- wlug - list.wlug.org.nz

Google and Intel Warn of High-Severity Bluetooth Security Bug In Linux
by Peter Reutemann 15 Oct '20

15 Oct '20

'An anonymous reader quotes a report from Ars Technica: Google and Intel are warning of a high-severity Bluetooth flaw in all but the most recent version of the Linux Kernel. While a Google researcher said the bug allows seamless code execution by attackers within Bluetooth range, Intel is characterizing the flaw as providing an escalation of privileges or the disclosure of information. The flaw resides in BlueZ, the software stack that by default implements all Bluetooth core protocols and layers for Linux. Besides Linux laptops, it's used in many consumer or industrial Internet-of-things devices. It works with Linux versions 2.4.6 and later. So far, little is known about BleedingTooth, the name given by Google engineer Andy Nguyen, who said that a blog post will be published "soon." A Twitter thread and a YouTube video provide the most detail and give the impression that the bug provides a reliable way for nearby attackers to execute malicious code of their choice on vulnerable Linux devices that use BlueZ for Bluetooth. Intel, meanwhile, has issued this bare-bones advisory that categorizes the flaw as privilege-escalation or information-disclosure vulnerability. The advisory assigned a severity score of 8.3 out of a possible 10 to CVE-2020-12351, one of three distinct bugs that comprise BleedingTooth. "Potential security vulnerabilities in BlueZ may allow escalation of privilege or information disclosure," the advisory states. "BlueZ is releasing Linux kernel fixes to address these potential vulnerabilities." Intel, which is a primary contributor to the BlueZ open source project, said that the most effective way to patch the vulnerabilities is to update to Linux kernel version 5.9, which was published on Sunday. Those who can't upgrade to version 5.9 can install a series of kernel patches the advisory links to. Maintainers of BlueZ didn't immediately respond to emails asking for additional details about this vulnerability. Ars Technica points out that since BleedingTooth requires proximity to a vulnerable device, there's not much reason for people to worry about this vulnerability. "It also requires highly specialized knowledge and works on only a tiny fraction of the world's Bluetooth devices," it adds.' -- source: https://it.slashdot.org/story/20/10/15/0043232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

KDE Plasma 5.20 Released
by Peter Reutemann 15 Oct '20

15 Oct '20

'KDE's Plasma 5.20 is now available, bringing a bunch of refinements as well as some larger features. Some of the KDE Plasma 5.20 highlights include (via Phoronix): - Numerous fixes to the KWin window manager / compositor including a number of Wayland fixes. Among the Wayland work in Plasma 5.20 includes Klipper support and middle-click paste, mouse and touchpad support nearly on par to X11, window thumbnails in the task manager, crash fixes, and more. - Improved notifications. - Different redesigns and additions to the KDE System Settings from SMART monitoring to better looking interfaces. - Redesigned on-screen displays. - Various tack manager and system tray improvements. ' -- source: https://tech.slashdot.org/story/20/10/14/0058213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Zoom To Roll Out End-to-End Encrypted (E2EE) Calls
by Peter Reutemann 15 Oct '20

15 Oct '20

'Video conferencing platform Zoom announced today plans to roll out end-to-end encryption (E2EE) capabilities starting next week. From a report: E2EE will allow Zoom users to generate individual encryption keys that will be used to encrypt voice or video calls between them and other conference participants. These keys will be stored locally and will not be shared with Zoom servers, meaning the software company won't be able to access or intercept any ongoing E2EE meetings. Support for E2EE calls will first be part of Zoom clients to be released next week. To use the new feature, users must update theri clients next week and enable support for E2EE calls at the account level. This green shield will contain a lock if E2EE is active. If the lock is absent, Zoom will use its default AES 256-bit GCM encryption scheme, which the company uses to secure current communications, but which the company can also intercept.' -- source: https://yro.slashdot.org/story/20/10/14/1722237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

WordPress Versus Jamstack
by Lawrence D'Oliveiro 14 Oct '20

14 Oct '20

Welcome to a new buzzword: “Jamstack”, which stands for “JavaScript, APIs and HTML Markup”. Or, in other words, websites made up of static pages, with all the dynamism implemented by JavaScript running on the browser. Hmm, maybe not quite all--that “APIs” part does still imply server-side dynamism of some sort. Seems the founder of WordPress is less than keen on the idea. WordPress, of course, is built very heavily around PHP code doing dynamic things (like reading and writing databases) server-side. Maybe the difference between the two is more one of degree and centralization rather than anything hard-and-fast. <https://www.theregister.com/2020/10/13/wordpress_matt_vs_netlify_matt/>

1 0

Oh, Those Lascivious Sinful Onions ...
by Lawrence D'Oliveiro 14 Oct '20

14 Oct '20

A seed company had one of its ads banned by Facebook after the image in it was deemed to contain “overtly sexual positioning”. To the normal human eye it just looks like a picture of some onions. Not even the most depraved imagination seems incapable of conjuring more than that out of it. Judge for yourself <https://www.theregister.com/2020/10/13/in_brief_ai/> ...

1 0

Meeting next Monday
by Peter Reutemann 13 Oct '20

13 Oct '20

Hi everyone Due to labour day, our next (and last meeting before the AGM) will be next Monday already. Ian will talk a few minutes about his experience upgrading his Ubuntu to 20.04.1. However, we could do with additional content. Suggestions? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Notepad++/Windows -> Notepadqq/Linux
by Peter Reutemann 13 Oct '20

13 Oct '20

Hi everyone Today, I was looking for a (graphical) text editor that could search through a directory structure and replace a particular string in lots of config files. Just using find in conjunction with sed wasn't gonna cut it, as I needed to inspect each individual file first (but then do a single subversion commit covering all the files). While searching on alternativeto.net for an alternative to Notepad++, using this URL: https://alternativeto.net/software/notepad-plus-plus/ I came across Notepadqq, which had the desired functionality: https://notepadqq.com/ Just like Notepad++, it also has syntax highlighting for lots of different file types. It's great to have such a wide variety of editors out there! :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Long-term WLUG member featured in a good-news article
by Eric Light 13 Oct '20

13 Oct '20

Hi everyone! I apologise if this isn't appropriate here (it does verge on a political post), but I noticed a familiar name in The Spinoff today. Most of you will know Roderick Aldridge from his membership in the WLUG over the years. It's been quite nice to see his writing on non-technical issues as well. https://thespinoff.co.nz/society/12-10-2020/im-80-years-old-ive-never-touch… Thanks Roderick :) E -------------------------------------------- Q: Why is this email five sentences or less? A: http://five.sentenc.es

2 1

Linux 5.9 Boosts CPU Performance With FSGSBASE Support
by Peter Reutemann 13 Oct '20

13 Oct '20

'FSGSBASE support in Linux "has the possibility of helping Intel/AMD CPU performance especially in areas like context switching that had been hurt badly by Spectre/Meltdown and other CPU vulnerability mitigations largely on the Intel side," Phoronix wrote back in August. As it started its journey into the kernel, they provided a preview on August 10: The FSGSBASE support that was finally mainlined a few days ago for Linux 5.9 is off to providing a nice performance boost for both Intel and AMD systems... FSGSBASE support for the Linux kernel has been around a half-decade in the making and finally carried over the finish line by one of Microsoft's Linux kernel engineers... FSGSBASE particularly helps out context switching heavy workloads like I/O and allowing user-space software to write to the x86_64 GSBASE without kernel interaction. That in turn has been of interest to Java and others...On Linux 5.9 where FSGSBASE is finally mainlined, it's enabled by default on supported CPUs. FSGSBASE can be disabled at kernel boot time via the "nofsgsbase" kernel option. Today on the Linux kernel mailing list, Linus Torvalds announced the release of Linux 5.9: Ok, so I'll be honest - I had hoped for quite a bit fewer changes this last week, but at the same time there doesn't really seem to be anything particularly scary in here. It's just more commits and more lines changed than I would have wished for. And Phoronix reported: Linux 5.9 has a number of exciting improvements including initial support for upcoming Radeon RX 6000 "RDNA 2" graphics cards, initial Intel Rocket Lake graphics, NVMe zoned namespaces (ZNS) support, various storage improvements, IBM's initial work on POWER10 CPU bring-up, the FSGSBASE instruction is now used, 32-bit x86 Clang build support, and more. See our Linux 5.9 feature overview for the whole scoop on the many changes to see with this kernel.' -- source: https://linux.slashdot.org/story/20/10/12/0029215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apple's T2 Security Chip Has an Unfixable Flaw
by Peter Reutemann 13 Oct '20

13 Oct '20

'A recently released tool is letting anyone exploit an unusual Mac vulnerability to bypass Apple's trusted T2 security chip and gain deep system access. The flaw is one researchers have also been using for more than a year to jailbreak older models of iPhones. But the fact that the T2 chip is vulnerable in the same way creates a new host of potential threats. Worst of all, while Apple may be able to slow down potential hackers, the flaw is ultimately unfixable in every Mac that has a T2 inside. From a report: In general, the jailbreak community haven't paid as much attention to macOS and OS X as it has iOS, because they don't have the same restrictions and walled gardens that are built into Apple's mobile ecosystem. But the T2 chip, launched in 2017, created some limitations and mysteries. Apple added the chip as a trusted mechanism for securing high-value features like encrypted data storage, Touch ID, and Activation Lock, which works with Apple's "Find My" services. But the T2 also contains a vulnerability, known as Checkm8, that jailbreakers have already been exploiting in Apple's A5 through A11 (2011 to 2017) mobile chipsets. Now Checkra1n, the same group that developed the tool for iOS, has released support for T2 bypass. On Macs, the jailbreak allows researchers to probe the T2 chip and explore its security features. It can even be used to run Linux on the T2 or play Doom on a MacBook Pro's Touch Bar. The jailbreak could also be weaponized by malicious hackers, though, to disable macOS security features like System Integrity Protection and Secure Boot and install malware. Combined with another T2 vulnerability that was publicly disclosed in July by the Chinese security research and jailbreaking group Pangu Team, the jailbreak could also potentially be used to obtain FileVault encryption keys and to decrypt user data. The vulnerability is unpatchable, because the flaw is in low-level, unchangeable code for hardware. "The T2 is meant to be this little secure black box in Macs -- a computer inside your computer, handling things like Lost Mode enforcement, integrity checking, and other privileged duties," says Will Strafach, a longtime iOS researcher and creator of the Guardian Firewall app for iOS. "So the significance is that this chip was supposed to be harder to compromise -- but now it's been done."' -- source: https://apple.slashdot.org/story/20/10/12/1854254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Five-Eyes Nations + Japan, India Ask Big Tech To Bake Backdoors Into Everything
by Lawrence D'Oliveiro 12 Oct '20

12 Oct '20

The abovementioned nations have issued a joint statement <https://www.theregister.com/2020/10/11/international_statementon_end_to_end…> where they “urge industry to address our serious concerns where encryption is applied in a way that wholly precludes any legal access to content”. One of the ways to do this is “Enable law enforcement access to content in a readable and usable format where an authorisation is lawfully issued, is necessary and proportionate, and is subject to strong safeguards and oversight”. To the extent that this is not calling for restrictions on strong encryption altogether, merely on its wide adoption by certain large companies, I can live with it. Just so long as we are not forced into using the products and services provided by these companies as an inescapable part of our daily lives.

1 0

The Unreasonable Effectiveness Of The Julia Programming Language
by Lawrence D'Oliveiro 10 Oct '20

10 Oct '20

A report from the recent JuliaCon <https://arstechnica.com/science/2020/10/the-unreasonable-effectiveness-of-t…>: Six years ago, I wrote in these pages about the enduring prominence of Fortran for scientific computing and compared it with several other languages. I ended that article with a prediction that, in 10 years, a new language called Julia stood a good chance of becoming the one that scientists would turn to when tackling large-scale numerical problems. My prediction was not very accurate, though. It actually only took Julia about half that time. He goes on to talk about the “two-language problem” and the “expression problem”, and how Julia solves these through its “multiple-dispatch” feature. A key point is that, even with all these advanced features, it manages to maintain program speed close to that of C++.

1 0

controlling network manager from the console
by Peter Reutemann 08 Oct '20

08 Oct '20

Hi everyone For a project at work, I'm working with a Nvidia Jetson Nano (https://www.nvidia.com/en-us/autonomous-machines/embedded-systems/jetson-na…) In order to get it hooked up to the wireless network, I came across the following tutorial: https://learn.sparkfun.com/tutorials/adding-wifi-to-the-nvidia-jetson/all The interesting tidbit in this article was the "nmcli" tool (https://linux.die.net/man/1/nmcli) to control the network manager from the console. Really neat! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

Botched Excel Import May Have Caused Loss Of 15,841 UK COVID-19 Cases
by Lawrence D'Oliveiro 07 Oct '20

07 Oct '20

Looks like someone tried to load a file of nationwide Coronavirus test results into Microsoft Excel, and exceeded its maximum-row limit <https://arstechnica.com/tech-policy/2020/10/excel-glitch-may-have-caused-uk…>. The omission has since been fixed.

