- wlug - list.wlug.org.nz

Fwd: [NZLUG] CFP: LCA2021 Systems Administration Miniconf
by Peter Reutemann 25 Nov '20

25 Nov '20

Apologies for cross-posting, but since the event is down-under/online some people on this list might want to present/attend. Cheers, Peter ---------- Forwarded message --------- From: Ewen McNeill Date: Wed, Nov 25, 2020 at 11:33 AM Subject: [NZLUG] CFP: LCA2021 Systems Administration Miniconf To: NZ Linux Users Group <nzlug(a)lists.nzoss.org.nz> linux.conf.au 2021 is being held in an "Online Only" format from 23-25 January 2021 (Saturday through Monday!), starting with a Miniconf day on Saturday 2021-01-23. Based in UTC+11 (AEDT), it makes for a "sleep in" schedule for attending from New Zealand! Tickets are extra affordable this year (AU $125/$70/$30), and on sale now: https://lca2021.linux.org.au/attend/tickets/ (Sadly NZers don't get the electronic badge option :-( ) The Systems Administration Miniconf is one of four Miniconfs being held on Saturday 2021-01-23, and would welcome your presentation proposals now (closes 2020-12-18 AoE). For details see: https://sysadmin.miniconf.org/cfp21.html or read on, as the CFP is repeated below for your convenience. Ewen -=- cut here -=- LCA2021 Systems Administration Miniconf: Call for Presentations Saturday 2021-01-23 10:45-17:30 UTC+11 at Linux.conf.au 2021, Online Virtualisation has won! As of 2021, they have even virtualised our Systems Administration Miniconf! TL;DR: If you know our Miniconf, and know online presenting, you can propose your 15-20 minute Linux-related operations talk via the LCA2021 Dashboard *before* 2020-12-18: https://linux.conf.au/dashboard We'd particularly love your 2020 War Stories! Read on to find out more :-) Introduction ============ The linux.conf.au Systems Administration Miniconf returns for the 15th time as part of the very online linux.conf.au 2021, to be held without a venue (Venueless!), online on Saturday 2021-01-23, based in UTC+11 (AEDT -- Australian Eastern Daylight Time). The Systems Administration Miniconf focuses on tips, tricks, tools, and best practices used to manage real-world Linux environments both large and small. From single small servers through to 2,000 node Kubernetes Clusters. The organisers of the Systems Administration Miniconf would like to invite proposals for presentations to be delivered at the Miniconf. Please forward this CFP to your colleagues, peers, social networks, and other relevant mailing lists. Please help by encouraging submissions from people you would like to hear present at this Miniconf. We are open to presentations from speakers anywhere in the world, but please be mindful of the need to present during daytime in UTC+11 which may not be daytime in your local timezone (presenting late at night or very early in your morning is tricky!). More information and details of previous presentations at the Miniconf can be found at the website: https://sysadmin.miniconf.org/ Presentation Topics =================== 2020 has been a surprising year, and not the least for systems administration -- remote *everything* came with a rush, leaving many officeless, and dependent on the Internet and video conferencing. We would be particularly interested in talks about how 2020 has gone for your systems, how you dealt with the rapid changes in operating environment, and what your plans look like for a world where touching physical hardware frequently seems increasingly unlikely. Tell us your war stories :-) We would be very interested in retrospectives and "lessons learned" from the past year. We of course also welcome the usual range of talks on systems technology, automation, monitoring, troubleshooting, best current practices and so on. Presentations should be of a technical nature and speakers should assume that members of the audience have at least a couple of years experience in professional Linux administration (many in the audience will have decades of experience). Format of Presentations ======================= Due to the online only format, and its increased demands on the AV team, we have to fit into a more fixed structure within the LCA2021 Miniconf day. So we have less flexibility in our choice of presentations, that usual. We have openings for 15 and 20 minute short presentations (ie, each approximately half of a 45-minute "session", with a 10 minute gap in between). LCA2021 have indicated they have a strong preference for presentations to be given live, which will be easier if your local time zone is close to UTC+11 and you have an Internet connection with good upload speeds. For accepted Miniconf speakers the LCA2021 AV Team will want to check in with you *early* January 2021 to help ensure your presentation audio and visuals come across as well as possible. You may wish to watch the AV Team advice from PyConline AU 2020 to get some advanced hints on small changes you could make to help your presentation look and sound great: https://www.youtube.com/watch?v=C1TBqdULp4E Submitting talks ================ Please note that in order to give a presentation or attend the Miniconf you must be registered (and paid up by the time the conference happens) for the main linux.conf.au conference. Either for the full conference (Sat/Sun/Mon), or at least for the Miniconf day (Saturday 2021-01-23). As a one off "online only, LCA2021 only" special we have access to a small pool of "Miniconf Speaker" tickets, so if your employer will not pay for your ticket and the conference cost makes it difficult for you to attend/present please get in touch and we will see if we can help. To submit a talk to the LCA2021 Sysadmin Miniconf, create an account on the LCA2021 website: https://linux.conf.au/dashboard create a speaker profile, and then select "Systems Administration Miniconf Talk" (in the "New Proposal" section of the Dashboard), or while logged into the LCA2021 site, go directly to: https://linux.conf.au/proposals/submit/sysadmin-miniconf/ Questions should be sent to: lca2021 at sysadmin.miniconf.org Dates and Deadlines =================== To encourage early submissions, priority (both of inclusion and scheduling) will be given to presentations submitted by 23:59 (AoE -- ie any time zone) on Sunday 6 December 2020. If you have a good presentation idea, please let us know early, even if you need time to finalise the presentation abstract. 2020-12-06 - Deadline for early submissions 2020-12-11 - early acceptances 2020-12-18 - Deadline for all submissions 2020-12-21 - final acceptances 2020-12-24 - LCA2021 Sysadmin Miniconf initial programme published 2021-01-21 - LCA2021 Sysadmin Miniconf held (Online, UTC+11) Contact and Questions ===================== Please see our website at https://sysadmin.miniconf.org for more information on the miniconf, past presentations and presenting at it. If you have any questions please feel free to email the organisers at: lca2021 at sysadmin.miniconf.org -=- cut here -=- _______________________________________________ NZLUG mailing list NZLUG(a)lists.nzoss.org.nz http://lists.nzoss.org.nz/mailman/listinfo/nzlug -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

LISP presentation uploaded to WLUG github.
by Ian Stewart 25 Nov '20

25 Nov '20

Hi Folks, For last night's LISP presentation, the slide show file and the LISP demonstration programs have been uploaded to: https://github.com/WLUG/meetings/tree/master/2020/2020-11-23 The slide show is available in both .odp and .pdf formats. The demonstration programs all have shebangs for CLISP, but these may be changed to be for SBCL. The programs have been tested to work under both CLISP and SBCL. Note that SBCL seems to be fussier than CLISP and, for example, requires (defvar) functions before the variable could be loaded via a (setf) function. At the meeting Jake demonstrated the apropos function to help with finding symbols. An appendix slide has been added to the presentation to show this function. I have also added my first attempt at something resembling a real a LISP program, package-symbols.lisp. This program will list packages that are available to either SBCL or CLISP. Upon selecting a package, it will display all the symbols the package has. If the command line argument "function" is used (E.g., $ sbcl --script package-symbols function) then the symbols displayed will be filtered to only displaying symbols that are functions. cheers, Ian.

1 1

Gimp Turns 25
by Peter Reutemann 24 Nov '20

24 Nov '20

'The General Image Manipulation Program, GIMP, has turned 25. A brief celebration post detailed how the package started life as a July 1995 Usenet thought bubble by then-student Peter Mattis, who posted the following to several newsgroups: Suppose someone decided to write a graphical image manipulation program (akin to photoshop). Out of curiosity (and maybe something else), I have a few (2) questions: What kind of features should it have? (tools, selections, filters, etc.) What file formats should it support? (jpeg, gif, tiff, etc.)" Four months later, Mattis and fellow University of California Berkeley student Spencer Kimball delivered what they described as software "designed to provide an intuitive graphical interface to a variety of image editing operations." The software ran on Linux 1.2.13, Solaris 2.4, HPUX 9.05, and SGI IRIX. The answer to the file format support question turned out to be GIF, JPEG, PNG, TIFF, and XPM. The rest is history. Richard Stallman gave Mattis and Kimball permission to change the "General" in its name to "GNU", reflecting its open-source status. Today the program is released under the GNU General Public License. As the program added features such as layers, it grew more popular and eventually became a byword for offering a FOSS alternative to Photoshop even though the project pushes back against that description. The project's celebration page says volunteers did their "best to provide a sensible workflow to users by using common user interface patterns. That gave us a few questionable monikers like 'Photoshop for Linux', 'free Photoshop', and 'that ugly piece of software'. We still can wholeheartedly agree with the latter one only!"' -- source: https://it.slashdot.org/story/20/11/23/1946252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Mass-Produced, Librem 5 Linux Smartphone Begins Shipping to Customers
by Peter Reutemann 23 Nov '20

23 Nov '20

'This week Purism began shipping its mass-produced Librem 5 phone to customers, according to announcement from the company: The Librem 5 is a one-of-a-kind general-purpose computer in a phone form-factor that Purism has designed and built from scratch following a successful crowdfunding campaign that raised over $2.2 million. Both the hardware and software design is focused on respecting the end user's freedom and giving them control over their privacy and security. The Librem 5 doesn't run Android nor iOS but instead runs the same PureOS operating system as Purism's laptops and mini PC. The Librem 5 has unique hardware features including a user-removable cellular modem, WiFi card, and battery. Like with Librem laptops, the Librem 5 also features external hardware kill switches that cut power to the cellular modem, WiFi/Bluetooth, and front and back cameras and microphone so that the user can control when these devices are in use. All hardware switches can also be triggered together to enable "lockdown mode" which also disables the GPS, accelerometer and all other sensors... Another unique feature of the Librem 5 is convergence: the ability to connect the Librem 5 to a monitor or laptop dock and use it as a desktop computer running the same full-sized desktop applications as on Librem laptops. When in a phone form-factor, applications behave much like "responsive websites" and change their appearance for the smaller screen. This allows you to use the Librem 5 as a phone, a desktop, or a laptop with the same applications and same files. Their announcement notes their work on software making desktop applications "adaptive" to phone form factors, adding "This suite of software has now become the most popular software stack to use on other handheld Linux hardware." And they close with an appreciative comment from Purism's founder and CEO Todd Weaver: "Shipping the Librem 5 has been an immense multi-year developmental effort. It is the culmination of people's desire to see an alternative to Android and iOS and fund it, coupled with dedication from a team of experts addressing hardware, kernel, operating system, and applications that has turned a lofty near-impossible goal into reality. We have built a strong foundation and with the continued support of customers, the community, and developers, we will continue to deliver revolutionary products like the Librem 5 running PureOS."' -- source: https://mobile.slashdot.org/story/20/11/23/025228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Ubuntu Web Remix' Distro Offers Firefox-Based Chrome OS Alternative
by Peter Reutemann 23 Nov '20

23 Nov '20

'Rudra Saraswat is the creator of the Ubuntu Unity distro (which uses the Unity interface in place of Ubuntu's GNOME shell). But this week they released Ubuntu Web Remix, "a privacy-focused, open source alternative to Google Chrome OS/Chromium OS" using Firefox instead of Google Chrome/Chromium. Liliputing reports: If the name didn't give it away, this operating system is based on Ubuntu, but it's designed to offer a Chrome OS-like experience thanks to a simplified user interface and a set of pre-installed apps including the Firefox web browser, some web apps from /e/, and Anbox, a tool that allows you to run Android apps in Linux... You don't get the long battery life, cloud backup, and many other features that make Chromebooks different from other laptops (especially other cheap laptops). But if you're looking for a simple, web-centric operating system that isn't made by a corporate giant? Then I guess it's nice to have the option. Rudra Saraswat writes: An easy web-app (wapp) format has been created to package web-apps for the desktop. You can now create your own web apps using web technologies, package them for the desktop and install them easily. An experimental wapp store can be found at store.ubuntuweb.co, for distributing web apps. Developers and packagers can do pull requests at gitlab.com/ubuntu-web/ubuntu-web.gitlab.io to contribute wapps. ' -- source: https://news.slashdot.org/story/20/11/22/0226213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How Firefox Boosted Its JavaScript Performance
by Peter Reutemann 23 Nov '20

23 Nov '20

'InfoWorld reports: Firefox users can expect improved JavaScript performance in the Firefox 83 browser, with the Warp update to the SpiderMonkey JavaScript engine enabled by default. Also called WarpBuilder, Warp improves responsiveness and memory usage and speeds up page loads by making changes to JiT (just-in-time) compilers... Warp has been shown to be faster than Ion, SpiderMonkey's previous optimizing JiT, including a 20 percent improvement on Google Docs load time. Other JavaScript-intensive websites such as Netflix and Reddit also have shown improvement... Warp has replaced the front end — the MIR building phase — of the IonMonkey JiT... Mozilla also will continue to incrementally optimize the back end of the IonMonkey JiT, as Mozilla believes there is still room for improvement for JavaScript-intensive workloads.' -- source: https://news.slashdot.org/story/20/11/22/0412232 I agree, 83 feels snappier when browsing. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

After Restoring YouTube-dl, GitHub Revamps Its Copyright Takedown Policy
by Peter Reutemann 22 Nov '20

22 Nov '20

'On October 23rd GitHub initially complied with a takedown request for the open-source project youtube-dl — and then after 24 days, reinstated it. "If there's a silver lining to the episode, it's that GitHub is implementing new policies to avoid a repeat of a repeat situation moving forward," reports Engadget: First, it says a team of both technical and legal experts will manually evaluate every single section 1201 claim. In instances where there's any ambiguity to a claim, the company says it will err on the side of developers and leave their repository online. If the company's technical and legal teams ultimately find any issues with a project, GitHub will give its owners the chance to address those problems before it takes down their work. Following a takedown, it will continue to give people the chance to recover their data — provided it doesn't include any offending code. GitHub is also establishing a $1 million defense fund to provide legal aid to developers against suspect section 1201 claims, as well as doubling down on its lobbying work to amend the DMCA and other similar copyright laws across the world. ' -- source: https://yro.slashdot.org/story/20/11/21/0554250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fearing Drama, Mozilla Opens Public Consultation Before Worldwide Firefox DoH Rollout
by Peter Reutemann 20 Nov '20

20 Nov '20

'Mozilla has opened today a public comment and consultation period about the ways it could enable support for the controversial privacy-centric DNS-over-HTTPS (DoH) protocol inside Firefox. From a report: The browser maker's decision to open a rare public consultation period comes after the organization faced criticism last year in the UK for its plans to support DoH inside Firefox. UK government officials, law enforcement agencies, and local internet service providers criticized Mozilla for developing and wanting to roll out DoH, a feature they said could have helped suspects bypass enterprise firewalls and parental controls blocklists -- even earning the browser maker a nomination for an "Internet Villain" award from a local ISP. All last year's hoopla was caused by DoH, a web protocol developed as an alternative to the classic DNS (Domain Name System). DoH works by encrypting DNS queries (which are normally sent out in clear text) and hiding them inside normal-looking HTTPS web traffic.' -- source: https://tech.slashdot.org/story/20/11/19/1711200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

OpenStreetMap is Having a Moment
by Peter Reutemann 20 Nov '20

20 Nov '20

'Joe Morrison: The first time I spoke with Jennings Anderson, I couldn't believe what he was telling me. I mean that genuinely -- I did not believe him. He was a little incredulous about it himself. I felt like he was sharing an important secret with me that the world didn't yet know. The open secret Jennings filled me in on is that OpenStreetMap (OSM) is now at the center of an unholy alliance of the world's largest and wealthiest technology companies. The most valuable companies in the world are treating OSM as critical infrastructure for some of the most-used software ever written. The four companies in the inner circle -- Facebook, Apple, Amazon, and Microsoft -- have a combined market capitalization of over six trillion dollars. In almost every other setting, they are mortal enemies fighting expensive digital wars of attrition. Yet they now find themselves eagerly investing in and collaborating on OSM at an unprecedented scale (more on the scale later). What likely started as a conversation in a British pub between grad students in 2004 has spiraled out of control into an invaluable, strategic, voluntarily-maintained data asset the wealthiest companies in the world can't afford to replicate. I will admit that I used to think of OSM as little more than a virtuous hobby for over-educated Europeans living abroad -- a cutesy internet collectivist experiment somewhere on the spectrum between eBird and Linux. It's most commonly summarized with a variant of this analogy: OSM is to an atlas as Wikipedia is to an encyclopedia. OSM acolytes hate this comparison in the much same way baseball players resent when people describe the sport as "cricket for fat people." While vaguely truthful, it doesn't quite get to the spirit of the thing. OSM is incomparable. Over 1.5M individuals have contributed data to it. It averages 4.5M changes per day. The stats page on the OSM Wiki is a collection of hockey sticks. [...] ' -- source: https://slashdot.org/story/20/11/19/1935221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google is Rolling Out End-To-End Encryption for RCS in Android Messages Beta
by Peter Reutemann 20 Nov '20

20 Nov '20

'After two long, complicated years, every Android user worldwide (outside China) now has access to the next-gen texting standard that is replacing SMS. Google is directly offering RCS chat services through its Android Messages app to anybody who installs it and uses it as their default texting app, which partly bypasses a carrier rollout that, at times, has ranged from sluggish to incoherent to broken. From a report Just as importantly, Google has announced that it's finally beginning to enable a key privacy feature: end-to-end encryption. For Android users who use Android Messages, one-on-one chats will eventually be end-to-end encrypted by default, meaning neither carriers nor Google will be able to read the content of those messages. Even though encryption is only beginning to roll out to people who sign up for the public beta for Android Messages, turning on encryption for RCS is a very big deal. It's a massive privacy win, as it could mean that the de facto replacement for SMS will, by default, be private on the smartphone platform used by the vast majority of people worldwide. As for the people who use that other smartphone platform -- the iPhone -- we have no word on whether Apple intends to adopt the RCS standard. But as every carrier worldwide gets on board, and now that there is a clearer path to ensuring private communication with RCS, the pressure on Apple to participate is likely to build. Unfortunately, SMS becoming fully deprecated and replaced by RCS will only happen if all goes to plan for Google. Since initially announcing plans to transition to RCS as the primary texting platform for Android, the standard's rollout has been mired in confusion. In attempting to be neutral and make Android's texting a standard shared by carriers worldwide, Google set itself up with the job of herding multibillion-dollar cats -- with sadly predictable results.' -- source: https://tech.slashdot.org/story/20/11/19/1528230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

BBC Releases Doctor-Who-Themed RISC-V-Based Programming Kit
by Lawrence D'Oliveiro 20 Nov '20

20 Nov '20

The BBC has created a miniature computer, the “Doctor Who HiFive Inventor”, aimed at young ’uns trying to learn programming <https://www.theregister.com/2020/11/19/bbc_doctor_who_sifive/>. This uses a RISC-V processor from SiFive, includes quite a range of I/O interfaces, and comes with lessons narrated by Jodie “Thirteenth Doctor” Whittaker. Pricing looks comparable to Raspberry-π-based products, too.

