdoor_wyden/>. But two independent researchers at Microsoft discovered that there were weaknesses in the algorithm, that could be exploited to implant backdoors -- that is, it was possible to compromise the algorithm such that the output still looked random, but a knowledgeable attacker would be able to predict enough statistical characteristics of the bitstream to fatally weaken its randomness. Naturally you can figure out what the NSA were assuming -- that they would be the only ones in the world with the capability to take advantage of such a weakness. This turned out to be wrong. Apparently a report was written up about “lessons learned” from this episode (would it be too much to assume it concluded that such backdoors should never be planted again?) ... but the NSA cannot find the report.

1 0

Hackers Can Now Reverse Engineer Intel Updates Or Write Their Own Custom Firmware
by Peter Reutemann 29 Oct '20

29 Oct '20

'Researchers have extracted the secret key that encrypts updates to an assortment of Intel CPUs, a feat that could have wide-ranging consequences for the way the chips are used and, possibly, the way they're secured. The key makes it possible to decrypt the microcode updates Intel provides to fix security vulnerabilities and other types of bugs. Having a decrypted copy of an update may allow hackers to reverse engineer it and learn precisely how to exploit the hole it's patching. The key may also allow parties other than Intel -- say a malicious hacker or a hobbyist -- to update chips with their own microcode, although that customized version wouldn't survive a reboot. "At the moment, it is quite difficult to assess the security impact," independent researcher Maxim Goryachy said in a direct message. "But in any case, this is the first time in the history of Intel processors when you can execute your microcode inside and analyze the updates." Goryachy and two other researchers -- Dmitry Sklyarov and Mark Ermolov, both with security firm Positive Technologies -- worked jointly on the project. The key can be extracted for any chip -- be it a Celeron, Pentium, or Atom -- that's based on Intel's Goldmont architecture. In a statement, Intel officials wrote: "The issue described does not represent security exposure to customers, and we do not rely on obfuscation of information behind red unlock as a security measure. In addition to the INTEL-SA-00086 mitigation, OEMs following Intel's manufacturing guidance have mitigated the OEM specific unlock capabilities required for this research. The private key used to authenticate microcode does not reside in the silicon, and an attacker cannot load an unauthenticated patch on a remote system."' -- source: https://developers.slashdot.org/story/20/10/28/217212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Wikimedia Is Moving To GitLab
by Peter Reutemann 29 Oct '20

29 Oct '20

'The Wikimedia Foundation, the American non-profit organization that owns the internet domain names of many movement projects and hosts sites like Wikipedia, has decided to migrate their code repositories from Gerrit to Gitlab. Slashdot reader nfrankel shares the announcement: For the past two years, our developer satisfaction survey has shown that there is some level of dissatisfaction with Gerrit, our code review system. This dissatisfaction is particularly evident for our volunteer communities. The evident dissatisfaction with code review, coupled with an internal review of our CI tooling and practice makes this an opportune moment to revisit our code review choices. While Gerrit's workflow is in many respects best-in-class, its interface suffers from usability deficits, and its workflow differs from mainstream industry practices. This creates barriers to entry for the community and slows onboarding for WMF technical staff. In addition, there are a growing number of individuals and teams (both staff and non-staff) who are opting to forgo the use of Gerrit and instead use a third-party hosted option such as GitHub. Reasons vary for the choice to use third-party hosting but, based on informal communication, there are 3 main groupings: lower friction to create new repositories; easier setup and self-service of Continuous Integration configuration; and more familiarity with pull-request style workflows. All these explanations point to friction in our existing code-review system slowing development rather than fostering it. The choice to use third-party code-hosting hurts our collaboration (both internal and external), adds to the confusion of onboarding, and makes it more difficult to maintain code standards across repositories. At the same time, there is a requirement that all software which is deployed to Wikimedia production is hosted and deployed from Gerrit. If we fail to address the real usability problems that users have with Gerrit, people will continue to launch and build projects on whatever system it is they prefer -- Wikimedia's GitHub already contains 152 projects, the Research team has 127 projects. This raises the question: if Gerrit has identifiable problems, why can't we solve those problems in Gerrit? Gerrit is open source (Apache licensed) software; modifications are a simple matter of programming. [...] Upstream has improved the UI in recent releases, and releases have become more frequent; however, upgrade path documentation is often lacking. The migration from Gerrit 2 to Gerrit 3, for example, required several upstream patchsets to avoid the recommended path of several days of downtime. This is the effort required to maintain the status quo. Even small improvements require effort and time as, often, our use-case is very different from the remainder of the Gerrit community. ' -- source: https://news.slashdot.org/story/20/10/28/2114259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

