- wlug - list.wlug.org.nz

Google Creates “Open Usage Commons”
by Lawrence D'Oliveiro 09 Jul '20

09 Jul '20

From <https://www.theregister.com/2020/07/08/google_trademarks_open_usage_commons/>, Google is creating an organization specifically to deal with trademark issues, entirely separate from code. FSF Europe’s Alexander Sander says: “Trademarks issues are becoming more and more relevant for Free Software. This development is mainly due to the fact that Free Software is increasingly and successfully used in the commercial sector.” True, that. Consider the stoush between Debian and Mozilla over the “Firefox” trademark and branding, and the consequent creation of the “Iceweasel” fork. (Looks like that was eventually resolved amicably.) However, note this counterpoint from the Linux Foundation: "Under US trademark law you are not able to effectively separate ownership of a project mark from control of the underlying open source project."

1 0

Over 100 Wi-Fi Routers Fail Major Security Test -- Protect Yourself Now
by Peter Reutemann 09 Jul '20

09 Jul '20

'Tom's Guide: Using its own analytical software, the [Fraunhofer Institute] tested the most recently available firmware for 117 home Wi-Fi models currently sold in Europe, including routers from ASUS, D-Link, Linksys, Netgear, TP-Link, Zyxel and the small German brand AVM. The models themselves were not physically tested. A full list of the tested models and firmware is on GitHub. The institute was not able to examine the firmware of 10 more models, mostly from Linksys. The report notes (PDF) that many firmware updates are issued without fixing known flaws. So what can you do? You can make sure that the next router you buy automatically installs firmware updates. You can check to see whether your current router does so, or makes it fairly easy to install firmware updates manually. You should also make sure that the administrative password for your router has been changed from the factory default password. (Check the list of default passwords at https://www.routerpasswords.com.) You should also check its administrative interface to make sure that UPnP and remote access are disabled. And if your router was first released more than 5 years ago, consider buying a newer model unless it meets all of the above criteria. Alternatively, you could try to "flash" your older router to run more secure open-source router firmware such as OpenWrt, DD-WRT or Tomato. "The worst case regarding high severity CVEs [widely known flaws] is the Linksys WRT54GL powered by the oldest kernel found in our study," the report said, noting that this model uses the 2.4.20 kernel from 2002. "There are 579 high severity CVEs affecting this product." "That particular model last had its firmware updated in January 2016, one of the oldest firmwares in the study," adds Tom's Guide. "The Linksys WRT54GL was first released in 2005 and is still sold today, even though it handles Wi-Fi protocols only up to 802.11g. However, the WRT54G series is possibly the best-selling family of Wi-Fi routers ever..."' -- source: https://mobile.slashdot.org/story/20/07/08/2058240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

Google and Canonical Bring Flutter Apps To Linux and the Snap Store
by Peter Reutemann 09 Jul '20

09 Jul '20

'Google is partnering with the Ubuntu Desktop team at Canonical to bring Linux support to its open source UI framework Flutter. Today's Linux alpha announcement also means Flutter developers can now deploy their apps to the Snap Store. Flutter group product manager Tim Sneath argues this is a big milestone because UI frameworks rarely become versatile and powerful enough for an operating system to depend on. He pointed to Windows being written in C++ rather than .NET, even for applets like the Calculator. Sneath also believes this shows Canonical is willing to invest in a first-class way to build apps for Linux, making Flutter on Linux an official part of Ubuntu. Additionally, enterprises can feel confident about picking Flutter -- it's more evidence of its longevity and technical excellence, Sneath said.' -- source: https://linux.slashdot.org/story/20/07/08/1722203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linux Company SUSE Outbids Competitors for Fast-growing Startup Rancher Labs
by Peter Reutemann 09 Jul '20

09 Jul '20

'SUSE, a Linux distribution company controlled by private equity firm EQT, has agreed to acquire Rancher Labs, a start-up with technology that helps organizations run software in virtual containers across many servers. From a report: The companies announced the deal Wednesday but didn't disclose the terms. Two people familiar with the deal said SUSE is paying $600 million to $700 million. The transaction suggests that even during a recession, demand remains high for technology that can enable companies to operate more efficiently. Talks between the companies began in the spring, and the process became competitive with additional bids, Ursheet Parikh, a partner at Rancher backer Mayfield Fund, told CNBC on Tuesday. There were "lots of Zoom calls," Parikh said. In the past few years, with the rise of start-ups such as Docker, containers became a trendy alternative to more traditional virtualization technology for running applications on each computer server in a company data center. Amazon, Microsoft and other cloud providers came out with services that developers can use to place code in containers, and in 2017 SUSE introduced its own service for managing containers. The companies haven't finalized integration plans as the deal still faces regulatory approval.' -- source: https://linux.slashdot.org/story/20/07/08/147202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Suspends Firefox Send Service While It Addresses Malware Abuse
by Peter Reutemann 09 Jul '20

09 Jul '20

'Mozilla has temporarily suspended the Firefox Send file-sharing service as the organization investigates reports of abuse from malware operators and while it adds a "Report abuse" button. The browser maker took down the service today after ZDNet reached out to inquire about Firefox Send's increasing prevalence in current malware operations. Since last year, several malware operations have hosted payloads on the service. This includes ransomware gangs like REvil/Sodinokibi, financial crime crews like FIN7, the Zloader and Ursnif banking trojans operations, and government surveillance groups targeting human rights defenders. Reasons include the fact that Firefox Send doesn't have an Report Abuse mechanism, all file uploads are encrypted (useful to dodge malware scanners), and the Firefox URL is whitelisted in most orgs (useful for bypassing email filters).' -- source: https://news.slashdot.org/story/20/07/08/1811228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

LibreOffice Getting More Commercial?
by Lawrence D'Oliveiro 08 Jul '20

08 Jul '20

Seems that a major policy announcement is coming up from The Document Foundation (the outfit behind LibreOffice) on July 15th. In the meantime, some hints have (unintentionally) leaked out <https://www.theregister.com/2020/07/07/libreoffice_community_protests_at_in…>, such as the about-box in LO 7.0 saying “The personal edition is supported by volunteers and intended for individual use”.

1 0

New H.266 VCC Codec Up To 50% More Efficient Than Previous Standard
by Peter Reutemann 07 Jul '20

07 Jul '20

'The Fraunhofer Heinrich Hertz Institute on Tuesday announced the H.266 Versatile Video Coding codec, which will power more data-efficient video capture and transmission on future iPhones. AppleInsider reports: Apple adopted the predecessor to the new codec, H.265/HEVC, in iOS 11. The updated video codec, which was developed after years of research and standardization, will bring a number of tangible benefits to future iPhone users. In its announcement, the Fraunhofer HHI said that H.266 will reduce data requirements by around 50% thanks to improved compression. With the previous HEVC codec, it took about 10GB of data to transmit a 90-minute ultra-high definition (UHD) video. H.266 can do that with 5GB. The codec, as detailed in a 500-page specification, was designed from the ground up for use with 4K and 8K streaming. It'll allow users to store more high-definition video and reduce the amount of data on cellular networks.' -- source: https://apple.slashdot.org/story/20/07/06/219225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds Likes His New AMD Threadripper System
by Peter Reutemann 06 Jul '20

06 Jul '20

'This week Linus Torvalds and Dirk Hohndel re-created their keynote conversation for a special all-virtual edition of the Open Source Summit and Embedded Linux Conference North America. ZDNet reports: While COVID-19 has slowed down many technologies, while speeding up other tech developments, it hasn't affected Linux development much at all. "None of my co-developers have been hugely impacted either. I was worried for a while because one of our developers was offline for a month or two.... [But,] it turned out that it was just RSI [repetitive strain injury], and RSI is kind of an occupational hazard to deal with." He added. "One of the things that is so interesting about the Linux community is how much it has always been email-based and remote, how rarely we get together in person...." Torvalds trusts this new build. Indeed, he ran his end of the videoconference from his new developer machine running the first release candidate of 5.8. Thinking of his new AMD Threadripper 3970x-based processor-powered developer desktop, Torvalds later added that, although he had been concerned about its fan noise it actually works well for him. Torvalds moved to this new homebrew computer because he needed the speed. "My 'allmodconfig' test builds are now three times faster than they used to be." That's important because Torvalds "strives to do about 20 to 30 [pull requests] a day, which is above my limit, ... [but] in order to do that, [he needs] a lot of computing power. ' -- source: https://linux.slashdot.org/story/20/07/03/2349231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 5

Mexico Bans Home PC Repair, Non-OEM OS Installs
by Lawrence D'Oliveiro 04 Jul '20

04 Jul '20

The Mexican “Cámara de Diputados” (“Chamber of Deputies” or lower house of the Mexican Congress) has just passed a law, according to DistroTube <https://www.youtube.com/post/UgyENs4zc_xx-uyL3-N4AaABCQ> (referencing this <https://twitter.com/YourAnonCentral/status/1278172057486766080> Twitter thread), seemingly making any kind of modifications to your own electronic devices illegal. This includes things like changing the hard drive or installing a non-OEM OS (e.g. a Linux distro).

1 0

Ads Are Taking Over Samsung's Galaxy Smartphones
by Peter Reutemann 02 Jul '20

02 Jul '20

'Max Weinbach, writing for Android Police: I have been using Samsung phones every day for almost 4 years. It was because Samsung had fantastic hardware paired with --depending on the year -- good software. 2020 is the first year in a while I'm not using a Samsung phone as my daily driver. The reason? Ads. Ads in Samsung phones never really bothered me, at least not until the past few months. It started with the Galaxy Z Flip. A tweet from Todd Haselton of CNBC is what really caught my eye. Samsung had put an ad from DirectTV in the stock dialer app. This is really something I never would have expected from any smartphone company, let alone Samsung. It showed up in the "Places" tab in the dialer app, which is in partnership with Yelp and lets you search for different businesses directly from the dialer app so you don't need to Google somewhere to find the address or phone number. I looked into it, to see if this was maybe a mistake on Yelp's part, accidentally displaying an ad where it shouldn't have, but nope. The ad was placed by Samsung, in an area where it could blend in so they could make money. Similar ads exist throughout a bunch of Samsung apps. Samsung Music has ads that look like another track in your library. Samsung Health and Samsung Pay have banners for promotional ads. The stock weather app has ads that look like they could be news. There is also more often very blatant advertising in most of these apps as well. Samsung Music will give you a popup ad for Sirius XM, even though Spotify is built into the Samsung Music app. You can hide the SiriusXM popup, but only for 7 days at a time. A week later, it will be right back there waiting for you. Samsung will also give you push notification ads for new products from Bixby, Samsung Pay, and Samsung Push Service. ' -- source: https://slashdot.org/story/20/07/01/196224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Removes 25 Android Apps Caught Stealing Facebook Credentials
by Peter Reutemann 01 Jul '20

01 Jul '20

'Google has removed this month 25 Android apps from the Google Play Store that were caught stealing Facebook credentials. From a report: Before being taken down, the 25 apps were collectively downloaded more than 2.34 million times. The malicious apps were developed by the same threat group and despite offering different features, under the hood, all the apps worked the same. According to a report from French cyber-security firm Evina shared with ZDNet today, the apps posed as step counters, image editors, video editors, wallpaper apps, flashlight applications, file managers, and mobile games. The apps offered a legitimate functionality, but they also contained malicious code. Evina researchers say the apps contained code that detected what app a user recently opened and had in the phone's foreground. If the app was Facebook, the malicious app would overlay a web browser window on top of the official Facebook app and load a fake Facebook login page (see image below: blue bar = actual Facebook app, black bar = phishing page).' -- source: https://tech.slashdot.org/story/20/06/30/1411202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android's AirDrop Competitor Is Coming Soon
by Peter Reutemann 01 Jul '20

01 Jul '20

'Android's long-awaited "Nearby Sharing" feature, which allows you to share files between Android devices wirelessly, is rolling out to beta testers. Android Police reports: Nearby Sharing may appear slightly differently depending on the type of content you try to share. In all cases, it shows up as an app in the apps list on the share sheet, but you may also get a smaller prompt just under the content preview, more like it did in the previous Android 11 video leak. We tested it on a Pixel 4 XL and Pixel 3a running Android 10, but the appearance may also vary on other versions of Android. Note that Nearby Share works for both files like photos or videos, as well as other shareable content like Tweets and URLs. It probably works with a lot of things. Select Nearby Share in the share sheet as the target, and you're prompted to turn on the feature, if it's the first time you've used it. The quick setup process lets you configure your default device name and device visibility settings, though those can also be changed later. Once you have it enabled, Nearby Sharing starts looking for other nearby devices. The interface is pretty simple: A big X in the top left corner backs you out, your avatar on the right takes you to a settings pane that lets you configure things like your device name, visibility, and which mechanism to use to make the transfer (i.e., whether to use your internet connection for small files, to stick to Wi-Fi, or to always share offline). Google says Nearby Share is currently in limited testing via the Play Services beta: "We're currently conducting a beta test of a new Nearby Share feature that we plan to share more information on in the future. Our goal is to launch the feature with support for Android 6+ devices as well as other platforms."' -- source: https://mobile.slashdot.org/story/20/06/30/2014259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apple Declined To Implement 16 Web APIs in Safari Due To Privacy Concerns
by Peter Reutemann 30 Jun '20

30 Jun '20

'Apple said last week that it declined to implement 16 new web technologies (Web APIs) in Safari because they posed a threat to user privacy by opening new avenues for user fingerprinting. Technologies that Apple declined to include in Safari because of user fingerprinting concerns include: Web Bluetooth - Allows websites to connect to nearby Bluetooth LE devices. Web MIDI API - Allows websites to enumerate, manipulate and access MIDI devices. Magnetometer API - Allows websites to access data about the local magnetic field around a user, as detected by the device's primary magnetometer sensor. Web NFC API - Allows websites to communicate with NFC tags through a device's NFC reader. Device Memory API - Allows websites to receive the approximate amount of device memory in gigabytes. Network Information API - Provides information about the connection a device is using to communicate with the network and provides a means for scripts to be notified if the connection type changes. Battery Status API - Allows websites to receive information about the battery status of the hosting device. Web Bluetooth Scanning - Allows websites to scan for nearby Bluetooth LE devices. Ambient Light Sensor - Lets websites get the current light level or illuminance of the ambient light around the hosting device via the device's native sensors. [...] The vast majority of these APIs are only implemented in Chromium-based browsers, and very few on Mozilla's platform. Apple claims that the 16 Web APIs above would allow online advertisers and data analytics firms to create scripts that fingerprint users and their devices. ' -- source: https://apple.slashdot.org/story/20/06/29/1456247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

A decidedly non-Linux distro walkthrough: Haiku R1/beta2
by Peter Reutemann 30 Jun '20