1 0

Apple Silicon Performance
by Lawrence D'Oliveiro 20 Nov '20

20 Nov '20

You may have seen reports popping up everywhere as Apple’s new Macs running its ARM-based “Apple Silicon” chips get into the hands of the first buyers. They seem to offer remarkable performance while still managing good battery life, even while a lot of the software they are running is still written for x86 processors and being translated on the fly through the “Rosetta 2” emulator layer. One of the secrets to that performance is that the system RAM is integrated into the CPU chipset <https://www.theregister.com/2020/11/19/apple_m1_high_bandwidth_memory_perfo…>. Yup, that means RAM is not upgradeable on these machines.

1 0

Microsoft’s “Project Reunion” Leads To More Fragmentation
by Lawrence D'Oliveiro 20 Nov '20

20 Nov '20

If you thought the Microsoft Windows development landscape was already confusing enough, consider this update <https://www.theregister.com/2020/11/19/microsoft_winui_windows/> on “Project Reunion” ... which [Windows Developer VP] Gallo described as “a common platform for new apps and APIs so that they will work down-level across supported versions of Windows.” A developer asked: “For a new desktop app what is your recommendation, UWP? WinUI, WPF or WinForm?” To which there was no simple answer. Indeed, while the presentation introduced WinUI version 3, it appears WinUI 2.x will also continue to be developed. Instead, Gallo talked about no longer having binary choices, but being able to mix and match in the brave new Reunion world. I wonder if anybody at Microsoft really understands what “Reunion” means ...

1 0

Google's Native Version of Chrome For Apple's ARM Macs Is Out Now
by Peter Reutemann 19 Nov '20

19 Nov '20

'According to Chrome product manager Mark Chang, Google's version of Chrome that support ARM Macs is now available to download. The Verge reports: In theory, a native version of the notoriously resource-hungry browser might run more efficiently on Apple's Arm-based computers. In our reviews of the MacBook Air, MacBook Pro, and Mac mini equipped with the new M1 chip, though, we found that the version of Chrome built for Intel chips already runs well on Apple's new Macs, so hopefully this native version runs even better. You'll be able to pick which version of Chrome to download from the browser's website. Google began rolling out a new version of Chrome on Tuesday, touting the "the largest gain in Chrome performance in years" thanks to some under-the-hood changes. The company's blog about the new release didn't mention anything about a version optimized for Apple's Arm-based Macs.' -- source: https://apple.slashdot.org/story/20/11/18/2239226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Massive, China-State-Funded Hack Hits Companies Around the World, Report Says
by Peter Reutemann 19 Nov '20

19 Nov '20

'Ars Technica: Researchers have uncovered a massive hacking campaign that's using sophisticated tools and techniques to compromise the networks of companies around the world. The hackers, most likely from a well-known group that's funded by the Chinese government, are outfitted with both off-the-shelf and custom-made tools. One such tool exploits Zerologon, the name given to a Windows server vulnerability, patched in August, that can give attackers instant administrator privileges on vulnerable systems. Symantec uses the code name Cicada for the group, which is widely believed to be funded by the Chinese government and also carries the monikers of APT10, Stone Panda, and Cloud Hopper from other research organizations. The group has been active in espionage-style hacking since at least 2009 and almost exclusively targets companies linked to Japan. While the companies targeted in the recent campaign are located in the United States and other countries, all of them have links to Japan or Japanese companies. The attacks make extensive use of DLL side-loading, a technique that occurs when attackers replace a legitimate Windows dynamic-link library file with a malicious one. Attackers use DLL side-loading to inject malware into legitimate processes so they can keep the hack from being detected by security software. The campaign also makes use of a tool that's capable of exploiting Zerologon. Exploits work by sending a string of zeros in a series of messages that use the Netlogon protocol, which Windows servers use to let users log into networks. People with no authentication can use Zerologon to access an organization's crown jewels -- the Active Directory domain controllers that act as an all-powerful gatekeeper for all machines connected to a network. Microsoft patched the critical privilege-escalation vulnerability in August, but since then attackers have been using it to compromise organizations that have yet to install the update. Both the FBI and Department of Homeland Security have urged that systems be patched immediately. Among the machines compromised during attacks discovered by Symantec were domain controllers and file servers. Company researchers also uncovered evidence of files being exfiltrated from some of the compromised machines.' -- source: https://it.slashdot.org/story/20/11/19/0124204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

$6 Billion Linux Deal? SUSE IPO Rumored
by Peter Reutemann 18 Nov '20

18 Nov '20

'ZDNet: According to Bloomberg, EQT is planning an IPO for German Linux and enterprise software company SUSE. EQT is a Swedish-based private equity firm with 50 billion euros in raised capital. SUSE is the leading European Union (EU) Linux distributor. Over the years, SUSE has changed owners several times. First, it was acquired by Novell in 2004. Then, Attachmate, with some Microsoft funding, bought Novell and SUSE in 2010. This was followed in 2014 when Micro Focus purchased Attachmate and SUSE was spun off as an independent division. Then, EQT purchased SUSE from Micro Focus for $2.5 billion in March 2019. With an IPO of approximately $6 billion, EQT would do very well for itself in very little time. Bloomberg states that the IPO talks are in a very preliminary stage. Nothing may yet come of these conversations. As for SUSE, a company representative said, "As a company, we are constantly exploring ways to grow. But as a matter of corporate policy, we do not comment on rumor or speculation in the market."' -- source: https://linux.slashdot.org/story/20/11/17/2148202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 83 Arrives With HTTPS-Only Mode and Faster Performance
by Peter Reutemann 18 Nov '20

18 Nov '20

'Mozilla today launched Firefox 83 for Windows, Mac, and Linux. An anonymous reader shares a report: Firefox 83's highlight feature is HTTPS-Only Mode, in which the browser attempts to establish fully secure connections to every website (just like the EFF's HTTPS Everywhere). If it can't, Firefox asks for your permission before connecting to a website that doesn't support secure connections. To enable HTTPS-Only Mode, click on Firefox's menu button, hit Preferences, then Privacy & Security, scroll down to HTTPS-Only Mode, and choose "Enable HTTPS-Only Mode in all windows." [...] Firefox 83 also brings performance improvements (improved page load performance by up to 15%, page responsiveness by up to 12%, and reduced memory usage by up to 8%). Firefox 83 is also the penultimate version of the web browser that will run Flash software; Firefox 85 will completely disable it when it arrives on Jan. 12, 2021.' -- source: https://news.slashdot.org/story/20/11/17/1725230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome 87 Released With Fix for NAT Slipstream Attacks, Broader FTP Deprecation
by Peter Reutemann 18 Nov '20

18 Nov '20

'Google has released today version 87 of its Chrome browser, a release that comes with a security fix for the NAT Slipstream attack technique and a broader deprecation of the FTP protocol. From a report: Todays' release is available for Windows, Mac, Linux, Chrome OS, Android, and iOS. Users can update to the new version via Chrome's built-in update utility. While in previous versions, Google has shipped some changes to Chrome settings and UI elements, almost all the major new Chrome 87 features are aimed at web developers. In Chrome 87, we have new APIs and updates to Chrome's built-in Developer Tools, such as: Support for the new Cookie Store API; new features to allow easier modification of web fonts via CSS; a new feature to let websites enumerate all the locally installed fonts; support for pan, tilt, and zoom controls on webcam streams; and, support for debugging WebAuthn operations via the Chrome DevTools.' -- source: https://slashdot.org/story/20/11/17/1810248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday
by Peter Reutemann 18 Nov '20

18 Nov '20

Hi everyone We have a meeting coming up next Monday: "Introduction to the LISP programming language will be presented by Jake Waas and Ian Stewart. They will focus on the open source CLISP and SBCL dialects of the LISP language and the use of functions in the COMMON-LISP package. By the end of the presentation you will be able to write simple LISP programs." -- details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/266792044/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Interview With KDE Developers
by Lawrence D'Oliveiro 17 Nov '20

17 Nov '20

Talk with a couple of the KDE “maintainers” (?) <https://www.theregister.com/2020/11/16/kde_maintainers_speak_on_why/> on the origins of KDE and where it stands today. The fact that it is built on Qt, which is heavily used in many commercial projects, means “Qt has to work well with a small footprint because of embedded systems, and that means KDE’s Plasma desktop has had a fundamental change since the mindset of KDE 3 days, when it was considered bloated and heavy,” said Riddell. “Now it’s a really fast, lightweight desktop.” Some other worthwhile info there, including discussions of working with Wayland and systemd.

1 0

GitHub Reinstates YouTube-dl Library After EFF Intervention
by Peter Reutemann 17 Nov '20

17 Nov '20

'GitHub has reinstated today the youtube-dl open-source project, a Python library that lets users download the source audio and video files behind YouTube videos. From a report: GitHub, a code-hosting repository, had previously removed the library from its portal after it received a controversial DMCA takedown request from the Recording Industry Association of America (RIAA) on October 23. In a DMCA takedown letter, RIAA argued that the library was being used to "circumvent the technological protection measures used by authorized streaming services such as YouTube" and to allow users to "reproduce and distribute music videos and sound recordings [...] without authorization." RIAA also noted that the project's source code "expressly suggests its use to copy and/or distribute the following copyrighted works." More specifically, RIAA used Section 1201 of the Digital Millennium Copyright Act (DMCA) to claim that the youtube-dl library was breaking copyright by providing a tool to circumvent copyrighted material -- even if the youtube-dl library didn't contain copyright-infringing code itself. But in a blog post today, GitHub said the library did not actually break Section 1201 of the DMCA, citing a letter it received from Electronic Frontier Foundation lawyers, who to take up the youtube-dl project's case. In the letter, the EFF team explained that Google does not have any technical measures in place to prevent the download of its videos -- all of which need to be made freely available to all kinds of apps, browsers, smart TVs, and more. Hence, EFF lawyers argued that the library could never be taken down under Section 1201 of the DMCA since the library doesn't actually circumvent any sort of copyright protection system in the first place.' -- source: https://yro.slashdot.org/story/20/11/16/1730250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ok Google: Please Publish Your DKIM Secret Keys
by Peter Reutemann 17 Nov '20

17 Nov '20

'Matthew Green, a cryptographer and professor at Johns Hopkins University, writes: The Internet is a dangerous place in the best of times. Sometimes Internet engineers find ways to mitigate the worst of these threats, and sometimes they fail. Every now and then, however, a major Internet company finds a solution that actually makes the situation worse for just about everyone. Today I want to talk about one of those cases, and how a big company like Google might be able to lead the way in fixing it. This post is about the situation with Domain Keys Identified Mail (DKIM), a harmless little spam protocol that has somehow become a monster. My request is simple and can be summarized as follows: Dear Google: would you mind rotating and publishing your DKIM secret keys on a periodic basis? This would make the entire Internet quite a bit more secure, by removing a strong incentive for criminals to steal and leak emails. The fix would cost you basically nothing, and would remove a powerful tool from hands of thieves.' -- source: https://tech.slashdot.org/story/20/11/16/1932234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

There’s Open Source, And There’s Open Source
by Lawrence D'Oliveiro 13 Nov '20

13 Nov '20

Vendors open-sourcing a bunch of code isn’t enough, if that code remains under the de-facto control of the vendor. It needs to be possible for a community to influence its development direction, rather than passively waiting for the next code drop from the vendor, according to Dave Airlie <https://www.theregister.com/2020/11/12/intel_igc_mesa/>. He says: “A warning then to anyone wishing for more vendor code sharing between OSes it generally doesn't end with Linux being better off, it ends up with Linux being more fragmented, harder to support and in the long run unsustainable.”

1 0

E-Cycle
by john 12 Nov '20

12 Nov '20

Hi All. Service industries now has a receiving warehouse offering all computers and paraphernalia can be dumped for free. Similarly any stuff that is salvageable is given away. Email ewasterecyclers(a)gmail.com Keily 021-526-4825 Adrian 020-256-2289 5 Johnson Street Dinsdale. Cheers John

1 0

Ubuntu fixes bugs that standard users could use to become root
by Peter Reutemann 12 Nov '20

12 Nov '20

'Ubuntu developers have fixed a series of vulnerabilities that made it easy for standard users to gain coveted root privileges. “This blog post is about an astonishingly straightforward way to escalate privileges on Ubuntu,” Kevin Backhouse, a researcher at GitHub, wrote in a post published on Tuesday. “With a few simple commands in the terminal, and a few mouse clicks, a standard user can create an administrator account for themselves.” The first series of commands triggered a denial-of-service bug in a daemon called accountsservice, which as its name suggests is used to manage user accounts on the computer. To do this, Backhouse created a Symlink that linked a file named .pam_environment to /dev/zero, changed the regional language setting, and sent accountsservice a SIGSTOP. With the help of a few extra commands, Backhouse was able to set a timer that gave him just enough time to log out of the account before accountsservice crashed. When done correctly, Ubuntu would restart and open a window that allowed the user to create a new account that—you guessed it—had root privileges.' -- source: https://arstechnica.com/information-technology/2020/11/ubuntu-fixes-bugs-th… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

No, the New MacBook Air is Not Faster Than 98% of PC Laptops
by Peter Reutemann 12 Nov '20

12 Nov '20

'Gordon Mah Ung, writing at PC World: Let me just say it outloud, OK? Apple is full of it. I'm referring to Apple's claim that its fanless, Arm-based MacBook Air is "faster than 98 percent of PC laptops." Yes, you read that correctly: Apple officials literally claimed that the new MacBook Air using Apple's custom M1 chip is faster than 98 percent of all PC laptops sold this year. Typically, when a company makes such a claim, it publishes a benchmark, a performance test or actual details on what it's basing that marketing claim on. This to prevent lawyers from launching out of missile silos across the world. Apple's website restates the claim by stating: "M1 is faster than the chips in 98 percent of PC laptops sold in the past year." The site also includes a detail note that states: "Testing conducted by Apple in October 2020 using preproduction 13-inch MacBook Pro systems with Apple M1 chip and 16GB of RAM. Performance measured using select industry-standard benchmarks. PC configurations from publicly available sales data over the last 12 months. Performance tests are conducted using specific computer systems and reflect approximate performance of MacBook Pro." So, not only does Apple not say what tests it's basing its claims on, it doesn't even say where it sources the comparable laptops. Does that mean the new fanless MacBook Air is faster than, say, Asus' stupidly fast Ryzen 4000 based, GeForce RTX 2060-based Zephyrus G14? Does it mean the MacBook Air is faster than Alienware's updated Area 51M? The answer, I'm going to guess is "no." Not at all. Is it faster than the miniLED-based MSI Creator 17? Probably not, either. And what is that "performance" claim hinged on? CPU performance? GPU performance? Performance running Windows? Is it using the same application running on both platforms? Is it experiential? Is this running Red Dead Redemption II or Call of Duty: Black Ops Cold War? Is it running CyberLink's PowerDirector? Is it running Fortnite? While I have absolutely no idea what Apple is basing its claims on, I can tell you that I am 98 percent sure that any of the above laptops listed will wreck the MacBook Air doing any of the tasks I just named. When Apple makes its claims, my guess is they are comparing the new M1 to Intel-based processors ranging from Atom to Celeron N to Core i3 and up, all with integrated graphics. But by not defining the word "performance," all this becomes just pure marketing spin. And is it really fair to compare a $999 MacBook to one that costs $150? Because $150 PCs are included in the 98 percent of laptops sold. Maybe Apple should compare its own $150 MacBook Air against a $150 Chromebook or Windows-based laptop. Of course, that would mean Apple would have to sell a product that most people can afford. I have no doubt the M1 will be impressive, but do I think it's going to compare to 8-cores of Ryzen 4000 performance or a GeForce RTX 2060? No.' -- source: https://apple.slashdot.org/story/20/11/11/2114225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome To Block Tab-Nabbing Attacks
by Peter Reutemann 12 Nov '20