RIAA's YouTube-DL Takedown Ticks Off Developers and GitHub's CEO
by Peter Reutemann 28 Oct '20

28 Oct '20

'An RIAA takedown request, which removed the YouTube-DL repository from GitHub, has ticked off developers and GitHub's CEO. Numerous people responded by copying and republishing the contested code, including in some quite clever ways. Meanwhile, GitHub's CEO is "annoyed" as well, offering help to get the repo reinstated. TorrentFreak reports: Soon after the RIAA notice took YouTube-DL offline many developers spoke out in protest. They believe that the music industry group went too far and started to republish copies of the code everywhere. Over the past several days, we have seen hundreds of new forks and copies appear online. These were also posted to GitHub, where YouTube-DL forks remain easy to find and continue to be uploaded. The code was also posted in some places one wouldn't expect. For example, there's still a copy in GitHub's DMCA notice repository, which some people find quite amusing. And the list of pull requests can be quite entertaining in themselves. One of the most creative responses we've seen was posted to Twitter by @GalacticFurball who encoded YouTube-DL into images that can be easily shared, encouraging others to share these as well. "I would also suggest that you save and repost the images, as one single source kind of defeats the point. Maybe start a hashtag trend or something. Make songs, and poetry. Get that data out there." This triggered even more creativity, with people finding alternative means to share the code online, all to counter the RIAA's takedown request. Meanwhile, GitHub's CEO Nat Friedman wasn't sitting still either. While the Microsoft-owned developer platform had to respond to the takedown notice, Friedman himself actively reached out to YouTube-DL's developers to help them get their project reinstated. The CEO joined YouTube-DL's IRC channel hoping to connect with the owner of the repository so he can help to get it unsuspended. "GitHub exists to help developers. We never want to interfere with their work. We want to help the youtube-dl maintainers defeat the DMCA claim so that we can restore the repo," Friedman told TorrentFreak, explaining his actions. GitHub's CEO suggested that YouTube-DL won't be reinstated in its original form. But, the software may be able to return without the rolling cipher circumvention code and the examples of how to download copyrighted material. ' -- source: https://news.slashdot.org/story/20/10/27/2230218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Facebook Further Borgs Its Oculus Acquisition
by Lawrence D'Oliveiro 27 Oct '20

27 Oct '20

When Facebook first acquired VR headset company Oculus back in 2014, the CEO of the latter claimed “I guarantee that you won't need to log into your Facebook account every time you wanna use the Oculus Rift.” That statement, to reuse an old phrase from the Vietnam War, is no longer operative <https://www.theregister.com/2020/10/27/facebook_oculus_accounts/>. They have also threatened to ban accounts that try to share more than one headset, but have resiled from that by popular demand, at least temporarily. Candidate for quote of the week: “While I do completely understand your concerns, we do need to have you comply with the Facebook TOS.”

1 0

Chrome OS May Finally Be Getting a Dark Mode
by Peter Reutemann 27 Oct '20

27 Oct '20

'The Verge: Chrome OS may finally be getting a dark mode, but so far it's only been spotted in its experimental Canary channel, Android Central reported. Before you go tinkering with Canary just be advised: Canary is Google's "bleeding edge" Chrome OS path, which receives daily updates of features before they've been widely tested. It can only be accessed from Chromebooks switched into a special developer mode (not to be confused with the Chrome OS Developer channel). Google warns that Canary can be "unstable." But at the moment, to activate dark mode on your Chromebook, you need to have the Canary channel installed. Once you've done that, Android Central says you just open Chrome and type in chrome://flags/#enable-force-dark and chrome://flags/#enable-webui-dark-mode into the URL bar. I should note I tried this on my older Chromebook and wasn't able to get it to work. But here's the view Android Police captured. Android Central says the dark mode has some bugs, but notes it seems to apply across the UI, not just as darker backgrounds. ' -- source: https://tech.slashdot.org/story/20/10/26/2047207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Study shows which messengers leak your data, drain your battery, and more
by Peter Reutemann 27 Oct '20

