- wlug - list.wlug.org.nz

The Legend Of The Melbourne Citadel
by Lawrence D'Oliveiro 21 Aug '20

21 Aug '20

It appears there is a 2300-foot tall building in Melbourne, at least according to the latest version of Microsoft Flight Simulator <https://www.theregister.com/2020/08/20/flight_simulator_bing_fawkner_tower/>. This would make it the second-tallest in the world. It originated from a mistaken entry into the OpenStreetMap database (since corrected), which Flight Simulator nevertheless managed to incorporate into its map data. There’s even a linked video of a player trying to land on it, before a future update deletes it from the game. Spoiler alert: yes, you can land, with the right sort of aircraft and a bit of effort. And you can even take off again. Another amusing item from the report comes from Microsoft’s use of AI to fill in road traffic flows. There is one case where the map data seems to omit the fact that there is a traffic tunnel through a building, with the result that the software has the cars going vertically up and down the sides of the building.

1 0

Linux Is Taking Over
by Lawrence D'Oliveiro 21 Aug '20

21 Aug '20

Seems like The Register’s BorkBorkBork column, featuring public examples of embedded systems falling over, is including more and more Linux-based screwups, e.g. <https://www.theregister.com/2020/08/20/bork/>: RailPoint has form for bork. Its Windows-based signage has already featured in these pages and back then the company told us it was "about to upgrade all of our production machines to a custom Linux build to improve their stability and generally operate with more efficiency". Behold the stability and efficiency. *Sigh*

1 0

'Real' Programming Is an Elitist Myth
by Peter Reutemann 20 Aug '20

20 Aug '20

'When people build a database to manage reading lists or feed their neighbors, that's coding -- and culture. From an essay: We are past the New York City Covid-19 peak. Things have started to reopen, but our neighborhood is in trouble, and people are hungry. There's a church that's opened space for a food pantry, a restaurant owner who has given herself to feeding the neighborhood, and lots of volunteers. [...] It's a complex data model. It involves date fields, text fields, integers, notes. You need lots of people to log in, but you need to protect private data too. You'd think their planning conversations would be about making lots of rice. But that is just a data point. The tool the mutual aid group has settled on to track everything is Airtable, a database-as-a-service program. You log in and there's your database. There are a host of tools like this now, "low-code" or "no-code" software with names like Zapier or Coda or Appy Pie. At first glance these tools look like flowcharts married to spreadsheets, but they're powerful ways to build little data-management apps. Airtable in particular keeps showing up everywhere for managing office supplies or scheduling appointments or tracking who at WIRED has their fingers on this column. The more features you use, the more they charge for it, and it can add up quickly. I know because I see the invoices at my company; we use it to track projects. "Real" coders in my experience have often sneered at this kind of software, even back when it was just FileMaker and Microsoft Access managing the flower shop or tracking the cats at the animal shelter. It's not hard to see why. These tools are just databases with a form-making interface on top, and with no code in between. It reduces software development, in all its complexity and immense profitability, to a set of simple data types and form elements. You wouldn't build a banking system in it or a game. It lacks the features of big, grown-up databases like Oracle or IBM's Db2 or PostgreSQL. And since it is for amateurs, the end result ends up looking amateur. But it sure does work. I've noticed that when software lets nonprogrammers do programmer things, it makes the programmers nervous. Suddenly they stop smiling indulgently and start talking about what "real programming" is. This has been the history of the World Wide Web, for example. Go ahead and tweet "HTML is real programming," and watch programmers show up in your mentions to go, "As if." Except when you write a web page in HTML, you are creating a data model that will be interpreted by the browser. This is what programming is. Code culture can be solipsistic and exhausting. Programmers fight over semicolon placement and the right way to be object-oriented or functional or whatever else will let them feel in control and smarter and more economically safe, and always I want to shout back: Code isn't enough on its own. We throw code away when it runs out its clock; we migrate data to new databases, so as not to lose one precious bit. Code is a story we tell about data.' -- source: https://developers.slashdot.org/story/20/08/19/146204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

235 Million Instagram, TikTok and YouTube User Profiles Exposed In Massive Data Leak
by Peter Reutemann 20 Aug '20

20 Aug '20

'Forbes: The security research team at Comparitech today disclosed how an unsecured database left almost 235 million Instagram, TikTok and YouTube user profiles exposed online in what can only be described as a massive data leak. The data was spread across several datasets; the most significant being two coming in at just under 100 million each and containing profile records apparently scraped from Instagram. The third-largest was a dataset of some 42 million TikTok users, followed by just under 4 million YouTube user profiles. Comparitech says that, based on the samples it collected, one in five records contained either a telephone number or email address. Every record also included at least some, sometimes all, the following information: Profile name; Full real name; Profile photo; and Account description. Statistics about follower engagement, including: Number of followers; Engagement rate; Follower growth rate; Audience gender; Audience age; Audience location; Likes; Last post timestamp; Age; and Gender. "The information would probably be most valuable to spammers and cybercriminals running phishing campaigns," Paul Bischoff, Comparitech editor, says. "Even though the data is publicly accessible, the fact that it was leaked in aggregate as a well-structured database makes it much more valuable than each profile would be in isolation," Bischoff adds. Indeed, Bischoff told me that it would be easy for a bot to use the database to post targeted spam comments on any Instagram profile matching criteria such as gender, age or number of followers. The data appeared to have originated from a company called Deep Social, which was banned by both Facebook and Instagram in 2018 after scraping user profile data. The company was wound down sometime after this. The researchers reached out to Deep Social, which then forwarded the disclosure to a Hong Kong-registered social media influencer data-marketing company called Social Data. Social Data shut down the database about three hours after the researchers' initial email. "Social Data has denied any connection between itself and Deep Social," reports Forbes, citing Comparitech.' -- source: https://yro.slashdot.org/story/20/08/19/212230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

More PowerShell Users On Linux Than Windows?!?
by Lawrence D'Oliveiro 19 Aug '20

19 Aug '20

According to this <https://www.theregister.com/2020/08/18/powershell_71_preview_6/>: While the Linux useragent continues to be responsible for the lion's share of daily usage (and Ubuntu the distro of choice), Windows has continued to rise in popularity, according to the figures. which surprises me just a little bit, considering this was a tool originally designed to bring more advanced command-line facilities to Windows, not Linux. Maybe they should fix those Linux-specific bugs <http://www.theregister.co.uk/2016/08/23/your_wget_is_broken_and_should_die_…> after all...

1 0

Chrome 86 Will Warn Users About Insecure Forms On HTTPS Pages
by Peter Reutemann 19 Aug '20

19 Aug '20

'While there's wide HTTPS adoption today, HTTP content on secure pages still persists. Google has been working to stamp that out, and Chrome is now turning its attention to and warning about insecure forms. "These 'mixed forms' (forms on HTTPS sites that do not submit on HTTPS) are a risk to users' security and privacy," says Google in a blog post. "Information submitted on these forms can be visible to eavesdroppers, allowing malicious parties to read or change sensitive form data." 9to5Google reports: The Google browser today removes the address bar's lock icon from sites with mixed forms. However, this proved to deliver an "unclear" experience that "did not effectively communicate the risks associated with submitting data in insecure forms." Starting in version 86, due to hit stable in October, Chrome will provide a more aggressive warning about insecure forms. Autofill will be disabled, but the built-in password manager will continue to offer "unique passwords." The company argues it's safer than reusing credentials. Next, the form will show red warning text underneath the field: "This form is not secure. Autofill has been turned off. The last measure will throw up a full-page warning communicating the potential risks. It gives users an option to cancel the action, but there will be a "Send anyway" button. ' -- source: https://tech.slashdot.org/story/20/08/18/0033257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Kernel NTFS Driver
by Lawrence D'Oliveiro 19 Aug '20

19 Aug '20

This article <https://www.theregister.com/2020/08/18/paragon_tries_to_contribute_ntfs/>, about the submission of a new Linux kernel driver for accessing Microsoft NTFS volumes (i.e. the kind of filesystems that are standard among Windows users), had me confused for a moment. It mentions limitations of the current kernel driver, like not being able to create or delete files or directories. I thought this kind of problem had been solved for Linux over a decade ago. And indeed it has, in the form of NTFS-3G, which is a userspace driver that connects via FUSE, and is available as a standard package for Debian and derivatives. I know this works, because just a few weeks ago, for example, I was at some friends’ place, and transferred several dozen gigabytes of files to an external hard drive of theirs from my Debian-Unstable-running laptop, without thinking twice about it, even though they are exclusively Windows users. I suppose a kernel driver offers higher performance, in principle, than one running in userspace. But I can’t imagine many Linux-based workloads that make heavy use of NTFS volumes.