12 Nov '20

'Google will deploy a new security feature in Chrome next year to prevent tab-nabbing, a type of web attack that allows newly opened tabs to hijack the original tab from where they were opened. From a report: The new feature is scheduled to go live with Chrome 88, to be released in January 2021. While the term "tab-nabbing" refers to a broad class of tab hijacking attacks [see OWASP, Wikipedia], Google is addressing a particular scenario. This scenario refers to situations when users click on a link, and the link opens in a new tab (via the "target=_blank" attribute). These new tabs have access to the original page that opened the new link. Via the JavaScript "window.opener" function, the newly opened tabs can modify the original page and redirect users to malicious sites. This type of attack has powered quite a few phishing campaigns across the years. To mitigate this threat, browser makers like Apple, Google, and Mozilla have created the rel="noopener" attribute.' -- source: https://tech.slashdot.org/story/20/11/11/1558242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi 4 Can Be Safely Overclocked To 2.15 GHz
by Peter Reutemann 12 Nov '20

12 Nov '20

'When the Raspberry Pi 400 (a keyboard form-factor single board computer) was released last week, the company hinted at overclocking. Testing has now shown that the heat spreader used in that design does an excellent job. The chip was already clocked at 1.8 GHz, versus the stock 1.5 GHz in the original Raspberry Pi 4 Model B board. But it can be safely overclocked to 2.15 GHz, as can the Compute Module 4 with an adequate heat sink. At 2.0 GHz, the Pi 400 got up above 60 C and showed signs of continuing to warm up even after 50 minutes, but it was nowhere near throttling. So I tried 2.2 GHz, at which speed the CPU refused to boot entirely. Backing down to 2.15 GHz, it ran just fine, so I left it for three hours. It settled in at a cozy 62.5 C, which is warm, but well within specs. I ran the CM4 with the larger heatsink at 1.8 GHz to give some basis for comparison to the cheap heatsinks. What a big difference a big hunk of aluminum makes! It settled in at a comfortable 68 C or so. Even pushing it up to 2.15 GHz and leaving it for a couple hours, it stayed just a hair below 70C (158F) -- a safe margin on the throttling threshold -- and only a few degrees warmer than that huge heat spreader in the Pi 400.' -- source: https://hardware.slashdot.org/story/20/11/11/182203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google's Play Store Identified as Main Distribution Vector For Most Android Malware
by Peter Reutemann 12 Nov '20

12 Nov '20

'The official Google Play Store has been identified as the primary source of malware installs on Android devices in a recent academic study -- considered the largest one of its kind carried out to date. >From a report: Using telemetry data provided by NortonLifeLock (formerly Symantec), researchers analyzed the origin of app installations on more than 12 million Android devices for a four-month period between June and September 2019. In total, researchers looked at more than 34 million APK (Android application) installs for 7.9 million unique apps. [...] The results showed that around 67% of the malicious app installs researchers identified came from the Google Play Store. Google did not respond to a request for comment made by ZDNet almost three weeks ago.' -- source: https://tech.slashdot.org/story/20/11/11/198244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Cricket NZ Makes Exclusive Deal With Amazon Prime For Indian Market
by Lawrence D'Oliveiro 11 Nov '20

11 Nov '20

Indian cricket fans (of which there are many) wanting to watch NZ matches will need to sign up for the Amazon Prime streaming service, according to this <https://www.theregister.com/2020/11/11/amazon_prime_new_zealand_cricket_dea…>. The deal will run for six years from late next year.

1 0

Lightweight Linux Distros for Old Laptop (2020)
by Peter Reutemann 11 Nov '20

11 Nov '20

'Do not discard that old PC or laptop yet. You can use a lightweight Linux distro to make them as good as new. Some of these Linux distros are specifically for use in older machines. You can use any of the lightweight Linux distros and bring your old machine back to life. In as much we focus on the old distros, we do have some new releases that do not require many resources that can re-invent your old computers. Are you in any or all of the situations below? - Your computer is but still feel like you can revive it - Your computer is modern but runs on low power - You need to install a modern computer to reserve resources to other demanding tasks If you find yourself in any of the above situations, then the best choice of action would be to start looking for the best lightweight Linux distros for old computers.' -- source: https://linoxide.com/distros/lightweight-linux-distros-for-old-laptop/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Computer Scientists Achieve 'Crown Jewel' of Cryptography
by Peter Reutemann 11 Nov '20

11 Nov '20

'A cryptographic master tool called indistinguishability obfuscation has for years seemed too good to be true. Three researchers have figured out that it can work. Erica Klarreich, reporting for Quanta Magazine: In 2018, Aayush Jain, a graduate student at the University of California, Los Angeles, traveled to Japan to give a talk about a powerful cryptographic tool he and his colleagues were developing. As he detailed the team's approach to indistinguishability obfuscation (iO for short), one audience member raised his hand in bewilderment. "But I thought iO doesn't exist?" he said. At the time, such skepticism was widespread. Indistinguishability obfuscation, if it could be built, would be able to hide not just collections of data but the inner workings of a computer program itself, creating a sort of cryptographic master tool from which nearly every other cryptographic protocol could be built. It is "one cryptographic primitive to rule them all," said Boaz Barak of Harvard University. But to many computer scientists, this very power made iO seem too good to be true. Computer scientists set forth candidate versions of iO starting in 2013. But the intense excitement these constructions generated gradually fizzled out, as other researchers figured out how to break their security. As the attacks piled up, "you could see a lot of negative vibes," said Yuval Ishai of the Technion in Haifa, Israel. Researchers wondered, he said, "Who will win: the makers or the breakers?" "There were the people who were the zealots, and they believed in [iO] and kept working on it," said Shafi Goldwasser, director of the Simons Institute for the Theory of Computing at the University of California, Berkeley. But as the years went by, she said, "there was less and less of those people." Now, Jain -- together with Huijia Lin of the University of Washington and Amit Sahai, Jain's adviser at UCLA -- has planted a flag for the makers. In a paper posted online on August 18, the three researchers show for the first time how to build indistinguishability obfuscation using only "standard" security assumptions. All cryptographic protocols rest on assumptions -- some, such as the famous RSA algorithm, depend on the widely held belief that standard computers will never be able to quickly factor the product of two large prime numbers. A cryptographic protocol is only as secure as its assumptions, and previous attempts at iO were built on untested and ultimately shaky foundations. The new protocol, by contrast, depends on security assumptions that have been widely used and studied in the past. "Barring a really surprising development, these assumptions will stand," Ishai said. While the protocol is far from ready to be deployed in real-world applications, from a theoretical standpoint it provides an instant way to build an array of cryptographic tools that were previously out of reach. For instance, it enables the creation of "deniable" encryption, in which you can plausibly convince an attacker that you sent an entirely different message from the one you really sent, and "functional" encryption, in which you can give chosen users different levels of access to perform computations using your data. The new result should definitively silence the iO skeptics, Ishai said. "Now there will no longer be any doubts about the existence of indistinguishability obfuscation," he said. "It seems like a happy end."' -- source: https://science.slashdot.org/story/20/11/10/1922225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

And Now For Some Local Bork
by Lawrence D'Oliveiro 10 Nov '20

10 Nov '20

A laser projection mural in Christchurch goes slightly wrong, showing a Windows 10 message instead <https://www.theregister.com/2020/11/09/bork/>: There can be few of us who have not felt the clammy hand of a Windows update on our shoulder, but sticking it on a mural and declaring it "art"? That takes a New Zealander.

1 0

HP Replaces 'Free Ink for Life' Plan With '99 Cents a Month Or Your Printer Stops Working'
by Peter Reutemann 10 Nov '20

10 Nov '20

'In a new essay at EFF.org, Cory Doctorow re-visits HP's anti-consumer "security updates" that disabled third-party ink cartridges (while missing real vulnerabilities that could actually bypass network firewalls). Doctorow writes that it was just the beginning: HP's latest gambit challenges the basis of private property itself: a bold scheme! With the HP Instant Ink program, printer owners no longer own their ink cartridges or the ink in them. Instead, HP's customers have to pay a recurring monthly fee based on the number of pages they anticipate printing from month to month; HP mails subscribers cartridges with enough ink to cover their anticipated needs. If you exceed your estimated page-count, HP bills you for every page (if you choose not to pay, your printer refuses to print, even if there's ink in the cartridges). If you don't print all your pages, you can "roll over" a few of those pages to the next month, but you can't bank a year's worth of pages to, say, print out your novel or tax paperwork. Once you hit your maximum number of "banked" pages, HP annihilates any other pages you've paid for (but continues to bill you every month). Now, you may be thinking, "All right, but at least HP's customers know what they're getting into when they take out one of these subscriptions," but you've underestimated HP's ingenuity. HP takes the position that its offers can be retracted at any time. For example, HP's "Free Ink for Life" subscription plan offered printer owners 15 pages per month as a means of tempting users to try out its ink subscription plan and of picking up some extra revenue in those months when these customers exceeded their 15-page limit. But Free Ink for Life customers got a nasty shock at the end of last month: HP had unilaterally canceled their "free ink for life" plan and replaced it with "a $0.99/month for all eternity or your printer stops working" plan... For would-be robber-barons, "smart" gadgets are a moral hazard, an irresistible temptation to use those smarts to reconfigure the very nature of private property, such that only companies can truly own things, and the rest of us are mere licensors, whose use of the devices we purchase is bound by the ever-shifting terms and conditions set in distant boardrooms. From Apple to John Deere to GM to Tesla to Medtronic, the legal fiction that you don't own anything is used to force you to arrange your affairs to benefit corporate shareholders at your own expense. And when it comes to "razors and blades" business-model, embedded systems offer techno-dystopian possibilities that no shaving company ever dreamed of: the ability to use law and technology to prevent competitors from offering their own consumables. >From coffee pods to juice packets, from kitty litter to light-bulbs, the printer-ink cartridge business-model has inspired many imitators. HP has come a long way since the 1930s, reinventing itself several times, pioneering personal computers and servers. But the company's latest reinvention as a wallet-siphoning ink grifter is a sad turn indeed, and the only thing worse than HP's decline is the many imitators it has inspired.' -- source: https://hardware.slashdot.org/story/20/11/09/0221226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Tim Berners Lee's Startup Inrupt Releases Privacy Platform for Enterprises
by Peter Reutemann 10 Nov '20

10 Nov '20

'Inrupt, the startup from World Wide Web founder Tim Berners-Lee, announced an enterprise version of the Solid privacy platform today, which allows large organizations and governments to build applications that put users in control of their data . From a report: Berners-Lee has always believed that the web should be free and open, but large organizations have grown up over the last 20 years that make their money using our data. He wanted to put people back in charge of their data, and the Solid open source project, developed at MIT, was the first step in that process. Three years ago he launched Inrupt, a startup built on top of the open source project, and hired John Bruce to run the company. The two shared the same vision of shifting data ownership without changing the way websites get developed. With Solid, developers use the same standards and methods of building sites, and these applications will work in any browser. What Solid aims to do is alter the balance of data power and redirect it to the user. "Fast forward to today, and we're releasing the first significant technology as the fruits of our labor, which is an enterprise version of Solid to be deployed at scale by large organizations," Bruce explained. The core idea behind this approach is that users control their data in online storage entities called Personal Online Data Stores or Pods for short. The enterprise version consists of Solid Server to manage the Pods, and developers can build applications using an SDK to take advantage of the Pods and access the data they need to do a particular job like pay taxes or interact with a healthcare provider. Bruce points out that the enterprise version is fully compatible with the open source Solid project specifications. The company has been working with some major organizations prior to today's release including the BBC and National Health Service in the UK and the Government of Flanders in Belgium as they have been working to bring this to market.' -- source: https://yro.slashdot.org/story/20/11/09/1453252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Compal, the Second-Largest Laptop Manufacturer in the World, Hit By Ransomware
by Peter Reutemann 10 Nov '20

10 Nov '20

'Compal, a Taiwanese electronics company that builds laptops for some of the world's largest computer brands, suffered a ransomware attack over the weekend. From a report: Responsible for the breach is believed to be the DoppelPaymer ransomware gang, according to a screenshot of the ransom note shared by Compal employees with Yahoo Taiwan reporters. According to Taiwanese media, the incident was discovered on Sunday morning and is believed to have impacted around 30% of Compal's computer fleet. Employees arriving at work were greeted by a memo from Compal's IT staff, asking workers to check the status of their workstations and back up important files on systems that were not impacted.' -- source: https://it.slashdot.org/story/20/11/09/1615207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FTC Announces a Settlement With Zoom Over Security Issues
by Peter Reutemann 10 Nov '20

10 Nov '20

'Zoom will implement new security practices as part of a proposed settlement with the Federal Trade Commission, the agency announced on Monday. From a report: "Zoom has agreed to a requirement to establish and implement a comprehensive security program, a prohibition on privacy and security misrepresentations, and other detailed and specific relief to protect its user base, which has skyrocketed from 10 million in December 2019 to 300 million in April 2020 during the COVID-19 pandemic," the FTC said in a press release.' -- source: https://news.slashdot.org/story/20/11/09/1645233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Cyberattackers Now Also Make Linux Versions of Their Ransomware
by Peter Reutemann 09 Nov '20

09 Nov '20

'"Security firm Kaspersky said Friday that it discovered a Linux version of the RansomEXX ransomware," reports ZDNet, "marking the first time a major Windows ransomware strain has been ported to Linux to aid in targeted intrusions." RansomEXX is a relatively new ransomware strain that was first spotted earlier this year in June. The ransomware has been used in attacks against the Texas Department of Transportation, Konica Minolta, U.S. government contractor Tyler Technologies, Montreal's public transportation system, and, most recently, against Brazil's court system (STJ)... The RansomEXX gang creating a Linux version of their Windows ransomware is in tune with how many companies operate today, with many firms running internal systems on Linux, and not always on Windows Server. A Linux version makes perfect sense from an attacker's perspective; always looking to expand and touch as much core infrastructure as possible in their quest to cripple companies and demand higher ransoms. What we see from RansomEXX may soon turn out to be an industry-defining trend, with other big ransomware groups rolling out their Linux versions in the future as well. And, this trend appears to have already begun. According to cyber-security firm Emsisoft, besides RansomEXX, the Mespinoza (Pysa) ransomware gang has also recently developed a Linux variant from their initial Windows version.' -- source: https://linux.slashdot.org/story/20/11/07/0541223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Verdict After Hackaday's Teardown of a Raspberry Pi 400: 'Very, Very Slick'
by Peter Reutemann 09 Nov '20

09 Nov '20

'"You can't send Hackaday a piece of gear without us taking it apart," warns an article shared by Slashdot reader beggarwoman. Hackady's verdict? The new Raspberry Pi 400 "is very, very slick." Inside, there's a flat-flex that connects the keyboard, and you see that big aluminum heat sink. It's almost the full size of the keyboard, and it's thick and heat-taped to the CPU. You know it means business. It's also right up against the aluminum bottom of the keyboard, suggesting it could get radiative help that way, and maybe keep your fingers warm in the winter. (I didn't feel any actual heat, but it's gotta go somewhere, right? There are also vents in the underside of the case.) Four PZ1 screws and a little bit of courage to unstick the pad get you underneath the heat spreader to find, surprise!, a Raspberry Pi 4. This was a little anticlimactic, as I've just spent a couple weeks looking over the schematics for my review of the new Compute Module 4, and it's just exactly what you'd expect. It's a Raspberry Pi 4, with all the ports broken out, inside a nice keyboard, with a beefy heat spreader. Ethernet magnetics sit on one side, and the wireless module sits on the other. That's it! "[C]ombine this with a small touch screen, and run it all off of a 5 V power pack, and you've got a ton of portable computing in a very small package. "If you're not mousing around all the time anyway, there's a certain streamlined simplicity here that's mighty tempting."' -- source: https://hardware.slashdot.org/story/20/11/07/1938245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