27 Oct '20

'Link previews are a ubiquitous feature found in just about every chat and messaging app, and with good reason. They make online conversations easier by providing images and text associated with the file that’s being linked. Unfortunately, they can also leak our sensitive data, consume our limited bandwidth, drain our batteries, and, in one case, expose links in chats that are supposed to be end-to-end encrypted. Among the worst offenders, according to research published on Monday, were messengers from Facebook, Instagram, LinkedIn, and Line.' -- source: https://arstechnica.com/information-technology/2020/10/study-shows-which-me… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Flying Your Plane!?
by Lawrence D'Oliveiro 27 Oct '20

27 Oct '20

Linux hardware guru Greg Kroah-Hartman on the use of Linux in safety-critical systems <https://www.theregister.com/2020/10/26/linux_kernel_intel/>: What does he think about using Linux in a safety-critical environment? “Anyone who’s ever flown in a plane, it’s been controlled by Linux, for the past decade, so it’s in safety-critical environments today,” he said, grinning. “It runs telecoms systems, it runs stock markets, it runs satellites, it keeps mega yachts from tipping over, it’s been in automotive as well, in the head units for a long time … nobody wants to write an operating system, they just want to write applications to solve their problems.” He also has a warning for those trying to selectively backport security fixes to older kernel versions.

1 0

Vint Cerf Is Working on an Internet for Outer Space
by Peter Reutemann 27 Oct '20

27 Oct '20

'"TCP/IP doesn't work at interplanetary distances," 77-year-old Vinton Cerf tells Quanta magazine. "So we designed a set of protocols that do." Specifically, bundle protocols: a disruption/delay-tolerant networking (DTN) protocol with nodes that can also store information: A data packet traveling from Earth to Jupiter might, for example, go through a relay on Mars, Cerf explained. However, when the packet arrives at the relay, some 40 million miles into the 400-million-mile journey, Mars may not be oriented properly to send the packet on to Jupiter. "Why throw the information away, instead of hanging on to it until Jupiter shows up?" Cerf said. This store-and-forward feature allows bundles to navigate toward their destinations one hop at a time, despite large disruptions and delays... So, a couple decades after conceiving of bundle protocols, is the interplanetary internet up and running? We don't have to build the whole thing and then hope somebody uses it. We sought to get standards in place, as we have for the internet; offer those standards freely; and then achieve interoperability so that the various spacefaring nations could help each other. We're taking the next obvious step for multi-mission infrastructure: designing the capability for an interplanetary backbone network. You build what's needed for the next mission. As spacecraft get built and deployed, they carry the standard protocols that become part of the interplanetary backbone. Then, when they finish their primary scientific mission, they get repurposed as nodes in the backbone network. We accrete an interplanetary backbone over time. In 2004, the Mars rovers were supposed to transmit data back to Earth directly through the deep space network — three big 70-meter antennas in Australia, Spain and California. However, the channel's available data rate was 28 kilobits per second, which isn't much. When they turned the radios on, they overheated. They had to back off, which meant less data would come back. That made the scientists grumpy. One of the JPL engineers used prototype software — this is so cool! — to reprogram the rovers and orbiters from hundreds of millions of miles away. We built a small store-and-forward interplanetary internet with essentially three nodes: the rovers on the surface of Mars, the orbiters and the deep space network on Earth. That's been running ever since. We've been refining the design of those protocols, implementing and testing them. The latest protocols are running back-and-forth relays between Earth and the International Space Station... We did another test at the ISS where the astronauts were controlling a little robot vehicle in Germany.' -- source: https://science.slashdot.org/story/20/10/25/2329239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