30 Jun '20

'Earlier this month, the Haiku project released the second beta of its namesake operating system, Haiku. Haiku is the reimagining of a particularly ambitious, forward-looking operating system from 1995—Be, Inc.'s BeOS. BeOS was developed to take advantage of Symmetrical Multi-Processing (SMP) hardware using techniques we take for granted today—kernel-scheduled pre-emptive multitasking, ubiquitous multithreading, and BFS—a 64-bit journaling filesystem of its very own. [...] In June 2020—nineteen years after OpenBeOS was born, and sixteen after its rename to Haiku—the project released its second beta distribution. The project still adheres to backward application compatibility with 1990s BeOS—although only in its 32-bit version, which I did not test.' -- source: https://arstechnica.com/gadgets/2020/06/a-decidedly-non-linux-distro-walkth… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Firefox 79 Stable Will Let Users Test Unreleased Features Using 'Experiments'
by Peter Reutemann 28 Jun '20

28 Jun '20

'Both Edge and Chrome already allow users to try unreleased, experimental features (by typing about:flags in the address bar). Soon there'll be a similar "Firefox Experiments" option starting in Firefox 79. Slashdot reader techtsp shares this report from the Windows Club: Mozilla has a dedicated Experimental Features page on MDN just for that. But limiting experimental features to Firefox's Nightly channel has a limitation: A fairly limited number of "curious" users. Now, extending some of these experimental features to stable releases will increase the scope of "Firefox Experiments" as a whole... This option will allow users to enable/disable experimental features under Preferences... [In Firefox 79] Navigate to Preferences by entering about:preferences in the browser's address bar or click the gear icon and got to "Preferences." Discover and set browser.preferences.experimental to True. Now, you should be able to see the "Firefox Experiments" menu under Firefox 79 Preferences.' -- source: https://tech.slashdot.org/story/20/06/27/0321206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Journalist's Phone Hacked: All He Had To Do Was Visit a Website. Any Website.
by Peter Reutemann 28 Jun '20

28 Jun '20

'The iPhone that Moroccan journalist Omar Radi used to contact his sources also allowed his government to spy on him (and at least two other journalists), reports the Toronto Star, citing new research from Amnesty International. Slashdot reader Iwastheone shares their report: Their government could read every email, text and website visited; listen to every phone call and watch every video conference; download calendar entries, monitor GPS coordinates, and even turn on the camera and microphone to see and hear where the phone was at any moment. Yet Radi was trained in encryption and cyber security. He hadn't clicked on any suspicious links and didn't have any missed calls on WhatsApp — both well-documented ways a cell phone can be hacked. Instead, a report published Monday by Amnesty International shows Radi was targeted by a new and frighteningly stealthy technique. All he had to do was visit one website. Any website. Forensic evidence gathered by Amnesty International on Radi's phone shows that it was infected by "network injection," a fully automated method where an attacker intercepts a cellular signal when it makes a request to visit a website. In milliseconds, the web browser is diverted to a malicious site and spyware code is downloaded that allows remote access to everything on the phone. The browser then redirects to the intended website and the user is none the wiser. Two more human rights advocates in Morocco have been targeted by the same malware, the article reports.' -- source: https://yro.slashdot.org/story/20/06/27/029222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Comcast Becomes the First ISP To Join Mozilla's TRR Program
by Peter Reutemann 26 Jun '20

26 Jun '20

'Comcast has joined Cloudflare and NextDNS in partnering with Mozilla's Trusted Recursive Resolver program, which aims to make DNS more trusted and secure. Neowin reports: Commenting on the move, Firefox CTO Eric Rescorla, said: "Comcast has moved quickly to adopt DNS encryption technology and we're excited to have them join the TRR program. Bringing ISPs into the TRR program helps us protect user privacy online without disrupting existing user experiences. We hope this sets a precedent for further cooperation between browsers and ISPs." With its TRR program, Mozilla said that encrypting DNS data with DoH is just the first step in securing DNS. It said that the second step requires companies handling the data to have appropriate rules in place for handling it. Mozilla believes these rules include limiting data collection and retention, ensuring transparency about any retained data, and limiting the use of the resolver to block access or modify content. Ars Technica notes that joining Mozilla's program means that Comcast agreed that it won't "retain, sell, or transfer to any third party (except as may be required by law) any personal information, IP addresses, or other user identifiers, or user query patterns from the DNS queries sent from the Firefox browser," along with other requirements. When the change happens, it'll be automatic for users unless they've chosen a different DoH provider or disabled DoH altogether. Comcast told Ars yesterday that "Firefox users on Xfinity should automatically default to Xfinity resolvers under Mozilla's Trusted Recursive Resolver program, unless they have manually chosen a different resolver, or if DoH is disabled. The precise mechanism is still being tested and the companies plan to document it soon in an IETF [Internet Engineering Task Force] Draft."' -- source: https://tech.slashdot.org/story/20/06/25/1953252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Ubuntu..
by john 25 Jun '20

25 Jun '20

One of the moderators asked (after using Simply Mepis) He wanted a more GUI system for another version of Linux OS. After we all gave an opinion favouring Ubuntu or Mint to meet his needs another member posted: "No, don't try Ubuntu. Right in the T&C it says all searches, including those of your own hard drive, go to the BBC and others. You really don't want an invasion of your privacy that includes all your search results including all your personal material effectively being public knowledge." I have a problem with this small "fact" and wonder about it's validity BBC. British broadcasting corporation. Blueberry county. Big beautiful clowns??? .-- Cheers John..

3 3

Safari 14 Removes Flash, Gets Support for Breach Alerts, HTTP/3, and WebP
by Peter Reutemann 25 Jun '20

25 Jun '20

'Safari 14, scheduled to be released later this fall with iOS 14 and macOS 11, is a release that is packed choke-full with features. From a report: The biggest and most important of the new additions is support for WebExtensions, a technology for creating browser extensions. What this means for Safari users is that starting this fall, they'll see a huge influx of new Safari extensions as add-on developers are expected to port their existing Chrome and Firefox extensions to work on Apple's browser as well. Apple said that, for now, WebExtensions will only be available for Safari on macOS. Safari 14 is also an end of an era, as this will be the first version of Safari that won't support Adobe Flash Player content. But while old stuff is being removed, new stuff is also being added. One of the new technologies added to Safari is support for HTTP/3, a new web standard that will make loading websites faster and safer. Another important addition in Safari is support for WebP, a lightweight image format that has been gaining widespread adoption across the internet. The format, created by Google, serves as an alternative to the older JPEG format, and Safari has been the last browser to add support for it. [...] But Safari hasn't been lagging behind other browsers just in terms of HTTP/3 and WebP support. Apple has also added support for another cool feature, namely breach alerts, already present in both Chrome and Firefox. Starting this fall, Apple says that Safari 14 will scan a user's locally-stored passwords and show a prompt if one or more of the user's credentials are present in publicly available lists of breached accounts.' -- source: https://yro.slashdot.org/story/20/06/24/1753236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Says It Will Keep Less Browser History and Location Data By Default
by Peter Reutemann 25 Jun '20

25 Jun '20

'Google said Wednesday it was changing the defaults on its services in an effort to store less browser history and location data on its servers. NBC News reports: Google CEO Sundar Pichai said in a blog post that the first time a person turns on location history, the default option would be for the data to be stored for 18 months. Activity from the web and from apps would also default to 18 months for new accounts, he said. "This means your activity data will be automatically and continuously deleted after 18 months, rather than kept until you choose to delete it," Pichai said. There will be no automatic change for existing accounts and people who already have location history turned on in their Google settings, but the company plans to inform existing users of the option to set up auto-delete after three to 18 months, he said. People also have the option to turn the setting off.' -- source: https://tech.slashdot.org/story/20/06/24/2030254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Edge Accused of Sneakily Importing Firefox Data In Windows 10
by Peter Reutemann 24 Jun '20

24 Jun '20

'Some Firefox users have discovered that the new default Windows 10 browser, which is shipped to their devices via Windows Update, sometimes imports the data from Mozilla's application even if they don't give their permission. Softpedia reports: Some of these Firefox users decided to kill the initial setup process of Microsoft Edge, only to discover that despite the wizard shutting down prematurely, the browser still copied data stored by Mozilla's browser. Several users confirmed on reddit that this behavior happened on their computers too. Microsoft has remained tight-lipped on this, so for the time being, it's still not known why Edge imports Firefox data despite the initial wizard actually killed off manually by the user. Users who don't want to be offered the new Edge on Windows Update can turn to the dedicated toolkit that Microsoft released earlier this year, while removing the browser is possible by just uninstalling the update from the device.' -- source: https://news.slashdot.org/story/20/06/23/2027205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

80,000 Printers Are Exposing Their IPP Port Online
by Peter Reutemann 24 Jun '20

24 Jun '20

'In a report published earlier this month, security researchers from the Shadowserver Foundation, a non-profit organization focused on improving cyber-security practices across the world, have published a warning about companies that are leaving printers exposed online. More specifically, Shadowserver experts scanned all the four billion routable IPv4 addresses for printers that are exposing their IPP port. IPP stands for "Internet Printing Protocol" and, as the name suggests, is a protocol that allows users to manage internet-connected printers and send printing jobs to printers hosted online. The difference between IPP and the multiple other printer management protocols is that IPP is a secure protocol that supports advanced features such as access control lists, authentication, and encrypted communications. However, this doesn't mean that device owners are making use of any of these features. Shadowserver experts said they specifically scanned the internet for IPP-capable printers that were left exposed without being protected by a firewall and allowed attackers to query for local details via the "Get-Printer-Attributes" function. In total, experts said they usually found an average of around 80,000 printers exposing themselves online via the IPP port on a daily basis. The number is about an eighth of all IPP-capable printers currently connected online. A normal scan with the BinaryEdge search engine reveals a daily count of between 650,000 and 700,000 devices with their IPP port (TCP/631) reachable via the internet. What are the issues with not securing the IPP port? Shadowserver experts say this port can be used for intelligence gathering, since many of the printers scanned returned additional info about themselves, such as printer names, locations, models, firmware, organization names, and even Wi-Fi network names. "To configure IPP access control and IPP authentication features, users are advised to check their printers' manuals," adds ZDNet. "Most printers have an IPP configuration section in their administration panel from where users can enable authentication, encryption, and limit access to the device via access lists."' -- source: https://hardware.slashdot.org/story/20/06/23/2049236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ARM-Based Japanese Supercomputer is Now the Fastest in the World
by Peter Reutemann 24 Jun '20

24 Jun '20

'A Japanese supercomputer has taken the top spot in the biannual Top500 supercomputer speed ranking. Fugaku, a computer in Kobe co-developed by Riken and Fujitsu, makes use of Fujitsu's 48-core A64FX system-on-chip. It's the first time a computer based on ARM processors has topped the list. From a report: Fugaku turned in a Top500 HPL result of 415.5 petaflops, 2.8 times as fast as IBM's Summit, the nearest competitor. Fugaku also attained top spots in other rankings that test computers on different workloads, including Graph 500, HPL-AI, and HPCG. No previous supercomputer has ever led all four rankings at once. While fastest supercomputer rankings normally bounce between American- and Chinese-made systems, this is Japan's first system to rank first on the Top500 in nine years since Fugaku's predecessor, Riken's K computer. Overall there are 226 Chinese supercomputers on the list, 114 from America, and 30 from Japan. US-based systems contribute the most aggregate performance with 644 petaflops' -- source: https://tech.slashdot.org/story/20/06/23/1614232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

virtual meeting on Monday
by Peter Reutemann 23 Jun '20

23 Jun '20

Hi everyone Sorry, it's a bit late notice, but this week has been a hit hectic... And, yes, we have a meeting on Monday: Continuing with last month's Linux distribution showdown, we are having a look at these: - Tom Butz will show off GhostBSD, a BSD with a graphical user interface - Peter Reutemann will give his account on converting his laptop to Arch (through EndeavourOS) Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/266792013/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 4

Windows 10 Linux Subsystem: You Get GPU Acceleration -- With Intel, AMD, Nvidia Drivers
by Peter Reutemann 23 Jun '20

23 Jun '20

'Nvidia, Intel and AMD have announced their support for Microsoft's new effort to bring graphics processor support to the Windows 10 Windows Subsystem for Linux to enhance machine-learning training. From a report: GPU support for WSL arrived on Wednesday in the Dev Channel preview of Windows 10 build 20150 under Microsoft's reorganized testing structure, which lets it test Windows 10 builds that aren't tied to a specific future feature release. Microsoft announced upcoming GPU support for WSL a few weeks ago at Build 2020, along with support for running Linux GUI apps. The move on GPU access for WSL is intended to bring the performance of applications running in WSL2 up to par with those running on Windows. GPU compute support is the feature most requested by WSL users, according to Microsoft. The 20150 update includes support for Nvidia's CUDA parallel computing platform and GPUs, as well as GPUs from AMD and Intel. It also supports DirectML (Direct Machine Learning), Microsoft's Windows 10 API for hardware-accelerated machine learning. ' -- source: https://tech.slashdot.org/story/20/06/22/1349251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google To Start Fact-Checking Google Images
by Peter Reutemann 23 Jun '20

23 Jun '20

'In an effort to curb the spread of misinformation on its platform, Google said Monday it would begin to fact-check Google Images search results. From a report: The danger of text-based misinformation could be dwarfed by that posed by misleading, manipulated and outright fake photos and videos, including convincing "deepfakes" generated with the aid of artificial intelligence. The move, a first among major search engines, comes as tech firms continue to wrestle with how to address the misinformation that continue to run rampant on their platforms. Beginning Monday, Google will surface fact-check information in Google Images around the world, a similar effort to what is does in its regular search and news results.' -- source: https://tech.slashdot.org/story/20/06/22/1634217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Nvidia Engineer Releases Open-Sourced Vulkan Graphics Driver for the Raspberry Pi
by Peter Reutemann 22 Jun '20

22 Jun '20

'Earlier this year, the Raspberry Pi Foundation hooked up with Igalia to start development on an open-sourced Vulkan graphics driver for the Raspberry Pi. However, Martin Thomas, an engineer at Nvidia, beat them to the punch. Thomas announced yesterday via his personal Twitter that his RPi-VK-Driver is ready for primetime. The talented engineer had been working on the Vulkan driver in his spare time for more than two years. Technically, Thomas' iteration isn't a Vulkan driver per se because it doesn't comply with the official standards established by The Khronos Group. Nonetheless, the resourceful developer produced a driver that adheres to the Vulkan parameters as much as possible, and as close as the hardware would permit it. There's just one limitation with the RPi-VK-Driver though. Unlike the official Vulkan driver that's still in the works, Thomas' version is only compatible with the Broadcom VideoCore IV GPU that's found inside the Raspberry Pi 1, 2, 3 and Zero devices.' -- source: https://tech.slashdot.org/story/20/06/21/185227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Anyone Can Build This Open Source, DRM-Free Kindle Alternative
by Peter Reutemann 21 Jun '20