On Older Versions of Android, Many Let's Encrypt-Secured Sites May Stop Working in 2021
by Peter Reutemann 09 Nov '20

09 Nov '20

'This year Let's Encrypt announced that it's issued a billion certificates, and it's been estimated they've made certs for almost 30% of web domains. But Friday they posted that "The DST Root X3 root certificate that we relied on to get us off the ground is going to expire — on September 1, 2021. Fortunately, we're ready to stand on our own, and rely solely on our own root certificate." "However, this does introduce some compatibility woes." Some software that hasn't been updated since 2016 (approximately when our root was accepted to many root programs) still doesn't trust our root certificate, ISRG Root X1. Most notably, this includes versions of Android prior to 7.1.1. That means those older versions of Android will no longer trust certificates issued by Let's Encrypt. Android has a long-standing and well known issue with operating system updates. There are lots of Android devices in the world running out-of-date operating systems. The causes are complex and hard to fix: for each phone, the core Android operating system is commonly modified by both the manufacturer and a mobile carrier before an end-user receives it. When there's an update to Android, both the manufacturer and the mobile carrier have to incorporate those changes into their customized version before sending it out. Often manufacturers decide that's not worth the effort. The result is bad for the people who buy these devices: many are stuck on operating systems that are years out of date. Currently, 66.2% of Android devices are running version 7.1 or above. The remaining 33.8% of Android devices will eventually start getting certificate errors when users visit sites that have a Let's Encrypt certificate. In our communications with large integrators, we have found that this represents around 1-5% of traffic to their sites. Hopefully these numbers will be lower by the time DST Root X3 expires next year, but the change may not be very significant. Let's Encrypt engineer Jacob Hoffman-Andrews explains that "In the time between now and September 29 we plan to start serving certificates with the 'alternate' link relation 186 to allow Automatic Certificate Management Environment (ACME) clients to programmatically select a chain they prefer." But Friday's blog post explains that won't solve everything: There will be site owners that receive complaints from users and we are empathetic to that being not ideal. We're working hard to alert site owners so you can plan and prepare. We encourage site owners to deploy a temporary fix (switching to the alternate certificate chain) to keep your site working while you evaluate what you need for a long-term solution: whether you need to run a banner asking your Android users on older OSes to install Firefox, stop supporting older Android versions, drop back to HTTP for older Android versions, or switch to a CA that is installed on those older versions. Gizmodo notes that Firefox will be unaffected "since it relies on its own certificate store that includes Let's Encrypt's root, though that wouldn't keep applications from breaking or ensure functionality beyond your browser." They describe Let's Encrypt as "the Mozilla-partnered nonprofit," and offers this succinct summary of the problem. "One of the world's top certificate authorities warns that phones running versions of Android prior to 7.1.1 Nougat will be cut off from large portions of the secure web starting in 2021."' -- source: https://it.slashdot.org/story/20/11/08/1654223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Generating Flag Emojis
by Lawrence D'Oliveiro 08 Nov '20

08 Nov '20

You may have seen our new Foreign Minister, Nanaia Mahuta, tweeting her congratulations to the next President of the USA, including a couple of country flag emojis. I was looking through the Unicode character list for the codes for country flags, and discovered that there aren’t any, as such. Instead, there is this range of special character codes (“Regional indicator symbols”): 1F1E6 REGIONAL INDICATOR SYMBOL LETTER A ... 1F1FF REGIONAL INDICATOR SYMBOL LETTER Z with a note saying These characters can be used in pairs to represent regional codes. In some emoji implementations, certain pairs may be recognized and displayed by alternate means; for instance, an implementation might recognize F + R and display this combination with a symbol representing the flag of France. So for example if I enter U+1F1F3 (the code for N in the above block) followed by U+1F1FF (the code for Z), being the ISO-3166 regional code for NZ, the text-rendering system could replace them with the NZ flag: 🇳🇿. Anyway, I found out this works in YouTube comments as well. (Not that I’m saying the YouTube commenting system is particularly fine -- but that’s another story...)

1 0

EFF Argues RIAA is 'Abusing DMCA' to Take Down YouTube-DL
by Peter Reutemann 08 Nov '20

08 Nov '20

'While the RIAA has objected to a tool for downloading online videos, EFF senior activist Elliot Harmon responds with this question. "Who died and put them in charge of YouTube?" He asks the question in a new video "explainer" on the controversy, and argues in a new piece at EFF.org that the youtube-dl tool "doesn't infringe on any RIAA copyrights." RIAA's argument relies on a different section of the DMCA, Section 1201. DMCA 1201 says that it's illegal to bypass a digital lock in order to access or modify a copyrighted work. Copyright holders have argued that it's a violation of DMCA 1201 to bypass DRM even if you're doing it for completely lawful purposes; for example, if you're downloading a video on YouTube for the purpose of using it in a way that's protected by fair use. (And thanks to the way that copyright law has been globalized via trade agreements, similar laws exist in many other jurisdictions too.) RIAA argues that since youtube-dl could be used to download music owned by RIAA-member labels, no one should be able to use the tool, even for completely lawful purposes. This is an egregious abuse of the notice-and-takedown system, which is intended to resolve disputes over allegedly infringing material online. Again, youtube-dl doesn't use RIAA-member labels' music in any way. The makers of youtube-dl simply shared information with the public about how to perform a certain task — one with many completely lawful applications. Harmon wants to hear from people using youtube-dl for lawful purposes. And he also links to an earlier EFF piece arguing that DMCA 1201 "is incredibly broad, apparently allowing rightsholders to legally harass any 'trafficker' in code that lets users re-take control of their devices from DRM locks..." And EFF's concern over DMCA 1201 has been ongoing: DMCA 1201 has been loaded with terrible implications for innovation and free expression since the day it was passed. For many years, EFF documented these issues in our "Unintended Consequences" series; we continue to organize and lobby for temporary exemptions to its provisions for the purposes of cellphone unlocking, restoring vintage videogames and similar fair uses, as well as file and defend lawsuits in the United States to try and mitigate its damage. We look forward to the day when it is no longer part of U.S. law. But due to the WIPO Copyright Treaty, the DMCA's anti-circumvention provisions infest much of the world's jurisdictions too, including the European Union via the Information Society Directive 2001/29/EC.' -- source: https://yro.slashdot.org/story/20/11/07/0313228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Brave Hits 20 Million Monthly Users a Year After 1.0 Release
by Peter Reutemann 06 Nov '20

06 Nov '20

'One year after its first 1.0 release, Brave says it has hit the milestone of 20.5 million active monthly users. "At the same time last year, the browser had 8.7 million active monthly users, and of the 20 million monthly users, 7 million are daily users, which represents more than a doubling of last year's 3 million," reports ZDNet. "Brave added that since Apple allowed browsers other than its own to be the default option on iOS, it has seen its iOS user base increase by a third." From the report: One of the touted features of the browser is that it hates ads, and will go out of its way to block them, unless users decide to see Brave-powered advertisements. To that end, Brave has hit "2 billion ad confirmation events" and completed 2,215 campaigns from over 460 companies. The browser maker says its users have a click-through rate of 9%, way and away outstripping industry averages. The browser also has its own cryptocurrency, Basic Attention Tokens, that users use to "tip" content creators. Thus far, 26 million of the tokens have been sent to creators. At the time of writing, the blockchain-based token is trading for just under 18 cents, meaning $4.6 million has been sent from users. ' -- source: https://tech.slashdot.org/story/20/11/05/0424253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

Why Do Printers Still Suck?
by Peter Reutemann 06 Nov '20

06 Nov '20

'Just when we need them the most, with print shops locked down, online schooling in session, and everyone working from home, they fail to step up. From a column: Printers have been my enemy ever since I can remember. My first office job involved an evil printer that suffered daily paper jams. Tasked with fixing it, I suffered frequent burns and paper cuts. It had a door you had to close just so, or it would immediately break again with the dreaded phantom paper jam. It tormented me for months, completely indifferent to my cries. There isn't even any paper in it! More than two decades later, printers haven't improved at all. It feels like printer companies stopped innovating sometime in the '90s when sales stopped climbing. In fact, it's almost as if they've regressed. Manufacturers tempt with unbelievably cheap deals on printers and then nail you on expensive ink. To make sure they get their pound of flesh, they focus an inordinate effort on making sure printers only work with proprietary ink cartridges. [...] Three years and a couple of printers later, sick of being gouged for ink cartridges that always seem to run out at the worst moment, I optimistically signed up for a printing subscription plan. The idea is you are charged a flat fee based on how many pages you print each month, and the printer automatically orders ink refills when it's running low. Reading this back, I can only cringe at my naivety. Things were fine for the first few weeks. Then I made the mistake of turning the printer off. It doesn't like to be turned off. It started emailing me, insisting that it needs to be turned on and connected to the internet so the subscription plan can work properly. Every time I turn it on, it prints an ink-heavy test page. It is incredibly good at printing test pages -- it just won't print the document you want. Things got worse when I made the mistake of changing my internet service provider. I forgot about the printer for a while. Then I suddenly needed it. I didn't have time to set up the Wi-Fi, so I plugged directly into the printer with a good old-fashioned cable. It refused to print. I refused to connect it to the internet, so it refused to print for me. To get it working again I had to completely uninstall everything related to the printer, update my drivers, install three separate programs, carry it to another room to plug directly into my desktop, carry it back again, hold down the correct button sequence at the stroke of midnight, spin around three times, and recite the printer incantation into a mirror. It's finally connected and working ... for now. But I know it's only a matter of time before it betrays me again.' -- source: https://hardware.slashdot.org/story/20/11/05/2049213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

LibreOffice: OpenOffice Should Give Up And Die, Already
by Lawrence D'Oliveiro 06 Nov '20

06 Nov '20

Seems OpenOffice still has the edge in brand recognition over LibreOffice, in spite of being a largely moribund project with no major releases in 6 years. Yet, in spite of occasional talk of shutting it down, it continues to lurk, unloved, in some obscure corner of the ASF Orbiting HQ. <https://www.theregister.com/2020/10/15/libreoffice_openoffice_taunts/>

1 1

AMD Ryzen 5000 Series Processors Set a New Performance Bar Over Intel
by Peter Reutemann 06 Nov '20

06 Nov '20

'AMD made bold claims when the company unveiled its new Zen 3-based Ryzen 5000 series processors early last month. Statements like "historic IPC uplift" and "fastest for gamers" were waved about like flags of victory. However, as with most things in the computing world, independent testing is always the best way to validate claims. Today AMD lifted the embargo on 3rd party reviews and, in testing, AMD's new Ryzen 5000 series CPUs set a new performance bar virtually across the board, and one that Intel currently can't touch. There are four processors in the initial Ryzen 5000 series lineup, though it's a safe bet more will be coming later. The current entry point is the Ryzen 5 5600X 6-core / 8-thread processor, followed by the 8-core / 16-thread Ryzen 7 5800X, 12-core / 24 thread Ryzen 9 5900X, and the flagship 16-core / 32-thread Ryzen 9 5950X. All of these new CPUs are backwards compatible with AMD socket AM4 motherboards. In comparison to Zen 2, Zen 3 has a larger L1 branch target buffer and improved bandwidth through multiple parts of its pipeline with additional load/store flexibility. Where Zen 2 could handle 2 load and 1 store per cycle, Zen 3 can handle 3 load and 2 stores. All told, AMD is claiming an average 19% increase in IPC with Zen 3, which is a huge uplift gen-over-gen. Couple that IPC uplift with stronger multi-core scaling and a new unified L3 cache configuration, and Zen 3's performance looks great across a wide variety of workloads for both content creation and gaming especially. AMD's Ryzen 9 5950X, Ryzen 9 5900X, Ryzen 7 5800X and Ryzen 5 5600X will be priced at $799, $549, $449 and $299, respectively and should be on retail and etail shelves starting today.' -- source: https://slashdot.org/story/20/11/05/208242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Dell Adding Hardware Privacy Driver For Linux
by Peter Reutemann 05 Nov '20

05 Nov '20

'According to Phoronix, a Dell privacy driver is is being prepared for the Linux kernel. From the report: Beginning in Dell's 2021 laptop models they are providing hardware-based "privacy buttons" to disable microphone and camera support. These new Dell privacy buttons are basically hardware kill switches for the microphone and web camera video stream. The Dell privacy driver sent out on Tuesday for the Linux kernel is about manipulating the relevant LEDs and tracking the status of the hardware-based controls where as the actual toggling of the audio/video support is handled by the hardware. The Dell privacy driver in its current form is talked about for the camera and microphone support but the patch does also note a "PRIVACY_SCREEN_STATUS" bit as well. Presumably they will be extending this privacy driver as well for privacy screen handling around reducing the horizontal/vertical viewing angles of the display. The dell-privacy Linux driver in its initial form can be found via the kernel mailing list. It's great seeing Dell working on this driver punctually for Linux ahead of their next-gen laptops. ' -- source: https://linux.slashdot.org/story/20/11/04/2216242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linux Mint Introduces Its Own Take On the Chromium Web Browser
by Peter Reutemann 05 Nov '20

05 Nov '20

'Mint's programmers, led by lead developer, Clement "Clem" Lefebvre, have built their own take on Google's open-source Chromium web browser. ZDNet reports: Some of you may be saying, "Wait, haven't they offered Chromium for years? Well, yes, and no. For years, Mint used Ubuntu's Chromium build. But then Canonical, Ubuntu's parent company, moved from releasing Chromium as an APT-compatible DEB package to a Snap. The Ubuntu Snap software packing system, along with its rivals Flatpak and AppImage, is a new, container-oriented way of installing Linux applications. The older way of installing Linux apps, such as DEB and RPM package management systems for the Debian and Red Hat Linux families, incorporate the source code and hard-coded paths for each program. While tried and true, these traditional packages are troublesome for developers. They require programmers to hand-craft Linux programs to work with each specific distro and its various releases. They must ensure that each program has access to specific libraries' versions. That's a lot of work and painful programming, which led to the process being given the name: Dependency hell. Snap avoids this problem by incorporating the application and its libraries into a single package. It's then installed and mounted on a SquashFS virtual file system. When you run a Snap, you're running it inside a secured container of its own. For Chromium, in particular, Canonical felt using Snaps was the best way to handle this program. [...] Lefebvre wrote, "The Chromium browser is now available in the official repositories for both Linux Mint and LMDE. If you've been waiting for this I'd like to thank you for your patience." Part of the reason was, well, Canonical was right. Building Chromium from source code is one really slow process. He explained, "To guarantee reactivity and timely updates we had to automate the process of detecting, packaging and compiling new versions of Chromium. This is an application which can require more than 6 hours per build on a fast computer. We allocated a new build server with high specifications (Ryzen 9 3900, 128GB RAM, NMVe) and reduced the time it took to build Chromium to a little more than an hour." That's a lot of power! Still, for those who love it, up-to-date builds of Chromium are now available for Mint users. ' -- source: https://linux.slashdot.org/story/20/11/03/2157255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GitHub Warns Users Reposting YouTube-DL They Could Be Banned
by Peter Reutemann 04 Nov '20

04 Nov '20

'On October 23, 2020, the RIAA decided on action to stunt the growth and potentially the entire future of popular YouTube-ripping tool YouTube-DL. The music industry group filed a copyright complaint with code repository Github, demanding that the project be taken down for breaching the anti-circumvention provisions of the DMCA. While this was never likely to be well received by the hoards of people who support the software, the response was unprecedented. [...] One of the responses was to repost the content to Github itself, where hundreds of YouTube-DL forks kept the flame alight. A copy even appeared in Github's DMCA notice repository where surprisingly it remains to this day. Now, however, Github is warning of consequences for those who continue to use the platform for deliberate breaches of the DMCA. As previously reported, Github is being unusually sympathetic to the plight of the YouTube-DL developers. Most platforms are very happy to simply follow the rules by removing content in response to a DMCA complaint and standing back while declaring "Nothing to do with us folks." Github, on the other hand, has actively become involved to try and get the project reinstated. Unfortunately, however, there is only so far Github can go, something the company made clear in a statement posted to its DMCA repository this weekend. "If you are looking to file or dispute a takedown notice by posting to this repository, please STOP because we do not accept Pull Requests or other contributions to this repository," wrote Jesse Geraci, Github's Corporate Counsel. "Please note that re-posting the exact same content that was the subject of a takedown notice without following the proper process is a violation of GitHub's DMCA Policy and Terms of Service. If you commit or post content to this repository that violates our Terms of Service, we will delete that content and may suspend access to your account as well," Geraci wrote. This statement caused an update to Github's earlier DMCA notice advice.' -- source: https://yro.slashdot.org/story/20/11/02/2250200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Wildly off topic but!!!
by john 03 Nov '20

03 Nov '20

Hi all, I know, but some light relief for those who have not seen these.. https://www.youtube.com/watch?v=4QsIQOevMLg https://www.youtube.com/watch?v=3MHDDSekvcE -- Cheers John

1 0

'youtube-dl' Downloading Software Removed From GitHub By RIAA Takedown Notice
by Peter Reutemann 03 Nov '20

03 Nov '20

'The GitHub repository for the popular youtube-dl utility is offline after GitHub received a DMCA takedown notice from the RIAA. The notice claims that "The clear purpose of this source code is to (i) circumvent the technological protection measures used by authorized streaming services such as YouTube, and (ii) reproduce and distribute music videos and sound recordings owned by our member companies without authorization for such use." "Whether you're looking to backup contents of your personal YouTube account or download some of your favorite YouTuber's videos for offline use, many turn to youtube-dl as the most reliable and in-depth tool for downloading videos from YouTube -- along with many, many other sites that have videos like Vimeo, CNN, etc," writes Kyle Bradshaw via 9to5Google. "Beyond simple downloading features, youtube-dl is also able to convert your download into nearly any format, including creating an mp3 of just a video's audio track." "One of the primary bases for the RIAA's claim is that youtube-dl appears to be developed with the explicit intention of enabling the downloading of copyrighted works, with music videos from the likes of Icona Pop, Justin Timberlake, and Taylor Swift being used to test the tool's functionality, a claim which we were able to independently verify." It's now up to the project's creators to file a counterclaim in the hopes of restoring youtube-dl's status on GitHub.' -- source: https://news.slashdot.org/story/20/10/23/2341202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

NetMarketShare Is Giving Up
by Lawrence D'Oliveiro 03 Nov '20

03 Nov '20

One of the two main companies that tracks web browser market share is leaving the business <https://www.theregister.com/2020/11/02/netmarketshare_to_end_browser_stats/>. The main reason given is that the “User-Agent” string that browsers send as part of HTTP requests is becoming less and less useful. But then, that was never a good way of detecting browser functionality anyway. An outfit called the Web Incubator Community Group (WICG) has a new proposal, called “Client Hints”, which is a much more granular way for the server to interrogate client-side capabilities.