So How Good Is Edge on Linux?
by Peter Reutemann 26 Oct '20

26 Oct '20

'"No one asked Microsoft to port its Edge browser to Linux," writes Steven J. Vaughan-Nichols at ZDNet, adding "Indeed, very few people asked for Edge on Windows. "But, here it is. So, how good — or not — is it..?" The new release comes ready to run on Ubuntu, Debian, Fedora, and openSUSE Linux distributions... Since I've been benchmarking web browsers since Mosaic rolled off the bit assembly line, I benchmarked the first Edge browser and Chrome 86 and Firefox 81 on my main Linux production PC.... First up: JetStream 2.0, which is made up of 64 smaller tests. This JavaScript and WebAssembly benchmark suite focuses on advanced web applications. It rewards browsers that start up quickly, execute code quickly, and run smoothly. Higher scores are better on this benchmark. JetStream's top-scorer — drumroll please — was Edge with 136.971. But, right behind it within the margin of error, was Chrome with a score of 132.413. This isn't too surprising. They are, after all, built on the same platform. Back in the back was Firefox with 102.131. Next up: Kraken 1.1. This benchmark, which is based on the long-obsolete SunSpider, measures JavaScript performance. To this basic JavaScript testing, it added typical use-case scenarios. Mozilla, Firefox's parent organization, created Kraken. With this benchmark, the lower the score, the better the result. To no great surprise, Firefox took first place here with 810.1 milliseconds (ms). Following it was Chrome with 904.5ms and then Edge with 958.8ms. The latest version of WebXPRT is today's best browser benchmark. It's produced by the benchmark professionals at Principled Technology. This company's executives were the founders of the Ziff Davis Benchmark Operation, the gold-standard of PC benchmarking. WebXPRT uses scenarios created to mirror everyday tasks. These include Photo Enhancement, Organize Album, Stock Option Pricing, Local Notes, Sales Graphs, and DNA Sequencing. Here, the higher the score, the better the browser. On this benchmark, Firefox shines. It was an easy winner with a score of 272. Chrome edges out Edge 233 to 230. The article concludes that "Oddly, Edge, which turned in a poor performance when I recently benchmarked it on Windows, did well on Linux. Who'd have guessed...? Edge is a good, fast browser on Linux. If you're a Windows user coming over to Linux or you're doing development work aimed at Edge, then by all means try Edge on Linux. It works and it works well." Yet Vaughan-Nichols admits he's still not going to switch to Edge. "Chrome is more than fast enough for my purposes and I don't want my information tied into the Microsoft ecosystem. For better or worse, mine's already locked into the Googleverse and I can live with that."' -- source: https://linux.slashdot.org/story/20/10/25/0118218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Snopes.com Exposes 4chan Campaign to 'Kindle Mistrust in Snopes'
by Peter Reutemann 26 Oct '20

26 Oct '20

'"This is the perfect moment to do this. This is an age of conspiracies for boomers... Let's kindle their mistrust in Snopes and other fact checkers," wrote one 4chan poster. Snopes.com later reported: In October 2020, a series of threads was posted to the anonymous internet forum 4Chan as part of operation "Snopes-Piercer," a smear campaign with the stated goal of "red-pilling some normies" — internet slang for a propaganda technique in which distorted, fabricated, or skewed information is used to further a self-determined "truth." In order to "red-pill" these people (one thread noted that "boomers" were the primary target), the plan was to create and circulate doctored screenshots of Snopes fact checks to make it appear as if Snopes fact-checkers addressed claims that we had not. Over the next few days, users created and shared these fake Snopes screenshots in a number of additional 4chan threads. These images were also posted on social media sites, like Twitter.... Some were humorous (we did not actually address the claim that CNN reporter Chris Cuomo was actually Fredo from "The Godfather"), some were insidious (we did not really publish a fact check questioning the Holocaust), and some were political (we did not publish a fact check questioning the results of the 2020 election before the election happened)... These red pill campaigns all follow a basic formula. The user decides what they want to be true and then they set out to find, or manufacture, the evidence to support that truth. A concerted effort is then made to spread these false narratives to as wide an audience as possible in order to "red-pill" the general population. In this formula, the desired "truth" comes first. The "evidence" comes second. It goes without saying that this method is antithetical to the mission of Snopes, fact-checkers in general, journalists, and anyone seeking an objective view of reality.' -- source: https://news.slashdot.org/story/20/10/24/1952242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Apple, Google and a Deal That Controls the Internet'
by Peter Reutemann 26 Oct '20