2 1

meeting next Monday
by Peter Reutemann 19 Aug '20

19 Aug '20

Hi everyone We have a meeting coming up next Monday: "With VPNs being in the news frequently (and often for sad reasons like selling logs despite assurances that no such logs would exist), let's have a hands-on session with WireGuard (https://www.wireguard.com/) a VPN tunnel that is easier to use and configure than IPSec and faster than OpenVPN." Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/266792032 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Microsoft: Improving The “Outage Experience”
by Lawrence D'Oliveiro 19 Aug '20

19 Aug '20

Seems that, when something goes wrong with Microsoft’s cloud service, customers expect to find out what has happened by visiting the Azure Status page. How silly of them <https://www.theregister.com/2020/08/18/dont_use_azure_status_page/>: The place to look, Kubba said, is in the Azure Portal under Service Health. The public Azure status page is "only used to communicate widespread outages" so likely to be ineffective in discovering what may be wrong. "Despite this, we constantly find that customers visit the Azure Status page to determine the health of services on Azure," complained Kubba – though we presume that if an outage blocks access to the portal, the Status page would then be the right place to look. In other cases, it is not much use since "more than 95 per cent of our incidents" do not appear there, according to Kubba. A further complication is that Azure DevOps (which is where Pipelines live) is not integrated into the Azure portal, and many Azure DevOps users only hang around the DevOps portal. Therefore, there is a separate Azure DevOps status page, making this a third site that needs to be bookmarked for tracking outages.

1 0

An Alexa Bug Could Have Exposed Your Voice History To Hackers
by Peter Reutemann 18 Aug '20

18 Aug '20

'Findings published on Thursday by the security firm Check Point reveal that Alexa's Web services had bugs that a hacker could have exploited to grab a target's entire voice history, meaning their recorded audio interactions with Alexa. Amazon has patched the flaws, but the vulnerability could have also yielded profile information, including home address, as well as all of the "skills," or apps, the user had added for Alexa. An attacker could have even deleted an existing skill and installed a malicious one to grab more data after the initial attack. [...] For an attacker to exploit the vulnerabilities, they would need first to trick targets into clicking a malicious link, a common attack scenario. Underlying flaws in certain Amazon and Alexa subdomains, though, meant that an attacker could have crafted a genuine and normal-looking Amazon link to lure victims into exposed parts of Amazon's infrastructure. By strategically directing users to track.amazon.com -- a vulnerable page not related to Alexa, but used for tracking Amazon packages -- the attacker could have injected code that allowed them to pivot to Alexa infrastructure, sending a special request along with the target's cookies from the package-tracking page to skillsstore.amazon.com/app/secure/your-skills-page. At this point, the platform would mistake the attacker for the legitimate user, and the hacker could then access the victim's full audio history, list of installed skills, and other account details. The attacker could also uninstall a skill the user had set up and, if the hacker had planted a malicious skill in the Alexa Skills Store, could even install that interloping application on the victim's Alexa account. Both Check Point and Amazon note that all skills in Amazon's store are screened and monitored for potentially harmful behavior, so it's not a foregone conclusion that an attacker could have planted a malicious skill there in the first place. Check Point also suggests that a hacker might be able to access banking data history through the attack, but Amazon disputes this, saying that information is redacted in Alexa's responses. "The security of our devices is a top priority, and we appreciate the work of independent researchers like Check Point who bring potential issues to us," an Amazon spokesperson told WIRED in a statement. "We fixed this issue soon after it was brought to our attention, and we continue to further strengthen our systems. We are not aware of any cases of this vulnerability being used against our customers or of any customer information being exposed."' -- source: https://yro.slashdot.org/story/20/08/17/2129202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Text Editor Notepad++ Banned In China After 'Stand With Hong Kong' Update
by Peter Reutemann 18 Aug '20

18 Aug '20

'The website of Notepad++ is banned in China as of Monday, "obviously due to" its release of editions named "Free Uyghur" and "Stand with Hong Kong," the source code and text editor announced on Twitter. TechCrunch reports: First released in 2003 by France-based developer Don Ho, free-to-use Notepad++ operates on Windows and supports some 90 languages. In his release notices for the two editions, Ho openly voiced his concerns over "human rights" conditions, respectively in the Xinjiang autonomous region and Hong Kong. Tests by TechCrunch found that the Notepad++ ban only applies to its Download page -- which showcases the special editions and thus politically sensitive language -- when one tries to reach it from Chinese browsers developed by Tencent (QQ Browser and WeChat's built-in browser), Alibaba (UC Browser), 360 and Sogou. These services flag the page as containing content "prohibited" by local regulators. Notepad++'s home page, on the other hand, remains unblocked through these local browsers. One can still access the full site from Chrome and DuckDuckGo in China. The ban began as early as August 12 when a user notified Ho of the ban, the developer told TechCrunch. He has never been contacted by any Chinese government authority and does not plan to take measures to cope with the website restriction.' -- source: https://yro.slashdot.org/story/20/08/17/2028235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Reviewer Calls Linux-based PinePhone 'the Most Interesting Smartphone I've Tried in Years'
by Peter Reutemann 17 Aug '20

17 Aug '20

'A review at the Android Police site calls Pine64's new Linux-based PinePhone "the most interesting smartphone I've tried in years," with 17 different operating systems available (including Fedora, Ubuntu Touch, SailfishOS, openSUSE, and Arch Linux ARM): There's a replaceable battery, which is compatible with batteries designed for older Samsung Galaxy J7 phones. It's good to know that even if PinePhone vanished overnight, you could still purchase new batteries for around $10-15... There's a microSD card slot above the SIM tray, which supports cards up to 2TB in size. While it can be used as extra storage, just like the SD slots in Android phones and tablets, it can also function as a bootable drive. If you write an operating system image to the SD card and put it in the PinePhone, the phone will boot from the SD card. This means you can move between operating systems on the PinePhone by simply swapping microSD cards, which is amazing for trying out new Linux distributions without wiping data. How great would it be if Android phones could do that? Finally, the inside of the PinePhone has six hardware killswitches that can be manipulated with a screwdriver. You can use them to turn off the modem, Wi-Fi/Bluetooth, microphone, rear camera, front camera, and headphone jack. No need to put a sticker over the selfie camera if you're worried about malicious software — just flip the switch and never worry about it again.... For a $150 phone produced in limited batches by a company with no previous experience in the smartphone industry, I'm impressed it's built as well as it is... I look forward to seeing what the community around the PinePhone can accomplish. A Pine64 blog post this weekend touts "a boat-load of cool and innovative things" being attempted by the PinePhone community, including users working on things like a fingerprint scanner or a thermal camera, plus a community that's 3D-printing their own custom PinePhone cases. And Pine64 has now identified three candidates for a future keyboard option (each of which can be configured as either a slide-out or clamshell keyboard): I feel like we have finally gotten into a good production rhythm; it was only last month we announced the postmarketOS Community Edition of the PinePhone, and this month I am here to tell you that the factory will deliver the phones to us at the end of this month... I don't know about you, but I think that this is a rather good production pace. At the time of writing, and based on current sale rates, the postmarketOS production-run will sell out in a matter of days... While I have no further announcements at this time, what I will say is that we have no intention of slowing down the pace now until February 2021 (when Chinese New Year begins)...' -- source: https://mobile.slashdot.org/story/20/08/17/0115227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Can Firefox Be Saved?
by Peter Reutemann 17 Aug '20