1 0

The Raspberry Pi 400 is a Compact Keyboard With a Built-in Computer
by Peter Reutemann 03 Nov '20

03 Nov '20

'The Raspberry Pi Foundation has announced the Raspberry Pi 400, a compact keyboard with an ARM-based computer built in. Just plug it into a TV or monitor using one of its two micro HDMI ports, insert a microSD card, attach a power cord and mouse, and you've got yourself a basic computer for day-to-day tasks, coding, or media playback. It's available starting today as a standalone machine for $70 or in a bundle including a mouse, power supply, microSD card, HDMI cable, and beginner's guide for $100. From a report: The hope is the Pi 400's form factor, plus these optional bundled items, makes it more approachable and user-friendly. That's important when you're selling an affordable computer, and it's especially important when you're selling an accessible device to help children learn to code. It looks more like a piece of consumer electronics than the basis for a DIY project. [...] Aside from its keyboard and form factor, the Raspberry Pi 400 is a very similar computer to last year's Raspberry Pi 4. It's got a slightly faster quad-core 1.8GHz ARM Cortex-A72 CPU, up from 1.5GHz in the Pi 4, 4GB of RAM, Gigabit Ethernet, Bluetooth 5.0, and 802.11ac Wi-Fi. There are a pair of micro HDMI ports that can each output up to 4K / 60Hz, two USB 3.0 ports, and a single USB 2.0 port. Power is provided via a USB-C port, there's a microSD card slot for storage, and there's a GPIO header for attaching a variety of more niche devices.' -- source: https://hardware.slashdot.org/story/20/11/02/1437202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Chrome Will Soon Have Its Own Dedicated Certificate Root Store
by Peter Reutemann 03 Nov '20

03 Nov '20

'Google has announced plans to run its own certificate root program/store for Chrome, in a major architectural shift for the company's web browser program. From a report: A "root program" or a "root store" is a list of root certificates that operating systems and applications use to verify the identity of a software program during its installation routine. Browsers like Chrome use root stores to check the validity of an HTTPS connection. They do this by looking at the website's TLS certificate and checking if the root certificate that was used to generate the TLS cert is included in the local root program/store. Since its launch in late 2009, Chrome was configured to use the "root store" of the underlying platform. For example, Chrome on Windows checked a site's TLS certificate against the Microsoft Trusted Root Program, the root store that ships with Windows; Chrome on macOS relied on the Apple Root Certificate Program; and so on. But in a wiki page, shared with ZDNet by one of our readers, Google announced plans to create its own root store, named the Chrome Root Program, that will ship with all versions of Chrome, on all platforms, except iOS.' -- source: https://it.slashdot.org/story/20/11/02/1638225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Dr. Strangenet—or, how I stopped worrying and embraced the WFH IT apocalypse
by Peter Reutemann 03 Nov '20

03 Nov '20

'We are now a solid two quarters into our new work-from-home bizarro world. Many companies found themselves in a bit of a pickle as workforces went from occasional or limited to everyone all-the-time, throwing up whatever they could provision to allow for remote access and continued productivity (or at least some semblance of it). We're well past the emergency stage, folks. For many of us, this will be ongoing and potentially permanent. And the way we do business will have to change—including how we structure our IT operations.' -- source: https://arstechnica.com/features/2020/11/future-of-collaboration-03/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Could RISC-V Processors Compete With Intel, ARM, and AMD?
by Peter Reutemann 02 Nov '20

02 Nov '20

'As promised, SiFive has unveiled a new computer featuring the company's SiFive FU740 processor based on RISC-V architecture," reports Liliputing: The company, which has been making RISC-V chips for several years, is positioning its new SiFive HiFive Unmatched computer as a professional development board for those interested in working with RISC-V. But unlike the company's other HiFive boards, the new Unmatched model is designed so that it can be easily integrated into a standard PC... SiFive says the system can support GNU/Linux distributions including Yocto, Debian, and Fedora. "SiFive is releasing the HiFive Unleashed in an effort to afford developers the ability to build RISC-V based systems, using readily available, off-the-shelf parts," explains Forbes: SiFive says it built the board to address the market need for easily accessible RISC-V hardware to further advance development of new platforms, products, and software using the royalty-free ISA... A short video demo shows the HiFive Unmatched installed in a common mid-tower PC chassis, running the included Linux distro, with an AMD Radeon graphics card pushing the pixels. In the video, the HiFive Unmatched is compiling an application and is shown browsing the web and opening a PDF. SiFive also notes that video playback is accelerated in hardware with the included version of Linux. "At the moment, these development PCs are early alternatives, most likely targeted at hobbyists and engineers who may snap them up when they become available in the fourth quarter for $665," notes VentureBeat. But they add that "While it's still early days, it's not inconceivable that RISC-V processors could someday be alternatives to Intel-based PCs and PC processors." The startup has raised $190 million to date, and former Qualcomm executive Patrick Little recently joined SiFive as CEO. His task will be to establish the company's RISC-V processors as an alternative to ARM. This move comes in the wake of Nvidia's $40 billion acquisition of the world's leading processor architecture. If Little is also looking to challenge Intel and AMD in PCs, he'll have his work cut out for him. For starters, SiFive is currently focused on Linux-based PCs, not Microsoft Windows PCs. Secondly, SiFive wouldn't build these processors or computers on its own. Its customers — anyone brave enough to take on the PC giants — would have to do that. "I wouldn't see this as SiFive moving out of the box. It's more like they're expanding their box," said Linley Group senior analyst Aakash Jani. "They're using their core architecture to enable other chip designers to build PCs, or whatever they plan to build."' -- source: https://hardware.slashdot.org/story/20/11/01/0127253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Foundation Creates Its Own Versions of Apple/Google Coronavirus Tracing Apps
by Peter Reutemann 02 Nov '20

02 Nov '20

'"The Linux Foundation has formed a new group to provide public health authorities with free technology for tracking the spread of the coronavirus and future epidemics," writes Business Insider. Launched in July, the group has already released two apps "that notify users if they've been in contact with someone who has tested positive with COVID-19." Since these apps are open source, people can contribute code and customize them, allowing regions with similar needs to collaborate, general manager at Linux Foundation Public Health, Dan Kohn, told Business Insider. Developers that want to build an app off these projects can access or download the source code. These apps take advantage of technology launched by Apple and Google, which can be integrated into any app, that uses Bluetooth on people's smartphones to track who a user has been in close proximity with, without identifying the specific people. If anyone tests positive for COVID-19 and uploads that information to a database run by a local public health authority, any user who has been in close contact with that person will get a notification through their app saying they may have been exposed — again, without identifying who has COVID-19. If someone knows that they may have been exposed, they can either self-quarantine or get tested. "Essentially we think exposure notification could have a big impact on reducing the overall rate of exposure," Kohn said. An Oxford University study in April said that if about 60% of the population used a contact tracing app, it could grind the diseases spread to a halt. Researchers on the team also found that digital contact tracing can cut down spread even at much lower levels of usage.' -- source: https://linux.slashdot.org/story/20/11/01/0214201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Chinese Laptop Appears With 14nm Loongsoon Quad-Core 3A4000 CPU
by Peter Reutemann 01 Nov '20

01 Nov '20

'"BDY electronics, a Chinese laptop manufacturer, has unveiled an all-new 13.3-inch laptop sporting Longsoon's new Dragon Core 3A4000 quad-core 14nm CPU," reports Tom's Hardware: The biggest feature of this laptop is the CPU, featuring Longsoon's latest 14nm quad-core 3A4000 CPU. Longsoon claims the CPU is 100% faster than the previous generation 3A3000 and is comparable in performance to AMD's "Excavator" cores used in the A8-7680 Godavari architecture. Of course, this demonstrates how far behind Longsoon is from TSMC and Intel in performance, speed, and efficiency of its latest node. However, the chairman of Loongsoon Technologies, Hu Weiwu, says, "14nm and 28nm (for its GPU node) is enough for 90% of applications.," so it appears the company isn't too worried about catching up to the performance leaders like Intel and AMD. Due to this laptop being in the Chinese market, Windows is not supported at all. It only runs Chinese "domestic operating systems" that are typically modified versions of Linux. Fortunately, this does mean you can install any Linux flavor you want on the laptop, which can be handy if you don't want to run China-specific apps only. Slashdot reader Hmmmmmm points out that Loongson's upcoming 3a5000 CPU "will be a 12nm CPU that is 50% faster than the 3A4000."' -- source: https://hardware.slashdot.org/story/20/10/31/1926242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Software Freedom Conservancy: Microsoft Should Resign from RIAA Over Youtube-DL Takedown Demand
by Peter Reutemann 01 Nov '20

01 Nov '20

'"We believe that youtube-dl has substantial non-infringing uses," argues the non-profit Software Freedom Conservancy. But while that software faces a DMCA takedown notice from the Recording Industry Association of America (RIAA), GitHub's owner Microsoft is also a paying member of the RIAA. The Software Freedom Conservancy argues that this leaves Microsoft "stuck between their industry association's abuses of the law and the needs of FOSS projects for which they provide infrastructure." While under current law (which we object to), complying with the takedown notice is admittedly the fastest way to limit Microsoft's liability, we view Microsoft's membership in the RIAA as a much bigger liability to our community, now that Microsoft controls GitHub. We call on Microsoft to resign from the RIAA and remove their conflict of interest in this matter. This is an important opportunity for Microsoft to stand up for the values of software freedom... To build a strong community of FOSS developers, we need confidence that our software hosting platforms will fight for our rights. While we'd prefer that Microsoft would simply refuse to kowtow to institutions like the RIAA and reject their DMCA requests, we believe in the alternative Microsoft can take the easy first step of resigning from RIAA in protest. We similarly call on all RIAA members who value FOSS to also resign.' -- source: https://yro.slashdot.org/story/20/10/31/0416208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Registering An XSS Attack As A UK Company Name
by Lawrence D'Oliveiro 31 Oct '20

31 Oct '20

It is permissible under UK law <https://www.theregister.com/2020/10/30/companies_house_xss_silliness/> to register a company name that, when inserted without escapes into a web page, will trigger certain ... interesting ... behaviour. Companies House blocked such an attempt, but frankly I don’t see why they don’t just allow it. It would serve as a wake-up call to a whole lot of lazy/naïve web developers, anyway.

1 0

Is X.Org Server Abandonware?
by Peter Reutemann 31 Oct '20

31 Oct '20

'Phoronix ran a story this morning with this provocative headline: "It's Time To Admit It: The X.Org Server Is Abandonware." The last major release of the X.Org Server was in May 2018 but don't expect the long-awaited X.Org Server 1.21 to actually be released anytime soon. This should hardly be surprising but a prominent Intel open-source developer has conceded that the X.Org Server is pretty much "abandonware" with Wayland being the future. [Or, more specifically, that "The main worry I have is that xserver is abandonware without even regular releases from the main branch."] This comes as X.Org Server development hits a nearly two decade low, the X.Org Server is well off its six month release regimen in not seeing a major release in over two years, and no one is stepping up to manage the 1.21 release. A year ago was a proposal to see new releases driven via continuous integration testing but even that didn't take flight and as we roll into 2021 there isn't any motivation for releasing new versions of the X.Org Server by those capable of doing so. Red Hat folks have long stepped up to manage X.Org Server releases but with Fedora Workstation using Wayland by default and RHEL working that way, they haven't been eager to devote resources to new X.Org Server releases. Other major stakeholders also have resisted stepping up to ship 1.21 or commit any major resources to new xorg-server versions.' -- source: https://tech.slashdot.org/story/20/10/25/1523253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

NSA “Learned Its Lesson” About Crypto Backdoors -- Take Their Word For It
by Lawrence D'Oliveiro 29 Oct '20

29 Oct '20

Some years ago, the US National Security Agency was quite keen to see the “Dual EC DRBG” pseudorandom number generator become widely adopted for secure encryption purposes <https://www.theregister.com/2020/10/28/nsa_backdoor_wyden/>. But two independent researchers at Microsoft discovered that there were weaknesses in the algorithm, that could be exploited to implant backdoors -- that is, it was possible to compromise the algorithm such that the output still looked random, but a knowledgeable attacker would be able to predict enough statistical characteristics of the bitstream to fatally weaken its randomness. Naturally you can figure out what the NSA were assuming -- that they would be the only ones in the world with the capability to take advantage of such a weakness. This turned out to be wrong. Apparently a report was written up about “lessons learned” from this episode (would it be too much to assume it concluded that such backdoors should never be planted again?) ... but the NSA cannot find the report.

1 0

Hackers Can Now Reverse Engineer Intel Updates Or Write Their Own Custom Firmware
by Peter Reutemann 29 Oct '20

29 Oct '20

'Researchers have extracted the secret key that encrypts updates to an assortment of Intel CPUs, a feat that could have wide-ranging consequences for the way the chips are used and, possibly, the way they're secured. The key makes it possible to decrypt the microcode updates Intel provides to fix security vulnerabilities and other types of bugs. Having a decrypted copy of an update may allow hackers to reverse engineer it and learn precisely how to exploit the hole it's patching. The key may also allow parties other than Intel -- say a malicious hacker or a hobbyist -- to update chips with their own microcode, although that customized version wouldn't survive a reboot. "At the moment, it is quite difficult to assess the security impact," independent researcher Maxim Goryachy said in a direct message. "But in any case, this is the first time in the history of Intel processors when you can execute your microcode inside and analyze the updates." Goryachy and two other researchers -- Dmitry Sklyarov and Mark Ermolov, both with security firm Positive Technologies -- worked jointly on the project. The key can be extracted for any chip -- be it a Celeron, Pentium, or Atom -- that's based on Intel's Goldmont architecture. In a statement, Intel officials wrote: "The issue described does not represent security exposure to customers, and we do not rely on obfuscation of information behind red unlock as a security measure. In addition to the INTEL-SA-00086 mitigation, OEMs following Intel's manufacturing guidance have mitigated the OEM specific unlock capabilities required for this research. The private key used to authenticate microcode does not reside in the silicon, and an attacker cannot load an unauthenticated patch on a remote system."' -- source: https://developers.slashdot.org/story/20/10/28/217212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Wikimedia Is Moving To GitLab
by Peter Reutemann 29 Oct '20