26 Oct '20

'The New York Times' looks at "a deal that controls the internet" — Apple's agreement to feature Google as the preselected search engine for iPhones, saying America's Justice Department views it "as a prime example of what prosecutors say are Google's illegal tactics to protect its monopoly and choke off competition..." The scrutiny of the pact, which was first inked 15 years ago and has rarely been discussed by either company, has highlighted the special relationship between Silicon Valley's two most valuable companies — an unlikely union of rivals that regulators say is unfairly preventing smaller companies from flourishing. "We have this sort of strange term in Silicon Valley: co-opetition," said Bruce Sewell, Apple's general counsel from 2009 to 2017. "You have brutal competition, but at the same time, you have necessary cooperation." Apple and Google are joined at the hip even though Mr. Cook has said internet advertising, Google's bread and butter, engages in "surveillance" of consumers and even though Steve Jobs, Apple's co-founder, once promised "thermonuclear war" on his Silicon Valley neighbor when he learned it was working on a rival to the iPhone. Apple and Google's parent company, Alphabet, worth more than $3 trillion combined, do compete on plenty of fronts, like smartphones, digital maps and laptops. But they also know how to make nice when it suits their interests. And few deals have been nicer to both sides of the table than the iPhone search deal. Nearly half of Google's search traffic now comes from Apple devices, according to the Justice Department, and the prospect of losing the Apple deal has been described as a "code red" scenario inside the company. When iPhone users search on Google, they see the search ads that drive Google's business. They can also find their way to other Google products, like YouTube. A former Google executive, who asked not to be identified because he was not permitted to talk about the deal, said the prospect of losing Apple's traffic was "terrifying" to the company. The Justice Department, which is asking for a court injunction preventing Google from entering into deals like the one it made with Apple, argues that the arrangement has unfairly helped make Google, which handles 92 percent of the world's internet searches, the center of consumers' online lives... [C]ompetitors like DuckDuckGo, a small search engine that sells itself as a privacy-focused alternative to Google, could never match Google's tab with Apple. Apple now receives an estimated $8 billion to $12 billion in annual payments — up from $1 billion a year in 2014 — in exchange for building Google's search engine into its products. It is probably the single biggest payment that Google makes to anyone and accounts for 14 to 21 percent of Apple's annual profits. That's not money Apple would be eager to walk away from. In fact, Mr. Cook and Mr. Pichai met again in 2018 to discuss how they could increase revenue from search. After the meeting, a senior Apple employee wrote to a Google counterpart that "our vision is that we work as if we are one company," according to the Justice Department's complaint. The article remembers Steve Jobs unveiling the iPhone in 2007 — and then inviting Google CEO Eric Schmidt onto the stage. Schmidt, who was also on Apple's board of directors, joked "If we just sort of merged the two companies, we could just call them AppleGoo." He'd also added that with Google search on the iPhone, "you can actually merge without merging."' -- source: https://apple.slashdot.org/story/20/10/25/180214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Slashdot Asks: How Do You Feel About Btrfs?
by Peter Reutemann 25 Oct '20