17 Aug '20

'"Even with another infusion of cash from Google, you have to wonder just how long Firefox will survive as a viable, mainstream web browser," argues ZDNet contributing editor Steven J. Vaughan-Nichols: I've been using Mozilla's Firefox browser since it was still in beta. In 2004, for a while, it was my favorite web browser. Not because it was open-source, but because it was so much better and more secure than Internet Explorer. That was then. This is now. Firefox is in real danger of dying off... Mozilla and Firefox still produced important work. You need to look no further than the JavaScript, Rust, and WebAssembly languages. They were also champions of security and privacy. Projects such as embracing DNS-over-HTTPS (DoH) and overall security improvements were great, but users didn't care. With the arrival of Google's Chrome browser, users turned from Firefox to Chrome as their favorite browser... Firefox is on its way to irrelevance. Making matters even worse, Mozilla's just had its second round of layoffs... As technology writer Matthew MacDonald put it, "Mozilla "." Firefox's security and development teams have also been hard hit. This is bad. In January. Mitchell Baker, Mozilla Corporation CEO and Mozilla Foundation chairperson, said it let people go because of declining interest in Firefox, and thus reduced earnings, and that Mozilla was looking for more revenue from "sources outside of search" but "this did not happen." It still isn't happening. According to Mozilla's latest annual report, the majority of its revenue is still generated from global browser search partnerships. This includes the deal negotiated with Google in 2017... Baker assured onlookers that Mozilla would "ship new products faster and develop new revenue streams." These include its bookmarking app Pocket; its virtual rooms Hubs; and its $4.99-a-month Firefox VPN. Excuse me if I don't buy any of these new revenue sources.... Firefox will live on in one way or the other. It's open source after all. But Firefox as an important browser, or Mozilla as a significant open-source developer hub? No. I can't see it. Those days are done. Firefox is officially on my endangered species list. Technology writer Matthew MacDonald ended his Medium essay on a more hopeful note. "If you have the skills and time, the best possible support is to join the Mozilla community and contribute to their code base."' -- source: https://news.slashdot.org/story/20/08/15/1955237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Happy Birthday to Debian, CPAN, and Mutt
by Peter Reutemann 17 Aug '20

17 Aug '20

'27 years ago today, in 1993, Debian first appeared in the world. August 16th has since been recognized as "DebianDay," celebrated shortly before the annual Debian Conference — with lots of ways to get involved, according to Debian.org: Today is also an opportunity for you to start or resume your contributions to Debian. For example, you can scratch your creative itch and suggest a wallpaper to be part of the artwork for the next release, have a look at the DebConf20 schedule and register to participate online (August 23rd to 29th, 2020), or put a Debian live image in a DVD or USB and give it to some person near you, who still didn't discover Debian. Our favorite operating system is the result of all the work we do together. Thanks to everybody who has contributed in these 27 years, and happy birthday Debian! And the same day is also the 25th anniversary of CPAN, the Comprehensive Perl Archive Network: On the 16th August 1995, Andreas König uploaded Symdump 1.20 to CPAN. There were other things already on CPAN, but this was the first true upload, to be followed by more than 6,500 people who have released over 35,000 distributions in 230k releases. So it seems appropriate that 16th August be designated CPAN Day, to celebrate CPAN, and all the authors who've made it what it is. That blog post urges readers to celebrate the anniversary "by doing something related to CPAN: release something, blog about your favourite module, or email its author thanking her or him." Finally, Slashdot reader JobSnijders reminds us that Mutt is also enjoying a birthday: The email client that aims to suck a little bit less celebrates its 25th anniversary!' -- source: https://linux.slashdot.org/story/20/08/16/1652249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How Qualcomm Shook Down The Cell Phone Industry For Almost 20 Years
by Lawrence D'Oliveiro 15 Aug '20

15 Aug '20

A pretty sobering read <https://arstechnica.com/tech-policy/2019/05/how-qualcomm-shook-down-the-cel…>: Qualcomm's first weapon against competitors: patent licensing terms requiring customers to pay a royalty on every phone sold—not just phones that contained Qualcomm's wireless chips. Sound familiar? Judge Koh draws a direct parallel to licensing behavior that got Microsoft in legal trouble in the 1990s. Microsoft would offer PC makers a discount if they agreed to pay Microsoft a licensing fee for every PC sold—whether or not the PC shipped with a copy of MS-DOS. This effectively meant that a PC maker had to pay twice if it shipped a PC running a non-Microsoft operating system. There’s a lot more--the article reads like a catalogue of gangster-like tactics. All of which is perfectly all right under the US interpretation of “Free Enterprise”, of course ... Also, reading the details of how Qualcomm managed to sabotage Intel’s efforts to develop 5G chips, it seems to me that Qualcomm is directly responsible for the situation today where US companies are lagging behind Chinese ones like Huawei in 5G capability.

1 1

LibreOffice 7.0
by Peter Reutemann 14 Aug '20

14 Aug '20

Hi everyone I completely missed the release of LibreOffice 7.0 at the start of August: https://wiki.documentfoundation.org/ReleaseNotes/7.0 Notable changes: - ODF 1.3 support - EMF+ import improved - improved import/export of docx/xlsx/pptx files - Python 2.7 support removed, uses Python 3 by default - Macromedia flash export removed Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

GPT-3 Raises Complex Questions for Philosophy and Policy
by Lawrence D'Oliveiro 14 Aug '20

14 Aug '20

From <https://freedom-to-tinker.com/2020/08/13/gpt-3-raises-complex-questions-for…>: GPT-3, a powerful, 175 billion parameter language model developed recently by OpenAI, has been galvanizing public debate and controversy ... Why the hype? GPT-3 is unlike other natural language processing (NLP) systems, the latter of which often struggle with what comes comparatively easily to humans: performing entirely new language tasks based on a few simple instructions and examples. Instead, NLP systems usually have to be pre-trained on a large corpus of text, and then fine-tuned in order to successfully perform a specific task. GPT-3, by contrast, does not require fine tuning of this kind: it seems to be able to perform a whole range of tasks reasonably well, from producing fiction, poetry, and press releases to functioning code, and from music, jokes, and technical manuals, to “news articles which human evaluators have difficulty distinguishing from articles written by humans”. Also note this: ... GPT-3 has been trained on us—on a lot of things that we have said and written—and ends up reproducing just that, racial and gender bias included. OpenAI acknowledges this in their own paper on GPT-3,where they contrast the biased words GPT-3 used most frequently to describe men and women, following prompts like “He was very…” and “She would be described as…”. The results aren’t great. For men? Lazy. Large. Fantastic. Eccentric. Stable. Protect. Survive. For women? Bubbly, naughty, easy-going, petite, pregnant, gorgeous.