1 2

Free Software Foundation Turns 35
by Lawrence D'Oliveiro 07 Oct '20

07 Oct '20

<https://www.theregister.com/2020/10/06/fsf_35/>: The FSF is keen that all should don their sandals and share in the celebration, perhaps by trying out an approved GNU/Linux distribution, or switching out a proprietary app like Microsoft Office for LibreOffice, or Adobe Photoshop for the GNU Image Manipulation Program. Heck, one could even have a crack at GNU Emacs and celebrate a keyboard shortcut or two.

1 0

Python 3.9 Is Out
by Lawrence D'Oliveiro 07 Oct '20

07 Oct '20

Worth noting from <https://devclass.com/2020/10/06/python-3_9/>: * Merging of dictionaries with “|” and “|=” operators * Generics in type hints * General expressions now allowed in decorators (I didn’t actually realize there were restrictions before) * New PEG parser, with option to revert to old parser for now (not that I expect to notice any difference between the two) * Deprecation of features for Python 2 backward compatibility (to be removed altogether in 3.10)

1 0

Oracle vs Google Goes To The US Supreme Court
by Lawrence D'Oliveiro 07 Oct '20

07 Oct '20

The US Supreme Court is due to hear Google’s appeal tomorrow <https://arstechnica.com/tech-policy/2020/10/google-asks-supreme-court-to-ov…> against the CAFC ruling that APIs are copyrightable and that Google infringed Oracle’s copyright on the Java APIs. A few companies (including GitHub) have filed “amicus curiae” briefs explaining why allowing the verdict against Google to stand will have unfortunate consequences for the entire software industry. The CAFC (Court of Appeals for the Federal Circuit) is a notoriously “intellectual-property-friendly” court, shall we say. They wouldn’t even have got the chance to rule on the original verdict by Judge Alsup, except that the suit initially included a patent claim (that was very quickly thrown out). Definite points to Oracle’s lawyers for doing this: like a chess strategy where you advance a seemingly unimportant pawn in the opening moves that is immediately sacrificed, but the long-term consequences for your opponent’s position only become apparent some time later in the game.

1 0

Developers Are Managing 100× More Code Than They Were 10 Years Ago
by Lawrence D'Oliveiro 05 Oct '20

05 Oct '20

This survey <https://arstechnica.com/gadgets/2020/10/sourcegraph-devs-are-managing-100x-…> reports on the explosion in typical source code bases that seems to have occurred over the past decade. I have a couple of concerns with this: * The obvious quantity-versus-quality issue. How much of this is due to things like node.js pulling in hundreds of dependencies for a comparatively small class library? Clearly, “managing” does not mean “writing” or even “maintaining”. * The use of “technology” as some kind of synonym for “information technology”. You mean it didn’t require “technology” to conduct insurance, retail, food and beverage businesses before? After all, pencil and paper are “technologies”, too. And if you think they are easy things to make, well ... try making them yourself. </rant>

1 0

What Operating Systems Keep Things Running In Space?
by Lawrence D'Oliveiro 05 Oct '20

05 Oct '20

Nice report <https://arstechnica.com/features/2020/10/the-space-operating-systems-bootin…> going into some details on the proprietary VxWorks (popular with NASA) and the open-source RTEMS (originating from the US military, now heavily used by ESA). Also mentions SpaceChain, which was developed in order to implement a BitCoin network in space. This is based on Sylix, which comes from the Chinese military, but is now open-source as well. And there is some use of Linux, but only in situations where hard-realtime constraints can be guaranteed by lower-level custom hardware. Summary: VxWorks and RTEMS are pretty much identical in basic features and maturity/reliability, but RTEMS does have an edge in configurability.

1 0

DigitalOcean’s “Hacktoberfest” Backfires
by Lawrence D'Oliveiro 03 Oct '20

03 Oct '20

Cloud company Digital Ocean has started its seventh annual “Hacktoberfest” <https://www.theregister.com/2020/10/01/digitalocean_hacktoberfest_pull_requ…>, promising free T-shirts to those who submit “quality” pull requests to online open-source repositories. Seems this year, the “quality” proviso is being roundly ignored. Many project maintainers are being deluged with trivial and pointless patches, many of whose submittors readily admit they are only doing it for the T-shirt. Choice quote: Imagine an arsonist declaring, "Only you can prevent forest fires," and you can get a sense of the frustration among open source maintainers. Actually, I’m surprised this hasn’t happened in previous years. But then again, maybe it has: "Hacktoberfest has never generated anything of value for open source ... It’s a marketing stunt which sends a deluge of low-effort contributions to maintainers, leaving them to clean up the spam." There’s also a link to a rather pungently-named Twitter account which is collecting examples of these useless patch submissions.

2 1

Developers Try Again To Upstream Motorola 68000 Series Support In LLVM
by Peter Reutemann 01 Oct '20

01 Oct '20

'Hobbyist developers are trying once again to get a Motorola 68000 back-end merged into the upstream LLVM compiler. Phoronix reports: The Motorola 68000 series processors have been around since the 80's thanks to the likes of the early Apple Macintosh computers. Fast forward to 2020, the Motorola 68000 is still a popular target for vintage computer enthusiasts and hobbyists. Community developers have worked on improving the Linux kernel support for M68k hardware like early Apple Powerbooks as recently as a few years ago and the compiler support is a continued target. GCC 11 due out next year was looking to drop the M68k target over its unmaintained status. Hobbyists though stepped up there so the M68k support will remain in GCC. Now developers are also looking at adding M68k support to the LLVM compiler. This isn't the first time that M68k support for LLVM has been brought up albeit never successfully landed to date. Building off the past failures to get the Motorola 68000 series support upstreamed, developers last week sent out new patches proposing this back-end -- this time they are showing more clarity about the developers involved and being committed to supporting the code, the sustainability of the code, and responding quickly to code review comments. This patch series is the latest attempt at upstreaming Motorola 68000 series support in LLVM. Besides all the back-end specific code there is also some common LLVM code changes that fall under greater scrutiny. ' -- source: https://hardware.slashdot.org/story/20/09/30/225226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Xen Project Officially Ports Its Hypervisor To Raspberry Pi 4
by Peter Reutemann 30 Sep '20

30 Sep '20

'The Xen Project has ported its hypervisor to the 64-bit Raspberry Pi 4. The Register reports: The idea to do an official port bubbled up from the Xen community and then reached the desk of George Dunlap, chairman of the Xen Project's Advisory Board. Dunlap mentioned the idea to an acquaintance who works at the Raspberry Pi Foundation, and was told that around 40 percent of Pis are sold to business users rather than hobbyists. With more than 30 million Arm-based Pis sold as of December 2019, and sales running at a brisk 600,000-plus a month in April 2020, according to Pi guy Eben Upton, Dunlap saw an opportunity to continue Xen's drive towards embedded and industrial applications. Stefano Stabellini, who by day works at FPGA outfit Xilinx, and past Apache Foundation director Roman Shaposhnik took on the task of the port. The pair clocked that the RPi 4's system-on-chip used a regular GIC-400 interrupt controller, which Xen supports out of the box, and thought this was a sign this would, overall, be an easy enough job. That, the duo admitted, was dangerous optimism. Forget the IRQs, there was a whole world of physical and virtual memory addresses to navigate. The pair were "utterly oblivious that we were about to embark on an adventure deep in the belly of the Xen memory allocator and Linux address translation layers," we're told. [The article goes on to explain the hurdles that were ahead of them.] "Once Linux 5.9 is out, we will have Xen working on RPi4 out of the box," the pair said. [...] Stefano Stabellini told The Register that an official Xen-on-RPi port will make a difference in the Internet-of-Things community, because other Arm development boards are more costly than the Pi, and programmers will gravitate towards a cheaper alternative for prototyping. He also outlined scenarios, such as a single edge device running both a real-time operating system alongside another OS, each dedicated to different tasks but inhabiting the same hardware and enjoying the splendid isolation of a virtual machine rather than sharing an OS as containers. George Dunlap also thinks that an official Xen-on-RPi port could also be of use to home lab builders, or perhaps just give developers a more suitable environment for their side projects than a virtual machine or container on their main machines. Stay tuned to Project EVE's Github page for more details about how to build your own Xen-for-RPi. Hacks to get it up and running should also appear on the Xen project blog.' -- source: https://hardware.slashdot.org/story/20/09/29/2025213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Cloudflare's Privacy Crusade Continues With a Challenge To Google Analytics
by Peter Reutemann 30 Sep '20

30 Sep '20

'Fortune: Cloudflare is launching a privacy-friendly rival to Google Analytics. Google Analytics is a free toolkit that's used by website administrators across the globe to help them track the behavior of the people visiting those sites -- how they find them, what they do there, the devices they're using, and so on. However, the service -- the most popular of its kind -- also helps Google track websites' visitors, so it can better profile them for advertising purposes. This privacy-invasive aspect makes many people squeamish. And that's where Cloudflare would now like to step in. Around its birthday every year, the decade-old company -- which went public last year -- announces a move intended to "give back" to the wider Internet community. These moves are often related to privacy. On Tuesday, it unveiled Cloudflare Web Analytics, a free-to-use toolkit that largely replicates what Google Analytics offers -- minus the invasive tracking, and thus the ability to assess the performance of targeted ads carried on websites. Cloudflare Web Analytics is immediately available to the company's paid customers, but any website owner will be able to use it from some point in the coming months. Cloudflare's scale is crucial here [...] because it takes substantial resources to run a free analytics platform, and Cloudflare already has a giant network that can support the load. Cloudflare Web Analytics isn't the company's only big announcement this week. "On Monday, Cloudflare launched a beta testing program for a cloud technology called Durable Objects," the report adds. "You can read the technical explanation here, but in essence this is a tool that allows developers of online services to make those services comply with the increasing number of data-localization and data-protection laws that limit where users' data is supposed to go." "With Durable Objects, Cloudflare says, it is possible to specify where particular data will reside on Cloudflare's network, so -- for example -- a German user's data does not have to leave Germany. Or, with an eye to other current news, a service such as TikTok could ensure that U.S. users' data never leaves the U.S., without having to create a separate version of its service for that country." ' -- source: https://tech.slashdot.org/story/20/09/29/2011226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Removes 17 Android Apps Caught Engaging In WAP Billing Fraud
by Peter Reutemann 30 Sep '20

30 Sep '20

'Google has recently removed 17 Android applications from the official Play Store because they were infected with the Joker (aka Bread) malware. ZDNet reports: "This spyware is designed to steal SMS messages, contact lists, and device information, along with silently signing up the victim for premium wireless application protocol (WAP) services," Zscaler security researcher Viral Gandhi said this week. The 17 malicious apps were uploaded on the Play Store this month and didn't get a chance to gain a following, having been downloaded more than 120,000 times before being detected. Following its internal procedures, Google removed the apps from the Play Store, used the Play Protect service to disable the apps on infected devices, but users still need to manually intervene and remove the apps from their devices. But this recent takedown also marks the third such action from Google's security team against a batch of Joker-infected apps over the past few months. [...] The way these infected apps usually manage to sneak their way past Google's defenses and reach the Play Store is through a technique called "droppers," where the victim's device is infected in a multi-stage process. Malware authors begin by cloning the functionality of a legitimate app and uploading it on the Play Store. This app is fully functional, requests access to dangerous permissions, but also doesn't perform any malicious actions when it's first run. Because the malicious actions are usually delayed by hours or days, Google's security scans don't pick up the malicious code, and Google usually allows the app to be listed on the Play Store. But once on a user's device, the app eventually downloads and "drops" (hence the name droppers, or loaders) other components or apps on the device that contain the Joker malware or other malware strains. ' -- source: https://tech.slashdot.org/story/20/09/28/236245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu - Online upgrade to 20.04.1 now available
by Ian Stewart 29 Sep '20

29 Sep '20

Hi All, I mentioned last night at the WLUG meeting that there had been a delay in releasing the Ubuntu 18.04 to 20.04.1 online upgrade. As of today, the Focal Fossa (20.04.1 LTS) Point-Release Status Tracking webpage<https://discourse.ubuntu.com/t/focal-fossa-20-04-1-lts-point-release-status…> is still showing Status 20.04.1 Released! Upgrades from 18.04 to 20.04.1 still disabled ...but with... Upgrade blockers None Previously two bugs, 1891680<https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1891680> and 1876506<https://bugs.launchpad.net/ubuntu/focal/+source/os-prober/+bug/1876506> had been shown as the "upgrade blockers". These bugs were fixed in the last few weeks. Despite the above message, today on my Ubuntu Mate 18.04 laptop, I ran the GUI application "Software Updater". When it completed it stated: The software on this computer is up to date. However, Ubuntu 20.04.1 LTS is now available (you have 18.04). I clicked on "Upgrade". There were 384 new packages to install and 1547 packages to upgrade requiring about 1.4GB of downloading. On my rather slow 1.4GHz CPU, but with reasonably fast internet and a SSD it took 50 minutes to do the upgrade. cheers, Ian. PS: The upgrade kept my python Version 2 at V2.7.18 and upgraded Python3 to 3.8.2. If I had done a fresh install from DVD/USB of Ubuntu 20.04.1 it would not have installed Python 2.