25 Oct '20

'Linux Journal re-visiting the saga of the btrfs file system (initially designed at Oracle in 2007): The btrfs filesystem has taunted the Linux community for years, offering a stunning array of features and capability, but never earning universal acclaim. Btrfs is perhaps more deserving of patience, as its promised capabilities dwarf all peers, earning it vocal proponents with great influence. Still, [while] none can argue that btrfs is unfinished, many features are very new, and stability concerns remain for common functions. Most of the intended goals of btrfs have been met. However, Red Hat famously cut continued btrfs support from their 7.4 release, and has allowed the code to stagnate in their backported kernel since that time. The Fedora project announced their intention to adopt btrfs as the default filesystem for variants of their distribution, in a seeming juxtaposition. SUSE has maintained btrfs support for their own distribution and the greater community for many years. For users, the most desirable features of btrfs are transparent compression and snapshots; these features are stable, and relatively easy to add as a veneer to stock CentOS (and its peers). Administrators are further compelled by adjustable checksums, scrubs, and the ability to enlarge as well as (surprisingly) shrink filesystem images, while some advanced btrfs topics (i.e. deduplication, RAID, ext4 conversion) aren't really germane for minimal loopback usage. The systemd init package also has dependencies upon btrfs, among them machinectl and systemd-nspawn . Despite these features, there are many usage patterns that are not directly appropriate for use with btrfs. It is hostile to most databases and many other programs with incompatible I/O, and should be approached with some care. The original submission drew reactions from three disgruntled btrfs users. But the article goes on to explore providers of CentOS-compatible btrfs-enabled kernels, ultimately opining that "There are many 'rough edges' that are uncovered above with btrfs capabilities and implementations, especially with the measures taken to enable it for CentOS. Still, this is far better than ext2/3/4 and XFS, discarding all the desirable btrfs features, in that errors can be known because all filesystem content is checksummed." It would be helpful if the developers of btrfs and ZFS could work together to create a single kernel module, with maximal sharing of "cleanroom" code, that implemented both filesystems... Oracle is itself unwilling to settle these questions with either a GPL or BSD license release of ZFS. Oracle also delivers a btrfs implementation that is lacking in features, with inapplicable documentation, and out-of-date support tools (for CentOS 8 conversion). Oracle is the impediment, and a community effort to purge ZFS source of Oracle's contributions and unify it with btrfs seems the most straightforward option... It would also be helpful if other parties refrained from new filesystem efforts that lack the extensive btrfs functionality and feature set (i.e. Microsoft ReFS). Until such a day that an advanced filesystem becomes a ubiquitous commodity as Linux is as an OS, the user community will continue to be torn between questionable support, lack of features, and workarounds in a fragmented btrfs community. This is an uncomfortable place to be, and we would do well to remember the parties responsible for keeping us here. So how do Slashdot's readers feel about btrfs?' -- source: https://linux.slashdot.org/story/20/10/24/0146258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Patched an Actively-Exploited Zero-Day Bug in Chrome
by Peter Reutemann 25 Oct '20

25 Oct '20

'"Google released an update to its Chrome browser that patches a zero-day vulnerability in the software's FreeType font rendering library that was actively being exploited in the wild, Threatpost reported this week: Security researcher Sergei Glazunov of Google Project Zero discovered the bug which is classified as a type of memory-corruption flaw called a heap buffer overflow in FreeType. Glazunov informed Google of the vulnerability on Monday. Project Zero is an internal security team at the company aimed at finding zero-day vulnerabilities. By Tuesday, Google already had released a stable channel update, Chrome version 86.0.4240.111, that deploys five security fixes for Windows, Mac & Linux — among them a fix for the zero-day, which is being tracked as CVE-2020-15999 and is rated as high risk. "Google is aware of reports that an exploit for CVE-2020-15999 exists in the wild," Prudhvikumar Bommana of the Google Chrome team wrote in a blog post announcing the update Tuesday... "The fix is also in today's stable release of FreeType 2.10.4," Ben Hawkes, technical lead for the Project Zero team, tweeted. Meanwhile, security researchers took to Twitter to encourage people to update their Chrome browsers immediately to avoid falling victim to attackers aiming to exploit the flaw... In addition to the FreeType zero day, Google patched four other bugs — three of high risk and one of medium risk — in the Chrome update released this week... So far in the last 12 months Google has patched three zero-day vulnerabilities in its Chrome browser.' -- source: https://it.slashdot.org/story/20/10/25/029202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome Caught Exempting Google Sites From User Requests To Delete Data
by Peter Reutemann 25 Oct '20