1 0

FBI and NSA Expose New Linux Malware Drovorub, Used by Russian State Hackers
by Peter Reutemann 14 Aug '20

14 Aug '20

'The FBI and NSA have published today a joint security alert containing details about a new strain of Linux malware that the two agencies say was developed and deployed in real-world attacks by Russia's military hackers. From a report: The two agencies say Russian hackers used the malware, named Drovorub, was to plant backdoors inside hacked networks. Based on evidence the two agencies have collected, FBI and NSA officials claim the malware is the work of APT28 (Fancy Bear, Sednit), a codename given to the hackers operating out of military unity 26165 of the Russian General Staff Main Intelligence Directorate (GRU) 85th Main SpecialService Center (GTsSS). Through their joint alert, the two agencies hope to raise awareness in the US private and public sectors so IT administrators can quickly deploy detection rules and prevention measures.' -- source: https://linux.slashdot.org/story/20/08/13/174237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Extends its Google Search Deal
by Peter Reutemann 13 Aug '20

13 Aug '20

'Mozilla and Google have extended their search deal for another three years, news outlet ZDNet reported Wednesday, citing sources familiar with thee matter. Mozilla confirmed the news. From a report: The new search deal will ensure Google remains the default search engine provider inside the Firefox browser until 2023 at an estimated price tag of around $400 million to $450 million per year. Mozilla officials are expected to announce the search deal's extension later this fall, in November, when the organization is scheduled to disclose its 2019 financial figures. Terms of the new deal were leaked to this reporter after Mozilla announced plans to lay off more than 250 employees on Wednesday in a move that had many users fearing for the browser maker's future, as Mozilla's current Google search deal was scheduled to expire at the end of the year. However, several sources have confirmed that the organization is sound financially, and the layoffs were part of a restructuring of its core business, with Mozilla moving away from its current role of internet standards steward and experimental approach to its product catalog to more commercially-viable offerings that generate revenues on their own.' -- source: https://tech.slashdot.org/story/20/08/13/0012243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Google Makes Building Android Apps on Chrome OS Easier
by Peter Reutemann 13 Aug '20

13 Aug '20

'Google today launched ChromeOS.dev, a new site that aims to help developers get started with building Android apps for the company's Linux-based operating system. With today's update, Google is also making it easier to build and test Android applications on Chromebooks. From a report: The new ChromeOS.dev site, which is available in English and Spanish for now, is meant to "help developers maximize their capabilities on the platform through technical resources/tutorials, product announcements, code samples and more," a Google spokesperson told us. As Google notes in today's announcement, in the last quarter, Chromebook unit sales were up 127% year-over-year in the last quarter, compared to 40% for notebook sales in general. To help Android developers do all of their work on a Chromebook if they so desire, Google now offers the full Android Emulator on Chrome OS to test apps right on their Chromebooks. The team also made deploying apps on Chrome OS (M81 and newer) much easier. Developers can now deploy and test apps directly without having to use developer mode or connect devices via USB.' -- source: https://developers.slashdot.org/story/20/08/12/193214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

TikTok Tracked User Data Using Tactic Banned By Google
by Peter Reutemann 12 Aug '20

12 Aug '20

'TikTok skirted a privacy safeguard in Google's Android operating system to collect unique identifiers from millions of mobile devices, data that allows the app to track users online without allowing them to opt out, a Wall Street Journal analysis has found. The tactic, which experts in mobile-phone security said was concealed through an unusual added layer of encryption, appears to have violated Google policies limiting how apps track people and wasn't disclosed to TikTok users. TikTok ended the practice in November, the Journal's testing showed. The identifiers collected by TikTok, called MAC addresses, are most commonly used for advertising purposes. The White House has said it is worried that users' data could be obtained by the Chinese government and used to build detailed dossiers on individuals for blackmail or espionage. In a statement, a spokesperson said the company is "committed to protecting the privacy and safety of the TikTok community. Like our peers, we constantly update our app to keep up with evolving security challenges." The company said "the current version of TikTok does not collect MAC addresses."' -- source: https://yro.slashdot.org/story/20/08/11/2120246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

upcoming meeting
by Peter Reutemann 12 Aug '20

12 Aug '20

Hi everyone With the country moving up levels again today [1], I will reevaluate next week whether we are still allowed to meet on campus for our August WLUG meeting. At this stage, the university only seems to assess events of more than 100 people. However, they are requiring social distancing, which is a bit more difficult when you have a hands-on meeting (wireguard). For the time being, stay safe and be kind! Cheers, Peter [1] https://covid19.govt.nz/updates-and-resources/latest-updates/new-zealands-a… -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android is Becoming a Worldwide Earthquake Detection Network
by Peter Reutemann 12 Aug '20

12 Aug '20

'Google is creating a worldwide, Android phone-powered earthquake alert system. The first part of that system is rolling out today. If you opt in, the accelerometer in your Android phone will become one data point for an algorithm designed to detect earthquakes. Eventually, that system will automatically send warnings to people who could be impacted. From a report: It's a feature made possible through Google's strengths: the staggering numbers of Android phones around the world and clever use of algorithms on big data. As with its collaboration with Apple on exposure tracing and other Android features like car crash detection and emergency location services, it shows that there are untapped ways that smartphones could be used for something more important than doomscrolling. Google is rolling out the system in small stages. First, Google is partnering with the United States Geological Survey and the California Office of Emergency Services to send the agencies' earthquake alerts to Android users in that state. Those alerts are generated by the already-existing ShakeAlert system, which uses data generated by traditional seismometer' -- source: https://tech.slashdot.org/story/20/08/11/1440235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Lays Off 250 Employees While it Refocuses on Commercial Products
by Peter Reutemann 12 Aug '20

12 Aug '20

'The Mozilla Corporation announced today it was laying off approximately 250 staff members in a move to shore up the organization's financial future. From a report: The layoffs were publicly announced in a blog post today. Employees were notified hours before, earlier this morning, via an email sent by Mitchell Baker, Mozilla Corporation CEO and Mozilla Foundation Chairwoman. Baker's message cited the organization's need to adapt its finances to a post-COVID-19 world and re-focus the organization on new commercial services. Baker said that after the onset of the COVID-19 pandemic, Mozilla attempted to minimize the healthcare crisis' financial impact with "immediate cost-saving measures such as pausing our hiring, reducing our wellness stipend and cancelling our All-Hands [meetings]." However, Baker said that Mozilla's "pre-COVID plan is no longer workable." "We have talked about the need for change -- including the likelihood of layoffs -- since the spring. Today these changes become real," the Mozilla CEO said today.' -- source: https://tech.slashdot.org/story/20/08/11/1458214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

China Blocking ESNI Connections
by Lawrence D'Oliveiro 11 Aug '20

11 Aug '20

TLS 1.3 (the latest version of the protocol used for “HTTPS” connections) adds a feature called “Encrypted Server Name Indication” (ESNI). This removes a loophole where the initial exchange, in which the browser indicates to the server which (of possibly many) virtual host names it is trying to connect to, is sent unencrypted. Reports <https://www.theregister.com/2020/08/11/china_blocking_tls_1_3_esni/> are saying that the Great Firewall of China is trying to block all such connection attempts, just in case any of them happen to be to “banned” sites. However, it is (currently) possible to manipulate the packet stream in such a way as to fool this filtering, so the connection can go through.

1 0

CrowPi 2 Raspberry-π-Based Laptop Incl Development Board
by Lawrence D'Oliveiro 11 Aug '20

11 Aug '20

Review <https://www.youtube.com/watch?v=l0WGyY7njWQ> of a laptop-styled unit built around a Raspberry π 4. Lift off the (wireless) keyboard, to reveal a built-in development board with a whole bunch of extra components on it for you to play with. Also comes with a few sensors that you can connect to conduct various experiments, plus two game controllers and a remote control. Oh, and some cardboard cut-out-and-fold Minecraft blocks.