1 0

Eric S. Raymond: Is Microsoft Switching To a Linux Kernel That Emulates Windows?
by Peter Reutemann 28 Sep '20

28 Sep '20

'Most of Microsoft's money now comes from its cloud service Azure, points out open-source advocate Eric S. Raymond. Now he posits a future where Windows development will "inevitably" become a drag on Microsoft's business: So, you're a Microsoft corporate strategist. What's the profit-maximizing path forward given all these factors? It's this: Microsoft Windows becomes a Proton-like emulation layer over a Linux kernel, with the layer getting thinner over time as more of the support lands in the mainline kernel sources. The economic motive is that Microsoft sheds an ever-larger fraction of its development costs as less and less has to be done in-house. If you think this is fantasy, think again. The best evidence that it's already the plan is that Microsoft has already ported Edge to run under Linux. There is only one way that makes any sense, and that is as a trial run for freeing the rest of the Windows utility suite from depending on any emulation layer. So, the end state this all points at is: New Windows is mostly a Linux kernel, there's an old-Windows emulation over it, but Edge and the rest of the Windows user-land utilities don't use the emulation. The emulation layer is there for games and other legacy third-party software. Economic pressure will be on Microsoft to deprecate the emulation layer... Every increment of Windows/Linux convergence helps with that — reduces administration and the expected volume of support traffic. Eventually, Microsoft announces upcoming end-of-life on the Windows emulation. The OS itself , and its userland tools, has for some time already been Linux underneath a carefully preserved old-Windows UI. Third-party software providers stop shipping Windows binaries in favor of ELF binaries with a pure Linux API... ...and Linux finally wins the desktop wars, not by displacing Windows but by co-opting it. Perhaps this is always how it had to be.' -- source: https://linux.slashdot.org/story/20/09/27/193250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GNU is Not Unix Emacs Developers (Including Richard Stallman) Discuss How to Build a More 'Modern' Emacs
by Peter Reutemann 27 Sep '20

27 Sep '20

'LWN.net re-visits the emacs-devel mailing list, where the Emacs 28 development cycle has revived discussions about how to make the text editor more "modern" and attractive to new users: A default dark theme may not be in the future, leading one to think that there may yet be hope for the world in general. But there does seem to be general agreement that Emacs could benefit from a better, more centralized approach to color themes, rather than having color names hard-coded throughout various Elisp packages. From that, a proper theme engine could be supported, making dark themes and such easily available to those who want them... Another area where Emacs is insufficiently "modern", it seems, has to do with keyboard and mouse bindings. On the keyboard side, users have come to expect certain actions from certain keystrokes; ^X to cut a selection, ^V to paste it, etc. These bindings are easily had by turning on the Cua mode, but new users tend not to know about this mode or how to enable it. Many participants in the discussion said that this mode should be on by default. That, of course, would break the finger memory of large numbers of existing Emacs users, who would be unlikely to appreciate the disruption. Or, as Richard Stallman put it: It is not an option to change these basic key bindings to imitate other, newer editors. It would create a different editor that we Emacs users would never switch to. It is unfortunate that the people who implemented the newer editors chose incompatibility with Emacs.... The situation with mouse behavior is similar; as several participants in the discussion pointed out, users of graphical interfaces have come to expect that a right-button click will produce a menu of available actions. In Emacs, instead, that button marks a region ("selection"), with a second click in the same spot yanking ("cutting") the selected text. Many experienced Emacs users have come to like this behavior, but it is surprising to newcomers. The right mouse button with the control key held down does produce a menu defined by the current major mode, but that is evidently not what is being requested here; that menu, some say, should present global actions rather mode-specific ones. Stallman suggested offering a "reshuffled mode" that would bring the context menu to an unadorned right-button click, and which would add some of the expected basic editing commands there as well. This would be relatively easy to do, he said, since mouse bindings are separate from everything else. Besides, as he noted, the current mouse behavior was derived from "what was the standard in X Windows around 1990"; while one wouldn't want to act in haste, it might just be about time for an update. Other proposed changes involved "discoverability," including the default enabling of various modes, although to incorporate them into GNU Emacs "would often require the author to sign copyrights over to the Free Software Foundation, which is not something all authors are willing to do..."' -- source: https://news.slashdot.org/story/20/09/25/2213230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bored Developer Creates 'DOS Subsystem For Linux'
by Peter Reutemann 27 Sep '20

27 Sep '20

'iTnews: A software engineer in Melbourne is whiling away the city's lockdown by creating a tool that DOS users so far have lacked: an integrated Linux environment similar to what Windows 10 users enjoy... "I first started out just seeing if I could get Linux booting from the DOS command line, and that turned out to be straightforward enough so I thought it'd be fun to see if I could continue executing DOS once Linux was running," Charlie Somerville said. "I'm mostly surprised by how smoothly the whole thing works given how *dodgy* it all is haha," he added. DOS Subsystem for Linux runs a real copy of MS-DOS under the QEMU virtual machine, and starts up from that, Somerville said... "Helpfully Linux seems to leave the first megabyte of memory (where DOS lives) intact during its own boot process, so it's just a matter of jumping back to the right place to continue DOS execution," he added. Somerville had it pointed out to him that this approach of running DOS under vm8086 is actually how early Windows worked. "Kinda cool to rediscover the technique so many years later," Somerville said.' -- source: https://linux.slashdot.org/story/20/09/26/048223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 81 Released, Can Now Be Your Default Browser in iOS
by Peter Reutemann 27 Sep '20

27 Sep '20

'Engadget reports: One big benefit of iOS 14 is that you can set non-Apple-made apps as your default, including for email and web browsing. Hot on the heels of you being able to set Chrome and Gmail as your clients of choice, Firefox is enabling you to make its browser the default on iPhones and iPads. Naturally, you'll need to have both the latest version of the operating system and the apps, and then just make the switch inside settings. Meanwhile, Bleeping Computer profiles some of the new features in this week's release of Firefox 81, including: The ability to control videos via your headset and keyboard even if you're not using Firefox at the time - A new credit card autofill feature for Firefox users in the U.S. and Canada - A new theme called AlpenGlow - Firefox can now be set as the default system PDF viewer' -- source: https://news.slashdot.org/story/20/09/26/0454229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bug Allowed Hijacking Other Firefox Mobile Browsers on the Same Wi-Fi Network
by Peter Reutemann 27 Sep '20

27 Sep '20

'"Mozilla has fixed a bug that can be abused to hijack all the Firefox for Android browsers on the same Wi-Fi network and force users to access malicious sites, such as phishing pages," reports ZDNet: The bug was discovered by Chris Moberly, an Australian security researcher working for GitLab. The actual vulnerability resides in the Firefox SSDP component. SSDP stands for Simple Service Discovery Protocol and is the mechanism through which Firefox finds other devices on the same network in order to share or receive content (i.e., such as sharing video streams with a Roku device). When devices are found, the Firefox SSDP component gets the location of an XML file where that device's configuration is stored. However, Moberly discovered that in older versions of Firefox, you could hide Android "intent" commands in this XML and have the Firefox browser execute the "intent," which could be a regular command like telling Firefox to access a link... The bug was fixed in Firefox 79; however, many users may not be running the latest release. Firefox for desktop versions were not impacted. ' -- source: https://news.slashdot.org/story/20/09/26/0443215 Chers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

killedbygoogle.com
by Lawrence D'Oliveiro 26 Sep '20

26 Sep '20

Came across this <https://killedbygoogle.com/> little hall of -- shame? sadness? quiet desperation? schadenfreude? -- listing projects that Google created and later abandoned, or is in the process of abandoning. Found it in a reader comment to this report <https://www.theregister.com/2020/09/23/google_sunsets_chrome_web_store/> on the death of Chrome Web Store payments. By the way: Neighbourly is dead? I keep seeing mentions of neighbourly.co.nz in the local free papers -- is that different?

3 2

Facebook “Took A Page From Big Tobacco’s Playbook”
by Lawrence D'Oliveiro 26 Sep '20

26 Sep '20

Some former Facebook employees are testifying to the US Congress <https://arstechnica.com/tech-policy/2020/09/former-facebook-manager-we-took…> as part of a hearing into the role social media platforms play in spreading extremist and radical content. Tim Kendall, former director of monetization, says: “We took a page form Big Tobacco’s playbook, working to make our offering addictive at the outset.” After making some more direct comparisons with how tobacco companies made their product more addictive, he talked about “engagement”, which was the measure Facebook tried to maximize above all else: “We initially used engagement as sort of a proxy for user benefit,” Kendall explained. “But we also started to realize that engagement could also mean [users] were sufficiently sucked in that they couldn’t work in their own best long-term interest to get off the platform... We started to see real-life consequences, but they weren’t given much weight. Engagement always won, it always trumped.” If a company becomes large and powerful, and cannot be trusted to exercise that power responsibly, then it must be taken from them.

1 0

Researchers Found the Manual For the World's Oldest Surviving Computer
by Peter Reutemann 24 Sep '20

24 Sep '20

'Researchers will be able to gain a deeper understanding of what's considered the world's oldest surviving (digital) computer after its long-lost user manual was unearthed. Engadget reports: The Z4, which was built in 1945, runs on tape, takes up most of a room and needs several people to operate it. The machine now takes residence at the Deutsches Museum in Munich, but it hasn't been used in quite some time. An archivist at ETH Zurich, Evelyn Boesch, discovered the manual among her father's documents in March, according to retired lecturer Herbert Bruderer. Rene Boesch worked with the Swiss Aeronautical Engineering Association, which was based at the university's Institute for Aircraft Statics and Aircraft Construction. The Z4 was housed there in the early 1950s. Among Boesch's documents were notes on math problems the Z4 solved that were linked to the development of the P-16 jet fighter. "These included calculations on the trajectory of rockets, on aircraft wings, on flutter vibrations [and] on nosedive," Bruderer wrote in a Association of Computing Machinery blog post.' -- source: https://hardware.slashdot.org/story/20/09/23/2058222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Wikipedia is getting a new look for the first time in 10 years. Here’s why.
by Peter Reutemann 24 Sep '20

24 Sep '20

'In order to make the desktop experience more readable and less overwhelming to new users, Wikipedia is being redesigned to move page elements, collapse in the sidebar, and decrease the maximum line width. From Diff, the Wikimedia community blog: Forthcoming changes to the desktop include a reconfigured logo, collapsible sidebar, table of contents, and more! You can see the full list of new features on MediaWiki. These changes will happen incrementally over a long period of time, to allow for ample user testing and feedback. If all goes to plan, these improvements will be the default on all wikis by the end of 2021, timed with Wikipedia's 20th birthday celebrations.' -- source: https://news.slashdot.org/story/20/09/23/1822218 Link to gallery of images that show the differences/new features: https://www.mediawiki.org/wiki/Reading/Web/Desktop_Improvements#What_featur… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday
by Peter Reutemann 24 Sep '20

24 Sep '20

Hi everyone We have a meeting next Monday, but no topic/speaker yet. Any ideas? Maybe some bash scripting or some useful command-line utilities? I came across "pigz" (https://linux.die.net/man/1/pigz) today by accident... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

“LokiBot,” the malware that steals your most sensitive data, is on the rise
by Peter Reutemann 24 Sep '20

24 Sep '20

'Federal and state officials are seeing a big uptick in infections coming from LokiBot, an open source DIY malware package for Windows that’s openly sold or traded for free in underground forums. It steals passwords and cryptocurrency wallets, and it can also download and install new malware. In an alert published on Tuesday, the Department of Homeland Security’s Cybersecurity and Infrastructure Agency and the Multi-State Information Sharing & Analysis Center said LokiBot activity has scaled up dramatically in the past two months. The increase was measured by “EINSTEIN,” an automated intrusion-detection system for collecting, correlating, analyzing, and sharing computer security information across the federal civilian departments and agencies. “CISA has observed a notable increase in the use of LokiBot malware by malicious cyber actors since July 2020,” Tuesday’s alert stated. “Throughout this period, CISA’s EINSTEIN Intrusion Detection System, which protects federal, civilian executive branch networks, has detected persistent malicious LokiBot activity.”' -- source: https://arstechnica.com/information-technology/2020/09/lokibot-the-malware-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Lenovo begins selling OEM Ubuntu PCs to the general public
by Peter Reutemann 24 Sep '20

24 Sep '20

'Beginning today, Lenovo is offering a greatly expanded selection of OEM Linux PCs to the general public. Earlier this year, Lenovo began offering Fedora Linux pre-installed on laptop systems including Thinkpad P1 Gen 2, Thinkpad P53, and Thinkpad X1 Gen 8. Today's announcement makes Ubuntu Linux available on a considerably broader swath of both desktop and laptop PCs.' -- source: https://arstechnica.com/gadgets/2020/09/lenovo-launches-new-oem-linux-think… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox usage is down 85% despite Mozilla's top exec pay going up 400%
by Peter Reutemann 24 Sep '20

24 Sep '20

'Mozilla recently announced that they would be dismissing 250 people. That's a quarter of their workforce so there are some deep cuts to their work too. The victims include: the MDN docs (those are the web standards docs everyone likes better than w3schools), the Rust compiler and even some cuts to Firefox development. Like most people I want to see Mozilla do well but those three projects comprise pretty much what I think of as the whole point of Mozilla, so this news is a a big let down. The stated reason for the cuts is falling income. Mozilla largely relies on "royalties" for funding. In return for payment, Mozilla allows big technology companies to choose the default search engine in Firefox - the technology companies are ultimately paying to increase the number of searches Firefox users make with them. Mozilla haven't been particularly transparent about why these royalties are being reduced, except to blame the coronavirus. I'm sure the coronavirus is not a great help but I suspect the bigger problem is that Firefox's market share is now a tiny fraction of its previous size and so the royalties will be smaller too - fewer users, so fewer searches and therefore less money for Mozilla. The real problem is not the royalty cuts, though. Mozilla has already received more than enough money to set themselves up for financial independence. Mozilla received up to half a billion dollars a year (each year!) for many years. The real problem is that Mozilla didn't use that money to achieve financial independence and instead just spent it each year, doing the organisational equivalent of living hand-to-mouth. Despite their slightly contrived legal structure as a non-profit that owns a for-profit, Mozilla are an NGO just like any other. In this article I want to apply the traditional measures that are applied to other NGOs to Mozilla in order to show what's wrong.' -- source: http://calpaterson.com/mozilla.html Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Buy Them Up, Shut Them Down
by Lawrence D'Oliveiro 23 Sep '20

23 Sep '20

The latest in a long line of IoT devices being bricked or crippled because their essential servers are being shut down is the Libra “smart” weighing scale from Adidas <https://www.theregister.com/2020/09/22/adidas_libra_scale/>. This product was originally created by a small startup, which was later acquired by the big company ... with the usual all-too-frequent consequences. The article includes a catalogue of similar examples, including a “lifetime subscription” that turned out to be anything but, and an attempt to impose subscription fees on users who thought they were getting a fixed-price product. I wonder how long the customers will continue to get taken in ...