29 Oct '20

'The Wikimedia Foundation, the American non-profit organization that owns the internet domain names of many movement projects and hosts sites like Wikipedia, has decided to migrate their code repositories from Gerrit to Gitlab. Slashdot reader nfrankel shares the announcement: For the past two years, our developer satisfaction survey has shown that there is some level of dissatisfaction with Gerrit, our code review system. This dissatisfaction is particularly evident for our volunteer communities. The evident dissatisfaction with code review, coupled with an internal review of our CI tooling and practice makes this an opportune moment to revisit our code review choices. While Gerrit's workflow is in many respects best-in-class, its interface suffers from usability deficits, and its workflow differs from mainstream industry practices. This creates barriers to entry for the community and slows onboarding for WMF technical staff. In addition, there are a growing number of individuals and teams (both staff and non-staff) who are opting to forgo the use of Gerrit and instead use a third-party hosted option such as GitHub. Reasons vary for the choice to use third-party hosting but, based on informal communication, there are 3 main groupings: lower friction to create new repositories; easier setup and self-service of Continuous Integration configuration; and more familiarity with pull-request style workflows. All these explanations point to friction in our existing code-review system slowing development rather than fostering it. The choice to use third-party code-hosting hurts our collaboration (both internal and external), adds to the confusion of onboarding, and makes it more difficult to maintain code standards across repositories. At the same time, there is a requirement that all software which is deployed to Wikimedia production is hosted and deployed from Gerrit. If we fail to address the real usability problems that users have with Gerrit, people will continue to launch and build projects on whatever system it is they prefer -- Wikimedia's GitHub already contains 152 projects, the Research team has 127 projects. This raises the question: if Gerrit has identifiable problems, why can't we solve those problems in Gerrit? Gerrit is open source (Apache licensed) software; modifications are a simple matter of programming. [...] Upstream has improved the UI in recent releases, and releases have become more frequent; however, upgrade path documentation is often lacking. The migration from Gerrit 2 to Gerrit 3, for example, required several upstream patchsets to avoid the recommended path of several days of downtime. This is the effort required to maintain the status quo. Even small improvements require effort and time as, often, our use-case is very different from the remainder of the Gerrit community. ' -- source: https://news.slashdot.org/story/20/10/28/2114259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

RIAA's YouTube-DL Takedown Ticks Off Developers and GitHub's CEO
by Peter Reutemann 28 Oct '20

28 Oct '20

'An RIAA takedown request, which removed the YouTube-DL repository from GitHub, has ticked off developers and GitHub's CEO. Numerous people responded by copying and republishing the contested code, including in some quite clever ways. Meanwhile, GitHub's CEO is "annoyed" as well, offering help to get the repo reinstated. TorrentFreak reports: Soon after the RIAA notice took YouTube-DL offline many developers spoke out in protest. They believe that the music industry group went too far and started to republish copies of the code everywhere. Over the past several days, we have seen hundreds of new forks and copies appear online. These were also posted to GitHub, where YouTube-DL forks remain easy to find and continue to be uploaded. The code was also posted in some places one wouldn't expect. For example, there's still a copy in GitHub's DMCA notice repository, which some people find quite amusing. And the list of pull requests can be quite entertaining in themselves. One of the most creative responses we've seen was posted to Twitter by @GalacticFurball who encoded YouTube-DL into images that can be easily shared, encouraging others to share these as well. "I would also suggest that you save and repost the images, as one single source kind of defeats the point. Maybe start a hashtag trend or something. Make songs, and poetry. Get that data out there." This triggered even more creativity, with people finding alternative means to share the code online, all to counter the RIAA's takedown request. Meanwhile, GitHub's CEO Nat Friedman wasn't sitting still either. While the Microsoft-owned developer platform had to respond to the takedown notice, Friedman himself actively reached out to YouTube-DL's developers to help them get their project reinstated. The CEO joined YouTube-DL's IRC channel hoping to connect with the owner of the repository so he can help to get it unsuspended. "GitHub exists to help developers. We never want to interfere with their work. We want to help the youtube-dl maintainers defeat the DMCA claim so that we can restore the repo," Friedman told TorrentFreak, explaining his actions. GitHub's CEO suggested that YouTube-DL won't be reinstated in its original form. But, the software may be able to return without the rolling cipher circumvention code and the examples of how to download copyrighted material. ' -- source: https://news.slashdot.org/story/20/10/27/2230218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Facebook Further Borgs Its Oculus Acquisition
by Lawrence D'Oliveiro 27 Oct '20

27 Oct '20

When Facebook first acquired VR headset company Oculus back in 2014, the CEO of the latter claimed “I guarantee that you won't need to log into your Facebook account every time you wanna use the Oculus Rift.” That statement, to reuse an old phrase from the Vietnam War, is no longer operative <https://www.theregister.com/2020/10/27/facebook_oculus_accounts/>. They have also threatened to ban accounts that try to share more than one headset, but have resiled from that by popular demand, at least temporarily. Candidate for quote of the week: “While I do completely understand your concerns, we do need to have you comply with the Facebook TOS.”

1 0

Chrome OS May Finally Be Getting a Dark Mode
by Peter Reutemann 27 Oct '20

27 Oct '20

'The Verge: Chrome OS may finally be getting a dark mode, but so far it's only been spotted in its experimental Canary channel, Android Central reported. Before you go tinkering with Canary just be advised: Canary is Google's "bleeding edge" Chrome OS path, which receives daily updates of features before they've been widely tested. It can only be accessed from Chromebooks switched into a special developer mode (not to be confused with the Chrome OS Developer channel). Google warns that Canary can be "unstable." But at the moment, to activate dark mode on your Chromebook, you need to have the Canary channel installed. Once you've done that, Android Central says you just open Chrome and type in chrome://flags/#enable-force-dark and chrome://flags/#enable-webui-dark-mode into the URL bar. I should note I tried this on my older Chromebook and wasn't able to get it to work. But here's the view Android Police captured. Android Central says the dark mode has some bugs, but notes it seems to apply across the UI, not just as darker backgrounds. ' -- source: https://tech.slashdot.org/story/20/10/26/2047207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Study shows which messengers leak your data, drain your battery, and more
by Peter Reutemann 27 Oct '20

27 Oct '20

'Link previews are a ubiquitous feature found in just about every chat and messaging app, and with good reason. They make online conversations easier by providing images and text associated with the file that’s being linked. Unfortunately, they can also leak our sensitive data, consume our limited bandwidth, drain our batteries, and, in one case, expose links in chats that are supposed to be end-to-end encrypted. Among the worst offenders, according to research published on Monday, were messengers from Facebook, Instagram, LinkedIn, and Line.' -- source: https://arstechnica.com/information-technology/2020/10/study-shows-which-me… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Flying Your Plane!?
by Lawrence D'Oliveiro 27 Oct '20

27 Oct '20

Linux hardware guru Greg Kroah-Hartman on the use of Linux in safety-critical systems <https://www.theregister.com/2020/10/26/linux_kernel_intel/>: What does he think about using Linux in a safety-critical environment? “Anyone who’s ever flown in a plane, it’s been controlled by Linux, for the past decade, so it’s in safety-critical environments today,” he said, grinning. “It runs telecoms systems, it runs stock markets, it runs satellites, it keeps mega yachts from tipping over, it’s been in automotive as well, in the head units for a long time … nobody wants to write an operating system, they just want to write applications to solve their problems.” He also has a warning for those trying to selectively backport security fixes to older kernel versions.

1 0

Vint Cerf Is Working on an Internet for Outer Space
by Peter Reutemann 27 Oct '20

27 Oct '20

'"TCP/IP doesn't work at interplanetary distances," 77-year-old Vinton Cerf tells Quanta magazine. "So we designed a set of protocols that do." Specifically, bundle protocols: a disruption/delay-tolerant networking (DTN) protocol with nodes that can also store information: A data packet traveling from Earth to Jupiter might, for example, go through a relay on Mars, Cerf explained. However, when the packet arrives at the relay, some 40 million miles into the 400-million-mile journey, Mars may not be oriented properly to send the packet on to Jupiter. "Why throw the information away, instead of hanging on to it until Jupiter shows up?" Cerf said. This store-and-forward feature allows bundles to navigate toward their destinations one hop at a time, despite large disruptions and delays... So, a couple decades after conceiving of bundle protocols, is the interplanetary internet up and running? We don't have to build the whole thing and then hope somebody uses it. We sought to get standards in place, as we have for the internet; offer those standards freely; and then achieve interoperability so that the various spacefaring nations could help each other. We're taking the next obvious step for multi-mission infrastructure: designing the capability for an interplanetary backbone network. You build what's needed for the next mission. As spacecraft get built and deployed, they carry the standard protocols that become part of the interplanetary backbone. Then, when they finish their primary scientific mission, they get repurposed as nodes in the backbone network. We accrete an interplanetary backbone over time. In 2004, the Mars rovers were supposed to transmit data back to Earth directly through the deep space network — three big 70-meter antennas in Australia, Spain and California. However, the channel's available data rate was 28 kilobits per second, which isn't much. When they turned the radios on, they overheated. They had to back off, which meant less data would come back. That made the scientists grumpy. One of the JPL engineers used prototype software — this is so cool! — to reprogram the rovers and orbiters from hundreds of millions of miles away. We built a small store-and-forward interplanetary internet with essentially three nodes: the rovers on the surface of Mars, the orbiters and the deep space network on Earth. That's been running ever since. We've been refining the design of those protocols, implementing and testing them. The latest protocols are running back-and-forth relays between Earth and the International Space Station... We did another test at the ISS where the astronauts were controlling a little robot vehicle in Germany.' -- source: https://science.slashdot.org/story/20/10/25/2329239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

So How Good Is Edge on Linux?
by Peter Reutemann 26 Oct '20

26 Oct '20

'"No one asked Microsoft to port its Edge browser to Linux," writes Steven J. Vaughan-Nichols at ZDNet, adding "Indeed, very few people asked for Edge on Windows. "But, here it is. So, how good — or not — is it..?" The new release comes ready to run on Ubuntu, Debian, Fedora, and openSUSE Linux distributions... Since I've been benchmarking web browsers since Mosaic rolled off the bit assembly line, I benchmarked the first Edge browser and Chrome 86 and Firefox 81 on my main Linux production PC.... First up: JetStream 2.0, which is made up of 64 smaller tests. This JavaScript and WebAssembly benchmark suite focuses on advanced web applications. It rewards browsers that start up quickly, execute code quickly, and run smoothly. Higher scores are better on this benchmark. JetStream's top-scorer — drumroll please — was Edge with 136.971. But, right behind it within the margin of error, was Chrome with a score of 132.413. This isn't too surprising. They are, after all, built on the same platform. Back in the back was Firefox with 102.131. Next up: Kraken 1.1. This benchmark, which is based on the long-obsolete SunSpider, measures JavaScript performance. To this basic JavaScript testing, it added typical use-case scenarios. Mozilla, Firefox's parent organization, created Kraken. With this benchmark, the lower the score, the better the result. To no great surprise, Firefox took first place here with 810.1 milliseconds (ms). Following it was Chrome with 904.5ms and then Edge with 958.8ms. The latest version of WebXPRT is today's best browser benchmark. It's produced by the benchmark professionals at Principled Technology. This company's executives were the founders of the Ziff Davis Benchmark Operation, the gold-standard of PC benchmarking. WebXPRT uses scenarios created to mirror everyday tasks. These include Photo Enhancement, Organize Album, Stock Option Pricing, Local Notes, Sales Graphs, and DNA Sequencing. Here, the higher the score, the better the browser. On this benchmark, Firefox shines. It was an easy winner with a score of 272. Chrome edges out Edge 233 to 230. The article concludes that "Oddly, Edge, which turned in a poor performance when I recently benchmarked it on Windows, did well on Linux. Who'd have guessed...? Edge is a good, fast browser on Linux. If you're a Windows user coming over to Linux or you're doing development work aimed at Edge, then by all means try Edge on Linux. It works and it works well." Yet Vaughan-Nichols admits he's still not going to switch to Edge. "Chrome is more than fast enough for my purposes and I don't want my information tied into the Microsoft ecosystem. For better or worse, mine's already locked into the Googleverse and I can live with that."' -- source: https://linux.slashdot.org/story/20/10/25/0118218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Snopes.com Exposes 4chan Campaign to 'Kindle Mistrust in Snopes'
by Peter Reutemann 26 Oct '20

26 Oct '20

'"This is the perfect moment to do this. This is an age of conspiracies for boomers... Let's kindle their mistrust in Snopes and other fact checkers," wrote one 4chan poster. Snopes.com later reported: In October 2020, a series of threads was posted to the anonymous internet forum 4Chan as part of operation "Snopes-Piercer," a smear campaign with the stated goal of "red-pilling some normies" — internet slang for a propaganda technique in which distorted, fabricated, or skewed information is used to further a self-determined "truth." In order to "red-pill" these people (one thread noted that "boomers" were the primary target), the plan was to create and circulate doctored screenshots of Snopes fact checks to make it appear as if Snopes fact-checkers addressed claims that we had not. Over the next few days, users created and shared these fake Snopes screenshots in a number of additional 4chan threads. These images were also posted on social media sites, like Twitter.... Some were humorous (we did not actually address the claim that CNN reporter Chris Cuomo was actually Fredo from "The Godfather"), some were insidious (we did not really publish a fact check questioning the Holocaust), and some were political (we did not publish a fact check questioning the results of the 2020 election before the election happened)... These red pill campaigns all follow a basic formula. The user decides what they want to be true and then they set out to find, or manufacture, the evidence to support that truth. A concerted effort is then made to spread these false narratives to as wide an audience as possible in order to "red-pill" the general population. In this formula, the desired "truth" comes first. The "evidence" comes second. It goes without saying that this method is antithetical to the mission of Snopes, fact-checkers in general, journalists, and anyone seeking an objective view of reality.' -- source: https://news.slashdot.org/story/20/10/24/1952242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Apple, Google and a Deal That Controls the Internet'
by Peter Reutemann 26 Oct '20

26 Oct '20

'The New York Times' looks at "a deal that controls the internet" — Apple's agreement to feature Google as the preselected search engine for iPhones, saying America's Justice Department views it "as a prime example of what prosecutors say are Google's illegal tactics to protect its monopoly and choke off competition..." The scrutiny of the pact, which was first inked 15 years ago and has rarely been discussed by either company, has highlighted the special relationship between Silicon Valley's two most valuable companies — an unlikely union of rivals that regulators say is unfairly preventing smaller companies from flourishing. "We have this sort of strange term in Silicon Valley: co-opetition," said Bruce Sewell, Apple's general counsel from 2009 to 2017. "You have brutal competition, but at the same time, you have necessary cooperation." Apple and Google are joined at the hip even though Mr. Cook has said internet advertising, Google's bread and butter, engages in "surveillance" of consumers and even though Steve Jobs, Apple's co-founder, once promised "thermonuclear war" on his Silicon Valley neighbor when he learned it was working on a rival to the iPhone. Apple and Google's parent company, Alphabet, worth more than $3 trillion combined, do compete on plenty of fronts, like smartphones, digital maps and laptops. But they also know how to make nice when it suits their interests. And few deals have been nicer to both sides of the table than the iPhone search deal. Nearly half of Google's search traffic now comes from Apple devices, according to the Justice Department, and the prospect of losing the Apple deal has been described as a "code red" scenario inside the company. When iPhone users search on Google, they see the search ads that drive Google's business. They can also find their way to other Google products, like YouTube. A former Google executive, who asked not to be identified because he was not permitted to talk about the deal, said the prospect of losing Apple's traffic was "terrifying" to the company. The Justice Department, which is asking for a court injunction preventing Google from entering into deals like the one it made with Apple, argues that the arrangement has unfairly helped make Google, which handles 92 percent of the world's internet searches, the center of consumers' online lives... [C]ompetitors like DuckDuckGo, a small search engine that sells itself as a privacy-focused alternative to Google, could never match Google's tab with Apple. Apple now receives an estimated $8 billion to $12 billion in annual payments — up from $1 billion a year in 2014 — in exchange for building Google's search engine into its products. It is probably the single biggest payment that Google makes to anyone and accounts for 14 to 21 percent of Apple's annual profits. That's not money Apple would be eager to walk away from. In fact, Mr. Cook and Mr. Pichai met again in 2018 to discuss how they could increase revenue from search. After the meeting, a senior Apple employee wrote to a Google counterpart that "our vision is that we work as if we are one company," according to the Justice Department's complaint. The article remembers Steve Jobs unveiling the iPhone in 2007 — and then inviting Google CEO Eric Schmidt onto the stage. Schmidt, who was also on Apple's board of directors, joked "If we just sort of merged the two companies, we could just call them AppleGoo." He'd also added that with Google search on the iPhone, "you can actually merge without merging."' -- source: https://apple.slashdot.org/story/20/10/25/180214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Slashdot Asks: How Do You Feel About Btrfs?
by Peter Reutemann 25 Oct '20