1 0

Boeing 747 Navigation Databases Updated Via 3½” Floppy Drives
by Lawrence D'Oliveiro 11 Aug '20

11 Aug '20

A group of security hackers took advantage of British Airways’ decommissioning of its Boeing 747 fleet to have a nose round inside one before the scrap dealers moved in <https://www.theregister.com/2020/08/10/boeing_747_floppy_drive_updates_walk…>. The navigation database has to be updated every 28 days. This is done by bringing along a 3½” floppy disk with the new info and putting it into an onboard drive. On the bright side, there really seemed to be a good separation between the customer-accessible in-flight entertainment systems and those used to manage critical aircraft systems.

2 1

Snapdragon chip flaws put >1 billion Android phones at risk of data theft
by Peter Reutemann 10 Aug '20

10 Aug '20

'A billion or more Android devices are vulnerable to hacks that can turn them into spying tools by exploiting more than 400 vulnerabilities in Qualcomm’s Snapdragon chip, researchers reported this week. The vulnerabilities can be exploited when a target downloads a video or other content that’s rendered by the chip. Targets can also be attacked by installing malicious apps that require no permissions at all. >From there, attackers can monitor locations and listen to nearby audio in real time and exfiltrate photos and videos. Exploits also make it possible to render the phone completely unresponsive. Infections can be hidden from the operating system in a way that makes disinfecting difficult. Snapdragon is what’s known as a system on a chip that provides a host of components, such as a CPU and a graphics processor. One of the functions, known as digital signal processing, or DSP, tackles a variety of tasks, including charging abilities and video, audio, augmented reality, and other multimedia functions. Phone makers can also use DSPs to run dedicated apps that enable custom features.' -- source: https://arstechnica.com/information-technology/2020/08/snapdragon-chip-flaw… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Researcher Discovers New 'HTTP Request Smuggling Attack' Variants
by Peter Reutemann 10 Aug '20

10 Aug '20

'Some scary new variants of "HTTP request smuggling" have been discovered by Amit Klein, VP of security research at SafeBreach, reports Security Week: Specifically, an HTTP request smuggling attack, which can be launched remotely over the internet, can allow a hacker to bypass security controls, gain access to sensitive data, and compromise other users of the targeted app. While the attack method has been known for more than a decade, it still hasn't been fully mitigated. Klein has managed to identify five new attack variants and he has released proof-of-concept (PoC) exploits. He demonstrated his findings using the Abyss X1 web server from Aprelium and the Squid caching and forwarding HTTP web proxy. The developers of Abyss and Squid have been notified of the vulnerabilities exploited by Klein during his research, and they have released patches and mitigations. One of the attacks bypasses the OWASP ModSecurity Core Rule Set (CRS), which provides generic attack detection rules for ModSecurity or other web application firewalls. OWASP has also released fixes after being notified. Klein told SecurityWeek ahead of his talk on HTTP request smuggling at the Black Hat conference that an attacker needs to find combinations of web servers and proxy servers with "matching" vulnerabilities in order to launch an attack, which makes it difficult to determine exactly how many servers are impacted. However, an attacker can simply try to launch an attack to determine if a system is vulnerable. "The attack is not demanding resource-wise, so there's no downside to simply trying it," Klein said. In his research, he demonstrated a web cache poisoning attack, in which the attacker forces the proxy server to cache the content of one URL for a request of a different URL. He says attacks can be launched en-masse through a proxy server against multiple different web servers or against multiple proxy servers... While there haven't been any reports of HTTP request smuggling being used in the wild, Klein has pointed out that attacks may have been launched but were not detected by the target.' -- source: https://it.slashdot.org/story/20/08/09/0047219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds: Linux 5.8 "One of our Biggest Releases of All Time"
by Peter Reutemann 10 Aug '20

10 Aug '20

'This week saw the release Linux 5.8, which Linus Torvalds called "one of our biggest releases of all time," reports TechRepublic: The new version of the Linux kernel brings a number of updates to Linux 5.7 spanning security, core components, drivers, memory management, networking and improvements to the kernel's design, amongst others. This includes updates for Microsoft's Hyper-V virtualization platform, Intel Tiger Lake Thunderbolt support, improvements to Microsoft's exFAT file system, and support for newer Intel and ARM chips. Torvalds said the kernel had received over 15,000 merge requests and that around 20% of all the files in the kernel source repository had been modified. "That's really a fairly big percentage, and while some of it is scripted, on the whole it's really just the same pattern: 5.8 has simply seen a lot of development," Torvalds said. Translated into numbers, Linux 5.8 includes over 800,000 new lines and over 14,000 changed files. It also received one of the biggest number of merge requests during its merge window — over 14,000 non-merge commits and more than 15,000 including merges, according to Torvalds. "5.8 looks big. Really big," he added.' -- source: https://linux.slashdot.org/story/20/08/09/2046232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Infographic: Ubuntu from 2004 to 20.04 LTS
by Peter Reutemann 09 Aug '20

09 Aug '20

'Today, the first point release of Ubuntu 20.04 LTS went live! To celebrate, we wanted to share how Ubuntu has evolved since the first release in 2004 to where we are today with 20.04. Thanks to those in the community and our users for your contributions and joining us on this journey. Upgrade to Ubuntu 20.04.1 LTS now!' -- source: https://ubuntu.com/blog/infographic-ubuntu-from-2004-to-20-04-lts Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

4 4

Scientists Rename Human Genes To Stop Microsoft Excel From Misreading Them as Dates
by Peter Reutemann 08 Aug '20

08 Aug '20

'There are tens of thousands of genes in the human genome: minuscule twists of DNA and RNA that combine to express all of the traits and characteristics that make each of us unique. Each gene is given a name and alphanumeric code, known as a symbol, which scientists use to coordinate research. But over the past year or so, some 27 human genes have been renamed, all because Microsoft Excel kept misreading their symbols as dates. From a report: The problem isn't as unexpected as it first sounds. Excel is a behemoth in the spreadsheet world and is regularly used by scientists to track their work and even conduct clinical trials. But its default settings were designed with more mundane applications in mind, so when a user inputs a gene's alphanumeric symbol into a spreadsheet, like MARCH1 -- short for "Membrane Associated Ring-CH-Type Finger 1" -- Excel converts that into a date: 1-Mar. This is extremely frustrating, even dangerous, corrupting data that scientists have to sort through by hand to restore. It's also surprisingly widespread and affects even peer-reviewed scientific work. One study from 2016 examined genetic data shared alongside 3,597 published papers and found that roughly one-fifth had been affected by Excel errors.' -- source: https://science.slashdot.org/story/20/08/06/147226 This auto-interpreting and getting things wrong has always annoyed me about Excel and other spreadsheet applications. Not sure whether there ever was an option to turn off this "auto-detect of content type"... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 5

Yet Another Spreadsheet Screwup
by Lawrence D'Oliveiro 08 Aug '20

08 Aug '20

The British Army had to retract a bunch of notifications about promotions incorrectly sent out <https://www.theregister.com/2020/08/07/army_promotion_excel_snafu/>. I suspect the phrase “incorrectly sorted” means they forgot to select all the right columns before doing a sort of the rows, leading to a scrambling of the data. This kind of thing is all too common.