21 Jun '20

'It’s harder to get an open source e-reader than you might think. Kindles are popular, but they lock you into Amazon’s ecosystem. Amazon’s books come with digital rights protection and the company can remove them from your device whenever it wants. Those problems exist on tablets from Barnes and Nobles, Google, and Apple, too. When it comes to open source reading, there’s just no good options. The Open Book Project wants to change that. As first spotted by Hackster.io, “the Open Book aims to be a simple device that anyone with a soldering iron can build for themselves,” designer Joey Castillo said on the GitHub repository for the project. Castillo is still prototyping the device, and his goal is to build an e-reader that anyone can redesign, recode, or accessorize as they see fit. Of course, it should be able to read books in any format, from ePub to MOBI and everything in between. Castillo’s prototype is built from a circuit board of his own design. The design works in the Adafruit Feather ecosystem, a user friendly set of development boards and electronics. Castillo has listed all the parts you’ll need to build your own open source e-reader and tweak the design on his GitHub. (Castillo is still working on the device’s firmware, so you’ll have to write it yourself or wait for a release.)' -- source: https://www.vice.com/en_us/article/7x5kpb/anyone-can-build-this-open-source… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AI Magic Comes At A Price
by Lawrence D'Oliveiro 20 Jun '20

20 Jun '20

Interview with a software developer <https://www.theregister.com/2020/06/19/generative_adversarial_networks_are_…> about the pitfalls of using Generative Adversarial Networks (GANs) for the specific task of adding colour to old monochrome images. You can get them to produce good results most of the time, then every now and then they will go wrong in some weird and unsettling way: "GANs would spit out very weird specific glitches like odd splashes of colour on someone's hand and it made them look creepy," he told us. In some examples, people have turned an eerie alien green. And trying to tweak things manually can just as easily make things worse as better. He offers an open-source version of his product here <https://github.com/jantic/DeOldify>. Note the Jupyter notebooks. ;)

1 0

Lawsuit vs. Western Digital wants to end any use of SMR in NAS drives
by Peter Reutemann 19 Jun '20

19 Jun '20

'Law firm Hattis & Lukacs has filed an amendment to its class-action lawsuit against Western Digital for including SMR technology in its WD Red line of NAS drives. The amendment adds five more named plaintiffs from five new states, and it includes significant additional technical detail. If you aren't up to date on the SMR saga, this is one article in an ongoing series. The short version: SMR—Shingled Magnetic Recording—is a relatively new hard drive recording technology that allows higher data densities. It does so by laying down overlapping tracks—like shingles on a roof—with a write head that's wider than the read head. Unfortunately, this technology makes rewriting existing disk sectors agonizingly slow in many cases—rewriting a single 4KiB sector will generally mean needing to both read and rewrite an entire 256MiB zone. The original American class-action suit (there's a Canadian one as well) had a single named plaintiff, Wisconsin's Nicholas Malone. The amendment features five new plaintiffs, each from a different state, and tells each plaintiff's story in detail. New York plaintiff Steve Gravel's story is particularly wince-inducing—he wasn't just using the drives for photo and movie storage; he had an iSCSI target on his QNAP NAS, and the performance decrease when he replaced CMR drives with SMR was, as you might expect, terrible.' -- source: https://arstechnica.com/information-technology/2020/06/lawsuit-vs-western-d… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google pushes “text fragment links” with new Chrome extension
by Peter Reutemann 19 Jun '20

19 Jun '20

'Google has been cooking up an extension to the URL standard called "Text Fragments." The new link style will allow you to link not just to a page but to specific text on a page, which will get scrolled to and highlighted automatically once the page loads. It's like an anchor link, but with highlighting and creatable by anyone. The feature has actually been supported in Chrome since version 80, which hit the stable channel in February. Now a new extension from Google makes it easy to create this new link type, which will work for anyone else using Chrome on desktop OSes and Android. Google has proposed the idea to the W3C and hopes other browsers will adopt it, but even if they don't, the links are backward-compatible.' -- source: https://arstechnica.com/gadgets/2020/06/google-pushes-text-fragment-links-w… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Massive Spying on Users of Google's Chrome Shows New Security Weakness
by Peter Reutemann 19 Jun '20

19 Jun '20

'A newly discovered spyware effort attacked users through 32 million downloads of extensions to Google's market-leading Chrome web browser, researchers at Awake Security told Reuters, highlighting the tech industry's failure to protect browsers as they are used more for email, payroll and other sensitive functions. From a report: Google said it removed more than 70 of the malicious add-ons from its official Chrome Web Store after being alerted by the researchers last month. "When we are alerted of extensions in the Web Store that violate our policies, we take action and use those incidents as training material to improve our automated and manual analyses," Google spokesman Scott Westover told Reuters. Most of the free extensions purported to warn users about questionable websites or convert files from one format to another. Instead, they siphoned off browsing history and data that provided credentials for access to internal business tools. Based on the number of downloads, it was the most far-reaching malicious Chrome store campaign to date, according to Awake co-founder and chief scientist Gary Golomb.' -- source: https://yro.slashdot.org/story/20/06/18/1341219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AWS Said It Mitigated a 2.3 Tbps DDoS Attack, the Largest Ever
by Peter Reutemann 18 Jun '20

18 Jun '20

'Amazon said its AWS Shield service mitigated the largest DDoS attack ever recorded, stopping a 2.3 Tbps attack in mid-February this year. The incident was disclosed in the company's AWS Shield Threat Landscape [PDF], a report detailing web attacks mitigated by Amazon's AWS Shield protection service. The report didn't identify the targeted AWS customer but said the attack was carried out using hijacked CLDAP web servers and caused three days of "elevated threat" for its AWS Shield staff. [...] The previous record for the largest DDoS attack ever recorded was of 1.7 Tbps, mitigated by NETSCOUT Arbor in March 2018. Before that, the biggest DDoS attack ever recorded was a 1.3 Tbps DDoS attack that hit GitHub, a month before, in February 2018.' -- source: https://it.slashdot.org/story/20/06/17/1958227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Medical Device Maker Threatens iFixit Over Ventilator Repair Project
by Peter Reutemann 18 Jun '20

18 Jun '20

'STERIS Corporation, a company that makes sterilization and other medical equipment, sent a letter to iFixit claiming their online database of repair manuals for ventilators and medical equipment violates their copyrights. Motherboard reports: "It has come to my attention that you have been reproducing certain installation and maintenance manuals relating to our products, documentation which is protected by copyright law," the letter said. The letter then went on to tell [Kyle Wiens, CEO of iFixit] to remove all Steris copyrighted material from the iFixit website within 10 days of the letter. As Motherboard reported in March, major manufacturers of medical devices have long made it difficult for their devices to be repaired through third party repair professionals. Manufacturers have often lobbied against right to repair legislation and many medical devices are controlled by artificial "software locks" that allow only those with authorization to make modifications. "I'm disappointed that Steris is resorting to legal threats to stop hospitals from having access to information about how to maintain critical sterilization equipment during a pandemic," Wiens told Motherboard in an email. "No manufacturer should be stopping hospitals from repairing their equipment," Wiens said. "The best way to ensure patient safety is to make sure that equipment is being maintained regularly using the manufacturer's recommended procedures. The only way to do that is if hospitals have up to date manuals." With regards to the letter sent by Steris, Wiens said iFixit has not removed any material from its website. "We explained to Steris that what we did is a lawful and protected fair use under the U.S. Copyright act," Wiens said. "iFixit is protected by Section 512 of the Digital Millennium Copyright Act, which allows online platforms to host content contributed by users provided they comply with the Act's requirements, which iFixit does," a letter to Steris from the Electronic Frontier Foundation on behalf of iFixit said.' -- source: https://science.slashdot.org/story/20/06/17/2013232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Zoom To Launch End-to-End Encryption For All Users -- Not Just Paid Accounts
by Peter Reutemann 18 Jun '20

18 Jun '20

'Weeks after Zoom said it will offer end-to-end encryption to only paying customers -- a move that was received poorly by several privacy and security advocates, the popular video calling software said on Wednesday it is making some amendments: We are also pleased to share that we have identified a path forward that balances the legitimate right of all users to privacy and the safety of users on our platform. This will enable us to offer E2EE (end-to-end encryption) as an advanced add-on feature for all of our users around the globe -- free and paid -- while maintaining the ability to prevent and fight abuse on our platform. To make this possible, Free/Basic users seeking access to E2EE will participate in a one-time process that will prompt the user for additional pieces of information, such as verifying a phone number via a text message. Many leading companies perform similar steps on account creation to reduce the mass creation of abusive accounts. We are confident that by implementing risk-based authentication, in combination with our current mix of tools -- including our Report a User function -- we can continue to prevent and fight abu' -- source: https://yro.slashdot.org/story/20/06/17/1631222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

CEO of Open Technology Fund Resigns After Closed-Source Lobbying Effort
by Peter Reutemann 18 Jun '20

18 Jun '20

'The head of the Open Technology Fund (OTF) Corporation, which funds internet freedom projects and technologies, resigned Wednesday because she said she became aware of a lobbying effort that would push the group's funds toward closed-source tools rather than the open-source ones it has traditionally championed. From a report: In a resignation email sent to an OTF mailing list, Libby Liu, the inaugural OTF CEO, mentioned that the Trump administration had recently sworn in Michael Peck as the new head of the U.S. Agency for Global Media (USAGM), which is the OTF's grantor. She said that she learned of lobbying efforts to push money to closed-source tools. "As you all know, OTF's flexible, transparent, and competitive funding model has been essential to our success in supporting the most secure and effective internet freedom technologies and innovative projects available," she wrote. "I have become aware of lobbying efforts to convince the new USAGM [U.S. Agency for Global Media] CEO to interfere with the current FY2020 OTF funding stream and redirect some of our resources to a few closed-source circumvention tools."' -- source: https://news.slashdot.org/story/20/06/17/1946213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla, EFF, 19,000 Citizens Urge Zoom To Reverse End-to-End Encryption Decision
by Peter Reutemann 17 Jun '20

17 Jun '20

'Mozilla, Electronic Frontier Foundation (EFF), and more than 19,000 internet users today urged Zoom CEO Eric Yuan to reverse his decision to deny end-to-end encryption to users of its free service end-to-end encryption, saying it puts activists and other marginalized groups at risk. Earlier this month, Zoom announced it will offer end-to-end encryption, but only to those who pay. From a statement: The pressure to reverse the decision comes as racial justice activists are using tools like Zoom to organize protests. Without end-to-end encryption, information shared in their online meetings could be intercepted -- a concern that has been legitimized by both recent actions by law enforcement and a long-term history of discriminatory policing. Mozilla and EFF today are presenting an open letter to Yuan, co-signed by 19,000 people, maintaining that privacy and best-in-class security should be the default, not something that only the wealthy or businesses can afford. ' -- source: https://tech.slashdot.org/story/20/06/16/1643214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ripple20 Vulnerabilities Will Haunt the IoT Landscape For Years To Come
by Peter Reutemann 17 Jun '20

17 Jun '20

'Cyber-security experts have revealed today 19 vulnerabilities in a small library designed in the 90s that has been widely used and integrated into countless of enterprise and consumer-grade products over the last 20+ years. From a report: Affected products include smart home devices, power grid equipment, healthcare systems, industrial gear, transportation systems, printers, routers, mobile/satellite communications equipment, data center devices, commercial aircraft devices, various enterprise solutions, and many others. Experts now fear that all products using this library will most likely remain unpatched due to complex or untracked software supply chains. Problems arise from the fact that the library was not only used by equipment vendors directly but also integrated into other software suites, which means that many companies aren't even aware that they're using this particular piece of code, and the name of the vulnerable library doesn't appear in their code manifests.' -- source: https://it.slashdot.org/story/20/06/16/179230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Partners With Parallels To Bring Windows Apps To Chrome OS
by Peter Reutemann 17 Jun '20

17 Jun '20

'For years, Parallels has provided virtualization software so you could run full Windows installs on a Mac, but today they're tackling a new OS. From a report: The company just announced that it is partnering with Google to work on bringing full Windows application support to Chrome OS enterprise devices. That's a big deal for the many businesses out there that run various pieces of legacy Windows software -- or just any business that wants to run Microsoft's Office software natively. It could Chrome OS devices a lot more viable in a variety of workspaces that may have previously had to rely on Windows hardware, though of course that'll depend on how well it is implemented. How exactly this will work remains to be seen; Parallels only said that partnership would "seamlessly add full-featured Windows apps, including Microsoft Office, to Chromebook Enterprise devices."' -- source: https://tech.slashdot.org/story/20/06/16/2059248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel Will Soon Bake Anti-malware Defenses Directly Into its CPUs
by Peter Reutemann 16 Jun '20

16 Jun '20

'The history of hacking has largely been a back-and-forth game, with attackers devising a technique to breach a system, defenders constructing a countermeasure that prevents the technique, and hackers devising a new way to bypass system security. On Monday, Intel is announcing its plans to bake a new parry directly into its CPUs that's designed to thwart software exploits that execute malicious code on vulnerable computers. From a report: Control-Flow Enforcement Technology, or CET, represents a fundamental change in the way processors execute instructions from applications such as Web browsers, email clients, or PDF readers. Jointly developed by Intel and Microsoft, CET is designed to thwart a technique known as return-oriented programming, which hackers use to bypass anti-exploit measures software developers introduced about a decade ago. While Intel first published its implementation of CET in 2016, the company on Monday is saying that its Tiger Lake CPU microarchitecture will be the first to include it. ROP, as return-oriented programming is usually called, was software exploiters' response to protections such as Executable Space Protection and address space layout randomization, which made their way into Windows, macOS, and Linux a little less than two decades ago. These defenses were designed to significantly lessen the damage software exploits could inflict by introducing changes to system memory that prevented the execution of malicious code. Even when successfully targeting a buffer overflow or other vulnerability, the exploit resulted only in a system or application crash, rather than a fatal system compromise.' -- source: https://it.slashdot.org/story/20/06/15/1453215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Meet the Big Tech Critic Behind Hey, Basecamp's Radical New Email Platform
by Peter Reutemann 16 Jun '20