1 0

Russia Wants To Ban the Use of Secure Protocols Such As TLS 1.3, DoH, DoT, ESNI
by Peter Reutemann 23 Sep '20

23 Sep '20

'The Russian government is working on updating its technology laws so it can ban the use of modern internet protocols that can hinder its surveillance and censorship capabilities. According to a copy of the proposed law amendments and an explanatory note, the ban targets internet protocols and technologies such as TLS 1.3, DoH, DoT, and ESNI. Moscow officials aren't looking to ban HTTPS and encrypted communications as a whole, as these are essential to modern-day financial transactions, communications, military, and critical infrastructure. Instead, the government wants to ban the use of internet protocols that hide "the name (identifier) of a web page" inside HTTPS traffic.' -- source: https://tech.slashdot.org/story/20/09/22/157245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Is Bringing Edge To Linux
by Peter Reutemann 23 Sep '20

23 Sep '20

'Edge is finally coming to Linux. At Ignite 2020 today, Microsoft announced that Edge for Linux will be available in the Dev preview channel starting in October. Linux users will be able to download the preview from the Microsoft Edge Insider website or from their native Linux package manager. Microsoft will start with the Ubuntu and Debian distributions, with support for Fedora and openSUSE coming afterwards. "Linux stands out in that, while it has a relatively small desktop population in terms of what you might call typical consumer or end user, developers are often overrepresented in that population, and especially in areas like test automation, or CI/CD workloads for their web apps," Edge program manager Kyle Pflug told VentureBeat. "Edge on Linux is a natural part of our strategy to reduce fragmentation and test overhead for web developers. By providing the same rendering behavior and tools across platforms, developers can build and test sites and web apps in their preferred environment and be confident in the experience their customers will have."' -- source: https://linux.slashdot.org/story/20/09/22/1924237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Journal Is Back
by Peter Reutemann 23 Sep '20

23 Sep '20

'On August 7, 2019, Linux Journal laid off all staff members and was left with no operating funds to continue in any capacity. Today, the technology magazine announced that they've secured a deal to keep the site alive indefinitely under the ownership of Slashdot Media. Linux Journal writes: We will begin publishing digital content again as soon as we can. If you're a former Linux Journal contributor or a Linux enthusiast that would like to get involved, please contact us and let us know the capacity in which you'd like to contribute. We're looking for people to cover Linux news, create Linux guides, and moderate the community and comments. We'd also appreciate any other ideas or feedback you might have. Right now, we don't have any immediate plans to resurrect the subscription/issue model, and will be publishing exclusively on LinuxJournal.com free of charge. Our immediate goal is to familiarize ourself with the Linux Journal website and ensure it doesn't ever get shut down again. We're ecstatic to be able to take the helm at Linux Journal, and ensure that this legendary Linux resource and community not only stays alive forever, but continues to grow and improve. Reach out if you'd like to get involved!' -- source: https://linux.slashdot.org/story/20/09/22/2243209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

NZ Govt Unveils “Algorithm Charter”
by Lawrence D'Oliveiro 22 Sep '20

22 Sep '20

The Charter <https://www.theregister.com/2020/07/28/new_zealand_algorithm_charter/> requires Government departments who sign on to it to “maintain transparency” about the algorithms they use, but does not make them reveal the actual details of these algorithms. Nor does it explain what it means by an “algorithm”.

2 3

Automated Unit Testing: Quis Custodiet Ipsos Custodes?
by Lawrence D'Oliveiro 22 Sep '20

22 Sep '20

A company called Diffblue has a product that uses AI techniques to automatically generate unit tests for your code <https://www.theregister.com/2020/09/21/diffblue_let_ai_code_unit_tests/>. Only problem is, it doesn’t actually know what the intent of your code is, so it assumes it is correct to begin with, and generates tests on that basis. So who tests the test code? It falls back to a human to ensure the tests make sense. But doesn’t that defeat the point of having them done automatically? Unless you only use the system to catch regressions--things that were previously working, but get broken by newer changes to the code. Even then, it seems to me there is a likelihood of false positives, caused by refactoring of functionality between different modules; too many of these, and the humans are going to start ignoring the test results.

1 0

GNOME Gets New Versioning Scheme
by Peter Reutemann 22 Sep '20

22 Sep '20

'The GNOME 3 desktop environment was officially released in 2011, and in 2020 we are still on version 3.x. Yeah, despite many massive changes over the last (almost) decade, we have been stuck with point releases for GNOME 3. For instance, just last week, GNOME 3.38 was released. Historically, the stable releases all ended in even numbers, with pre-release versions ending in odd. For fans of the DE, such as yours truly, we have simply learned to live with this odd versioning scheme. Well, folks, with the next version of GNOME, the developers have finally decided to move on from version 3.x. You are probably thinking the new version will be 4.0, but you'd be very wrong. Actually, following GNOME3.38 will be GNOME 40. "After nearly 10 years of 3.x releases, the minor version number is getting unwieldy. It is also exceedingly clear that we're not going to bump the major version because of technological changes in the core platform, like we did for GNOME 2 and 3, and then piling on a major UX change on top of that. Radical technological and design changes are too disruptive for maintainers, users, and developers; we have become pretty good at iterating design and technologies, to the point that the current GNOME platform, UI, and UX are fairly different from what was released with GNOME 3.0, while still following the same design tenets," says Emmanuele Bassi, The GNOME Foundation.' -- source: https://linux.slashdot.org/story/20/09/21/1652221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Mozilla WebThings IoT Platform Spun Out As an Independent Open Source Project
by Peter Reutemann 22 Sep '20

22 Sep '20

'Following a round of layoffs at Mozilla, their WebThings IoT platform is being spun out as an independent open source project by former employees, with a new commercial sponsor. WebThings is an open platform for monitoring and controlling devices over the web, built on W3C Web of Things standards. It includes WebThings Gateway which is a software distribution for smart home gateways focused on privacy, security and interoperability and the WebThings Framework which is a collection of re-usable software components to help developers build their own web things. The project will be renamed from "Mozilla WebThings" to "WebThings" and will move to a new home at https://webthings.io/ Users will be able to opt-in to receive software updates from the new community run update servers and be offered the opportunity to transition to a replacement remote tunnelling service before Mozilla servers are shut down at the end of the year.' -- source: https://tech.slashdot.org/story/20/09/21/185236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Could Open Source Licensing Stop Big Pharma Profiteering On Taxpayer-Funded Covid-19 Vaccines?
by Peter Reutemann 21 Sep '20

21 Sep '20

'Two professors at the University of Massachusetts have co-authored a new essay explaining how open source licensing "could keep Big Pharma from making huge profits off taxpayer-funded research" in the international, multi-billion-dollar race for a Covid-19 vaccine: The invention of the "General Public License," sometimes referred to as a viral or reciprocal license, meant that should an improvement be made, the new software version automatically inherits the same license as its parent. We believe that in a time of a global pandemic, a safe and effective COVID-19 vaccine should be licensed with General Public License-like properties... Fortunately, some pharmaceutical companies, national governments, nonprofits like the Bill & Melinda Gates Foundation and international organizations like the Coalition for Epidemic Preparedness Initiatives — which supports vaccine development — are putting policies in place that embrace openness and sharing rather than intellectual property protection. Coalition for Epidemic Preparedness Initiatives officials have stated that all of their funding agreements require that "appropriate vaccines are first available to populations when and where they are needed to end an outbreak or curtail an epidemic, regardless of ability to pay." That's an important start. However, when there is a safe, effective COVID-19 vaccine, the U.S. and other national governments need to create contractual agreements with firms that provide fair and reasonable funding to cover their costs or even some reasonable profit margin while still mandating the open sharing of the processes for vaccine production, quality assurance and rapid global distribution.' -- source: https://science.slashdot.org/story/20/09/20/2359229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Browser Extension uMatrix Ends Active Development
by Peter Reutemann 21 Sep '20

21 Sep '20

'Raymond Hill, known online as gorhill, has set the status of the uMatrix GitHub repository to archived; this means that it is read-only at the time and that no updates will become available. The uMatrix extension is available for several browsers including Firefox, Google Chrome, and most Firefox and Chromium-based browsers. It is a privacy and security extensions for advanced users that provides firewall-like capabilities when it is installed... Hill suggests that developers could fork the extension to continue development under a new name. There is also the chance that Hill might resume development in the future but there is no guarantee that this is going to happen. For now, uMatrix is no longer in active development. ' -- source: https://yro.slashdot.org/story/20/09/20/2124248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DuckDuckGo Is Growing Fast
by Peter Reutemann 18 Sep '20

18 Sep '20

'DuckDuckGo, the privacy-focused search engine, announced that August 2020 ended in over 2 billion total searches via its search platform. While Google remains the most popular search engine, DuckDuckGo has gained a great deal of traction in recent months as more and more users have begun to value their privacy on the internet. DuckDuckGo saw over 2 billion searches and 4 million app/extension installations, and the company also said that they have over 65 million active users. DuckDuckGo could shatter its old traffic record if the same growth trend continues. Even though DuckDuckGo is growing rapidly, it still controls less than 2 percent of all search volume in the United States. However, DuckDuckGo's growth trend has continued throughout the year, mainly due to Google and other companies' privacy scandal.' -- source: https://yro.slashdot.org/story/20/09/17/2036241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Patient Dies After Hospital Hit By Ransomware Attack
by Peter Reutemann 18 Sep '20

18 Sep '20

'A patient died after a German hospital was hit by ransomware attack, when hackers thought they were targeting a university. German authorities said that what appears to have been a misdirected hacker attack impacted systems at a major hospital in Duesseldorf, and a woman who needed urgent admission died after she had to be taken to another city for treatment. Duesseldorf police established contact and told the attacker that the hospital, and not the university, had been affected, endangering patients. The attacker then withdrew the extortion attempt and provided a digital key to decrypt the data.' -- source: https://tech.slashdot.org/story/20/09/17/144257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

YouTube's Recommendation System is Criticized as Harmful. Mozilla Wants To Research It
by Peter Reutemann 18 Sep '20

18 Sep '20

'YouTube's video recommendation system has been repeatedly accused by critics of sending people down rabbit holes of disinformation and extremism. Now Mozilla, the nonprofit that makes the Firefox browser, wants YouTube's users to help it research how the controversial algorithms work. From a report: Mozilla on Thursday announced a project that asks people to download a software tool that gives Mozilla's researchers information on what video recommendations people are receiving on the Google-owned platform. YouTube's algorithms recommend videos in the "What's next" column along the right side of the screen, inside the video player after the content has ended, or on the site's homepage. Each recommendation is tailored to the person watching, taking into account things like their watch history, list of channel subscriptions or location. The recommendations can be benign, like another live performance from the band you're watching. But critics say YouTube's recommendations can also lead viewers to fringe content, like medical misinformation or conspiracy theories. ' -- source: https://tech.slashdot.org/story/20/09/17/150228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Cloudflare and the Wayback Machine, Joining Forces For a More Reliable Web
by Peter Reutemann 18 Sep '20

18 Sep '20

'Cloudflare and the Internet Archive are now working together to help make the web more reliable. Websites that enable Cloudflare's Always Online service will now have their content automatically archived, and if by chance the original host is not available to Cloudflare, then the Internet Archive will step in to make sure the pages get through to users. From a report: Cloudflare has become core infrastructure for the Web, and we are glad we can be helpful in making a more reliable web for everyone."The Internet Archive's Wayback Machine has an impressive infrastructure that can archive the web at scale," said Matthew Prince, co-founder and CEO of Cloudflare. "By working together, we can take another step toward making the Internet more resilient by stopping server issues for our customers and in turn from interrupting businesses and users online." For more than 20 years the Internet Archive's Wayback Machine has been archiving much of the public Web, and making those archives available to journalists, researchers, activists, academics and the general public, in total to hundreds of thousands of people a day. To date more than 468 billion Web pages are available via the Wayback Machine and we are adding more than 1 billion new archived URLs/day. We archive URLs that are identified via a variety of different methods, such as "crawling" from lists of millions of sites, as submitted by users via the Wayback Machine's "Save Page Now" feature, added to Wikipedia articles, referenced in Tweets, and based on a number of other "signals" and sources, such multiple feeds of "news" stories. An additional source of URLs we will preserve now originates from customers of Cloudflare's Always Online service. As new URLs are added to sites that use that service they are submitted for archiving to the Wayback Machine. In some cases this will be the first time a URL will be seen by our system and result in a "First Archive" event.' -- source: https://tech.slashdot.org/story/20/09/17/1544222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Shuts Down Firefox Send and Firefox Notes Services
by Peter Reutemann 18 Sep '20