1 0

The Next Step In SSD Evolution: NVMe Zoned Namespaces Explained
by Peter Reutemann 07 Aug '20

07 Aug '20

'In June we saw an update to the NVMe standard. The update defines a software interface to assist in actually reading and writing to the drives in a way to which SSDs and NAND flash actually works. Instead of emulating the traditional block device model that SSDs inherited from hard drives and earlier storage technologies, the new NVMe Zoned Namespaces optional feature allows SSDs to implement a different storage abstraction over flash memory. This is quite similar to the extensions SAS and SATA have added to accommodate Shingled Magnetic Recording (SMR) hard drives, with a few extras for SSDs. 'Zoned' SSDs with this new feature can offer better performance than regular SSDs, with less overprovisioning and less DRAM. The downside is that applications and operating systems have to be updated to support zoned storage, but that work is well underway. The NVMe Zoned Namespaces (ZNS) specification has been ratified and published as a Technical Proposal. It builds on top of the current NVMe 1.4a specification, in preparation for NVMe 2.0. The upcoming NVMe 2.0 specification will incorporate all the approved Technical Proposals, but also reorganize that same functionality into multiple smaller component documents: a base specification (one for each command set of block, zoned, key-value, and potentially more in the future), and separate specifications for each transport protocol (PCIe, RDMA, TCP). The standardization of Zoned Namespaces clears the way for broader commercialization and adoption of this technology, which so far has been held back by vendor-specific zoned storage interfaces and very limited hardware choices. [...]' -- source: https://hardware.slashdot.org/story/20/08/06/1916230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Can Killing Cookies Save Journalism?
by Peter Reutemann 07 Aug '20

07 Aug '20

'In May 2018, as the European Union’s landmark privacy law, the General Data Protection Regulation, went into effect, the main Dutch public broadcaster set in motion a grand experiment. The leadership at Nederlandse Publieke Omroep—essentially the BBC of the Netherlands—interpreted the law strictly, deciding that visitors to any of its websites would now be prompted to opt in or out of cookies, the tracking technology that enables personalized ads based on someone’s browsing history. And, unlike with most companies, who assume that anyone who skips past a privacy notice is OK with tracking, any NPO visitor who clicked past the obtrusive consent screen without making a choice would be opted out by default. The results weren’t terribly surprising: 90 percent of users opted out. Here is where the ad tech industry would have predicted calamity. A study performed by Google last year, for example, concluded that disabling cookies reduced publisher revenue by more than 50 percent. (Research by an independent team of economists, however, pegged the cookie premium at only 4 percent. Needless to say, there were methodological differences.) If the Google study was right, then NPO should have been heading for financial disaster. The opposite turned out to be true. Instead, the company found that ads served to users who opted out of cookies were bringing in as much or more money as ads served to users who opted in. The results were so strong that as of January 2020, NPO simply got rid of advertising cookies altogether. And rather than decline, its digital revenue is dramatically up, even after the economic shock of the coronavirus pandemic.' -- source: https://www.wired.com/story/can-killing-cookies-save-journalism/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Cluster of 295 Chrome Extensions Caught Hijacking Google and Bing Search Results
by Peter Reutemann 07 Aug '20

07 Aug '20

'More than 80 million Chrome users have installed one of 295 Chrome extensions that have been identified to hijack and insert ads inside Google and Bing search results. The malicious extensions were discovered by AdGuard, a company that provides ad-blocking solutions, while the company's staff was looking into a series of fake ad-blocking extensions that were available on the official Chrome Web Store. AdGuard says that most of the extensions (245 out of the 295 extensions) were simplistic utilities that had no other function than to apply a custom background for Chrome's "new tab" page. In addition to the 295 cluster, AdGuard also found a large number of copycat extensions that cloned popular add-ons to capitalize on their brands, and then load malicious code that performed ad fraud or cookie stuffing. ZDNet has the full list of 295 Chrome extensions embedded in their article.' -- source: https://search.slashdot.org/story/20/08/05/213204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Massive 20GB Intel IP Data Breach Floods the Internet, Mentions Backdoors
by Peter Reutemann 07 Aug '20

07 Aug '20

'A leaker today posted on Twitter a link to a file sharing service that contains what an anonymous source claims is a portion of Intel's crown jewels: A 20GB folder of confidential Intel intellectual property. The leaker dubbed the release the "Intel exconfidential Lake Platform Release ;)" The folder has been posted by an anonymous source that claims more is coming soon, and while we don't know the exact specifics of the folder's contents, we have verified that it does exist. In fact, the title of many of the documents do correlate to the list of purported information posted by the leaker: Intel ME Bringup guides + (flash) tooling + samples for various platforms Kabylake (Purley Platform) BIOS Reference Code and Sample Code + Initialization code (some of it as exported git repos with full history) Intel CEFDK (Consumer Electronics Firmware Development Kit (Bootloader stuff)) SOURCES Silicon / FSP source code packages for various platforms Various Intel Development and Debugging Tools Simics Simulation for Rocket Lake S and potentially other platforms Various roadmaps and other documents Binaries for Camera drivers Intel made for SpaceX Schematics, Docs, Tools + Firmware for the unreleased Tiger Lake platform (very horrible) Kabylake FDK training videos Intel Trace Hub + decoder files for various Intel ME versions Elkhart Lake Silicon Reference and Platform Sample Code Some Verilog stuff for various Xeon Platforms, unsure what it is exactly. Debug BIOS/TXE builds for various Platforms Bootguard SDK (encrypted zip) Intel Snowridge / Snowfish Process Simulator ADK Various schematics Intel Marketing Material Templates (InDesign)' -- source: https://slashdot.org/story/20/08/06/199225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome for Android May Soon Send Notifications Reminding You To Use Chrome
by Peter Reutemann 06 Aug '20

06 Aug '20

'For years now, Google Chrome has been an absolute dominant force in the world of web browsers, but since the relaunch of Microsoft Edge based on Google's Chromium, that position has been challenged. Now, Google is preparing to drive more Android owners back to using Chrome through targeted notifications. Over the admittedly brief history of the Internet, there have been a number of fierce competitions, commonly called "browser wars," between companies, in an effort to get more people to use their particular web browser. Mozilla and Netscape waged war against Internet Explorer, and Chrome fought and won against Firefox. Most recently, Microsoft Edge and Samsung Internet have begun to wage war against Chrome on desktop and Android respectively. Now, we've found that Google is preparing to try and win back some of those who have left Chrome for other browsers, starting on Android. Based on our reading of a series of code changes, we believe Google Chrome for Android will send you a notification if you haven't used Chrome in a while.' -- source: https://it.slashdot.org/story/20/08/05/2022204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Online Hacker Court Hearing Gets Hacked
by Lawrence D'Oliveiro 06 Aug '20

06 Aug '20

A bail hearing being conducted via Zoom video conference concerning the hacker who is accused of taking over several Twitter accounts to commit a Bitcoin fraud got “Zoombombed” by unidentified parties who interjected videos of racial slurs, music and porn <https://arstechnica.com/tech-policy/2020/08/zoombomber-crashes-court-hearin…>. Priceless subhead: “Judge will require password next time”.