16 Jun '20

'The Basecamp cofounder and creator of web application framework Ruby on Rails David Heinemeier Hansson has become increasingly outspoken about Big Tech's privacy violations and monopolistic tendencies. Now he's inviting you to join the cause -- by switching your email provider. From a report: Two years ago, he and fellow Basecamp cofounder and CEO Jason Fried decided to do something about it. The culmination of that work is a paid, $99-per-year email service called Hey, which launches today. Along with protecting users from the types of invasive surveillance tactics that have become de rigueur online, Hey also contains some radical ideas about the way that modern correspondence should work. Silicon Valley will be watching the product closely: Consumers like to say they value their privacy, but are they finally willing to pay for it? [...] Most people haven't tried a new email service since Gmail launched 16 years ago, if not earlier. A handful of startups have played around with email interfaces in the years since, trying to make the experience cleaner and mobile-friendly, but no one has touched concepts as foundational as the inbox itself. Hansson and Fried argue that now is the time to do just that. They have made several radical changes to the inbox, the most glaring of which is that you, the email recipient, have control over who is allowed to appear there. That means you screen all first-time senders. They've also separated out what they call the "The Feed" and the "Paper Trail," so that there are distinct places for emails like newsletters and shipping confirmation notices. Because The Feed requires opt-in confirmation, it's much more pleasant to browse than Gmail's cluttered Promotions tab. It's also more private: Hey strips incoming messages of the tracking tools known as spy pixels that have become common practice in many emails. (The service indicates any emails that originally had tracking capabilities by displaying a small binoculars icon next to them.)' -- source: https://yro.slashdot.org/story/20/06/15/2034209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Chrome Criticized Over 'Senseless Attack on the URL Bar'
by Peter Reutemann 16 Jun '20

16 Jun '20

'The site Android Police is calling out new feature flags in Chrome's early-release Dev and Canary channels (V85) "which modify the appearance and behavior of web addresses in the address bar." The main flag is called "Omnibox UI Hide Steady-State URL Path, Query, and Ref" which hides everything in the current web address except the domain name... There are two additional flags that modify this behavior. One reveals the full address once you hover over the address bar (instead of having to click it), while the other only hides the address bar once you interact with the page... There's no public explanation yet for why Google is pressing ahead with these changes, but the company has said in the past that it believes showing the full address can make it harder to tell if the current site is legitimate. "Showing the full URL may detract from the parts of the URL that are more important to making a security decision on a webpage," Chromium software engineer Livvie Lin said in a design document earlier this year. However, it's also worth considering that making the web address less important, as this feature does, benefits Google as a company. Google's goal with Accelerated Mobile Pages (AMP) and similar technologies is to keep users on Google-hosted content as much as possible, and Chrome for Android already modifies the address bar on AMP pages to hide that the pages are hosted by Google. Modifying addresses on the desktop is another step towards making them irrelevant, which hurts the decentralized nature of the internet as a whol' -- source: https://tech.slashdot.org/story/20/06/14/192227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

regular meetings starting July
by Peter Reutemann 15 Jun '20

15 Jun '20

Hi everyone This morning I received confirmation that the university will be allowing evening meetings again on campus (assuming that the COVID19 situation doesn't change for the worse). The start date is Monday, July 13th, which is the start date of B trimester. In theory, regular WLUG and Python meetings would start up again in July. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Does the Internet Need a New Architecture that Puts Users First?
by Peter Reutemann 15 Jun '20

15 Jun '20

'Two VoIP pioneers argue in a Wired opinion piece that "Treating the internet like a public utility only bolsters the platform giants," adding "A more secure model starts with control by the people." As we rely on the internet more and more for work, social connections, and basic needs, it is time to talk about the future of meaningful online experiences, and the need for a new internet architecture. We need a user-focused, localized internet. This competitive architecture would deliver an experience that values real-time connectivity over one-way advertising and puts control with the user, not with big tech platforms. This paradigm would flip the model on its head, letting people start with complete privacy and security, and from there allow them to open their channels depending on trust level. It inverts the terms of service, where instead of any platform imposing them on users, users impose theirs terms on the platform. A new architecture that competes with the "public" internet is completely possible, and it begins with a policy approach that fosters the necessary innovation and investment, while allowing for flexibility and experimentation. Fixing the internet is not rooted in treating it like a public utility; it is not to be found in micromanagement by government. In fact, those very backward-looking policies only fuel more harm by protecting the status quo, which is likely why big tech platforms have been so fervently pushing for them... As we argued in challenges to the 2015 Federal Communications Commission's public-utility-based Net Neutrality rules, this also kills investment, startups, and new innovation... [T]he public internet we experience today created the trillion-dollar tech platforms, but it allows for a few entities in Silicon Valley to colonize the entire planet and kill consumer choice. Six companies control 43 percent of all internet traffic. Of those six, three — Google, Facebook, and Amazon — receive 70 percent of all digital ad revenue in the U.S... Exposing everyone to the equivalent of homelessness online for the purposes of selling advertising already exceeds the tolerance of most of us. There exist more valuable uses of connectivity in support of human productivity than conjuring ever expanding modes of performance and creepy surveillance to drive advertising revenue' -- source: https://tech.slashdot.org/story/20/06/14/049230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GitHub, Android, Python, Go: More Software Adopts Race-Neutral Terminology
by Peter Reutemann 15 Jun '20

15 Jun '20

'The terms 'allowlist' and 'blocklist' describe their purpose, while the other words use metaphors to describe their purpose," reads a change description on the source code for Android -- from over a year ago. 9to5Mac calls it "a shortened version of Google's (internal-only) explanation" for terminology changes which are now becoming more widespread. And Thursday GitHub's CEO said they were also "already working on" renaming the default branches of code from "master" to a more neutral term like "main," reports ZDNet: GitHub lending its backing to this movement effectively ensures the term will be removed across millions of projects, and effectively legitimizes the effort to clean up software terminology that started this month. But, in reality, these efforts started years ago, in 2014, when the Drupal project first moved in to replace "master/slave" terminology with "primary/replica." Drupal's move was followed by the Python programming language, Chromium (the open source browser project at the base of Chrome), Microsoft's Roslyn .NET compiler, and the PostgreSQL and Redis database systems... The PHPUnit library and the Curl file download utility have stated their intention to replace blacklist/whitelist with neutral alternatives. Similarly, the OpenZFS file storage manager has also replaced its master/slave terms used for describing relations between storage environments with suitable replacements. Gabriel Csapo, a software engineer at LinkedIn, said on Twitter this week that he's also in the process of filing requests to update many of Microsoft's internal libraries. A recent change description for the Go programming language says "There's been plenty of discussion on the usage of these terms in tech. I'm not trying to have yet another debate." It's clear that there are people who are hurt by them and who are made to feel unwelcome by their use due not to technical reasons but to their historical and social context. That's simply enough reason to replace them. Anyway, allowlist and blocklist are more self-explanatory than whitelist and blacklist, so this change has negative cost. That change was merged on June 9th -- but 9to5Mac reports it's just one of many places these changes are happening. "The Chrome team is beginning to eliminate even subtle forms of racism by moving away from terms like 'blacklist' and 'whitelist.' Google's Android team is now implementing a similar effort to replace the words 'blacklist' and 'whitelist.'" And ZDNet reports more open source projects are working on changing the name of their default Git repo from "master" to alternatives like main, default, primary, root, or another, including the OpenSSL encryption software library, automation software Ansible, Microsoft's PowerShell scripting language, the P5.js JavaScript library, and many others.' -- source: https://developers.slashdot.org/story/20/06/14/1722223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bypassing DRM On Your Fridge
by Lawrence D'Oliveiro 14 Jun '20

14 Jun '20

Certain refrigerators made by General Electric in the US <https://www.theregister.com/2020/06/13/ge_refrigerator_drm_keeps_turning/> have an RFID chip in their water filters to ensure that you only replace them with genuine GE parts. People have figured out how to hack this so cheaper third-party replacement filters will work, and now there is a website explaining the procedure. Quote: The GE website suggests that a water filter is a good idea to avoid exposure to unfiltered water and sediment, inadvertently offering a sad commentary on public water infrastructure and government funding priorities. I wonder how the lead levels are in the Flint, Michigan water supply these days ...

1 0

OpenZFS Removed Offensive Terminology From Its Code
by Peter Reutemann 13 Jun '20

13 Jun '20

'On Wednesday evening, ZFS founding developer Matthew Ahrens submitted what should have been a simple, non-controversial pull request to the OpenZFS project: wherever possible without causing technical issues, the patch removed references to "slaves" and replaced them with "dependents." This patch in question doesn't change the way the code functions -- it simply changes variable names in a way that brings them in conformance with Linux upstream device-mapper terminology, in 48 total lines of code (42 removed and 48 added; with one comment block expanded slightly to be more descriptive). But this being the Internet, unfortunately, outraged naysayers descended on the pull request, and the comments were quickly closed to non-contributors. I first became aware of this as the moderator of the r/zfs subreddit where the overflow spilled once comments on the PR itself were no longer possible. "The horrible effects of human slavery continue to impact society," writes Ahrens in his pull request. "The casual use of the term 'slave' in computer software is an unnecessary reference to a painful human experience." Ahrens' pull request has been reviewed by fellow lead developers Brian Behlendorf and Ryan Moeller and merged into the OpenZFS project repository.' -- source: https://developers.slashdot.org/story/20/06/12/0543254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Internet Archive Kills Its Free Digital Library Over Copyright Concerns
by Peter Reutemann 13 Jun '20

13 Jun '20

'The Internet Archive's National Emergency Library is finished. The non-profit repository for digital preservation, which began offering millions of e-books for free to address the closure of libraries during the pandemic, buckled under a joint lawsuit filed by major publishers including Penguin Random House and HarperCollins. From a report: Publishers said lending out books without compensation was "mass copyright infringement." The digital library will close next week. The archive of books was initially invite-only and only allowed a given file to be downloaded a limited number of times at once, with each rental limited to 14 days. But then the pandemic hit and libraries closed, so the Internet Archive responded by making all the books accessible to everyone, with no limits.' -- source: https://news.slashdot.org/story/20/06/12/1411237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New FreeBSD Code of Conduct
by Peter Reutemann 13 Jun '20

13 Jun '20

'FreeBSD has has adopted a new LLVM-derived code of conduct. The code of conduct requires users to: be friendly and patient, be welcoming, be considerate, be respectful, be careful in the words that you choose and be kind to others, when we disagree, try to understand why. This isn't an exhaustive list of things that you can't do. Rather, take it in the spirit in which it's intended - a guide to make it easier to communicate and participate in the community. This code of conduct applies to all spaces managed by the FreeBSD project. This includes online chat, mailing lists, bug trackers, FreeBSD events such as the developer meetings and socials, and any other forums created by the project that the community uses for communication. It applies to all of your communication and conduct in these spaces, including emails, chats, things you say, slides, videos, posters, signs, or even t-shirts you display in these spaces. In addition, violations of this code outside these spaces may, in rare cases, affect a person's ability to participate within them, when the conduct amounts to an egregious violation of this code.' -- source: https://developers.slashdot.org/story/20/06/12/1430203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Canonical Releases Important Ubuntu Kernel Security Updates, Patch Now
by Peter Reutemann 12 Jun '20

12 Jun '20

'Canonical already released the other day a new version of the intel-microcode firmware to mitigate the latest Intel vulnerabilities, but now it also published new versions of the Linux kernel for all supported Ubuntu releases, including Ubuntu 20.04 LTS, Ubuntu 19.10, Ubuntu 18.04 LTS, and Ubuntu 16.04 LTS. Apart from mitigating the Intel SRBDS/CrossTalk vulnerability (CVE-2020-0543), the new Linux kernel security updates fix race conditions (CVE-2020-12114) discovered by Piotr Krysiuk in the file system implementation, which lets a local attacker cause a denial of service (system crash).' -- source: https://www.linuxtoday.com/security/canonical-releases-important-ubuntu-ker… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hands on with Android 11 Beta 1—A new media player and suggested apps
by Peter Reutemann 12 Jun '20

12 Jun '20

'Android 11's first "beta" release is finally out after numerous delays. The beta release works on the Pixel 2, 3, 3a, and 4, and enrolling for the beta OTA at google.com/android/beta. is super easy. Previously, the Android beta has launched simultaneously on plenty of third-party devices, but that's not the case this year. So far, OnePlus has also shipped the beta, and that's about it. Google says that more devices are coming "in the coming weeks." The Android 11 Beta has gone through a wild ride. First, it was supposed to debut at the Shoreline Amphitheater for Google I/O in May 12, but the physical event was canceled due to the coronavirus outbreak. Then it was supposed to debut in an online version of Google I/O, but that was canceled, too, as everyone was still trying to deal with the logistics problems the new shelter-in-place requirements. With no release in May, a surprise fourth preview release of Android 11 was created, and the Beta was delayed until June 3, when Google would hold an online event for "The Android 11 Beta Launch Show." The online Android 11 launch show was delayed, too, due to the ongoing nationwide protests against police brutality and the death of George Floyd. In its latest blog post, Google says the online launch show is also canceled entirely, and, surprise, the company is pressing the launch button now with zero fanfare. Not since Google canceled the launch of the Nexus 4 due to Hurricane Sandy in 2012 has a Google launch been such a hot, hot mess. With the Android 11 Beta finally go for launch, we're still seeing a bit of a mini I/O, even though every event is canceled. Google posted two blog posts, lots of documentation, and 12 videos covering new aspects of Android 11. The company is also planning "11 weeks of Android," a series that will see new developer talks posted each week. So far, the lack of fanfare seems appropriate for Android 11, which seems like a smaller release than we've gotten in previous years. This beta only has two new standout features we can point to.' -- source: https://arstechnica.com/gadgets/2020/06/hands-on-with-android-11-beta-1-a-n… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

UPnP flaw exposes millions of network devices to attacks over the Internet
by Peter Reutemann 12 Jun '20

12 Jun '20

'Millions of routers, printers, and other devices can be remotely commandeered by a new attack that exploits a security flaw in the Universal Plug and Play network protocol, a researcher said. CallStranger, as the exploit has been named, is most useful for forcing large numbers of devices to participate in distributed denial of service—or DDoS—attacks that overwhelm third-party targets with junk traffic. CallStranger can also be used to exfiltrate data inside networks even when they’re protected by data loss prevention tools that are designed to prevent such attacks. The exploit also allows attackers to scan internal ports that would otherwise be invisible because they’re not exposed to the Internet. Billions of routers and other so-called Internet-of-things devices are susceptible to CallStranger, Yunus Çadırcı, a Turkish researcher who discovered the vulnerability and wrote the proof-of-concept attack code that exploits it, wrote over the weekend. For the exploit to actually work, however, a vulnerable device must have UPnP, as the protocol is known, exposed on the Internet. That constraint means only a fraction of vulnerable devices are actually exploitable.' -- source: https://arstechnica.com/information-technology/2020/06/upnp-flaw-exposes-mi… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux distro review: System76’s Ubuntu-based Pop!_OS
by Peter Reutemann 12 Jun '20