18 Sep '20

'Mozilla is shutting down two of its legacy products, Firefox Send and Firefox Notes, the company announced today. From a report: "Both services are being decommissioned and will no longer be a part of our product family," a Mozilla spokesperson told ZDNet this week. Of the two, the most beloved was Firefox Send, a free file-sharing service, and one of the few that supported sharing files in encrypted formats. Launched in March 2019, the service gained a dedicated fanbase but Send was taken offline earlier this summer after ZDNet reported on its constant abuse by malware groups. At the time, Mozilla said that Send's shutdown was temporary and promised to find a way to curb the service's abuse in malware operations. But weeks later, things changed after Mozilla leadership laid off more than 250 employees as part of an effort to re-focus its business on commercial products.' -- source: https://tech.slashdot.org/story/20/09/17/1923240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Billions of Devices Vulnerable To New 'BLESA' Bluetooth Spoofing Attack
by Peter Reutemann 17 Sep '20

17 Sep '20

'"Billions of smartphones, tablets, laptops, and IoT devices are using Bluetooth software stacks that are vulnerable to a new security flaw disclosed over the summer," reports ZDNet. Named BLESA (Bluetooth Low Energy Spoofing Attack), the vulnerability impacts devices running the Bluetooth Low Energy (BLE) protocol, and affects the reconnection process that occurs when a device moves back into range after losing or dropping its pairing. A successful BLESA attack allows bad actors to connect with a device (by getting around reconnection authentication requirements) and send spoofed data to it. In the case of IoT devices, those malicious packets can convince machines to carry out different or new behavior. For humans, attackers could feed a device deceptive information. BLESA impacts billions of devices that run vulnerable BLE software stacks. Vulnerable are BLE software libraries like BlueZ (Linux-based IoT devices), Fluoride (Android), and the iOS BLE stack. Windows' BLE stack is not impacted.' -- source: https://it.slashdot.org/story/20/09/16/220211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft To Open-Source Windows Security-Testing Tool
by Lawrence D'Oliveiro 16 Sep '20

16 Sep '20

Ever wondered how Microsoft manages to keep Windows so secure? You won’t have to wonder for much longer, as it is planning to open-source OneFuzz <https://www.theregister.com/2020/09/16/microsoft_open_sources_fuzzing_tool/>, a key tool it uses to probe its OS for vulnerabilities. Yes, third-party developers! Soon you, too, will be able to achieve truly Microsoftian levels of code quality!

1 0

Microsoft To Build Data Centre In Auckland
by Lawrence D'Oliveiro 16 Sep '20

16 Sep '20

The Overseas Investment Office has approved <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=123654…> Microsoft’s proposal to build a cloud data centre in Auckland: The applicant was Microsoft NZ - 100 per cent owned by a Bermuda entity but ultimately controlled by Microsoft Corporation in the US. Wonder why Bermuda is involved ...

2 1

Microsoft Submits Linux Kernel Patches For a 'Complete Virtualization Stack' With Linux and Hyper-V
by Peter Reutemann 16 Sep '20

16 Sep '20

'Microsoft has submitted a series of patches to the Linux kernel with its aim being "to create a complete virtualization stack with Linux and Microsoft Hypervisor." The Register reports: The patches are designated "RFC" (Request for comments) and are a minimal implementation presented for discussion. The key change is that with the patched kernel, Linux will run as the Hyper-V root partition. In the Hyper-V architecture, the root partition has direct access to hardware and creates child partitions for the VMs it hosts. "Just think of it like Xen's Dom0," said Microsoft principal software engineer Wei Liu. Hyper-V's architecture is more similar to Xen than it is to KVM or to VMware's ESXi, and Liu acknowledged that "we drew inspiration from the Xen code in Linux," specifically for code handing interrupts. Until now, the Hyper-V root partition had to run Windows. Microsoft has also ported Intel's open-source Cloud Hypervisor, a Virtual Machine Monitor (VMM) written in Rust that normally runs on KVM, the hypervisor that is built into the Linux kernel. Cloud Hypervisor itself is currently in "very early pre-alpha stage." Even when Linux is the root partition, it will still run on top of Microsoft's hypervisor, a thin layer running with ring -1 privileges. It will no longer be necessary to run Windows on that hypervisor, though, enabling Microsoft to call the new arrangement "a complete virtualization stack with Linux."' -- source: https://linux.slashdot.org/story/20/09/15/207219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

New Windows exploit lets you instantly become admin. Have you patched?
by Peter Reutemann 16 Sep '20

16 Sep '20

'Researchers have developed and published a proof-of-concept exploit for a recently patched Windows vulnerability that can allow access to an organization’s crown jewels—the Active Directory domain controllers that act as an all-powerful gatekeeper for all machines connected to a network. CVE-2020-1472, as the vulnerability is tracked, carries a critical severity rating from Microsoft as well as a maximum of 10 under the Common Vulnerability Scoring System. Exploits require that an attacker already have a foothold inside a targeted network, either as an unprivileged insider or through the compromise of a connected device.' -- source: https://arstechnica.com/information-technology/2020/09/new-windows-exploit-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

European Police Malware Could Harvest GPS, Messages, Passwords, More
by Peter Reutemann 16 Sep '20

16 Sep '20

'The malware that French law enforcement deployed en masse onto Encrochat devices, a large encrypted phone network using Android phones, had the capability to harvest "all data stored within the device," and was expected to include chat messages, geolocation data, usernames, passwords, and more, according to a document obtained by Motherboard. From the report: The document adds more specifics around the law enforcement hack and subsequent takedown of Encrochat earlier this year. Organized crime groups across Europe and the rest of the world heavily used the network before its seizure, in many cases to facilitate large scale drug trafficking. The operation is one of, if not the, largest law enforcement mass hacking operation to date, with investigators obtaining more than a hundred million encrypted messages. "The NCA has been collaborating with the Gendarmerie on Encrochat for over 18 months, as the servers are hosted in France. The ultimate objective of this collaboration has been to identify and exploit any vulnerability in the service to obtain content," the document reads, referring to both the UK's National Crime Agency and one of the national police forces of France. As well as the geolocation, chat messages, and passwords, the law enforcement malware also told infected Encrochat devices to provide a list of WiFi access points near the device, the document reads.' -- source: https://yro.slashdot.org/story/20/09/15/1517203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Nvidia To Buy ARM
by Lawrence D'Oliveiro 15 Sep '20

15 Sep '20

So, SoftBank has found a buyer for ARM, and it’s graphics-card maker Nvidia <https://www.theregister.com/2020/09/14/nvida_arm_acquisition/>. The price is US$40 billion, including US$12 billion in cash. NVidia promises to maintain the open licensing model, and promises to “turbocharge” it with its own R&D resources. SoftBank makes a modest profit on the deal.

2 3

Australian Cyber Security Centre Recommends Not Paying Ransomware
by Lawrence D'Oliveiro 13 Sep '20

13 Sep '20

From <https://www.theregister.com/2020/09/12/follow_security_basics_and_you/>: Paying a ransom does not guarantee decryption of data. Open source reporting indicates several instances where an entity paid the ransom but the keys to decrypt the data were not provided. The ACSC has also seen cases where the ransom was paid, the decryption keys were provided, but the adversary came back a few months later and deployed ransomware again. The likelihood that an Australian [organisation] will be retargeted increases with every successful ransom payment. ...

1 0

DPL: Debian Project Has Plenty Of Money But Not Enough Developers
by Lawrence D'Oliveiro 11 Sep '20

11 Sep '20

A report <https://www.theregister.com/2020/09/10/debian_project_address/> by the current Debian Project Leader, Jonathan Carter, on the current state of the Mother Of All Linux Distros. They are not short of funds, but they have too few project contributors trying to do too much: The culture of the community is not to spend money unnecessarily. “Debianites don’t like spending money,” he said. “They feel guilty.” It’s probably also the largest Linux distro: In 2009, there were 22,000 binary packages for the i386 architecture in Lenny, the current release at the time. Today there are over 61,000 amd64 binary packages in Bullseye, the forthcoming release. After Bullseye, “100,000 packages is a serious reality on the horizon,” he said. I like this quote: “Debian is a bottomless pit of problems. It’s inherent in the work we do. We’re affected by nearly every problem that exists in the realm of computer science.” How about that for the ultimate geek brag? 🐧

1 0

Some Of Our Open-Access Journals Are Missing
by Lawrence D'Oliveiro 11 Sep '20

11 Sep '20

“Open-Access” scientific journals make research papers available online for free. They have become popular as awareness has spread of the practices of traditional publishers like Elsevier, which charge research groups to publish their papers in journals, and then charge hefty subscription fees to those same groups, and all the rest of their customers, for copies of those journals. And then claiming copyright on those papers, on top of it. (And what about the parties the providing the most expensive part of the publication service, namely the fellow researchers doing the peer review? Nope, they don’t get any payment for this at all.) However, this does make the financial model of these Open-Access journals a bit precarious. And perhaps it’s not too surprising that several of them have disappeared since their founding. Operations like the Internet Archive do have the resources to grab copies of their content before they do, but it helps to be aware that these sorts of sites are particularly vulnerable to vanishing. <https://www.theregister.com/2020/09/10/open_access_journal/>

1 0

System76’s Lemur Pro: A powerful, ultralight OEM Linux laptop
by Peter Reutemann 11 Sep '20

11 Sep '20

'System76's Lemur Pro is a 14.1-inch, lightweight powerhouse of an OEM Linux laptop, with an attractive black-finished magnesium-aluminum alloy chassis. If you're looking for a laptop that gets the occasional jealous look at coffee shops (or technical conferences), the Lemur Pro will not disappoint. As configured at $1,563, the Lemur Pro is not a cheap laptop—but it doesn't look, feel, or perform like one, either. The Intel Comet Lake CPU wouldn't be our first choice if we designed a laptop from scratch, but as an entire system, it's hard to find much fault with the Lemur Pro—particularly when limiting the field to OEM Linux laptops alone.' -- source: https://arstechnica.com/gadgets/2020/09/system76s-lemur-pro-a-powerful-ultr… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android 11 Go Could Make Cheap Phones Up To 20% Faster
by Peter Reutemann 11 Sep '20

11 Sep '20

'Following the official release of Android 11 earlier this week, Google also has some updates in store for the stripped-down version of Android designed for phones with lower specs. From a report: For Android 11 (Go Edition), the most important upgrade is just generally speedier performance, with Google claiming that apps will launch 20% faster in Android 11 Go compared to Android 10 Go. Meanwhile, when it comes to messaging, Android 11 Go is also getting a dedicated section for conversations in the notification tray, so you can see all your ongoing texts in one place, regardless of the specific app. On top of that, Android 11 Go is also getting Google's gesture-based navigation just like vanilla Android 11. Instead of a row of buttons along the bottom of the screen, you can swipe up to go home, swipe in from either side to go back, or swipe up and hold to see your recently used apps. Also, with digital privacy becoming increasingly important, Google is giving Android 11 Go more granular security settings including the ability to grant apps access to hardware like cameras, microphones, or GPS on a one-time basis. And when it comes to apps you haven't used in a long time, Android 11 Go will automatically reset app permissions to prevent old settings that you've probably forgotten about from comprising your security. But perhaps the biggest change for Android 11 Go is that previously, Go Editions of Android were limited to phones with 1GB of RAM. However, with smartphone memory becoming cheaper and more accessible, Android 11 Go has been updated to support phones with up to 2GB of RAM. ' -- source: https://tech.slashdot.org/story/20/09/10/1650235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ransomware Accounted For 41% of All Cyber Insurance Claims in H1 2020
by Peter Reutemann 11 Sep '20

11 Sep '20

'Ransomware incidents accounted for 41% of cyber insurance claims filed in the first half of 2020, according to a report published today by Coalition, one of the largest providers of cyber insurance services in North America. From a report: The high number of claims comes to confirm previous reports from multiple cyber-security firms that ransomware is one of today's most prevalent and destructive threats. "Ransomware doesn't discriminate by industry. We've seen an increase in ransom attacks across almost every industry we serve," Coalition added. "In the first half of 2020 alone, we observed a 260% increase in the frequency of ransomware attacks amongst our policyholders, with the average ransom demand increasing 47%," the company added. Among the most aggressive gangs, the cyber insurer listed Maze and DoppelPaymer, which have recently begun exfiltrating data from hacked networks, and threatening to release data on specialized leak sites, as part of double extortion schemes. Based on cyber insurance claims filed by customers who faced a ransomware attack in the first half of 2020, Coalition said the Maze ransomware gang was the most greedy, with the group requesting ransom demands six times larger than the overall average.' -- source: https://it.slashdot.org/story/20/09/10/1829253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Vivaldi Browser Adds a Pause Button For the Internet
by Peter Reutemann 10 Sep '20