25 Oct '20

'Linux Journal re-visiting the saga of the btrfs file system (initially designed at Oracle in 2007): The btrfs filesystem has taunted the Linux community for years, offering a stunning array of features and capability, but never earning universal acclaim. Btrfs is perhaps more deserving of patience, as its promised capabilities dwarf all peers, earning it vocal proponents with great influence. Still, [while] none can argue that btrfs is unfinished, many features are very new, and stability concerns remain for common functions. Most of the intended goals of btrfs have been met. However, Red Hat famously cut continued btrfs support from their 7.4 release, and has allowed the code to stagnate in their backported kernel since that time. The Fedora project announced their intention to adopt btrfs as the default filesystem for variants of their distribution, in a seeming juxtaposition. SUSE has maintained btrfs support for their own distribution and the greater community for many years. For users, the most desirable features of btrfs are transparent compression and snapshots; these features are stable, and relatively easy to add as a veneer to stock CentOS (and its peers). Administrators are further compelled by adjustable checksums, scrubs, and the ability to enlarge as well as (surprisingly) shrink filesystem images, while some advanced btrfs topics (i.e. deduplication, RAID, ext4 conversion) aren't really germane for minimal loopback usage. The systemd init package also has dependencies upon btrfs, among them machinectl and systemd-nspawn . Despite these features, there are many usage patterns that are not directly appropriate for use with btrfs. It is hostile to most databases and many other programs with incompatible I/O, and should be approached with some care. The original submission drew reactions from three disgruntled btrfs users. But the article goes on to explore providers of CentOS-compatible btrfs-enabled kernels, ultimately opining that "There are many 'rough edges' that are uncovered above with btrfs capabilities and implementations, especially with the measures taken to enable it for CentOS. Still, this is far better than ext2/3/4 and XFS, discarding all the desirable btrfs features, in that errors can be known because all filesystem content is checksummed." It would be helpful if the developers of btrfs and ZFS could work together to create a single kernel module, with maximal sharing of "cleanroom" code, that implemented both filesystems... Oracle is itself unwilling to settle these questions with either a GPL or BSD license release of ZFS. Oracle also delivers a btrfs implementation that is lacking in features, with inapplicable documentation, and out-of-date support tools (for CentOS 8 conversion). Oracle is the impediment, and a community effort to purge ZFS source of Oracle's contributions and unify it with btrfs seems the most straightforward option... It would also be helpful if other parties refrained from new filesystem efforts that lack the extensive btrfs functionality and feature set (i.e. Microsoft ReFS). Until such a day that an advanced filesystem becomes a ubiquitous commodity as Linux is as an OS, the user community will continue to be torn between questionable support, lack of features, and workarounds in a fragmented btrfs community. This is an uncomfortable place to be, and we would do well to remember the parties responsible for keeping us here. So how do Slashdot's readers feel about btrfs?' -- source: https://linux.slashdot.org/story/20/10/24/0146258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Patched an Actively-Exploited Zero-Day Bug in Chrome
by Peter Reutemann 25 Oct '20

25 Oct '20

'"Google released an update to its Chrome browser that patches a zero-day vulnerability in the software's FreeType font rendering library that was actively being exploited in the wild, Threatpost reported this week: Security researcher Sergei Glazunov of Google Project Zero discovered the bug which is classified as a type of memory-corruption flaw called a heap buffer overflow in FreeType. Glazunov informed Google of the vulnerability on Monday. Project Zero is an internal security team at the company aimed at finding zero-day vulnerabilities. By Tuesday, Google already had released a stable channel update, Chrome version 86.0.4240.111, that deploys five security fixes for Windows, Mac & Linux — among them a fix for the zero-day, which is being tracked as CVE-2020-15999 and is rated as high risk. "Google is aware of reports that an exploit for CVE-2020-15999 exists in the wild," Prudhvikumar Bommana of the Google Chrome team wrote in a blog post announcing the update Tuesday... "The fix is also in today's stable release of FreeType 2.10.4," Ben Hawkes, technical lead for the Project Zero team, tweeted. Meanwhile, security researchers took to Twitter to encourage people to update their Chrome browsers immediately to avoid falling victim to attackers aiming to exploit the flaw... In addition to the FreeType zero day, Google patched four other bugs — three of high risk and one of medium risk — in the Chrome update released this week... So far in the last 12 months Google has patched three zero-day vulnerabilities in its Chrome browser.' -- source: https://it.slashdot.org/story/20/10/25/029202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome Caught Exempting Google Sites From User Requests To Delete Data
by Peter Reutemann 25 Oct '20

25 Oct '20

'This week the Verge reported: If you ask Chrome to delete all cookies and site data whenever you quit the browser, it's reasonable to expect that this policy applies to all websites. Recently, though, a bug in the browser meant data wasn't being removed for two sites in particular: Google and YouTube. This problem was first documented by iOS developer Jeff Johnson on his blog. Johnson found that in Chrome version 86.0.4240.75, "local storage" data for Google.com and YouTube.com stuck around even after restarting the browser. We've been able to replicate similar behavior... The Register notes that Chrome's behavior could allow Google to stash cookie-style data as site data, allowing it to track users even when they think they're being careful by deleting their cookie and site data every time they close the browser. In a statement, Google said it was aware of the issue and was working on a fix... At least one of the affected sites, YouTube, appears to have already been fixed. After we upgraded the Chrome browser to version 86.0.4240.111, YouTube's local storage data seems to successfully purge after a restart, although the data from Google.com still sticks around.' -- source: https://tech.slashdot.org/story/20/10/25/0155246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Options For ps
by Lawrence D'Oliveiro 25 Oct '20

25 Oct '20

One look at the man page for ps(1) <https://man7.org/linux/man-pages/man1/ps.1.html> and you see all the different traditional option syntaxes it tries to be compatible with. The BSD style doesn’t even prefix options with dashes, which can lead to ambiguities and is best avoided. If this is what you’re used to, try to wean yourself off it. To list some useful info about all processes, you can do ps -ef or, for even more info, try ps -eF One thing I find annoying about this it reports less precision in process start times for long-running processes. To get around this, you can use a custom format. For example ps -eo pid,ppid,lstart,tty,etime,cmd shows some similar info to the default “-f” format, but always includes start time and elapsed time to the nearest second, regardless of how long the process has been running. Another useful command to use with ps is pgrep(1) <https://man7.org/linux/man-pages/man1/pgrep.1.html>, which lets you filter processes to get information for according to various criteria. Or you could just use grep(1) on the output from ps, as I suspect a lot of people do. ;)

1 1

Debian Donates 10,000 Euros to Fund Free and Decentralized Livestreaming
by Peter Reutemann 25 Oct '20

25 Oct '20

'PeerTube (developed by Framasoft) is "the free and decentralized alternative to video platforms, providing you over 400,000 videos published by 60,000 users and viewed over 15 million times," according to its web site. But now they're exploring livestreaming, writes Debian developer Phil Hands (Slashdot reader #2,365): Holding DebConf20 online this year highlighted the effort involved in setting up Live Streaming using Free Software — something that is beyond the reach of many smaller events which is where PeerTube with Live Streaming should be a perfect fit. In June PeerTube had posted a roadmap with a humble request for donations in lieu of a crowdfunding campaign: At a time when no one knows what the future holds, we deem it inappropriate to start a crowdfunding campaign and threaten not to do our best on PeerTube if we don't get the necessary funds. We believe in the public utility of PeerTube, so much so that we commit to working on it for six months to make this v3 happen, even if we must do it with our own funds (which we had already done for v2). We still hope that by sharing this roadmap as widely as possible, some of you will support us in our approach with a donation that will allow us to fund this project. And this week PeerTube's official Twitter feed announced that "Thanks to Debian's €10,000 donation we've just reached the 4th step of our PeerTube fundraising" — livestreaming. "Many thanks to all those who donated. And it's not too late to contribute." "We hope this unconventional gesture from the Debian project will help us make this year somewhat less terrible," added the Debian blog, "and give us, and thus humanity, better Free Software tooling to approach the future." It describes their donation as "a strong sign of recognition from an international project — one of the pillars of the Free Software world — towards a small French association which offers tools to liberate users from the clutches of the web's giant monopolies." And secondly, "it's a substantial amount of help in these difficult times, supporting the development of a tool which equally belongs to and is useful to everyone. The strength of Debian's gesture proves, once again, that solidarity, mutual aid and collaboration are values which allow our communities to create tools to help us strive towards Utopia."' -- source: https://linux.slashdot.org/story/20/10/24/010213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

WHO To Grant Wikipedia Free Use of Its Published Material To Combat Covid Misinformation
by Peter Reutemann 23 Oct '20

23 Oct '20

'As part of efforts to stop the spread of false information about the coronavirus pandemic, Wikipedia and the World Health Organization announced a collaboration on Thursday: The health agency will grant the online encyclopedia free use of its published information, graphics and videos. The collaboration is the first between Wikipedia and a health agency. From a report: "We all consult just a few apps in our daily life, and this puts W.H.O. content right there in your language, in your town, in a way that relates to your geography," said Andrew Pattison, a digital content manager for the health agency who helped negotiate the contract. "Getting good content out quickly disarms the misinformation." Since its start in 2001, Wikipedia has become one of the world's 10 most consulted sites; it is frequently viewed for health information. The agreement puts much of the W.H.O.'s material into the Wikimedia "commons," meaning it can be reproduced or retranslated anywhere, without the need to seek permission -- as long as the material is identified as coming from the W.H.O. and a link to the original is included. "Equitable access to trusted health information is critical to keeping people safe and informed," said Tedros Adhanom Ghebreyesus, the W.H.O.'s director general. His agency translates its work into six official languages, which do not include, for example, Hindi, Bengali, German or Portuguese, so billions of people cannot read its documents in their native or even second language. Wikipedia articles, by contrast, are translated into about 175 languages. The first W.H.O. items used under the agreement are its "Mythbusters" infographics, which debunk more than two dozen false notions about Covid-19. Future additions could include, for example, treatment guidelines for doctors, said Ryan Merkley, chief of staff at the Wikimedia Foundation, which produces Wikipedia. If the arrangement works out, it could be extended to counter misinformation regarding AIDS, Ebola, influenza, polio and dozens of other diseases, Mr. Merkley said, "But this was something that just had to happen now." Eventually, live links will be established that would, for example, update global case and death numbers on Wikipedia as soon as the W.H.O. posts them, Mr. Pattison said.' -- source: https://news.slashdot.org/story/20/10/22/1833243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 5

Firefox 'Site Isolation' Feature Enters User Testing, Expected Next Year
by Peter Reutemann 23 Oct '20

23 Oct '20

'Site Isolation is a modern browser security feature that works by separating each web page and web iframes in their own operating system process in order to prevent sites from tampering or stealing with each other's data. The feature was first deployed with Google Chrome in mid-2018, with the release of Chrome 67. Although initially, Site Isolation was meant to be deployed as a general improvement to Chrome's security posture, the feature came just in time to serve as a protective measure against the Spectre vulnerability impacting modern CPUs. Seeing the feature's success, Mozilla also announced plans to support it with the Firefox browser in February 2019, as part of an internal project codenamed Fission. For both Google and Mozilla, implementing Site Isolation was a time-consuming operation, requiring engineers to re-write large chunks of their browsers' internal architecture. The process took about two years for both Google and Mozilla. While Site Isolation is now a stable feature inside Chrome, this work is now nearing its completion inside Firefox. According to an update to the Project Fission wiki page, Site Isolation can now be enabled inside versions of Firefox Nightly, the Firefox version where new features are tested.' -- source: https://news.slashdot.org/story/20/10/22/1717203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu Linux 20.10 'Groovy Gorilla' is Here With Renewed Raspberry Pi Focus
by Peter Reutemann 23 Oct '20

23 Oct '20

'As stated earlier, new Ubuntu versions come April and October, and wouldn't you know it, we are at the end of the latter. With Halloween a bit more than a week away, Canonical today releases Ubuntu 20.10. Ubuntu's version numbering scheme is based on year (YY), a period, and the month (MM). For instance, the previous stable version was released this past April and it is numbered as 20.04. In addition, Canonical (the operating system's owner) assigns names -- sequentially and alphabetically. The alphanumeric code name is always based on two words starting with the same sequential letter -- an adjective followed by an animal name. The aforementioned 20.04 is named "Focal Fossa." This time, the operating system will be called Ubuntu 20.10 "Groovy Gorilla." This new version of the desktop operating system is loaded with fixes, new features, and a renewed focus on the now-iconic Raspberry Pi. Yes, folks, with a compatible Pi (models with 4GB or 8GB of RAM), you can now have the full Ubuntu desktop experience.' -- source: https://news.slashdot.org/story/20/10/22/1737224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Vector Instructions: Everything Old Is New Again
by Lawrence D'Oliveiro 22 Oct '20

22 Oct '20

This article <https://www.sigarch.org/simd-instructions-considered-harmful/> (linked from <https://www.theregister.com/2020/10/21/sifive_vector_cpu_core/>) goes into how RISC-V implements vector instructions, and how this differs from the conventional SIMD approach taken by existing architectures like x86, ARM and MIPS. These CPUs add instructions that can operate on two, four or eight operands at once, in parallel. One drawback is that every new data type (and every new extension to dealing with greater parallelism) requires a new set of instructions, and so we a massive growth in the size of instruction sets for these machines over time. And then there is the trickiness of generating code using these instructions: even though you mostly leave it to the compiler to worry about this sort of thing nowadays, it still involves the generation of complicated sequences to set up a loop and deal with odd numbers of operands that don’t fit into the exact multiples that the instructions can deal with. So you wonder why a small sequence of source code can generate a whole lot of machine code. RISC-V, on the other hand, hearkens back to the grand-daddy of vector machines, the original Cray supercomputer family from the 1970s and 1980s. Here you have a vector-length register, which tells the CPU how many operands you have. You then set up operand pointer registers and write basically one instruction that operates on a single set of operands, and leave it to the hardware to automatically repeat this operation the required number of times, batching the iterations up to whatever size a particular implementation can handle in parallel. So the same code can run unchanged on future hardware with more parallel function units, and automatically take advantage of the greater performance.

1 0

TrueNAS R-series hyperconverged appliances blend storage and compute
by Peter Reutemann 22 Oct '20

22 Oct '20

'Today, storage vendor iXsystems is launching a new R-series hyperconverged infrastructure appliance for its TrueNAS product line—and the first alpha release of TrueNAS SCALE, a Debian Linux-based version of the TrueNAS storage distribution. The new R-series appliances are designed to run either traditional, FreeBSD-based TrueNAS, or the new Debian-based TrueNAS SCALE. The series launches with four models—all rack-mounted—ranging from the 1U, 16-bay TrueNAS R10 to the up to 12U, 52 bay TrueNAS R50. All four models offer Ethernet connectivity up to dual 100GbE, as well as optional dual 32Gb Fibre Channel and Intel Xeon CPUs. The three larger models are expandable via separate JBOD shelves as well. TrueNAS itself is an OpenZFS-based storage distribution, which can be purchased preinstalled on NAS hardware or installed by users on their own generic PC equipment. It offers users the rich feature set of the ZFS filesystem—including block-level checksums and data healing, advanced storage topologies, atomic COW snapshots, rapid asymmetric replication, and more—along with a broad range of network sharing protocols, including SMB, NFS, sFTP, and iSCSI.' -- source: https://arstechnica.com/gadgets/2020/10/ixsystems-launches-new-hyperconverg… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Fears 'Collateral Damage' in Google Antitrust Case
by Peter Reutemann 22 Oct '20

22 Oct '20

'Mozilla has responded to the U.S. Department of Justice's antitrust lawsuit against Google, but rather than commending the DOJ's action, the Firefox browser maker has voiced concerns that its commercial partnership could make it "collateral damage" in the fight against Google's alleged monopolistic practices. From a report: The DOJ, with support from 11 U.S. states, confirmed yesterday that it is suing Google for allegedly violating anti-competition laws by crowding out rivals in the internet search and advertising markets. "Small and independent companies such as Mozilla thrive by innovating, disrupting, and providing users with industry-leading features and services in areas like search," Mozilla chief legal officer Amy Keating wrote in a blog post. "The ultimate outcomes of an antitrust lawsuit should not cause collateral damage to the very organizations -- like Mozilla -- best positioned to drive competition and protect the interests of consumers on the web." Mozilla has a long and complicated history with Google. In recent years, Mozilla has launched countless privacy campaigns against the internet giant's various online properties, and just last month it introduced a new browser add-on to crowdsource research into YouTube's opaque recommendation algorithm. On the other hand, Mozilla relies heavily on royalties from a search engine partnership with Google. The duo recently extended their deal to make Google the default search engine inside Firefox in the U.S. and other markets, which will reportedly secure Mozilla up to $450 million over the next three years.' -- source: https://news.slashdot.org/story/20/10/21/1633207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Releases Chromium-Based Edge Preview For Linux
by Peter Reutemann 21 Oct '20

21 Oct '20

'Last month, Microsoft officials said they'd release a preview of the new Chromium-based Edge browser for Linux some time in October. On October 20, Microsoft made good on the promise, making available the Edge Dev Channel build for Linux. ZDNet reports: The new release supports Ubuntu, Debian, Fedora and openSUSE Linux distributions. Microsoft is planning to release weekly builds, like it does with the Dev Channel builds for other platforms. To get started, users can download and install a .deb or .rpm package directly from the Edge Insider site, which will configure a system to get future automatic updates. Or users can install Edge from Microsoft's Linux Software Repository. More detailed instructions are available on Microsoft's Chredge-on-Linux blog post. ' -- source: https://linux.slashdot.org/story/20/10/20/2144234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Seven Mobile Browsers Vulnerable To Address Bar Spoofing Attacks
by Peter Reutemann 21 Oct '20