12 Jun '20

'The subject of today's Linux distro review is perhaps one of a kind—as far as we know, Pop!_OS is the first Linux distribution to be created and maintained by a hardware OEM manufacturer. At the very least, it's the first one anyone has taken seriously. That hardware manufacturer is System76, probably the world's best-known Linux-only laptop manufacturer. Some larger OEMs offer Linux as an alternative operating system on a few models—but System76 sells Linux systems, and only Linux systems. Until 2017, System76 sold its systems preinstalled with Ubuntu Linux. But Canonical left the company cold when it decided to stop development on its Unity desktop environment and move back to Gnome3—and, controversially, System76 decided that instead of merely adding its own private repository and a few packages to a stock Ubuntu install, it would create and manage its own Ubuntu-derived distribution. Crucially, the new distribution would not just be for System76 hardware. Although the company uses the new distro to simplify and retain more control over its hardware setup, it designed Pop!_OS to be a real distro suitable for use—and encouraged for use—on any Linux PC, whether purchased from System76 or not.' -- source: https://arstechnica.com/gadgets/2020/06/linux-distro-review-system76s-ubunt… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

System76 Launches AMD Ryzen-Powered 'Serval WS' Portable Linux Workstation
by Peter Reutemann 12 Jun '20

12 Jun '20

'Linux computer maker/seller System76 has been offering AMD processors in its Thelio desktop computers, but believe it or not, the company has never offered an AMD-powered laptop -- until now, that is. From a report: You see, starting today, you can buy a "Serval WS" powered by AMD. No, System76 is not offering mobile Ryzen chips in this laptop, but instead, desktop-class processors. As you can expect, this 15-inch portable Linux workstation is quite chunky and heavy as a result. With that said, it is simply impossible to cram this much power into a thin and light notebook. "The Serval WS comes with either the 3rd Gen Ryzen 3600, 3700X, or 3900 CPU. The latter is equipped with 12 Cores and 24 Threads, making this laptop perfect for taking on heavy computational loads. Having this kind of desktop-caliber power in a laptop body helps if you need to run complex simulations at your desk or quickly render 3D scenes while on the road. AMD CPUs are also known for having the an extremely high price per performance, which means you get maximum bang-for-buck," says System76. The laptop starts at $1,300 -- and BetaNews has all the specs.' -- source: https://linux.slashdot.org/story/20/06/11/1634258 CHeers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Activists Rally To Save Internet Archive as Lawsuit Threatens Site
by Peter Reutemann 12 Jun '20

12 Jun '20

'The Internet Archive is a massive endeavor -- it's an online library aiming to "provide Universal Access to All Knowledge." It has digitized millions of web pages, movies, photos, recordings, software programs, and books that might otherwise be lost to history. But it's neither un-censorable nor outside the bounds of copyright law. And now open internet supporters are wondering how to save it before it disappears. ' -- source: https://yro.slashdot.org/story/20/06/11/194226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android 11 Will Help You Rein In Zombie App Permissions
by Peter Reutemann 11 Jun '20

11 Jun '20

'With 2.5 billion users worldwide, Google has a responsibility to make its Android operating system as secure as possible. But the company has at times struggled to adequately vet apps in the Google Play Store, allowing malicious programs through that thousands or millions of users go on to download. With Google's release of the Android 11 Beta on Wednesday, though, the company is taking steps to make it even more difficult for rogue apps to grab your data even when they do slip by. From a report: Google has worked for years to incrementally tighten Android security under the hood. And the release of Android 11 is particularly focused on expanding privacy improvements to give you more control over what your apps can access and giving more ways to distribute software updates across Android's fragmented and disjointed device population. Android 10 addressed some of this as well, requiring that app developers request permissions and then reaffirm user choices more often. Android 11 adds a feature that allows developer to request one-time permissions for things like the microphone, camera, or location as an alternative to all or nothing. You can share your location with a friend through a chat app once, for example, without granting indefinite location access, or having to remember to wade back into settings to revoke the permission later. "We can see that people are actually leveraging these features from Android 10 and thinking about their choices when they're giving apps access to permissions," says Charmaine D'Silva, an Android product manager who works on privacy. "So building on that this time we've added even more controls." Android 11 will also rein in apps that you don't use very often, automatically revoking permissions if you don't open it for a still undetermined period of time. If you start using the app again you can always reinstate its access, but the permission won't be lurking forgotten. Google plans to experiment with different cutoffs after 60-90 days, with the goal of eliminating stray permissions without breaking functionality.' -- source: https://yro.slashdot.org/story/20/06/10/1730228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Playing Around With the Fuchsia OS
by Peter Reutemann 11 Jun '20

11 Jun '20

'Security and software development company Quarkslab played around with Google's new Fuchsia operating system, which could one day replace Android on smartphones and Chrome OS on laptops. The researchers "decided to give a quick look at Fuchsia, learn about its inner design, security properties, strengths and weaknesses, and find ways to attack it." Here's what they concluded: Fuchsia's micro kernel is called Zircon. It is written in C++. [...] Contrary to every other major OS, it appears rather difficult to target the Zircon kernel directly. A successful RCE (Remote Code Execution) on the world-facing parts of the system (USB, Bluetooth, network stack, etc) will only give you control over the targeted components, but they run in independent userland processes, not in the kernel. From a component, you then need to escalate privileges to the kernel using the limited number of syscalls you can access with the handles you have. Overall, it seems easier to target other components rather than the kernel, and to focus on components that you can talk to via IPC and that you know have interesting handles. Overall, Fuchsia exhibits interesting security properties compared to other OSes such as Android. A few days of vulnerability research allowed us to conclude that the common programming bugs found in other OSes can also be found in Fuchsia. However, while these bugs can often be considered as vulnerabilities in other OSes, they turn out to be uninteresting on Fuchsia, because their impact is, for the most part, mitigated by Fuchsia's security properties. We note however that these security properties do not -- and in fact, cannot -- hold in the lowest layers of the kernel related to virtualization, exception handling and scheduling, and that any bug here remains exploitable just like on any other OS. All the bugs we found were reported to Google, and are now fixed. Again, it is not clear where Fuchsia is heading, and whether it is just a research OS as Google claims or a real OS that is vowed to be used on future products. What's clear, though, is that it has the potential to significantly increase the difficulty for attackers to compromise devices. ' -- source: https://tech.slashdot.org/story/20/06/10/008245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

KDE Plasma 5.19 Released
by Peter Reutemann 10 Jun '20

10 Jun '20

'The KDE community has released Plasma 5.19, the popular free and open-source desktop environment. "In this release, we have prioritized making Plasma more consistent, correcting and unifying designs of widgets and desktop elements; worked on giving you more control over your desktop by adding configuration options to the System Settings; and improved usability, making Plasma and its components easier to use and an overall more pleasurable experience," reads the announcement. For a complete list of what's new, you can visit the Plasma 5.19 changelog.' -- source: https://tech.slashdot.org/story/20/06/09/2035226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New CrossTalk Attack Impacts Intel's Mobile, Desktop, and Server CPUs
by Peter Reutemann 10 Jun '20

10 Jun '20

'Academics from a university in the Netherlands have published details today about a new vulnerability in Intel processors. From a report: The security bug, which they named CrossTalk, enables attacker-controlled code executing on one CPU core to leak sensitive data from other software running on a different core. The Vrije University's Systems and Network Security Group (VUSec) says the CrossTalk vulnerability is another type of MDS (microarchitectural data sampling) attack. MDS attacks target user data while in a "transient" state, as it's being processed inside the CPU and its many data-caching systems. More specifically, CrossTalk attacks data while it's being processed by the CPU's Line Fill Buffer (LBF), one of these aforementioned CPU cache systems. According to the VUSec team, the LBF cache actually works with a previously undocumented memory "staging buffer" that is shared by all CPU cores.' -- source: https://it.slashdot.org/story/20/06/09/1941205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Pinebook Pro review—a $200 FOSS-to-the-hilt magnesium-chassis laptop
by Peter Reutemann 10 Jun '20

10 Jun '20

Since we had our own demo of the Pinebook earlier this year, here is another take: 'In early March of this year, I ordered one of the FOSS-driven Pine64 project's newest designs—the Pinebook Pro. The company's manufacturing efforts have taken an enormous hit due to the impact of COVID-19 on its Chinese manufacturing partners, which kept me from receiving my Pinebook Pro until last week. Unfortunately, COVID-19 didn't merely slow down production. It also made QA impossible, which led to enough problems with my new laptop that it's going to need to be replaced. We'll talk about why that is in much greater detail later, but for right now, keep in mind that some parts of my experience aren't as-designed for the hardware. You should also keep in mind that the Pinebook isn't exactly a consumer product—it's a device aimed squarely at hobbyists and tinkerers with offbeat plans and limited budget. Most people will not want to replace their standard consumer laptop or Chromebook with a Pinebook Pro—but it's a fascinating look at what's possible in inexpensive hardware design with an intense focus on privacy, open source design, and community.' -- source: https://arstechnica.com/gadgets/2020/06/pinebook-pro-review-a-200-foss-to-t… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Plundering of crypto keys from ultrasecure SGX sends Intel scrambling again
by Peter Reutemann 10 Jun '20

10 Jun '20

'For the past two years, modern CPUs—particularly those made by Intel—have been under siege by an unending series of attacks that make it possible for highly skilled attackers to pluck passwords, encryption keys, and other secrets out of silicon-resident memory. On Tuesday, two separate academic teams disclosed two new and distinctive exploits that pierce Intel’s Software Guard eXtension, by far the most sensitive region of the company’s processors. Abbreviated as SGX, the protection is designed to provide a Fort Knox of sorts for the safekeeping of encryption keys and other sensitive data even when the operating system or a virtual machine running on top is badly and maliciously compromised. SGX works by creating trusted execution environments that protect sensitive code and the data it works with from monitoring or tampering by anything else on the system. Key to the security and authenticity assurances of SGX is its creation of what are called enclaves, or blocks of secure memory. Enclave contents are encrypted before they leave the processor and are written in RAM. They are decrypted only after they return. The job of SGX is to safeguard the enclave memory and block access to its contents by anything other than the trusted part of the CPU. Tuesday’s attacks aren’t the first to defeat SGX. In 2018, a different team of researchers broke into the fortified Intel region after building on an attack known as Meltdown, which, along with a similar attack known as Spectre, ushered in the flurry of processor exploits. A different team of researchers broke SGX earlier this year. Intel mitigated the earlier SGX vulnerability by introducing microcode updates. However, these mitigations did not last, as two new attacks have sent Intel scrambling anew to devise new defenses. Intel released the new updates on Tuesday and expects them to be available to end users in the coming weeks. Depending on the computer, the fix will either be installed automatically or will require manual intervention. Users, particularly those who rely on the SGX, should check with the manufacturer of their machine and ensure that the update is installed as soon as practical. The new SGX attacks are known as SGAxe and CrossTalk. Both break into the fortified CPU region using separate side-channel attacks, a class of hack that infers sensitive data by measuring timing differences, power consumption, electromagnetic radiation, sound, or other information from the systems that store it. The assumptions for both attacks are roughly the same. An attacker has already broken the security of the target machine through a software exploit or a malicious virtual machine that compromises the integrity of the system. While that’s a tall bar, it’s precisely the scenario that SGX is supposed to defend against.' -- source: https://arstechnica.com/information-technology/2020/06/new-exploits-plunder… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bryan Lunduke Explains Why Linux Sucks in 2020
by Peter Reutemann 09 Jun '20

09 Jun '20

'Roblimo once called it "a tradition, not just a speech" -- Bryan Lunduke's annual "Linux Sucks" presentations at various Linux conferences. But before you get too upset, in his 2014 interview with Slashdot Lunduke admitted "I love Linux, I have made my whole life around Linux. I work for Linux companies. I write for Linux magazines, but it really blows..." This year he's releasing a special YouTube version of Linux Sucks 2020, the first time Lunduke has attempted the talk without a live audience, "And it feels really wicked weird." But he's still trying to get a rise out of his audience. "Follow me on this into Journey Into Graphs and Numbers Land," Lunduke says playfully, pulling up one of his 160 x 90 pixel slides showing current market share for Windows, Mac, and then Linux "You might notice that some platforms have a higher market share than Linux does," he says with a laugh, describing one slide showing Linux as "scooping up the bottom of the barrel at 1.6%..." "But here's the thing. These numbers have been either consistent, or for Linux, slowly dropping." And then he puts up a graph showing the number of searches for Linux. "If you look back at 2004 -- the year 2004, 16 years ago -- that was the high point in interest in searching for the word Linux (or Linux plus other things). 2006 it was about half that -- so about two years later it had dropped down to about half. Here in 2020 it is so low, not only does it not fill up the first bar of pixels there, it's like only three pixels in. That doesn't happen -- that sort of decline does not happen -- unless the platform sucks. That's just the truth of the matter. That's just how it goes, right?"' -- source: https://linux.slashdot.org/story/20/06/07/1941256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

4 3

Vulnerabilities in Popular Open Source Projects Doubled in 2019
by Peter Reutemann 09 Jun '20

09 Jun '20

'A study that analyzed the top 54 open source projects found that security vulnerabilities in these tools doubled in 2019, going from 421 bugs reported in 2018 to 968 last year. From a report: According to RiskSense's "The Dark Reality of Open Source" report, released today, the company found 2,694 bugs reported in popular open source projects between 2015 and March 2020. The report didn't include projects like Linux, WordPress, Drupal, and other super-popular free tools, since these projects are often monitored, and security bugs make the news, ensuring most of these security issues get patched fairly quickly. Instead, RiskSense looked at other popular open source projects that aren't as well known but broadly adopted by the tech and software community. This included tools like Jenkins, MongoDB, Elasticsearch, Chef, GitLab, Spark, Puppet, and others. RiskSense says that one of the main problems they found during their study was that a large number of the security bugs they analyzed had been reported to the National Vulnerability Database (NVD) many weeks after they've been publicly disclosed. The company said it usually took on average around 54 days for bugs found in these 54 projects to be reported to the NVD, with PostgreSQL seeing reporting delays that amounted to eight months.' -- source: https://it.slashdot.org/story/20/06/08/1417259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Coffee Run--Blender Open Movie
by Lawrence D'Oliveiro 08 Jun '20

08 Jun '20

The latest annual short-feature project from the Blender Animation Studio came out week before last <https://www.youtube.com/watch?v=PVGeM40dABA>. At just about 3 minutes long, this one is done in the style of a 2D-rendered video game. But beware: there are some less-than-lighthearted elements behind the surface.