1 0

Hackers Could Use IoT Botnets To Manipulate Energy Markets
by Peter Reutemann 06 Aug '20

06 Aug '20

'Wired: At the Black Hat security conference on Wednesday, [researchers at the Georgia Institute of Technology] will present their findings, which suggest that high-wattage IoT botnets -- made up of power-guzzling devices like air conditioners, car chargers, and smart thermostats -- could be deployed strategically to increase demand at certain times in any of the nine private energy markets around the US. A savvy attacker, they say, would be able to stealthily force price fluctuations in the service of profit, chaos, or both. The researchers used real, publicly available data from the New York and California markets between May 2018 and May 2019 to study fluctuations in both the "day-ahead market" that forecasts demand and the "real-time market," in which buyers and sellers correct for forecasting errors and unpredictable events like natural disasters. By modeling how much power various hypothetical high-wattage IoT botnets could draw, and crunching the market data, the researchers devised two types of potential attacks that would alter energy pricing. They also figured out how far hackers would be able to push their attacks without the malicious activity raising red flags. "Our basic assumption is that we have access to a high-wattage IoT botnet," says Tohid Shekari, a PhD candidate at the Georgia Institute of Technology who contributed to the research, along with fellow PhD candidate Celine Irvine and professor Raheem Beyah. "In our scenarios, attacker one is a market player; he's basically trying to maximize his own profit. Attacker two is a nation-state actor who can cause financial damage to market players as part of a trade war or cold war. The basic part of either attack is to look at price-load sensitivity. If we change demand by 1 percent, how much is the price going to change as a result of that? You want to optimize the attack to maximize the gain or damage." An attacker could use their botnet's power to increase demand, for instance, when other entities are betting it will be low. Or they could bet that demand will go up at a certain time with certainty that they can make that happen. "The researchers caution that, based on their analysis, much smaller demand fluctuations than you might expect could affect pricing, and that it would take as few as 50,000 infected devices to pull off an impactful attack," the report adds. "Consumers whose devices are unwittingly conscripted into a high-wattage botnet would also be unlikely to notice anything amiss; attackers could intentionally turn on devices to pull power late at night or while people are likely to be out of the house. [...] The researchers calculated that market manipulation campaigns would cause, at most, a 7 percent increase in consumers' home electric bills, likely low enough to go unnoticed." The researchers say market manipulators could take home as much as $245 million a year, and cause as much as $350 million per year in economic damage.' -- source: https://hardware.slashdot.org/story/20/08/04/2213253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

LastPass Will Warn You If Your Passwords Show Up On the Dark Web
by Peter Reutemann 06 Aug '20

06 Aug '20

'LastPass is updating its Security Dashboard with a feature that provides an overview of all your accounts, highlighting any passwords that could pose a security risk. The password manager is also introducing dark web monitoring, although it will require you to be a paid LastPass subscriber. Engadget reports: If you already use LastPass and the Security Dashboard sounds familiar, it's because it builds on the Security Challenge functionality LastPass developer LogMeIn added in 2010. As before, grading is a major aspect of the interface. When you first navigate to the Security Dashboard, you'll see a score of all your logins, followed by a breakdown of passwords that are either old, inactive, weak or reused. You can click or tap on a problematic password to change it, and LastPass will automatically take you to the webpage where you can update your login information. LogMeIn hasn't changed how the app calculates the overall score it gives to each user. But one significant improvement the Security Dashboard brings over the Security Challenge is that you don't need to manually run it each time you want to see the security of your online accounts. The score and steps you can take to improve your online security are there each time you visit that part of the software's interface. With today's update, LogMeIn is also introducing dark web monitoring. When you enable the feature, LastPass will proactively check your online accounts against Enzoic's compromised credentials database. If it detects an issue, it will notify you through both email and the app. Dark web monitoring is available to LastPass Premium, Family and Business subscribers. The dashboard, by contrast, is available to all LastPass users. ' -- source: https://it.slashdot.org/story/20/08/05/2027246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hacker Leaks Passwords For 900+ Enterprise VPN Servers
by Peter Reutemann 06 Aug '20

06 Aug '20

'A hacker has published today a list of plaintext usernames and passwords, along with IP addresses for more than 900 Pulse Secure VPN enterprise servers. ZDNet reports: According to a review, the list includes: IP addresses of Pulse Secure VPN servers, Pulse Secure VPN server firmware version, SSH keys for each server, a list of all local users and their password hashes, admin account details, last VPN logins (including usernames and cleartext passwords), and VPN session cookies. Bank Security, a threat intelligence analyst specialized in financial crime [...] noted that all the Pulse Secure VPN servers included in the list were running a firmware version vulnerable to the CVE-2019-11510 vulnerability. Bank Security believes that the hacker who compiled this list scanned the entire internet IPv4 address space for Pulse Secure VPN servers, used an exploit for the CVE-2019-11510 vulnerability to gain access to systems, dump server details (including usernames and passwords), and then collected all the information in one central repository. Making matters worse, the list has been shared on a hacker forum that is frequented by multiple ransomware gangs. For example, the REvil (Sodinokibi), NetWalker, Lockbit, Avaddonm, Makop, and Exorcist ransomware gangs have threads on the same forum, and use it to recruit members (developers) and affiliates (customers). Many of these gangs perform intrusions into corporate networks by leveraging network edge devices like Pulse Secure VPN servers, and then deploy their ransomware payload and demand huge ransom demands. As Bank Security told ZDNet, companies have to patch their Pulse Secure VPNs and change passwords with the utmost urgency. ' -- source: https://it.slashdot.org/story/20/08/04/2333258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Twitter Says Android Security Bug Gave Access To Direct Messages
by Peter Reutemann 06 Aug '20

06 Aug '20

'Twitter says a security bug may have exposed the private direct messages of its Android app users, but said that there was no evidence that the vulnerability was ever exploited. From a report: The bug could have allowed a malicious Android app running on the same device to siphon off a user's direct messages stored in the Twitter app by bypassing Android's in-built data permissions. But, Twitter said that the bug only worked on Android 8 (Oreo) and Android 9 (Pie), and has since been fixed. A Twitter spokesperson told TechCrunch that the bug was reported by a security researcher "a few weeks ago" through HackerOne, which Twitter uses for its bug bounty program. "Since then, we have been working to keep accounts secure," said the spokesperson. "Now that the issue has been fixed, we're letting people know." Twitter said it waited to let its users know in order to prevent someone from learning about the issue and taking advantage of it before it was fixed.' -- source: https://yro.slashdot.org/story/20/08/05/1728253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Cambridge University Goes Microsoft
by Lawrence D'Oliveiro 05 Aug '20

05 Aug '20

Cambridge University, one of the pioneering centres of computer science research (since 1937), is retiring its in-house Hermes e-mail system in favour of moving completely to Microsoft Exchange Online <https://www.theregister.com/2020/08/04/cambridge_uni_decommissioning_hermes…>. Admin David McBride argues that Microsoft “does not implement IETF standards – at least not competently". In particular, he said: "Its IMAP service implementation is sufficiently poor as to lose data in practice, its mail handling has been seen to violate RFC MUST assertions that causes cryptographic email signatures to be rendered invalid, and it has even sometimes generated outbound email that contains invalid MIME data." He added: "Email services that do not competently support IETF standards, such as SMTP, IMAP, MIME and the like, present significant interoperability challenges and will risk leaving us locked in to using a single vendor." According to the info here <https://fanf2.user.srcf.net/photos.html> (linked from a reader comment), Hermes is not some kind of homebrew proprietary system; it is built on well-known open-source components such as Exim and Cyrus.