10 Sep '20

'It can be hard to tear yourself away from the never-ending stream of content provided by the internet, so Vivaldi decided to make taking a break easier by introducing a pause button. PCMag reports: Version 3.3 of the Vivaldi browser introduces a new feature called "Break Mode." Rather than having to close your browser, Break Mode allows you to effectively pause your access to the internet with a button press. Once installed, Vivaldi 3.3 displays a pause button on the status bar. When pressed, Break Mode is engaged, which "mutes and stops HTML5 audio and videos, hides all tabs, panels, and other content leaving the screen clean." It's also possible to trigger Break Mode with the keyboard shortcut Ctrl + "." and to activate it via the browser's Quick Commands. The Vivaldi team sees it as a way of allowing you to "interact with the physical world" while at the same time not having to remember which tabs you had open or what you were viewing when you're ready to return. Pressing the pause button again resumes access just as you left it. Break Mode also acts as a very simple and quick way to hide what you were doing on the internet, which could come in very handy seeing as we're spending so much more time at home together. Other new features include more options for customizing themes as well as adding a new "Private" theme, highlighting base domains to help identify malicious web pages, easier cropping of URLs in the address bar making it easier to visit different parts of a website, and enhancements to the built-in tracker and ad blocker allowing whole pages to be easily blocked.' -- source: https://tech.slashdot.org/story/20/09/09/1933207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Windows 10 Themes Can Be Abused To Steal Windows Passwords
by Peter Reutemann 09 Sep '20

09 Sep '20

'Specially crafted Windows 10 themes and theme packs can be used in 'Pass-the-Hash' attacks to steal Windows account credentials from unsuspecting users. Windows allows users to create custom themes that contain customized colors, sounds, mouse cursors, and the wallpaper that the operating system will use. Windows users can then switch between different themes as desired to change the appearance of the operating system. A theme's settings are saved under the %AppData%\Microsoft\Windows\Themes folder as a file with a .theme extension, such as 'Custom Dark.theme.' Windows themes can then be shared with other users by right-clicking on an active theme and selecting 'Save theme for sharing,' which will package the theme into a '.deskthemepack' file. These desktop theme packs can then be shared via email or as downloads on websites, and installed by double-clicking them. This weekend security researcher Jimmy Bayne (@bohops) revealed that specially crafted Windows themes could be used to perform Pass-the-Hash attacks. Pass-the-Hash attacks are used to steal Windows login names and password hashes by tricking a user into accessing a remote SMB share that requires authentication. When trying to access the remote resource, Windows will automatically try to login to the remote system by sending the Windows user's login name and an NTLM hash of their password. In a Pass-the-Hash attack, the sent credentials are harvested by the attackers, who then attempt to dehash the password to access the visitors' login name and password.' -- source: https://tech.slashdot.org/story/20/09/08/2017228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Amiga Fast File System Makes Minor Comeback In New Linux Kernel
by Peter Reutemann 09 Sep '20

09 Sep '20

'The Amiga Fast File System (AFFS) is making a minor comeback in the new version of the Linux kernel. The Register reports: As noted by chief penguin Linus Torvalds in his weekly state-of-the-kernel report, a change to AFFS popped up among what he described as a collection of "the usual suspects" in new submissions to the kernel over the last week. The Amiga was ahead of its time, but is now largely a curiosity. However Suse developer David Sterba has noticed that "The basic permission bits (protection bits in AmigaOS) have been broken in Linux' AFFS - it would only set bits, but never delete them. Also, contrary to the documentation, the Archived bit was not handled." "Let's fix this for good, and set the bits such that Linux and classic AmigaOS can coexist in the most peaceful manner," he added. Torvalds appears to have agreed inasmuch as Sterba's code has made it into rc4 of version 5.9 of the Linux kernel. Torvalds said that while rc4 is a big release -- he rated it as "larger than usual" -- it's still "well within the normal range, and not something I'll lose any sleep over."' -- source: https://linux.slashdot.org/story/20/09/08/203224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Begins Rolling Out Android 11
by Peter Reutemann 09 Sep '20

09 Sep '20

'Google today launched Android 11, the latest version of its mobile OS, and pushed the source code to the Android Open Source Project (AOSP). From a report: Unlike previous major versions, Android 11 is not only arriving as an over-the-air update to Pixel phones first, but also on OnePlus, Xiaomi, Oppo, and Realme phones "with more partners launching and upgrading devices over the coming months." That's a major departure for Android, updates for which take months to arrive thanks to carriers and device makers dragging their feet. It doesn't help that Android is the dominant mobile operating system available on thousands of different device configurations, powering over 2.5 billion monthly active devices. [...] Android 11 brings a long list of new features. Google originally split them into three themes: People, Controls, and Privacy. But there is also support for 5G, new screen types, and call screening. There's even a frame rate API for helping apps and games adopt variable refresh rates, which will be a big focus over the next few years as phones and TVs adopt the feature from computer monitors. Google also expanded the Neural Networks API for running computationally intensive machine learning operations.' -- source: https://tech.slashdot.org/story/20/09/08/1710224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Western Digital is trying to redefine the word “RPM”
by Peter Reutemann 08 Sep '20

08 Sep '20

'Last week, the fine Redditors of /r/DataHoarder got upset with Western Digital again—this time, for misrepresenting the rotational speed of their WD Red Network Attached Storage hard drives. (Although the linked post brings things to a head, members of the German-language forum hardwareluxx.de began investigating the issue more than year ago.) We found this controversy reminiscent of earlier complaints that Western Digital was not properly disclosing use of Shingled Magnetic Recording technology in their NAS drives. But the new complaint is that Western Digital calls 7200RPM drives "5400 RPM Class"—and the drives' own firmware report 5400 RPM via the SMART interface. Recently, redditor /u/Amaroko set out to prove or disprove earlier netizens' findings. For each of several drive models, Amoroko placed a sample of that drive on an empty cardboard box, with a Blue Yeti mic held directly above it, then powered the drive on. Spectral analysis of the recorded audio using Adobe Audition showed a baseline frequency of 120Hz for two models of WD 8TB "5400 RPM class" drive. 120 cycles/sec multiplied to 60 secs/min comes to 7,200 cycles/min. So in other words, these "5400 RPM class" drives really were spinning at 7,200rpm.' -- source: https://arstechnica.com/gadgets/2020/09/western-digital-is-trying-to-redefi… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Arm's New Linux-Capable Cortex-R82 Processor Will Enable Drives That Both Store and Process Data
by Peter Reutemann 07 Sep '20

07 Sep '20

'"Arm has announced its first 64 bit, Linux-capable Cortex-R processor, designed for computational storage solutions," reports Electronics Weekly. SiliconAngle calls it "a chip designed to enable a new generation of storage devices that will not only hold data but also help process it." Such devices are part of an emerging hardware category known as computational storage. The technology promises to provide a speed boost for latency-sensitive workloads such as machine learning and real-time analytics applications. Normally, the task of storing data and processing it is relegated to separate components inside a system. The disk or flash drive holds onto the information while a separate processor does the processing. Data has to travel from the storage drive to the processor and back every time an operation is carried out, which creates delays that can slow down performance. The emerging computational storage devices Arm targets attempt to do away with these delays to speed up applications. Instead of sending information to a separate chip for processing, the storage drive processes it locally using its built-in controller. A controller is a tiny computing module inside flash and disk drives that normally performs only low-level tasks such as writing and reading data. Arm's new Cortex-R82 is designed to serve as the controller for computational storage devices. It's available as a chip design that hardware makers can license and customize based on their needs. "The extra computing power allows the chip to run a full Linux distribution as well as applications, all directly inside a storage drive."' -- source: https://hardware.slashdot.org/story/20/09/06/0110227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Is There A Google-Free Future For Firefox?
by Peter Reutemann 07 Sep '20

07 Sep '20

'Forbes reports: Firefox is exploring subscriptions and other "value exchange" services to ease its financial dependence on rival Google, according to the browser's lead developer. Firefox maker, Mozilla, is in the uneasy position of being financially dependent on its search deal with Google, which accounts for the majority of the organization's revenue. Although Mozilla only last month renewed the search deal, ensuring Google remains the default search engine for Firefox in the U.S. and other territories, the company is keen to explore other ways of raising revenue, including charging users for services. Mozilla's partnership with Google is an uncomfortable alliance, not only because the companies distribute rival browsers, but because their values are markedly different. While Google generates the vast bulk of its revenue from online advertising, Firefox's developers expend much of their effort creating tools that thwart advertisers, including the automatic blocking of third-party tracking tools and social-media trackers. "At Mozilla, we tend to believe things are at their best when users have this transparent value exchange," said Dave Camp, senior vice president of Firefox at Mozilla. "The advertising model has become a default way to fund things on the internet and to fund products, and we're pretty interested — not just for financial reasons, but actually for health of the internet reasons — to explore how can we do better for users than advertising." Mozilla recently began charging users $4.99 per month for its VPN product and Camp says the company is exploring other subscription products. "We don't have any immediate plans in the Firefox team to do add-on services or anything like that at the moment, but we're going to look at other ways to get some value exchange going on," said Camp.' -- source: https://news.slashdot.org/story/20/09/06/0122206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Do Developers Trust Each Other Too Much?
by Lawrence D'Oliveiro 06 Sep '20

06 Sep '20

From <https://www.theregister.com/2020/09/04/disclosure_developer_targeting/>: ... much of it is down to exploiting the trust developers put into shared code and software stacks. By selecting a developer and studying their projects, an attacker would be able to map out the software stack being used. From there, the attacker would pick out a weak spot in that stack – say, a dependency or GitHub project – and slip poisoned code in. This could be as simple as slipping attack code into StackOverflow. ... "Most developers consider themselves to be moderately intelligent but not stupid," mused Jones. "I have found most developers are highly intelligent, but also highly stupid."

1 0

'Linusgate': Debian Project Leaders Want To Ban Linus Torvalds For His Manners
by Peter Reutemann 06 Sep '20

06 Sep '20

'Artem S. Tashkinov writes: 253 emails have been leaked from private (high-level) mailing lists of Debian, in which its representatives vocally complain about the talk Linus Torvalds gave at the most recent DebConf conference. Some people insist that he should be permanently banned from future conferences because the language he uses is inappropriate and infringes on the project's Code of Conduct. This could set a very bad precedent for the open source community, which has recently seen an influx of various CoC policies applied to a number of high-profile projects mostly after very vocal concerns from the people who barely participate in the open source community. Some observers believe that it's a plot by Microsoft to destroy the open source movement from the inside.' -- source: https://linux.slashdot.org/story/20/09/04/2218239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AWS Introduces a Rust Language-Oriented Linux for Containers
by Peter Reutemann 06 Sep '20

06 Sep '20

'ZDNet reports: An anonymous reader shares this enthusiastic report from ZDNet: Earlier this year, Linus Torvalds approved of adding drivers and other components in Rust to Linux.* Last week, at the virtual Linux Plumbers Conference, developers gave serious thought to using the Rust language for new Linux inline code. ["Nothing firm has been determined yet," reported Phoronix, "but it's a topic that is still being discussed."] And, now Amazon Web Services (AWS) has announced that its just-released Bottlerocket Linux for containers is largely written in Rust. Mozilla may have cut back on Rust's funding, but with Linux embracing Rust, after almost 30-years of nothing but C, Rust's future is assured. Rust was chosen because it lends itself more easily to writing secure software. Samartha Chandrashekar, an AWS Product Manager, said it "helps ensure thread safety and prevent memory-related errors, such as buffer overflows that can lead to security vulnerabilities." Many other developers agree with Chandrashekar. Bottlerocket also improved its security by using Device-mapper's verity target. This is a Linux kernel feature that provides integrity checking to help prevent attackers from overwriting core system software or other rootkit type attacks. It also includes the extended Berkeley Packet Filter (eBPF), In Linux, eBPF is used for safe and efficient kernel function monitoring. * Linus's exact words were "people are actively looking at, especially doing drivers and things that are not very central to the kernel itself, and having interfaces to do those, for example, in Rust. People have been looking at that for years now. I'm convinced it's going to happen one day." The article also reminds readers that AWS's Bottlerocket "is also designed to be quick and easy to maintain... by including the bare essentials needed to run containers..." "Besides its standard open-source elements, such as the Linux kernel and containerd container runtime, Bottlerocket's own code is licensed under your choice of either the Apache 2.0 or the MIT license."' -- source: https://linux.slashdot.org/story/20/09/04/2342226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Spotting Security Vulns By Monitoring The Linux Kernel Mailing List
by Lawrence D'Oliveiro 05 Sep '20

05 Sep '20

This research <https://www.theregister.com/2020/09/04/linux_kernel_flaws/> shows that it is possible to get clues about security vulnerabilities in the Linux kernel simply by looking for patches published with lower than usual discussion about their purpose. In some cases they were able to spot these up to nearly 6 months in advance of their being publicly disclosed. Not all such patches are to address security issues. With itself raises other troubling questions. And of course, mailing lists for other open-source projects can be just as fruitful sources of similar information.