2 1

Brave Browser Mistake Adds Its Referrer Code For Cryptocurrency Sites
by Peter Reutemann 08 Jun '20

08 Jun '20

'The following report appeared on Yahoo! Finance: Privacy-focused browser Brave was found to autocomplete several websites and keywords in its address bar with an affiliate code. Shortly after a user published his findings, Brave CEO and co-founder Brendan Eich addressed the incident and called it "a mistake we're correcting." Eich said that while Brave is a Binance affiliate [a cryptocurrency exchange], the browser's autocompleting feature should not have added any new affiliate codes. "The autocomplete default was inspired by search query clientid attribution that all browsers do, but unlike keyword queries, a typed-in URL should go to the domain named, without any additions," Eich wrote in the thread. "Sorry for this mistake — we are clearly not perfect, but we correct course quickly," he added. Android Police reports the mistake occured more than 10 weeks ago — and that referrer codes were also included for other cryptocurrency-related sites: The browser's GitHub repository reveals the functionality was first added on March 25th, and the current list of sites includes Binance, Coinbase, Ledger, and Trezor. Brave Software receives a kickback for purchases/accounts made with those services — for example, Coinbase says that when you refer a new customer to the service, you can earn 50% of their fees for the first three months. The nature of these affiliate programs also allows the referrer — in this case, Brave Software — to view some amount of data about the customers who sign up with the code. Coinbase's program provides "direct access to your campaign's performance data," while Trezor offers a "detailed overview of purchases." Brave CEO and co-founder Brendan Eich (who also created the JavaScript programming language) tweeted, "For what it's worth there's a setting to disable the autocomplete defaults that add affiliate codes, in brave://settings first page. Current plan is to flip default to off as shown here. You can disable ahead of our release schedule if you want to. "Good to hear from supporters who'll enable it."' -- source: https://it.slashdot.org/story/20/06/07/2217224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ars Technica: We put Western Digital’s dreaded SMR Red drive to the test
by Peter Reutemann 08 Jun '20

08 Jun '20

'Western Digital has been receiving a storm of bad press—and even lawsuits—concerning their attempt to sneak SMR disk technology into their "Red" line of NAS disks. To get a better handle on the situation, Ars purchased a Western Digital 4TB Red EFAX model SMR drive and put it to the test ourselves.' -- source: https://arstechnica.com/gadgets/2020/06/western-digitals-smr-disks-arent-gr… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Java-Based Ransomware Targets Linux and Windows Systems
by Peter Reutemann 08 Jun '20

08 Jun '20

'"A newly uncovered form of ransomware is going after Windows and Linux systems," reports ZDNet, "in what appears to be a targeted campaign." Named Tycoon after references in the code, this ransomware has been active since December 2019 and looks to be the work of cyber criminals who are highly selective in their targeting. The malware also uses an uncommon deployment technique that helps stay hidden on compromised networks. The main targets of Tycoon are organisations in the education and software industries. Tycoon has been uncovered and detailed by researchers at BlackBerry working with security analysts at KPMG. It's an unusual form of ransomware because it's written in Java, deployed as a trojanised Java Runtime Environment and is compiled in a Java image file (Jimage) to hide the malicious intentions... [T]he first stage of Tycoon ransomware attacks is less uncommon, with the initial intrusion coming via insecure internet-facing Remote Desktop Protocol servers. This is a common attack vector for malware campaigns and it often exploits servers with weak or previously compromised passwords. Once inside the network, the attackers maintain persistence by using Image File Execution Options (IFEO) injection settings that more often provide developers with the ability to debug software. The attackers also use privileges to disable anti-malware software using ProcessHacker in order to stop removal of their attack... After execution, the ransomware encrypts the network with files encrypted by Tycoon given extensions including .redrum, .grinch and .thanos — and the attackers demand a ransom in exchange for the decryption key. The attackers ask for payment in bitcoin and claim the price depends on how quickly the victim gets in touch via email. The fact the campaign is still ongoing suggests that those behind it are finding success extorting payments from victims. ' -- source: https://linux.slashdot.org/story/20/06/06/0445235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Dropped for Open Source Again in Germany: Hamburg Follows Munich's Lead
by Peter Reutemann 08 Jun '20

08 Jun '20

'"The trend towards open-source software on government computers is gathering pace in Germany," reports ZDNet: In the latest development, during coalition negotiations in the city-state of Hamburg, politicians have declared they are ready to start moving its civil service software away from Microsoft and towards open-source alternatives. The declaration comes as part of a 200-page coalition agreement between the Social Democratic and Green parties, which will define how Hamburg is run for the next five years. It was presented on Tuesday but has yet to be signed off. The political parties in charge in Hamburg are the same as those in Munich, who recently agreed to revert back to that city's own open-source software. "With this decision, Hamburg joins a growing number of German states and municipalities that have already embarked on this path," said Peter Ganten, chairman of the Open Source Business Alliance, or OSBA, based in Stuttgart. He's referring to similar decisions made in Schleswig-Holstein, Thuringia, Bremen, Dortmund, and Munich. But, he adds: "The Hamburg decision is nevertheless remarkable because the city has always been more aggressively oriented towards Microsoft. "In the future we will aim to have more open-source software in digital management [systems] and we also want to develop our own code, which will remain open," the head of the local Hamburg-Mitte branch of the Greens, Farid Mueller, wrote on his website. Hamburg wants to be a leading example of digital independence, he stated. The article also adds a final interesting detail. A Microsoft spokeperson told a Germany technology site "that the company didn't see the desire for more open-source software as an attack on itself. Microsoft now also uses and develops a lot of open source and welcomed fair competition, the spokesperson added."' -- source: https://linux.slashdot.org/story/20/06/07/0147255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Eyes Decentralized Web-Based Videoconferencing Platform 'Meething'
by Peter Reutemann 08 Jun '20

08 Jun '20

'Last month Techcrunch reported that Mozilla had gone "full incubator" by holding a startup lab called Fix the Internet, followed by "a formal program dangling $75,000 investments in front of early-stage companies..." Fix the Internet had many key themes, including collaboration and decentralization (as well as user-controlled data and privacy-protecting social networks). That event "drew the interest of some 1,500 people in 520 projects, and 25 were chosen to receive the full package and stipend during the development of their minimum viable product (MVP). Below that, as far as pecuniary commitment goes, is the 'MVP Lab,' similar to the spring program but offering a total of $16,000 per team." And one of those MVP Lab teams is Meething, a new video conferencing and collaboration platform from the innovation lab ERA. Meething "aims to be more secure than existing video conferencing tools and run on a decentralized database engine and leverage peer-to-peer networking" according to ZDNet. In their video interview with CEO Mark Nadal, he outlined the following selling points: - Browser based video conferencing gives customers better options for security as well as branding. - Open source architecture is a win and the peer-to-peer networking is more efficient on compute costs. - Meething doesn't require downloads or apps that increase the security attack surface. The total addressable market for video conferencing is large and can support multiple players. Their press release quotes Mark Mayo, a former Chief Product Officer at Mozilla who served as Meething's mentor, arguing that video conferencing on the web "has long promised to enable a whole new world of online collaboration. Frankly, it hasn't delivered. It's been way too hard to build cool products with video and Meething aims to be the zero-barrier-to-entry platform that realizes this future. Soon, video conferencing won't suck!"' -- source: https://tech.slashdot.org/story/20/06/07/1739228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How SpaceX Uses Linux, Chromium, C++ and Open Source Libraries
by Peter Reutemann 07 Jun '20

07 Jun '20

'Long-time Slashdot reader mrflash818 ("Linux geek since 1999") shared a ZDNet article pointing out that SpaceX's Falcon 9 rocket has an onboard operating system that's "a stripped-down Linux running on three ordinary dual-core x86 processors. The flight software itself runs separately on each processor and is written in C/C++." Interestingly, back in 2018 a Slashdot headline asked whether C++ was "a really terrible language," and Elon Musk replied on Twitter with his single-word answer. "Yes." ZDNet points out that "ordinary" processors are often needed because of the multi-year development time for the spacecraft they power. Their article notes that the International Space Station actually runs on 1988-vintage 20 MHz Intel 80386SX CPUs: Of course, while those ancient chips work for the station's command and control multiplexer/demultiplexer, they're not much good for anything else. For ordinary day-in and day-out work, astronauts use HP ZBook 15s running Debian Linux, Scientific Linux, and Windows 10. The Linux systems act as remote terminals to the control multiplexer/demultiplexer, while the Windows systems are used for email, the web, and fun. Usually, though, chips that go into space aren't ordinary chips. CPUs that stay in space must be radiation-hardened. Otherwise, they tend to fail due to the effects of ionizing radiation and cosmic rays. These customized processors undergo years of design work and then more years of testing before they are certified for spaceflight. For instance, NASA expects its next-generation, general-purpose processor, an ARM A53 variant you may know from the Raspberry Pi 3, to be ready to run in 2021... The Dragon spacecraft's touchscreen interface is rendered using Chromium and JavaScript. If something were to go wrong with the interface, the astronauts have physical buttons to control the spacecraft. Today the SpaceX software team answered questions on Reddit, revealing they use Chromium with a reactive library developed in-house, and that "All of our on-board computers either run Linux (with the PREEMPT_RT patch) or are microcontrollers that run bare-metal code...." Later they emphasized that for the Falcon 9 and Dragon software, "All of the application-level autonomous software is written in C++. We generally use object oriented programming techniques from C++, although we like to keep things as simple as possible. "We do use open source libraries, primarily the standard C++ library, plus some others. However, we limit our use of open source libraries to only extremely high quality ones, and often will opt to develop our own libraries when it is feasible so that we can control the code quality ourselves."' -- source: https://science.slashdot.org/story/20/06/06/2023249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linux Mint Dumps Ubuntu Snap
by Peter Reutemann 07 Jun '20

07 Jun '20

'ZDNet reports: Mint's programmers, led by lead developer, Clement "Clem" Lefebvre, has dropped support for Ubuntu's Snap software packing system. [...] So, what's not to like? Well, a lot, thinks Clem. As he wrote in July 2019, the idea is fine: "When snap was announced it was supposed to be a solution, not a problem. It was supposed to make it possible to run newer apps on top of older libraries and to let third-party editors publish their software easily towards multiple distributions, just like Flatpak and AppImage." But, he said, "What we didn't want it to be was for Canonical to control the distribution of software between distributions and third-party editors, to prevent direct distribution from editors, to make it so software worked better in Ubuntu than anywhere else and to make its store a requirement." Clem was worried then that Canonical was moving in that direction because: "Ubuntu is planning to replace the Chromium [Google's open-source browser and foundation for Chrome] repository package with an empty package, which installs the Chromium snap. In other words, as you install APT [Debian's program for installing and managing DEB files] updates, Snap becomes a requirement for you to continue to use Chromium and installs itself behind your back. This breaks one of the major worries many people had when Snap was announced and a promise from its developers that it would never replace APT. A self-installing Snap Store which overwrites part of our APT package base is a complete NO-NO. It's something we have to stop and it could mean the end of Chromium updates and access to the snap store in Linux Mint." Fast forward to now, and that's still the case with Chromium, and Clem has had enough: "In the Ubuntu 20.04 package base, the Chromium package is indeed empty and acting, without your consent, as a backdoor by connecting your computer to the Ubuntu Store. Applications in this store cannot be patched, or pinned. You can't audit them, hold them, modify them, or even point snap to a different store. You've as much empowerment with this as if you were using proprietary software, i.e. none. This is in effect similar to a commercial proprietary solution, but with two major differences: It runs as root, and it installs itself without asking you." ' -- source: https://news.slashdot.org/story/20/06/05/2148219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Lenovo Will Pre-load Ubuntu and Red Hat on All Its Workstations
by Peter Reutemann 07 Jun '20

07 Jun '20

'TechRepublic calls it "a tectonic shift in the landscape... a massive company showing serious support for both Ubuntu Linux and Red Hat Enterprise Linux." Forbes reports: Beginning this month, Lenovo will certify its ThinkStation PCs and ThinkPad P Series laptops for both Ubuntu LTS and Red Hat Enterprise Linux. Every single model, every single configuration across the entire workstation portfolio. [ZDNet adds that the two Linux distros will also be preloaded.] And it doesn't end there. "Going beyond the box, this also includes full web support, dedicated Linux forums, configuration guidance and more," says Rob Herman, General Manager, Executive Director Workstation & Client AI Group at Lenovo. We're not talking about just hardware certification, either. Lenovo will offer both Red Hat Enterprise Linux and Ubuntu LTS distributions pre-installed... "What's more, Lenovo will also upstream device drivers directly to the Linux kernel, to help maintain stability and compatibility throughout the life of the workstation," says Herman. Lenovo and Fedora are already working together to enable fingerprint sensor support on select ThinkPads, and send that support upstream to benefit all Linux distributions (including firmware being available through LVFS). When I spoke to Mark Pearson, the Senior Linux Software Engineer even mentioned porting certain Windows-only PC management tools to Linux to aid in the overall effort. TechRepublic notes the news "comes on the heels of a number of new Linux desktop support news. This year we've seen the rise of Purism, Tuxedo Computers, Pine64, Juno Computers, Vikings, Dell's continued support with the XPS Dev edition laptop and the Precision line, and now Lenovo." They also argue for continued support for the smaller vendors of Linux hardware. "Companies like System76 are a big reason why desktop Linux continued climbing up that steep mountain called 'Acceptance.'" But their article concludes that "No matter which path you take, you now (as a Linux user) have more options."' -- source: https://linux.slashdot.org/story/20/06/06/0113250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Will The Transition To IPv6 Take 5 to 10 Years?
by Peter Reutemann 07 Jun '20