21 Oct '20

'In a report published today by cyber-security firm Rapid7, the company said it worked with Pakistani security researcher Rafay Baloch to disclose ten new address bar spoofing vulnerabilities across seven mobile browser apps. From a report: Impacted browsers include big names like Apple Safari, Opera Touch, and Opera Mini, but also niche apps like Bolt, RITS, UC Browser, and Yandex Browser. The issues were discovered earlier this year and reported to browser makers in August. The big vendors patched the issues right away, while the smaller vendors didn't even bother replying to the researchers, leaving their browsers vulnerable to attacks. "Exploitation all comes down to 'JavaScript shenanigans'," said Rapid7's Research Director, Tod Beardsley. The Rapid7 exec says that by messing with the timing between when the page loads and when the browser gets a chance to refresh the address bar URL, a malicious site could force the browser to show the wrong address.' -- source: https://tech.slashdot.org/story/20/10/20/1850252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Backblaze Hard Drive Stats Q3 2020
by Peter Reutemann 21 Oct '20

21 Oct '20

'Backblaze's Q3 2020 hard drive stats: As of September 30, 2020, Backblaze had 153,727 spinning hard drives in our cloud storage ecosystem spread across four data centers. Of that number, there were 2,780 boot drives and 150,947 data drives. This review looks at the Q3 2020 and lifetime hard drive failure rates of the data drive models currently in operation in our data centers and provides a handful of insights and observations along the way. [...] There are several models with zero drive failures in the quarter. That's great, but when we dig in a little we get different stories for each of the drives. The 18TB Seagate model (ST18000NM000J) has 300 drive days and they've been in service for about 12 days. There were no out of the box failures which is a good start, but that's all you can say. The 16TB Seagate model (ST16000NM001G) has 5,428 drive days which is low, but they've been around for nearly 10 months on average. Still, I wouldn't try to draw any conclusions yet, but a quarter or two more like this and we might have something to say. The 4TB Toshiba model (MD04ABA400V) has only 9,108 drive days, but they have been putting up zeros for seven quarters straight. That has to count for something. The 14TB Seagate model (ST14000NM001G) has 21,120 drive days with 2,400 drives, but they have only been operational for less than one month. Next quarter will give us a better picture. The 4TB HGST (model: HMS5C4040ALE640) has 274,923 drive days with no failures this quarter.' -- source: https://hardware.slashdot.org/story/20/10/20/1927247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Adblockers Installed 300,000 Times Are Malicious and Should Be Removed Now
by Peter Reutemann 21 Oct '20

21 Oct '20

'Adblocking extensions with more than 300,000 active users have been surreptitiously uploading user browsing data and tampering with users' social media accounts thanks to malware its new owner introduced a few weeks ago, according to technical analyses and posts on Github. Hugo Xu, developer of the Nano Adblocker and Nano Defender extensions, said 17 days ago that he no longer had the time to maintain the project and had sold the rights to the versions available in Google's Chrome Web Store. Xu told me that Nano Adblocker and Nano Defender, which often are installed together, have about 300,000 installations total. Four days ago, Raymond Hill, maker of the uBlock Origin extension upon which Nano Adblocker is based, revealed that the new developers had rolled out updates that added malicious code. The first thing Hill noticed the new extension doing was checking if the user had opened the developer console. If it was opened, the extension sent a file titled "report" to a server at https://def.dev-nano.com/. "In simple words, the extension remotely checks whether you are using the extension dev tools -- which is what you would do if you wanted to find out what the extension is doing," he wrote. The most obvious change end users noticed was that infected browsers were automatically issuing likes for large numbers of Instagram posts, with no input from users. Cyril Gorlla, an artificial intelligence and machine learning researcher at the University of California in San Diego, told me that his browser liked more than 200 images from an Instagram account that didn't follow anyone. The screenshot to the right shows some of the photos involved.' -- source: https://it.slashdot.org/story/20/10/20/2116228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Surface Duo review—Orphaned Windows hardware makes a poor Android device
by Peter Reutemann 20 Oct '20

20 Oct '20

'After one of the strangest run-ups to launch in smartphone history, the Microsoft Surface Duo is here. Microsoft's first-ever Android phone (sorry, we're not counting the Nokia X) was announced and demoed an entire year before its release, hinting at what a long and winding road the Surface Duo took from inception to shipping. The hardware apparently dates back to plans to revitalize Windows for phones, but after that plan fell through, the hardware was upcycled into the most head-scratching Android phone of the year. The Surface Duo sales pitch is that foldable display technology isn't ready yet, so try this best-we-can-do-right-now version that features two rigid, 5.6-inch OLED displays attached together with a 360 hinge. Microsoft is calling this a "productivity" device thanks to it having the side-by-side app capability of a tablet-style foldable smartphone without any of the janky display technology. Microsoft's website also says the Duo was designed to "inspire people to rethink how they want to use the device in their pocket," indicating that the company definitely sees this as a primary device. I bring up Microsoft's sales pitch because, boy, is the Surface Duo bad at doing the things Microsoft says it's supposed to be good at. The phone feels like it was made without any respect to ergonomics, hand size, pocket-size, or anything that makes a good Android phone. It has crippling productivity problems that negate any benefit you could get from the two-screen design, it's extremely awkward in day-to-day use, and it's very buggy. The phone is missing a whole host of features you would expect for the stratospheric $1400 asking price, and even the hardware that is here seems like it's a least a year old. The Surface Duo feels like a phone that was slapped together without a plan, and the reports of the phone's history indicate that's what actually happened. We would like to gently welcome Microsoft to the Android ecosystem, but we are not grading $1400 smartphones on a curve. Microsoft needed to knock this out of the park. Instead, the company turned in a borderline incompetent smartphone that I really had to force myself to use during the review period.' -- source: https://arstechnica.com/gadgets/2020/10/surface-duo-review-orphaned-windows… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Chat goes free in 2021, while Hangouts loses features this month
by Peter Reutemann 20 Oct '20

20 Oct '20

'With the rise of Google Chat, Google Hangouts is going to die. Google initially announced this all the way back in 2018, and now we're getting more details about the service's slow shutdown and transition plans for the services that rely on it. We've already seen Hangouts lose location sharing and SMS support, and in the blog post, Google announced that phone calls, Google Fi support, and Google Voice support will soon be stripped away from the service.' -- source: https://arstechnica.com/gadgets/2020/10/google-chat-goes-free-in-2021-while… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fancy Bear imposters are on a hacking extortion spree
by Peter Reutemann 20 Oct '20

20 Oct '20

'Ransomware attacks that tear through corporate networks can bring massive organizations to their knees. But even as these hacks reach new popularity highs—and new ethical lows—among attackers, it's not the only technique criminals are using to shake down corporate victims. A new wave of attacks relies instead on digital extortion—with a side of impersonation. On Wednesday, the Web security firm Radware published extortion notes that had been sent to a variety of companies around the world. In each of them, the senders purport to be from the North Korean government hackers Lazarus Group, or APT38, and Russian state-backed hackers Fancy Bear, or APT28. The communications threaten that if the target doesn’t send a set number of bitcoin—typically equivalent to tens or even hundreds of thousands of dollars—the group will launch powerful distributed denial of service attacks against the victim, walloping the organization with a fire hose of junk traffic strategically directed to knock it offline. This type of digital extortion—give us what we’re asking for and we won’t attack you—has resurfaced repeatedly throughout the last decade. But in recent months, criminals have attempted to capitalize on fear about high-profile nation-state attacks, combined with anxieties related to rising ransomware attacks, to try to make some extra money.' -- source: https://arstechnica.com/information-technology/2020/10/fancy-bear-imposters… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers are using a severe Windows bug to backdoor unpatched servers
by Peter Reutemann 20 Oct '20

20 Oct '20

'One of the most critical Windows vulnerabilities disclosed this year is under active attack by hackers who are trying to backdoor servers that store credentials for every user and administrative account on a network, a researcher said on Friday. Zerologon, as the vulnerability has been dubbed, gained widespread attention last month when the firm that discovered it said it could give attackers instant access to active directories, which admins use to create, delete, and manage network accounts. Active directories and the domain controllers they run on are among the most coveted prizes in hacking, because once hijacked, they allow attackers to execute code in unison on all connected machines. Microsoft patched CVE-2020-1472, as the security flaw is indexed, in August. On Friday, Kevin Beaumont, working in his capacity as an independent researcher, said in a blog post that he had detected attacks on the honeypot he uses to keep abreast of attacks hackers are using in the wild. When his lure server was unpatched, the attackers were able to use a powershell script to successfully change an admin password and backdoor the server.' -- source: https://arstechnica.com/information-technology/2020/10/hackers-are-using-a-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi Foundation Launches Compute Module 4 for Industrial Users
by Peter Reutemann 20 Oct '20

20 Oct '20

'The Raspberry Pi Foundation is launching a new product today -- the Compute Module 4. From a report: If you've been keeping an eye on the Raspberry Pi releases, you know that the flagship Raspberry Pi 4 was released in June 2019. The Compute Module 4 features the same processor, but packed in a compute module for industrial use cases. A traditional Raspberry Pi is a single-board computer with a ton of ports sticking out. Compute Modules are somewhat different. Those system-on-module variants are more compact single-board computers without any traditional port. It lets you create a prototype using a traditional Raspberry Pi, and then order a bunch of Compute Modules to embed in your commercial products. "Over half of the seven million Raspberry Pi units we sell each year go into industrial and commercial applications, from digital signage to thin clients to process automation," Eben Upton wrote on the Raspberry Pi blog. Some things are strictly similar between the Raspberry Pi 4 and the Compute Module 4, such as the 64-bit ARM-based processor with VideoCore VI graphics. This is going to represent a huge upgrade for previous Compute Module customers. In particular, you get much better video performance with 4Kp60 hardware decode for H.265 videos, 1080p60 hardware decode for H.264 videos, 1080p30 hardware encode of H.264 videos. You can also take advantage of the dual HDMI interfaces to connect up to two 4K displays at 60 frames per second.' -- source: https://tech.slashdot.org/story/20/10/19/175255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Three npm Packages Opened Remote-Access Shells on Linux and Windows Systems
by Peter Reutemann 19 Oct '20

19 Oct '20

'"Three JavaScript packages have been removed from the npm portal on Thursday for containing malicious code," reports ZDNet. "According to advisories from the npm security team, the three JavaScript libraries opened shells on the computers of developers who imported the packages into their projects." The shells, a technical term used by cyber-security researchers, allowed threat actors to connect remotely to the infected computer and execute malicious operations. The npm security team said the shells could work on both Windows and *nix operating systems, such as Linux, FreeBSD, OpenBSD, and others. All three packages were uploaded on the npm portal in May (first) and September 2018 (last two). Each package had hundreds of downloads since being uploaded on the npm portal. The packages names were: plutov-slack-client nodetest199 nodetest1010 "Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer," the npm security team said.' -- source: https://it.slashdot.org/story/20/10/18/2321208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 5.10 Solves the Year 2038 Problem Until 2486
by Peter Reutemann 19 Oct '20

19 Oct '20

'The Linux 5.10 kernel's XFS file-system will have two new on-disk meta-data capabilities, reports Phoronix: 1. The size of inode btrees in the allocation group is now recorded. This is for increasing redundancy checks and also allowing faster mount times. 2. Support for timestamps now until the year 2486. This "big timestamps" feature is the refactoring of their timestamp and inode encoding functions to handle timestamps as a 64-bit nanosecond counter and bit shifting to increase the effective size. This now allows XFS to run well past the Year 2038 problem (where storing the time since 1970 in seconds will no longer fit in a signed 32-bit integer and thus wraparound) to now the Year 2486. Making a new XFS file-system with bigtime enabled allows a timestamp range from December 1901 to July 2486 rather than December 1901 to January 2038. For preserving backwards compatibility, the big timestamps feature is not currently enabled by default. ' -- source: https://linux.slashdot.org/story/20/10/17/2237236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bash Hackers’ Wiki
by Lawrence D'Oliveiro 18 Oct '20

18 Oct '20

Found this useful collection of Bash tips and tricks. May not be all that well maintained, but I found some handy pages, like this list <https://wiki.bash-hackers.org/scripting/bashchanges> of the more interesting features that were introduced in the various versions of Bash. I was looking for something like this because the Bash version in my Debian Unstable installations was just upgraded to 5.1.

1 0

Need A New Computer For Homeschooling? How About a 2007-Vintage MacBook?
by Lawrence D'Oliveiro 17 Oct '20

17 Oct '20

PC sales have been given a boost by, among other things, the need for schooling the young ones from home, but there’s no reason why they need the latest and greatest hardware for this. How about something from over a decade ago? Here a long-time collector of same <https://www.theregister.com/2020/10/16/need_a_new_computer_for/> reports how Apple-branded gear from that era can be obtained quite cheaply, is a lot easier to service and upgrade than the current stuff, and while it is not supported by current versions of Apple’s own OS, something like Linux will work just fine. That way you get a modern web browser, and enough grunt to stream video. What more could you ask for?

1 0

Quote Of The Week: The State Of Microsoft
by Lawrence D'Oliveiro 16 Oct '20

16 Oct '20

>From this <https://forums.theregister.com/forum/all/2020/10/15/microsoft_adopting_goog…> reader comment: ... today's Microsoft users really are left with best guesses [as to what their software is doing]. It's sad that web searches reveal that everybody's first concern on [Macs]/Linux is installing 3rd party things, but the first concern for everybody on Windows is uninstalling 1st party things. Ironically, nobody on Windows seems to use the term "jailbreak” ... ... yet.

1 0

Should Windows Move To A Linux Kernel?
by Lawrence D'Oliveiro 16 Oct '20

16 Oct '20

An engineer at Canonical has poured cold water <https://www.theregister.com/2020/10/15/even_2020_cannot_bring_forth/> over the suggestion by Eric Raymond that Microsoft might move to substituting a Linux kernel over its own in the Windows OS. Sure, the idea seems complicated and expensive, and very likely troublesome, too. But since when have Windows upgrades not been troublesome? Even updates between different versions of what is ostensibly all the same OS, Windows 10, have been far from smooth lately. Attempting the level of compatibility needed for every Win32 API and syscall would be a huge undertaking. Consider that the WINE folks have already provided a usable fraction of this, with resources that are only a drop in the bucket compared to those available to Microsoft. And as for the vast array of drivers enjoyed by the NT kernel, Barnes reckoned that shunting them into Linux would cost millions. Sure. But would it cost as much as having to continue maintaining them? Particularly since most of those drivers would not be needed, because Linux already has its own native ones. Furthermore, rebasing Windows on Linux could have the ironic effect of stifling competition should a kernel monoculture take hold. Interesting to discuss this use of the term “monoculture”. Linux is already adaptable to a wider range of platforms and applications than Windows can manage. This in spite of the fact that the Windows NT kernel has been fragmented into a number of different versions, including about 5 or 6 different ones for ARM, with little or no compatibility between them. Linux is able to manager better interoperability than that, even between versions for entirely different architectures.

1 0

Google and Intel Warn of High-Severity Bluetooth Security Bug In Linux
by Peter Reutemann 15 Oct '20

15 Oct '20

'An anonymous reader quotes a report from Ars Technica: Google and Intel are warning of a high-severity Bluetooth flaw in all but the most recent version of the Linux Kernel. While a Google researcher said the bug allows seamless code execution by attackers within Bluetooth range, Intel is characterizing the flaw as providing an escalation of privileges or the disclosure of information. The flaw resides in BlueZ, the software stack that by default implements all Bluetooth core protocols and layers for Linux. Besides Linux laptops, it's used in many consumer or industrial Internet-of-things devices. It works with Linux versions 2.4.6 and later. So far, little is known about BleedingTooth, the name given by Google engineer Andy Nguyen, who said that a blog post will be published "soon." A Twitter thread and a YouTube video provide the most detail and give the impression that the bug provides a reliable way for nearby attackers to execute malicious code of their choice on vulnerable Linux devices that use BlueZ for Bluetooth. Intel, meanwhile, has issued this bare-bones advisory that categorizes the flaw as privilege-escalation or information-disclosure vulnerability. The advisory assigned a severity score of 8.3 out of a possible 10 to CVE-2020-12351, one of three distinct bugs that comprise BleedingTooth. "Potential security vulnerabilities in BlueZ may allow escalation of privilege or information disclosure," the advisory states. "BlueZ is releasing Linux kernel fixes to address these potential vulnerabilities." Intel, which is a primary contributor to the BlueZ open source project, said that the most effective way to patch the vulnerabilities is to update to Linux kernel version 5.9, which was published on Sunday. Those who can't upgrade to version 5.9 can install a series of kernel patches the advisory links to. Maintainers of BlueZ didn't immediately respond to emails asking for additional details about this vulnerability. Ars Technica points out that since BleedingTooth requires proximity to a vulnerable device, there's not much reason for people to worry about this vulnerability. "It also requires highly specialized knowledge and works on only a tiny fraction of the world's Bluetooth devices," it adds.' -- source: https://it.slashdot.org/story/20/10/15/0043232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0