2 1

Is It Plugged In?
by Lawrence D'Oliveiro 05 Sep '20

05 Sep '20

A standard question with phone- or online-based troubleshooting is to ask the user if the misbehaving gear in question is actually plugged in. Sometimes they take the implication less than kindly. But here <https://forums.theregister.com/forum/all/2020/09/04/on_call/#c_4102668> is a wonderfully tactful way to phrase the question: If it was obvious from the phone call that the power wasn't on, she would tell the user that they'd had problems with a batch [of] power cables and ask them to check the serial number on the wall plug. After a minute she usually got a sheepish reply that the problem seemed to have gone away....

1 0

nload - network throughput monitor
by Peter Reutemann 05 Sep '20

05 Sep '20

Hi there When being logged into servers remotely, pulling large docker images can take quite a while. On my desktop, I find the network traffic monitor in my taskbar rather handy to check throughput and whether a large transfer across the network has finished. However, I've always wanted to have an alternative for the console. Well, the other week I came across one that suits me: nload - Real time network traffic monitor for the text console https://github.com/rolandriegel/nload Available from Arch/Debian/Ubuntu repos (package "nload"). Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

Lenovo Releases First Fedora Linux ThinkPad Laptop
by Peter Reutemann 04 Sep '20

04 Sep '20

'Today, Lenovo has released a ThinkPad with Red Hat's community Linux, Fedora. ZDNet reports: First in this new Linux-friendly lineup is the X1 Carbon Gen 8. It will be followed by forthcoming versions of the ThinkPad P1 Gen2 and ThinkPad P53. While ThinkPads are usually meant for business users, Lenovo will be happy to sell the Fedora-powered X1 Carbon to home users as well. The new X1 Carbon runs Fedora Workstation 32. This cutting-edge Linux distribution uses the Linux Kernel 5.6. It includes WireGuard virtual private network (VPN) support and USB4 support. This Fedora version uses the new GNOME 3.36 for its default desktop. The system itself comes standard with a 10th Generation Intel Core 1.6Ghz i5-10210U CPU, with up to 4.20 GHz with Turbo Boost. This processor boasts 4 Cores, 8 Threads, and a 6 MB cache. It also comes with 8MBs of LPDDR3 RAM. Unfortunately, its memory is soldered in. While that reduces the manufacturing costs, Linux users tend to like to optimize their hardware and this restricts their ability to add RAM. You can upgrade it to 16MBs, of course, when you buy it for an additional $149. For storage, the X1 defaults to a 256GB SSD. You can push it up to a 1TB SSD. That upgrade will cost you $536. The X1 Carbon Gen 8 has a 14.0" Full High Definition (FHD) (1920 x 1080) screen. For practical purposes, this is as high-a-resolution as you want on a laptop. I've used laptops with Ultra High Definition (UHD), aka 4K, with 3840x2160 resolution, and I've found the text to be painfully small. This display is powered by an integrated Intel HD Graphics chipset. For networking, the X1 uses an Intel Wi-Fi 6 AX201 802.11AX with vPro (2 x 2) & Bluetooth 5.0 chipset. I've used other laptops with this wireless networking hardware and it tends to work extremely well. The entire default package has a base price of $2,145. For now, it's available for $1,287. If you want to order one, be ready for a wait. You can expect to wait three weeks before Lenovo ships it to you.' -- source: https://linux.slashdot.org/story/20/09/03/206205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ARM Co-Founder Hermann Hauser: 'It's In Nvidia's Interests To Destroy Arm'
by Peter Reutemann 04 Sep '20

04 Sep '20

'SoftBank is in advanced talks with US chip company Nvidia to sell Arm -- with a price in the region of 32 billion euros reportedly being thrown around. But Nvidia's purchase of the Cambridge-based chip designer would not only strike a blow to the UK's technological sovereignty, but would result in the destruction of Arm itself, Arm co-founder Hermann Hauser has claimed. Nvidia recently overtook Intel as the most valuable microprocessor company in the world, and its great wealth right now provides it a unique opportunity, says Hauser. "They are the semiconductor company that can buy Arm to destroy it -- and it is very much in its interest to destroy Arm because they [would] gain a lot more than the 40 billion that they pay for it," he claims. Hauser says the acquisition would allow Nvidia to swipe "the microprocessor crown from Intel", and become the chip supplier for 95 per cent of mobile phones, 90 per cent of embedded controllers for the internet of things, as well as taking the PC and data centre markets. Hauser says that an Arm acquisition is a means for Nvidia to become the dominant microprocessor company in the world, "at the same time as they can prevent their main competitors" from making use of further Arm developments. Instead, competitors would need to "scramble" to create their own architecture, handing Nvidia the edge. Up until now, Arm's business model is acting as the "Switzerland of the semiconductor industry" -- maintaining relations with many customers around the world. "Most of them of course, are competitors of Nvidia," says Hauser. Japanese technology investment firm SoftBank acquired Arm in 2016, but ensured the company's continued neutrality. ' -- source: https://slashdot.org/story/20/09/03/2019200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Kiwis Get Poorer Netflix
by Lawrence D'Oliveiro 03 Sep '20

03 Sep '20

A comparison of Netflix services available in various regions <https://www.nzherald.co.nz/entertainment/news/article.cfm?c_id=1501119&obje…> shows NZ near the bottom in terms of quality and choice. The study concludes that Canada and the UK get the best service overall, though South Korea gets the best content-quality rating. Presumably this doesn’t apply to those using VPNs ...

1 0

Hackers are exploiting a critical flaw affecting >350,000 WordPress sites
by Peter Reutemann 03 Sep '20

03 Sep '20

'Hackers are actively exploiting a vulnerability that allows them to execute commands and malicious scripts on Websites running File Manager, a WordPress plugin with more than 700,000 active installations, researchers said on Tuesday. Word of the attacks came a few hours after the security flaw was patched. Attackers are using the exploit to upload files that contain webshells that are hidden in an image. From there, they have a convenient interface that allows them to run commands in plugins/wp-file-manager/lib/files/, the directory where the File Manager plugin resides. While that restriction prevents hackers from executing commands on files outside of the directory, hackers may be able to exact more damage by uploading scripts that can carry out actions on other parts of a vulnerable site. NinTechNet, a website security firm in Bangkok, Thailand, was among the first to report the in-the-wild attacks. The post said that a hacker was exploiting the vulnerability to upload a script titled hardfork.php and then using it to inject code into the WordPress scripts /wp-admin/admin-ajax.php and /wp-includes/user.php.' -- source: https://arstechnica.com/information-technology/2020/09/hackers-are-exploiti… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

YouTube More Popular Than TV In NZ
by Lawrence D'Oliveiro 01 Sep '20

01 Sep '20

The only local media company maintaining an “encouraging” market share is TVNZ, according to <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=123611…>. YouTube is the most popular “site, station or channel”, reaching 51% of Kiwis daily. Overall, it seems free-to-air TV has remained stable, while pay TV has fallen, leading to an overall decline in “linear TV”.

1 0

Linux Developers Continue Evaluating The Path To Adding Rust Code To The Kernel
by Peter Reutemann 31 Aug '20

31 Aug '20

'Phoronix reports: As mentioned back in July, upstream Linux developers have been working to figure out a path for adding Rust code to the Linux kernel. That topic is now being further explored at this week's virtual Linux Plumbers Conference... To be clear though, these Rust Linux kernel plans do not involve rewriting large parts of the kernel in Rust (at least for the foreseeable future...), there would be caveats on the extent to which Rust code could be used and what functionality, and the Rust support would be optional when building the Linux kernel. C would remain the dominant language of the kernel and then it's just a matter of what new functionality gets added around Rust if concerned by memory safety, concurrency, and other areas where Rust is popular with developers. Various upstream developers have been interested in Rust for those language benefits around memory safety and security as well as its syntax being close to C. There would be a to-be-determined subset of Rust to be supported by the Linux kernel.... While the Rust code would be optional, the developers do acknowledge there are limitations on where Rust is supported due to the LLVM compiler back-ends. But at least for x86/x86_64, ARM/ARM64, POWER, and other prominent targets there is support along with the likes of RISC-V. Nothing firm has been determined yet but it's a topic that is still being discussed at the virtual LPC this week and surely over the weeks/months ahead on the kernel mailing list. There is Rust-For-Linux on GitHub with a prototype kernel module implementation. There is also the PDF slides from Thursday's talk on the matter. It's not clear to me that this is a done deal. But the article argues that "it's still looking like it will happen, it's just a matter of when the initial infrastructure will be in place and how slowly the rollout will be..."' -- source: https://linux.slashdot.org/story/20/08/29/2250237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

HBO Max Cranks Up the Widevine DRM, Leaves Linux Users in the Cold
by Peter Reutemann 27 Aug '20

27 Aug '20

'Jim Salter, reporting for ArsTechnica: A reader tipped us off today that HBO Max stopped working a couple of weeks ago for Linux users, under any Web browser. Any attempt to play back a video on the streaming service on a Linux system -- regardless of distribution or browser -- returns an error saying, "We're having trouble playing this video. Please try again later." Unfortunately, trying again later won't help -- the root cause of the problem is that the Widevine DRM attempting to protect HBO Max's content from pirates is refusing to recognize any Linux system as a known platform. We saw the same thing happen in January, when CBS All Access suddenly stopped working on Linux in the same way. When we asked CBS executives if they had enabled the Verified Media Path (VMP) requirement on their Widevine server, they suddenly clammed up -- but later that day, the service miraculously worked for Linux users again. We did verify that HBO Max will not work on Linux browsers and that the problem is -- once again -- Widevine DRM refusing to issue a license. Although HBO Max has not returned requests for comment at press time, it seems very likely that the cause here is the same as it was for CBS All Access back in January. It seems like somebody enabled Verified Media Path on the Widevine server, and since the Linux kernel is not a verified media path, Linux users can't get a license and can't watch the content.' -- source: https://slashdot.org/story/20/08/26/1923213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Code-execution bug in Pulse Secure VPN threatens patch laggards everywhere
by Peter Reutemann 27 Aug '20

27 Aug '20

'Organizations that have yet to install the latest version of the Pulse Secure VPN have a good reason to stop dithering—a code-execution vulnerability that allows attackers to take control of networks that use the product. Tracked as CVE-2020-8218, the vulnerability requires an attacker to have administrative rights on the machine running the VPN. Researchers from GoSecure, the firm that discovered the flaw, found an easy way to clear that hurdle: trick an administrator into clicking on a malicious link embedded in an email or other type of message.' -- source: https://arstechnica.com/information-technology/2020/08/code-execution-bug-i… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google: Jetpack Compose Lets Android Developers Write Apps With 'Dramatically Less Code'
by Peter Reutemann 27 Aug '20

27 Aug '20

'Google today released the alpha version of Jetpack Compose, its UI toolkit for helping developers "build beautiful UI across all Android platforms, with native access to the platform APIs." From a report: While an alpha release means it is definitely not production ready, Jetpack Compose promises to let Android developers build apps using "dramatically less code, interactive tools, and intuitive Kotlin APIs." The alpha release also includes new tools including Animations, Constraint Layouts, and performance optimizations. Android Jetpack, which Google launched at its I/O 2018 developer conference, is a set of components for speeding up app development. Think of it as the successor to Support Library, a set of components that makes it easier to leverage new Android features while maintaining backwards compatibility. Jetpack Compose, which Google first showed off at its I/O 2019 developer conference, is an unbundled toolkit meant to simplify UI development by combining a reactive programming model with Kotlin.' -- source: https://developers.slashdot.org/story/20/08/26/1749231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Requiring Plain-Text Email Is A “Barrier To Entry” For Linux Kernel Development, Says Somebody Or Other
by Lawrence D'Oliveiro 26 Aug '20

26 Aug '20

Seems plain-text e-mails are just too hard to work with nowadays <https://www.theregister.com/2020/08/25/linux_kernel_email/>: “It is a fairly specific workflow that is a challenge for some newer developers to engage with. As an example, my partner submitted a patch to OpenBSD a few weeks ago, and he had to set up an entirely new mail client which didn’t mangle his email message to HTML-ise or do other things to it, so he could even make that one patch. That’s a barrier to entry that’s pretty high for somebody who may want to be a first-time contributor.” ... It turned out, though, that this time Outlook was not guilty. “I think it was actually Gmail that was a barrier. And he also couldn’t do it from Apple Mail. It is just that the modern mail client has intentionally moved towards HTML,” ...