07 Jun '20

'The Register: IPv4 is here to stay with us for a good few years yet, reckons the the Réseaux IP Européens Network Coordination Centre's (RIPE NCC) public policy manager, eight years after IPv6 was supposed to replace it. Marco Hogewoning, public policy for the Amsterdam, Netherlands-based European regional internet registry, told The Register that despite the best efforts of IPv6 proponents over the last eight years, it might take "five to 10 years" before the world starts to truly abandon the IPv4 address space. IPv6 was first defined in 1996, but with Friday marking the 8th anniversary of (the second) IPv6 "Launch" Day, RIPE NCC was keen to talk up the tech, whose chief benefit is that it provides a much greater pile of internet addresses for all the stuff humanity has dumped online in the last few decades...Musing that "little pockets of IPv4" and some government services hosted on IPv4 are two of the things holding the world back, Hogewoning told The Register: "It's impossible for me to file my taxes over IPv6. As much as I want, I can't get rid of IPv4 in the end because I need to file my taxes. That's a dialogue we try to have with the governments... It's an important step to go to, enabling IPv6 [instead of] IPv4 to make sure we don't force people to have that backwards compatibility."' -- source: https://tech.slashdot.org/story/20/06/06/0245248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

one week of arch
by Peter Reutemann 07 Jun '20

07 Jun '20

Hi everyone At last month's meeting, we also had a look at Manjaro, an Arch-based Linux distribution: https://www.meetup.com/WaikatoLinuxUsersGroup/events/266792009/ While preparing for the presentation, I played around with Manjaro and quite liked the arch package manager "pacman". Since then, Angus came across EndeavourOS, another Arch Linux distribution, which is a bit more up-to-date than Manjaro: https://endeavouros.com/ So, last weekend, I decided to bite the bullet and upgrade the aging LinuxMint 18.3 installation on my laptop at home. The EndeavourOS installer seemed less polished (showing lots of Space Shuttle Endeavour related imagery) than the likes of Mint or Ubuntu, but it did the job. Always glad that my home directory is on a separate partition. Makes the installation so much easier... :-) I've been using it now for a week and I must say, I quite like it. The MATE desktop, in contrast to Linux Mint, is far less polished, but it works absolutely fine. It feels really, really snappy (and that on a spinning drive!) and it doesn't seem to suffer from the same performance degradation over time like my old Mint installation did: as the days went by, the login screen would take longer and longer to show up after resuming from sleep, the Caja file browser would take longer to start up and everything just felt more and more sluggish. Last night, I flashed an old Samsung S4 with LineageOS (Android 9) and I didn't have to resort to compiling Heimdall myself, the Arch repositories already had packages built on the latest code from the repository. Nice! Only problem so far are the proprietary Brother printer drivers. Haven't been able to get printing working yet (the package for the printer in the arch repositories didn't do anything). Something to figure out on a rainy day... Anyway, looks like I'm sort of an Arch convert now. ;-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Windows 10 Is Hostile To Open Source
by Lawrence D'Oliveiro 06 Jun '20

06 Jun '20

From <https://www.theregister.com/2020/06/05/windows_10_microsoft_defender_smarts…>: A developer of a Windows utility has protested that "Microsoft Defender SmartScreen is hurting independent developers" because of the number of warnings and obstacles placed in front of users who download installers that are not signed or sufficiently well known. In the absence of a “Let’s Encrypt” equivalent for them, code-signing certificates cost money. And on top of that, SmartScreen’s warnings will not go away until that certificate has built up some (unspecified) minimum level of “reputation”. Because of this, many projects, like Ardour and Inkscape, don’t bother with signing, and rely on their users to negotiate the obstacle course of download and installation warnings.

1 0

Follow-up to the EFF .ORG petition
by Ian Stewart 06 Jun '20

06 Jun '20

You may remember, from over a month ago, there was circulation on WLUG email of a request to sign a petition<https://act.eff.org/action/help-stop-the-sale-of-public-interest-registry-t…> of Electronic Frontier Foundation to "Help Stop the Sale of Public Interest Registry to a Private Equity Firm"... "This month [November 2019] it was suddenly announced that the nonprofit that owns the .ORG domain registry was planning to sell it to a private equity firm, Ethos Capital. This could impact the millions of individuals and organizations that have a .ORG website, subjecting them to potential censorship and leaving the door open for price increases on domain registration and renewals." You may be wondering what happened. I've just looked at the wikipedia entry for .ORG, and it contains the following paragraph based on this article from the The Verge<https://www.theverge.com/2020/4/30/21241946/icann-dot-org-isoc-ethos-capita…>: "In November 2019, the Public Interest Registry (PIR) was to be sold by the Internet Society to shell company Ethos Capital for US$1.135 billion. The PIR also announced it would abandon its non-profit status to become a B Corporation. However, this move was criticized by non-profits and various digital rights groups on concerns that Ethos Capital, a private equity firm, would raise fees or censor the domain. The sale was blocked by Internet Corporation for Assigned Names and Numbers (ICANN) in April 2020 on the basis that transfer of control of the domain to the private equity firm would create "unacceptable uncertainty" for non-profits that relied on the .org domain." While Wikipedia's entry on .ORG<https://en.wikipedia.org/wiki/.org> has a brief history section, more details can be found at Wikipedias Public Interest Registry webpage<https://en.wikipedia.org/wiki/Public_Interest_Registry>. In case you find its TL;DR here are some snippets... the Internet Society proposed creating the Public Interest Registry as a separate 501(c)3 non-profit to manage .ORG when the Public Interest Registry was established, “our aim was to promote the non-commercial use of the internet" Public Interest Registry released an open letter on 1 May 2019, stating, “The .ORG Community always is considered in every decision we make here at Public Interest Registry. Rest assured, we will not raise prices unreasonably. In fact, we currently have no specific plans for any price increases for .ORG.” On 13 May 2019, ICANN announced that they would remove the price cap on .ORG registrations. ...former ICANN CEO Fadi Chehadé registered the domain name EthosCapital.com. On 14 May 2019, Ethos Capital was incorporated in Delaware On 13 November 2019 the Internet Society announced that it was divesting of the Public Interest Registry, and that Ethos Capital would be acquiring its assets Ethos Capital stated on their website, "Our plan is to live within the spirit of historic practice when it comes to pricing," which they later clarified to mean raising prices by an average of 10% per year. People who came out in opposition to the sale included Tim Berners-Lee... On 29 November 2019, it was revealed that the purchase price is $1.135 billion. On 30 April 2020, the ICANN Board, saying it was "the right thing to do," withheld its consent to the transfer of control of the Public Internet Registry to Ethos Capital, effectively killing the proposed deal. In Summary The .ORG remains in the hands of the "Public Interest Registry" which seems to sometimes get called the "Public Internet Registry"? The "Public Interest Registry" pir.org link takes you to https://thenew.org/org-people/ where, among other things, you can download the PIR 2018 Annual Report<https://thenew.org/app/uploads/2019/09/PIR-2018-Annual-Report.pdf> or their 2018 Form 990<https://thenew.org/app/uploads/2019/09/PIR-2017_2018-990.zip> "Return of Organization Exempt From Tax". For 2018 you will see their total revenue was $93 million. cheers, Ian.

1 0

Linux not Windows: Why Munich is shifting back from Microsoft to open source – again
by Peter Reutemann 05 Jun '20

05 Jun '20

'In a notable U-turn for the city, newly elected politicians in Munich have decided that its administration needs to use open-source software, instead of proprietary products like Microsoft Office. "Where it is technologically and financially possible, the city will put emphasis on open standards and free open-source licensed software," a new coalition agreement negotiated between the recently elected Green party and the Social Democrats says. The agreement was finalized Sunday and the parties will be in power until 2026. "We will adhere to the principle of 'public money, public code'. That means that as long as there is no confidential or personal data involved, the source code of the city's software will also be made public," the agreement states.' -- source: https://www.zdnet.com/article/linux-not-windows-why-munich-is-shifting-back… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Signal Launches Face-Blurring Tool as US Protesters Embrace Encrypted Messaging
by Peter Reutemann 05 Jun '20

05 Jun '20

'Law enforcement officials across the U.S. have already revealed that they will leverage facial recognition technology to retroactively target protesters following the killing of George Floyd, with police asking the public for footage and photos. Against this backdrop, Signal is introducing a new feature that can automatically obfuscate faces shared within the encrypted messaging app, as the company says it's "working hard to keep up with the increased traffic" from protesters. From a report: Moving forward, Signal users will be able to activate a feature in the main photo editing toolbox that will automatically blur all faces it identifies in an image. As with many automated computer vision tools, Signal doesn't claim that its face-blurring smarts are 100% effective. It may not identify all faces in a photo, which is why users can manually obscure faces by drawing the blur brush across each face with their finger.' -- source: https://it.slashdot.org/story/20/06/04/1621201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Does Ringing Room Use BBB?
by Lawrence D'Oliveiro 04 Jun '20

04 Jun '20

Came across this site <https://ringingroom.com/> mentioned on the TV news this evening. It’s a “virtual bell tower” where fans of bell-ringing can gather to scratch their itch during lockdown in the UK and US. The thing that strikes me is, it look remarkably similar, at least in concept, to Web conferencing software BigBlueButton <https://bigbluebutton.org/>. I wonder if it’s an application/customization of the latter?

1 0

Zoom Won't Encrypt Free Calls Because it Wants To Comply With Law Enforcement
by Peter Reutemann 04 Jun '20

04 Jun '20

'If you're a free Zoom user, and waiting for the company to roll out end-to-end encryption for better protection of your calls, you're out of luck. From a report: Free calls won't be encrypted, and law enforcement will be able to access your information in case of 'misuse' of the platform. Zoom CEO Eric Yuan today said that the video conferencing app's upcoming end-to-end encryption feature will be available to only paid users.' -- source: https://yro.slashdot.org/story/20/06/03/1150245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

6 9

TrueNAS isn’t abandoning BSD—but it is adopting Linux
by Peter Reutemann 04 Jun '20

04 Jun '20

'To the surprise—and likely consternation—of BSD fans everywhere, FreeNAS vendor iXsystems is building a new version of its core product, TrueNAS, on top of Debian Linux. This week's TrueNAS Scale announcement builds on the company's March announcement that its commercial project TrueNAS and its community project FreeNAS would be merging into a common base. Effectively, all the NAS projects from iXsystems will be TrueNAS variants moving forward, with the free-to-use version being TrueNAS Core, the new Debian-based project becoming TrueNAS Scale, and the commercial project remaining simply TrueNAS.' -- source: https://arstechnica.com/gadgets/2020/06/truenas-isnt-abandoning-bsd-but-it-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

New Cold Boot Attack Affects Seven Years of LG Android Smartphones
by Peter Reutemann 04 Jun '20

04 Jun '20

'South Korean phone manufacturer LG has released a security update last month to fix a vulnerability that impacts its Android smartphones sold over the past seven years. From a report: The vulnerability, tracked under the identifier of CVE-2020-12753, impacts the bootloader component that ships with LG smartphones. In March this year, US software engineer Max Thomas discovered a vulnerability in the bootloader component that had been added to LG smartphones starting with the LG Nexus 5 series. In a technical breakdown of the vulnerability published on Tuesday, Thomas says the bootloader component's graphics package contains a bug that lets attackers sneak in their own code to run alongside the bootloader's graphics under certain conditions, such as when the battery dies out and when the device is in the bootloader's Download Mode. Thomas says that threat actors who perfectly time an attack can gain the ability to run their own custom code, which could allow them to take over the bootloader, and inherently the entire device.' -- source: https://mobile.slashdot.org/story/20/06/03/1830216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google fixes Android flaws that allow code execution with high system rights
by Peter Reutemann 03 Jun '20

03 Jun '20

'Google has shipped security patches for dozens of vulnerabilities in its Android mobile operating system, two of which could allow hackers to remotely execute malicious code with extremely high system rights. In some cases, the malware could run with highly elevated privileges, a possibility that raises the severity of the bugs. That’s because the bugs, located in the Android System component, could enable a specially crafted transmission to execute arbitrary code within the context of a privileged process. In all, Google released patches for at least 34 security flaws, although some of the vulnerabilities were present only in devices available from manufacturer Qualcomm.' -- source: https://arstechnica.com/information-technology/2020/06/google-fixes-android… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DOD's Third Attempt To Implement IPv6 Isn't Going Well
by Peter Reutemann 03 Jun '20

03 Jun '20

'The US Department of Defense is woefully behind on its plan to upgrade its IT infrastructure to support the newer IPv6 protocol, according to a government report published on Monday. From a report: This current effort is the third time the DOD attempts to upgrade its infrastructure to support IPv6 over in the past 17 years. The first two attempts took place in 2003 and 2010, respectively. The 2003 effort was abandoned with the DOD citing security risks and a lack of personnel trained in IPv6, while the second attempt was also abandoned, similarly on the grounds that IPv6 was not yet secure enough for the DOD's sensitive networks. On Monday, the Government Accountability Office (GAO), the auditing agency of the US government, said that the DOD's third attempt isn't doing any better either. GAO officials said the DOD failed to follow four basic requirements that were set out by the White House Office of Management and Budget (OMB) in 2006. The four requirements were part of an OMB guideline sent to all federal agencies detailing the proper procedure for upgrading networks from IPv4 to IPv6. "For its current [third] initiative, DOD has not completed three of four longstanding OMB requirements," GAO auditors said in a report published on Monday.' -- source: https://news.slashdot.org/story/20/06/02/1447254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 77 Arrives With Faster JavaScript Debugging and Optional Permissions
by Peter Reutemann 03 Jun '20

03 Jun '20

'Mozilla today launched Firefox 77 for Windows, Mac, and Linux. Firefox 77 includes faster JavaScript debugging, optional permissions for extensions, and Pocket recommendations in the U.K. You can download Firefox 77 for desktop now from Firefox.com, and all existing users should be able to upgrade to it automatically. According to Mozilla, Firefox has about 250 million active users, making it a major platform for web developers to consider. [...] Other than Pocket recommendations arriving in the U.K. (they've been in Canada, Germany, and the U.S. since April 2018), this is primarily a developer release. Firefox's Debugger is now better at handling large web apps with all their bundling, live reloading, and dependencies. Mozilla is promising performance improvements that speed up pausing and stepping, as well as cutting down on memory usage over time. Source maps should also see performance boosts -- some inline source maps load 10 times faster -- and improved reliability for many configurations. The debugger will now also respect the currently selected stack when stepping, which is useful when you've stepped into a function call or paused in a library method further down in the stack.' -- source: https://news.slashdot.org/story/20/06/02/1530214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Wallpaper crash explained: Here’s how a simple image can soft-brick phones
by Peter Reutemann 02 Jun '20

02 Jun '20

'How can a simple image crash an Android phone to the point that it becomes unusable? It’s a question that came out frequently over the past 24 hours, as news of a “cursed wallpaper” spread around the web. Here’s a recap: Setting a particular image as wallpaper can send some phones into a loop of crashes that makes them unusable. There are a few solutions, depending on how hard the phone is hit. Some users were able to change the wallpaper in the short interval between crashes. Others had success deleting the wallpaper using the recovery tool TWRP. But in most cases, the only solution was to reset the phone to factory settings, losing any data that’s not backed up. The issue was brought to light by Ice Universe, the Chinese Twitter users known for leaks. Based on user reports, many models from Samsung and Google are affected, while we’ve also seen some reports from users of OnePlus, Nokia, and Xiaomi devices (it’s not clear if these latter devices ran stock software or custom ROMs). From our own testing and looking at user reports, Huawei devices seem to be less exposed to the wallpaper crash issue.' -- source: https://www.androidauthority.com/android-wallpaper-crash-1124577/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Programmers Use 80 Characters Per Line!?
by Lawrence D'Oliveiro 02 Jun '20

02 Jun '20

Are there still people writing their code to the constraints of 80-column CRT terminals which vanished into museums decades ago? Seems there are enough such around to rile Linus Torvalds <https://www.theregister.com/2020/06/01/linux_5_7/>. Even back in the days of those terminals, the printers you used for hard-copy listings could almost always do 132-column lines. And some of the terminals could be put into a mode with such a line length, by using a much narrower font (I remember it hurt my eyes to do much work in this mode). Nowadays I typically have my text-editor windows set to a width of 100 columns. And there is still enough room on my screen for two such views side-by-side.