25 Oct '20

'This week the Verge reported: If you ask Chrome to delete all cookies and site data whenever you quit the browser, it's reasonable to expect that this policy applies to all websites. Recently, though, a bug in the browser meant data wasn't being removed for two sites in particular: Google and YouTube. This problem was first documented by iOS developer Jeff Johnson on his blog. Johnson found that in Chrome version 86.0.4240.75, "local storage" data for Google.com and YouTube.com stuck around even after restarting the browser. We've been able to replicate similar behavior... The Register notes that Chrome's behavior could allow Google to stash cookie-style data as site data, allowing it to track users even when they think they're being careful by deleting their cookie and site data every time they close the browser. In a statement, Google said it was aware of the issue and was working on a fix... At least one of the affected sites, YouTube, appears to have already been fixed. After we upgraded the Chrome browser to version 86.0.4240.111, YouTube's local storage data seems to successfully purge after a restart, although the data from Google.com still sticks around.' -- source: https://tech.slashdot.org/story/20/10/25/0155246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Options For ps
by Lawrence D'Oliveiro 25 Oct '20

25 Oct '20

One look at the man page for ps(1) <https://man7.org/linux/man-pages/man1/ps.1.html> and you see all the different traditional option syntaxes it tries to be compatible with. The BSD style doesn’t even prefix options with dashes, which can lead to ambiguities and is best avoided. If this is what you’re used to, try to wean yourself off it. To list some useful info about all processes, you can do ps -ef or, for even more info, try ps -eF One thing I find annoying about this it reports less precision in process start times for long-running processes. To get around this, you can use a custom format. For example ps -eo pid,ppid,lstart,tty,etime,cmd shows some similar info to the default “-f” format, but always includes start time and elapsed time to the nearest second, regardless of how long the process has been running. Another useful command to use with ps is pgrep(1) <https://man7.org/linux/man-pages/man1/pgrep.1.html>, which lets you filter processes to get information for according to various criteria. Or you could just use grep(1) on the output from ps, as I suspect a lot of people do. ;)

1 1

Debian Donates 10,000 Euros to Fund Free and Decentralized Livestreaming
by Peter Reutemann 25 Oct '20

25 Oct '20

'PeerTube (developed by Framasoft) is "the free and decentralized alternative to video platforms, providing you over 400,000 videos published by 60,000 users and viewed over 15 million times," according to its web site. But now they're exploring livestreaming, writes Debian developer Phil Hands (Slashdot reader #2,365): Holding DebConf20 online this year highlighted the effort involved in setting up Live Streaming using Free Software — something that is beyond the reach of many smaller events which is where PeerTube with Live Streaming should be a perfect fit. In June PeerTube had posted a roadmap with a humble request for donations in lieu of a crowdfunding campaign: At a time when no one knows what the future holds, we deem it inappropriate to start a crowdfunding campaign and threaten not to do our best on PeerTube if we don't get the necessary funds. We believe in the public utility of PeerTube, so much so that we commit to working on it for six months to make this v3 happen, even if we must do it with our own funds (which we had already done for v2). We still hope that by sharing this roadmap as widely as possible, some of you will support us in our approach with a donation that will allow us to fund this project. And this week PeerTube's official Twitter feed announced that "Thanks to Debian's €10,000 donation we've just reached the 4th step of our PeerTube fundraising" — livestreaming. "Many thanks to all those who donated. And it's not too late to contribute." "We hope this unconventional gesture from the Debian project will help us make this year somewhat less terrible," added the Debian blog, "and give us, and thus humanity, better Free Software tooling to approach the future." It describes their donation as "a strong sign of recognition from an international project — one of the pillars of the Free Software world — towards a small French association which offers tools to liberate users from the clutches of the web's giant monopolies." And secondly, "it's a substantial amount of help in these difficult times, supporting the development of a tool which equally belongs to and is useful to everyone. The strength of Debian's gesture proves, once again, that solidarity, mutual aid and collaboration are values which allow our communities to create tools to help us strive towards Utopia."' -- source: https://linux.slashdot.org/story/20/10/24/010213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0