2 1

Firefox Daylight For Android Arrives With Enhanced Tracking Protection, New UI
by Peter Reutemann 26 Aug '20

26 Aug '20

'After more than a year of development, Mozilla today launched Firefox 79 for Android, branded Firefox Daylight. Like with Firefox 57 Quantum, Firefox Daylight gets its own name as it marks "a new beginning for our Android browser." The new version is "an entirely overhauled, faster, and more convenient product." Firefox Daylight includes Enhanced Tracking Protection on by default, a new user interface, Mozilla's own mobile browser engine GeckoView, and a slew of new features. Mozilla is rolling out the new Firefox for Android globally, starting in Germany, France, and the U.K. today, and North America starting August 27.' -- source: https://news.slashdot.org/story/20/08/25/1511257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

A New Botnet Is Covertly Targeting Millions of Servers
by Peter Reutemann 26 Aug '20

26 Aug '20

'Wired reports: FritzFrog has been used to try and infiltrate government agencies, banks, telecom companies, and universities across the US and Europe. Researchers have found what they believe is a previously undiscovered botnet that uses unusually advanced measures to covertly target millions of servers around the world. The botnet uses proprietary software written from scratch to infect servers and corral them into a peer-to-peer network, researchers from security firm Guardicore Labs reported on Wednesday. Peer-to-peer (P2P) botnets distribute their administration among many infected nodes rather than relying on a control server to send commands and receive pilfered data. With no centralized server, the botnets are generally harder to spot and more difficult to shut down. The botnet, which Guardicore Labs researchers have named FritzFrog, has a host of other advanced features, including: In-memory payloads that never touch the disks of infected servers; At least 20 versions of the software binary since January; A sole focus on infecting secure shell, or SSH, servers that network administrators use to manage machines; The ability to backdoor infected servers; and A list of login credential combinations used to suss out weak login passwords that's more "extensive" than those in previously seen botnets. Taken together, the attributes indicate an above-average operator who has invested considerable resources to build a botnet that's effective, difficult to detect, and resilient to takedowns. The new code base -- combined with rapidly evolving versions and payloads that run only in memory -- make it hard for antivirus and other end-point protection to detect the malware. The botnet has so far succeeded in infecting 500 servers belonging to "well-known universities in the US and Europe, and a railway company."Once installed, the malicious payload can execute 30 commands, including those that run scripts and download databases, logs, or files. To evade firewalls and endpoint protection, attackers pipe commands over SSH to a netcat client on the infected machine. Netcat then connects to a "malware server." (Mention of this server suggests that the FritzFrog peer-to-peer structure may not be absolute. Or it's possible that the "malware server" is hosted on one of the infected machines, and not on a dedicated server. Guardicore Labs researchers weren't immediately available to clarify.)' -- source: https://it.slashdot.org/story/20/08/25/1947246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Windows 95 Released a Quarter Century Ago
by Peter Reutemann 26 Aug '20

26 Aug '20

'Windows 95 was released a full quarter century ago today, on August 24th, 1995. Long gone, nearly forgotten? I'm surprised to not have come across a retrospective article yet. I've linked to the Wikipedia article. As for me I still haven't grown to re-like The Rolling Stones "Start Me Up" yet. I got so sick of hearing it with all the pre-launch and post-launch hype, as the song was tied heavily to the Win 95 launch event. Microsoft paid the Stones a princely sum to use it. I still remember how exciting it was to see the full-length, full-screen video included on the installation CD-ROM, "Buddy Holly" by Weezer. Mind-blowing to watch a whole music video on your computer. Crappy resolution by our standards today, and a very limited palette to my memory. But as I said, amazing in the day. Windows 95 had many fans and many critics. At the time, I recall it as an exciting OS (or GUI on top of DOS, if you prefer). PC users were riveted to all the magazine and other media coverage pre-launch. I remember it fondly (with all the obligatory respect due Mac OS, the Amiga, and all the other early GUIs of course).' -- source: https://tech.slashdot.org/story/20/08/25/1936234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome 85 Arrives With Tab Management, 10% Faster Page Loads, and PDF Improvements
by Peter Reutemann 26 Aug '20

26 Aug '20

'Google today launched Chrome 85 for Windows, Mac, Linux, Android, and iOS. Chrome 85 brings tab management changes, 10% faster page loads, PDF improvements, and a slew of developer features. From a report: Google is promising under-the-hood performance improvements with Chrome 85. You can expect two types of speed gains: Profile Guided Optimization, which delivers up to 10% faster page loads, and Tab Throttling, which helps reduce the impact of idle background tabs. The latter, however, is coming to the Beta channel meaning it's not yet ready. Profile Guided Optimization is a compiler optimization technique where the most performance-critical parts of the code can run faster. Profile Guided Optimization prioritizes the most common tasks using real usage scenarios that match the workflows of Chrome users around the world.' -- source: https://it.slashdot.org/story/20/08/25/1741206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chinese-Made Smartphones Are Secretly Stealing Money From People Around the World
by Peter Reutemann 25 Aug '20

25 Aug '20

'When Mxolosi saw a Tecno W2 smartphone in a store in Johannesburg, South Africa, he was attracted to its looks and functionality. But what really drew him in was the price, roughly $30 -- far less than comparable models from Samsung, Nokia, or Huawei, Africa's other top brands. It was another sale for Transsion, the Chinese company that makes Tecno and other low-priced smartphones, as well as basic handsets, for the developing world. Since releasing its first smartphone in 2014, the upstart has grown to become Africa's top handset seller, beating out longtime market leaders Samsung and Nokia. But its success can come at a price. Mxolosi, an unemployed 41-year-old, became frustrated with his Tecno W2. Pop-up ads interrupted his calls and chats. He'd wake up to find his prepaid data mysteriously used up and messages about paid subscriptions to apps he'd never asked for. He thought it might be his fault, but according to an investigation by Secure-D, a mobile security service, and BuzzFeed News, software embedded in his phone right out of the box was draining his data while trying to steal his money. Mxolosi's Tecno W2 was infected with xHelper and Triada, malware that secretly downloaded apps and attempted to subscribe him to paid services without his knowledge. Secure-D's system, which mobile carriers use to protect their networks and customers against fraudulent transactions, blocked 844,000 transactions connected to preinstalled malware on Transsion phones between March and December 2019. Secure-D Managing Director Geoffrey Cleaves told BuzzFeed News that Mxolosi's data was used up by the malware as it attempted to subscribe him to paid services. Along with South Africa, Tecno W2 phones in Ethiopia, Cameroon, Egypt, Ghana, Indonesia, and Myanmar were infected.' -- source: https://it.slashdot.org/story/20/08/24/2139209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bridgefy, the Messenger Promoted For Mass Protests, Is a Privacy Disaster
by Peter Reutemann 25 Aug '20

25 Aug '20

'Bridgefy, a popular messaging app for conversing with one another when internet connections are heavily congested or completely shut down, is a privacy disaster that can allow moderately-skilled hackers to take a host of nefarious actions against users, according to a paper published on Monday. The findings come after the company has for months touted the app as a safe and reliable way for activists to communicate in large gatherings. Ars Technica reports: By using Bluetooth and mesh network routing, Bridgefy lets users within a few hundred meters -- and much further as long as there are intermediary nodes -- to send and receive both direct and group texts with no reliance on the Internet at all. Bridgefy cofounder and CEO Jorge Rios has said he originally envisioned the app as a way for people to communicate in rural areas or other places where Internet connections were scarce. And with the past year's upswell of large protests around the world -- often in places with hostile or authoritarian governments -- company representatives began telling journalists that the app's use of end-to-end encryption (reiterated here, here, and here) protected activists against governments and counter protesters trying to intercept texts or shut down communications. [R]esearchers said that the app's design for use at concerts, sports events, or during natural disasters makes it woefully unsuitable for more threatening settings such as mass protests. They wrote: "Though it is advertised as 'safe' and 'private' and its creators claimed it was secured by end-to-end encryption, none of aforementioned use cases can be considered as taking place in adversarial environments such as situations of civil unrest where attempts to subvert the application's security are not merely possible, but to be expected, and where such attacks can have harsh consequences for its users. Despite this, the Bridgefy developers advertise the app for such scenarios and media reports suggest the application is indeed relied upon." The researchers are: Martin R. Albrecht, Jorge Blasco, Rikke Bjerg Jensen, and Lenka Marekova from Royal Holloway, University of London. After reverse engineering the app, they devised a series of devastating attacks that allow hackers -- in many cases with only modest resources and moderate skill levels -- to take a host of nefarious actions against users. The attacks allow for: deanonymizing users; building social graphs of users' interactions, both in real time and after the fact; decrypting and reading direct messages; impersonating users to anyone else on the network; completely shutting down the network; and performing active man-in-the-middle attacks, which allow an adversary not only to read messages, but to tamper with them as well. "The key shortcoming that makes many of these attacks possible is that Bridgefy offers no means of cryptographic authentication, which one person uses to prove she's who she claims to be," the report adds. "Instead, the app relies on a user ID that's transmitted in plaintext to identify each person. Attackers can exploit this by sniffing the ID over the air and using it to spoof another user." The app also uses PKCS #1, an outdated way of encoding and formatting messages so that they can be encrypted with the RSA cryptographic algorithm. "This encoding method, which was deprecated in 1998, allows attackers to perform what's known as a padding oracle attack to derive contents of an encrypted message," reports Ars.' -- source: https://yro.slashdot.org/story/20/08/24/2228219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apple Apologizes To WordPress, Won't Force the Free App To Add Purchases After All
by Peter Reutemann 25 Aug '20

25 Aug '20

'On Friday, the internet erupted in a small way to learn that Apple had successfully forced WordPress to monetize its free app -- forcing it to sell premium plans and custom domain names seemingly just so that Apple could get its traditional 30 percent cut. But one afternoon and evening of surprise and outrage later, Apple is backing off. The company is issuing a rare on-the-record apology, and it says that WordPress will no longer have to add in-app purchases now that all is said and done. Here's Apple's full statement: "We believe the issue with the WordPress app has been resolved. Since the developer removed the display of their service payment options from the app, it is now a free stand-alone app and does not have to offer in-app purchases. We have informed the developer and apologize for any confusion that we have caused." You'll notice that Apple is positioning this as the developer -- WordPress -- having done the right thing and removed the "display of their service payment options from the app," and to my knowledge that is technically true. But as far as I'm aware, that didn't happen today: it happened weeks or months ago.' -- source: https://apple.slashdot.org/story/20/08/24/204211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Open Source Sustainability is Really a People Problem
by Peter Reutemann 24 Aug '20

24 Aug '20

'Matt Asay, a former COO of Canonical now working at AWS, argues that the question of open source sustainability "is really a people problem." But to make the case, he cites comments by Tobie Langel, formerly W3C's testing lead (and a former member of Facebook's Open Source and Web Standards Team) who's now founded an open-source strategies consulting firm whose clients include Mozilla, Intell, Google, and Microsoft. Much of the "open source sustainability" discussion has focused on the one thing that really needs no help being sustained: software. As Tobie Langel rightly points out, "Open source code isn't a scarce resource. It's the exact opposite, actually: It's infinitely reproducible at zero cost to the user and to the ecosystem." Nor is sustainability really a matter of funding, though this gets closer to the truth. No, open source sustainability is really a people problem. Or, as Langel highlights, "In open source, the maintainers working on the source code are the scarce resource that needs to be protected and nurtured." Over the past several weeks, I've interviewed a number of maintainers for popular open source projects. In every case, they talked about how they contribute because it's fun, but also acknowledged that some aspects of open source development can make it decidedly "un-fun" (e.g., demanding users who complain about missing features or existing bugs but don't contribute code or fixes). Most have found ways to turn their passion into financial independence, but Langel stresses that cash is critical to keeping open source humming along... "Without revenue, there is no maintenance, and without maintenance, the commons becomes toxic very quickly... As new security issues are discovered, open source code that isn't updated becomes a security risk..." Langel is absolutely correct to argue, "In an ecosystem with infinite resources, the attention needs to be on the people taking care of and maintaining that resource, because that's where the bottleneck is." Again, that's partly a question of money, but it's even more a question of treating people with dignity and respect, while making open source communities a fun, welcoming place.' -- source: https://news.slashdot.org/story/20/08/23/0447224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Virtual Influencers: Who Needs Real People?
by Lawrence D'Oliveiro 23 Aug '20

23 Aug '20

You probably know that celebrities can earn a lot by promoting products to their followers on social media. Some of these don’t actually have a flesh-and-blood job: they are famous for nothing more than being such “influencers”. Some advertisers have now decided to shortcut the process by creating their own “virtual influencers”: essentially, animated CG characters that they can control totally and much more easily than managing real people <https://www.theregister.com/2020/08/21/virtual_instagram_influencers/>. If all their interactions happen online, why do they need to be real?

1 0

Chrome/Chromium Now Accounting For Half Of All DNS Root Server Traffic
by Lawrence D'Oliveiro 23 Aug '20

23 Aug '20

Google’s Chrome (and its Chromium-based offshoots) include some elaborate workarounds to detect ISPs hijacking “no such domain” responses to advertise their own DNS services. Unfortunately, these workarounds lead to the generation of a lot of traffic to the DNS root servers <https://www.theregister.com/2020/08/21/chromiums_dns_network/>. Firefox is able to implement something similar, but with less impact on the Internet at large.

1 0

Google Fixes Major Gmail Bug Seven Hours After Exploit Details Go Public
by Peter Reutemann 21 Aug '20

21 Aug '20

'Google has patched on Wednesday a major security bug impacting the Gmail and G Suite email servers. From a report: The bug could have allowed a threat actor to send spoofed emails mimicking any Gmail or G Suite customer. According to security researcher Allison Husain, who found and reported this issue to Google in April, the bug also allowed attachers to pass the spoofed emails as compliant with SPF (Sender Policy Framework) and DMARC (Domain-based Message Authentication, Reporting, and Conformance), two of the most advanced email security standards. However, despite having 137 days to fix the reported issue, Google initially delayed patches past the disclosure deadline, planning to fix the bug somewhere in September. Google engineers changed their mind yesterday after Husain published details about the bug on her blog, including proof-of-concept exploit code.' -- source: https://it.slashdot.org/story/20/08/20/1522226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0