1 0

Lawsuit Over Online Book Lending Could Bankrupt Internet Archive
by Lawrence D'Oliveiro 02 Jun '20

02 Jun '20

A group of book publishers is suing the Internet Archive over its recent loosening of restrictions on lending out copyrighted books <https://arstechnica.com/tech-policy/2020/06/publishers-sue-internet-archive…>. Choice description of the founder of the Internet Archive: "Brewster Kahle is what the Russians might call a holy fool—someone who acts without real regard for himself or the worldly things in the service of a higher calling," [copyright scholar James] Grimmelmann said.

1 0

Cisco Discloses Security Breach That Impacted VIRL-PE Infrastructure
by Peter Reutemann 01 Jun '20

01 Jun '20

'Thursday Cisco disclosed a security breach that impacted a small part of its backend infrastructure and two of its commercial products also bundling the SaltStack software package as part of their firmware. ZDNet reports: Cisco said that hackers used a vulnerability in the SaltStack software package, which Cisco bundles with some products, to gain access to six servers... The six servers provide the backend infrastructure for VIRL-PE (Internet Routing Lab Personal Edition), a Cisco service that lets users model and create virtual network architectures to test network setups before deploying equipment in real situations. "Cisco identified that the Cisco maintained salt-master servers that are servicing Cisco VIRL-PE releases 1.2 and 1.3 were compromised," the company said Thursday. Cisco said it patched and remediated all hacked VIRL-PE servers on May 7, when it deployed updates for the SaltStack software. However, the issue isn't localized to Cisco's backend infrastructure alone. Cisco says that two of its commercial products also bundle the SaltStack software package as part of their firmware. These are the aforementioned Cisco VIRL-PE, and Cisco Modeling Labs Corporate Edition (CML), another network modeling tool. Both VIRL-PE and CML can be used in Cisco-hosted and on-premise scenarios. In case companies use the two products on location, Cisco says CML and VIRL-PE need to be patched.' -- source: https://tech.slashdot.org/story/20/05/30/055201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

An advanced and unconventional hack is targeting industrial firms
by Peter Reutemann 01 Jun '20

01 Jun '20

'Attackers are putting considerable skill and effort into penetrating industrial companies in multiple countries, with hacks that use multiple evasion mechanisms, an innovative encryption scheme, and exploits that are customized for each target with pinpoint accuracy. The attacks begin with emails that are customized for each target, a researcher at security firm Kaspersky Lab reported this week. For the exploit to trigger, the language in the email must match the localization of the target’s operating system. For example, in the case of an attack on a Japanese company, the text of the email and an attached Microsoft Office document containing a malicious macro had to be written in Japanese. Also required: an encrypted malware module could be decrypted only when the OS had a Japanese localization as well. Recipients who click on a request to urgently enable the document’s active content will see no indication anything is amiss. Behind the scenes, however, a macro executes a Powershell script. The reason it stays hidden: the command parameters: - ExecutionPolicy ByPass—to override organization policies - WindowStyle Hidden. This hides the PowerShell window - NoProfile, which executes the script with no end-user configuration.' -- source: https://arstechnica.com/information-technology/2020/05/an-advanced-and-unco… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GitHub Warns Java Developers of New Malware Poisoning NetBeans Projects
by Peter Reutemann 01 Jun '20

01 Jun '20

'GitHub issued a security alert Thursday warning about new malware spreading on its site via boobytrapped Java projects, ZDNet reports: The malware, which GitHub's security team has named Octopus Scanner, has been found in projects managed using the Apache NetBeans IDE (integrated development environment), a tool used to write and compile Java applications. GitHub said it found 26 repositories uploaded on its site that contained the Octopus Scanner malware, following a tip it received from a security researcher on March 9. But the article adds GitHub "believes that many more projects have been infected during the past two years." GitHub says that when other users would download any of the 26 projects, the malware would behave like a self-spreading virus and infect their local computers. It would scan the victim's workstation for a local NetBeans IDE installation, and proceed to burrow into the developer's other Java projects. The malware, which can run on Windows, macOS, and Linux, would then download a remote access trojan (RAT) as the final step of its infection, allowing the Octopus Scanner operator to rummage through an infected victim's computer, looking for sensitive information. GitHub says the Octopus Scanner campaign has been going on for years, with the oldest sample of the malware being uploaded on the VirusTotal web scanner in August 2018, time during which the malware operated unimpeded.' -- source: https://news.slashdot.org/story/20/05/30/2031219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Zoom's New, Stronger Encryption May Only Protect Paying Clients
by Peter Reutemann 01 Jun '20

01 Jun '20

'"Zoom plans to strengthen the encryption of its service for paying customers," reports Newsweek, "but the upgrade will not be available to users of its free service." Zoom security consultant Alex Stamos later confirmed the details of the reported move in an interview with Reuters, which first reported the changes on Friday. But he also told the news outlet that Zoom's plans could still change. "The CEO is looking at different arguments," Stamos said. "The current plan is paid customers plus enterprise accounts where the company knows who they are." In the wake of privacy concerns, he added that Zoom was making significant efforts to upgrade safety and trust on its platform. In an emailed statement to Newsweek, a Zoom spokesperson said: "Zoom's approach to end-to-end encryption is very much a work in progress — everything from our draft cryptographic design, which was just published last week, to our continued discussions around which customers it would apply to." The tech company's plans to boost the encryption of video calls on its platform have been revealed a month after it was reported that half a million Zoom account credentials were being sold on the Dark Web. Zoom's increased usage during lockdowns brought increase scrutiny, reports CNET, which "revealed several Zoom security problems and the fact that an earlier Zoom boast of end-to-end encryption was baseless."' -- source: https://it.slashdot.org/story/20/05/30/2311256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Should Maintainers of Open Source Projects Be Paid?
by Peter Reutemann 01 Jun '20

01 Jun '20

'Matt Asay, a former COO of Canonical now working at AWS, writes "Over the last few weeks I've interviewed a range of open source project maintainers, most of which don't directly get paid for supporting their projects... Is this a bad thing?" It's not completely clear. Linux Foundation executive Chris Aniszczyk has been an outspoken opponent of open source "tip jars" that seek to sustain projects with donations. "These [open source developers] should be encouraged to start businesses or your business should hire them directly," he argues. But many such developers don't want a 9-to-5 corporate job, preferring the independence of contract work. Open source sustainability, in other words, is messy. Most open source project maintainers with whom I've spoken got started because it was a "fun" way to spend their free time. They had a variety of personal "itches" they needed to scratch. Exactly none started coding because they were hoping to get paid for that work. In fact, in some cases, it was specifically to create space from their employer that they started the project. For Datasette founder Simon Willison, for example, he "wanted a creative outlet." That is, a project that he got to have complete control over. In some ways, he said, it was perhaps "a way of blowing off steam," but really it was a place where he could express his creativity without a corporate overlord steering that creativity. See the problem...? Aniszczyk reasonably suggests that the most sustainable source of funding is a paycheck, but that's precisely what many of these developers don't want. Or, at least, they don't want a paycheck that comes with restrictions on their ability to code freely... [O]pen source sustainability will never have one, meta answer for all of open source. It's always a project-by-project analysis and, really, a founder-by-founder (or community-by-community) decision. ' -- source: https://news.slashdot.org/story/20/05/31/0138252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ardour 6.0 Is Out
by Lawrence D'Oliveiro 29 May '20

29 May '20

Most of us are happy with Audacity for our audio-editing needs, but if you need full on pro-quality audio production, Ardour is it <https://www.theregister.co.uk/2020/05/28/ardour_6_release/>. I did try running it briefly once, but like Blender, you really need an introductory tutorial or two to make at least some initial sense of it all--you cannot just dive in blindly and expect to figure it out by messing around.

2 1

Microsoft Announces The Official “Windows Package Manager”
by Lawrence D'Oliveiro 29 May '20

29 May '20

<https://www.theregister.co.uk/2020/05/20/microsoft_announces_official_windo…>: Among the best features of Linux is the availability of package managers, such as Debian's Apt, that can install, remove and manage dependencies for applications from the command line. It is not perfect – dependency version issues or broken configuration files can be a problem – but most of the time it makes it easy to get what you want, and is scriptable. Many users would like Windows to be equally convenient to use. Only it’s not quite there yet: More seriously, the current preview is limited to installation; it does not even have a remove option for packages. It does not auto-update packages or even have any mechanism to update them, and there is no specific dependency management. On the to-do list are features including uninstall, update, and Store app support. Hence the filing of a bug report pointing out that “All it does is downloading installers (which are not packages) and executing them (which is not management)”.

1 1

A $350 “anti-5G” device is just a 128MB USB stick, teardown finds
by Peter Reutemann 29 May '20

29 May '20

'Believers of 5G conspiracy theories have apparently been buying a $350 anti-5G USB key that—not surprisingly—appears to just be a regular USB stick with only 128MB of storage. As noted by the BBC today, the "5GBioShield" USB stick "was recommended by a member of Glastonbury Town Council's 5G Advisory Committee, which has called for an inquiry into 5G." The company that sells 5GBioShield claims it "is the result of the most advanced technology currently available for balancing and prevention of the devastating effects caused by non-natural electric waves, particularly (but not limited to) 5G, for all biological life forms." The product's website charges £283 for a single 5GBioShield, which converts to nearly $350. That's what it costs to get "protection for your home and family, thanks to the wearable holographic nano-layer catalyser, which can be worn or placed near to a smartphone or any other electrical, radiation or EMF emitting device." "The 5GBioShield makes it possible, thanks to a uniquely applied process of quantum nano-layer technology, to balance the imbalanced electric oscillations arising from all electric fog induced by all devices such as: laptops, cordless phones, wlan, tablets, etc.," the company says, adding that the USB stick "brings balance into the field at the atomic and cellular level restoring balanced effects to all harmful (ionized and non-ionized) radiation." The USB stick apparently doesn't need to be plugged in to anything to work its magic. "It is always ON and working—that's why we used quantum nano-layer technology," the company says in an FAQ. But the device allegedly produces a wider field of protection when it is plugged in. To answer the question of whether the stick needs to be "charged regularly," the FAQ says, "No—the input charge only expands the field effect from 4m radius to 20m + radius when plugged into an USB wall charger or a computer." Fortunately, you can use 5GBioShield without disabling your Wi-Fi. The USB key doesn't block Wi-Fi signals, the company says. Instead, the product "transmutes" the signals and "harmonizes all harmful frequencies into life affirming frequencies."' -- source: https://arstechnica.com/tech-policy/2020/05/5g-conspiracy-theorists-sell-35… Oh dear... Techno-babble to scam the uneducated always seems to work... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Using Curl to make REST API requests
by Peter Reutemann 29 May '20

29 May '20

'An application program interface (API) is a set of definitions and protocols that allows software programs to communicate with each other. The term REST stands for representational state transfer. It is an architectural style that consists of a set of constraints to be used when creating web services. RESTful API is an API that follows the REST architecture. Typically REST APIs use the HTTP protocol for sending and retrieving data and JSON formatted responses. You can use the standard HTTP methods to create, view, update, or delete resources through the API. To test and interact with the RESTful APIs, you can use any library or tool that can make HTTP requests. API requests are made up of four different parts: - The endpoint. This is the URL that the client uses to communicate with the server. - The HTTP method. It tells the server what action the client wants to perform. The most common methods are GET POST PUT DELETE and PATCH - The headers. Used to pass additional information between the server and the client, such as authorization. - The body. The data sent to the server. In this article, we’re going to discuss how to use curl to interact with RESTful APIs. curl is a command-line utility for transferring data from or to a remote server. It is installed by default on macOS and most Linux distributions.' -- source: https://linuxize.com/post/curl-rest-api/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Raspberry Pi 4 model comes with a ton of RAM: 8GB
by Peter Reutemann 29 May '20

29 May '20

'Hot off the launch of an interchangeable camera system earlier this month, Raspberry Pi is introducing a new configuration of the Pi4: a model with a whopping 8GB of RAM. The new, highest-end config for the Pi 4 will run you $75. The 8GB version of the Raspberry Pi 4 has been long rumored, thanks to Raspberry Pi itself leaking the existence of an 8GB model. The blog post reveals that an 8GB model was always a possibility and says, "We were so enthusiastic about the idea that the non-existent product made its way into both the Beginner’s Guide and the compliance leaflet." The Raspberry Pi 4 launched last year with a faster SoC, more RAM, dual micro-HDMI, USB 3.0 support, and a USB-C charging port. In addition to the usual server and hobbyist uses, Raspberry Pi promoted performance on par with an "entry-level x86 PC" and dual-monitor desktop uses.' -- source: https://arstechnica.com/gadgets/2020/05/new-raspberry-pi-4-model-comes-with… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Russian hackers are exploiting bug that gives control of US servers
by Peter Reutemann 29 May '20

29 May '20

'A Russian hacking group tied to power-grid attacks in Ukraine, the world’s most destructive data wiper worm, and other nefarious Kremlin operations is exploiting a vulnerability that allows it to take control of computers operated by the US government and its partners. In an advisory published on Thursday, the US National Security Agency said that the Sandworm group was actively exploiting a vulnerability in Exim, an open source mail transfer agent, or MTA, for Unix-based operating systems. Tracked as CVE-2019-10149, the critical bug makes it possible for an unauthenticated remote attacker to send specially crafted emails that execute commands with root privileges. With that, the attacker can install programs of their choosing, modify data, and create new accounts.' -- source: https://arstechnica.com/information-technology/2020/05/russian-hackers-are-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Digital Signage Moving To Linux?
by Lawrence D'Oliveiro 28 May '20

28 May '20

The Register regularly collects reports of computer-controlled public signage malfunctioning in an amusing way. In this latest instalment <https://www.theregister.co.uk/2020/05/27/bork/>, there is an interesting mention: The company went on to tell us that the units run Windows 10, but "we're about to upgrade all of our production machines to a custom Linux build to improve their stability and generally operate with more efficiency." One of the reader comments mentions a company called “Screenly”, which offers a product in both open-source and proprietary-paid forms.

1 0