1 0

Windows 10: HOSTS File Blocking Telemetry Is Now Flagged As a Risk
by Peter Reutemann 05 Aug '20

05 Aug '20

'Starting at the end of July, Microsoft has begun detecting HOSTS files that block Windows 10 telemetry servers as a 'Severe' security risk. Windows 10 users are reporting that Windows Defender had started detectingmodified HOSTS files as a 'SettingsModifier:Win32/HostsFileHijack' threat. So it seems that Microsoft had recently updated their Microsoft Defender definitions to detect when their servers were added to the HOSTS file. Users who utilize HOSTS files to block Windows 10 telemetry suddenly caused them to see the HOSTS file hijack detection. Users who intentionally modify their HOSTS file can allow this 'threat,' but it may enable all HOSTS modifications, even malicious ones, going forward.' -- source: https://tech.slashdot.org/story/20/08/04/143248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 79 Clears Redirect Tracking Cookies Every 24 Hours
by Peter Reutemann 05 Aug '20

05 Aug '20

'Mozilla today started rolling out Enhanced Tracking Protection (ETP) 2.0 in Firefox. While the company technically launched Firefox 79 for Windows, Mac, and Linux last week, it only unveiled its marquee feature today. Firefox 79 by default blocks redirect tracking, also known as bounce tracking, and adds a handful of new developer features. [...] Since enabling Enhanced Tracking Protection by default, Mozilla says it has blocked 3.4 trillion tracking cookies. But the company notes the ad industry has since created workarounds and new ways to collect user data as you browse the web.' -- source: https://news.slashdot.org/story/20/08/04/176239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android's Nearby Share' File Sharing Feature is Finally Launching
by Peter Reutemann 05 Aug '20

05 Aug '20

'It will finally be slightly easier to share files, images, links, and other content between Android devices. Google is launching a new Android feature called "Nearby Share" that enables direct sharing between any device running Android 6 and up. Nearby Share is already available on some Pixel and Samsung phones, and Google says it'll arrive on other devices "over the next few weeks." From a report: Nearby Share works very much like Apple's AirDrop feature for the iPhone: you simply select the Nearby Share button on the share menu and then wait for a nearby phone to appear. Then whatever thing you're sharing is sent directly over your transfer method of choice to the other phone. As with AirDrop, you can set your preferred visibility for Nearby Share to different levels of contacts: all, some, or stay hidden. Google says it's even possible to "send and receive files anonymously." (Welcome to AirSlothing, Android users.) Nearby Share also shares files directly via whatever method your two phones deem is fastest: "Bluetooth, Bluetooth Low Energy, WebRTC or peer-to-peer Wi-Fi," which Google says should allow it to work offline.' -- source: https://tech.slashdot.org/story/20/08/04/1935221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Decades-Old Email Flaws Could Let Attackers Mask Their Identities
by Peter Reutemann 05 Aug '20

05 Aug '20

'At the Black Hat security conference on Thursday, researchers will present "darn subtle" flaws in industry-wide protections used to ensure that emails come from the address they claim to. From a report: The study looked at the big three protocols used in email sender authentication -- Sender Policy Framework (SPF), Domain Keys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting and Conformance (DMARC) -- and found 18 instances of what the researchers call "evasion exploits." The vulnerabilities don't stem from the protocols themselves, but from how different email services and client applications implement them. Attackers could use these loopholes to make spearphishing attacks even harder to detect. "I think I'm a savvy, educated user and the reality is, no, that's actually not enough," says Vern Paxson, cofounder of the network traffic analysis firm Corelight and a researcher at the University of California, Berkeley, who worked on the study along with Jianjun Chen, a postdoctoral researcher at the International Computer Science Institute, and Jian Jiang, senior director of engineering at Shape Security. "Even users who are pretty savvy are going to look at the indicators that Gmail or Hotmail or others provide and be fooled," Paxson says. Think about when you hand a friend a birthday card at their party. You probably only write their first name on the outside of the envelope, and maybe underline it or draw a heart. If you mail that letter instead, though, you need the recipient's full name and detailed address, a stamp, and ultimately a postmark with a date on it. Sending email across the internet works similarly. Though email services only require you to fill out the "To" and "Subject" fields, there's a whole list of more detailed information getting filled out behind the scenes. Those industry-standard "headers," as they're known, include date and time sent and received, language, a unique identifier called a Message-ID, and routing information.' -- source: https://it.slashdot.org/story/20/08/04/2037238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome and Edge Rise In Popularity. Firefox, Opera, and Safari Drop.
by Peter Reutemann 04 Aug '20

04 Aug '20

'July's statistics from web analytics firm Net Applications showed continuing changes in the most frequently-used web browsers. Softpedia reports: Last month, Google Chrome increased its market share from 70.19% to 71.00%, while Microsoft Edge jumped from 8.07% to 8.46%... The migration to the Chromium engine allowed Microsoft to turn Edge into a cross-platform browser, and this is one of the reasons that contributed to the growth of the new app. Edge is now available not only on Windows 10, but also on Windows 7, Windows 8, Windows 8.1, and even macOS. At the same time, Microsoft is also working on a Linux version of the browser, and a preview build is expected by the end of the year. But what made Microsoft Edge the second most-used desktop browser out there so fast after the switch to Chromium is definitely Microsoft offering it as the default browser in Windows 10. But what about Firefox? And Opera, and Apple's Safari? Computerworld reports: A decade ago, Mozilla's browser may have dreamed of upsetting the then-order of things, taking its April 2010 share of 25.1% and parlaying it into victory over IE — down to 61.2% by then... But that was Firefox's peak. At the end of July, Firefox stood at 7.3%, down three-tenths of a percentage point from the previous month... Firefox let its second-place spot (far, far behind Chrome) slip away in March, when Edge snatched it. That did not change in July. The gap between the two more than doubled, in fact, to 1.2 points. On almost every browser share metric, Firefox is in trouble... Since the end of January, Firefox has been stuck in the 7s; for the eight months before that, it was mired in the 8s; and between May 2018 and March 2019, Firefox floundered in the 9s. The trend is crystal clear... Elsewhere in Net Applications' numbers, Apple's Safari plunged to 3%, a loss of six-tenths of a point, its lowest mark since late 2008. Opera software's Opera also took a dive, ending July at 0.8%, a decline of three-tenths of a point. Those numbers have to be frightening to both those browsers' makers.' -- source: https://news.slashdot.org/story/20/08/03/028217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Package management mistake borking some Ubuntu machines running WireGuard
by Eric Light 04 Aug '20

04 Aug '20

Morning folks! For those who watch WireGuard, Jason Donenfeld is giving the Canonical kernel team a damn roasting after they bungled a Provides statement in about half of their Linux kernel manifests... which borks certain systems running WireGuard. For example, systems with the linux-image-oem kernel will try to install the linux-image-gke kernel (meant for the Google Kubernetes Engine), in order to receive the wireguard-modules package, leading to Proper Breakage. Donenfeld: "I'll note that this is at least the third time Canonical has forgotten the "Provides:" line for kernel packages. I'd highly recommend they put some time into double checking their procedures. [...] Usually things go quite a bit better with the WireGuard side of things, but this seems pretty par for the course with _Ubuntu_ and Canonical's kernel team. We've had perpetual issues over the last 6 months with getting Canonical to release high quality packages in a timely manner. A pretty large portion of my time is spent dealing with these bugs and Ubuntu in general." Looks like Canonical's kernel packaging team are already working on it, after Jason Donenfeld escalated a bug report earlier this morning. E -------------------------------------------- Q: Why is this email five sentences or less? A: http://five.sentenc.es

1 0

Red Hat Security Update Renders Systems Unbootable
by Peter Reutemann 04 Aug '20

04 Aug '20

'A recently released Red Hat update for the BootHole Vulnerability (firehose link) is causing systems to become unbootable. It is widely reported that updates to the shim, grub2 and kernel packages in RHEL and CentOS 7 and 8 are leaving various systems that use secure boot unbootable. Current recommendations are to avoid updating your system until the issue is resolved, or at least avoid updating the shim, grub2 and kernel packages. Update, shared by PAjamian: Red Hat is now recommending that users do not apply grub2, fwupd, fwupdate or shim updates until new packages are available.' -- source: https://linux.slashdot.org/story/20/07/31/158212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

5 4

O/T: Waikato-based laptop repairer
by David McNab 01 Aug '20

01 Aug '20

Hi all, Apologies for being slightly off-topic. Does anyone know of a computer repairer in/around Hamilton, who can do board-level troubleshooting and repair on laptops, without having to "send it to Auckland"? I've got a Gigabyte i7 laptop which became unable to charge its battery a couple of years ago. I was able to run it plugged into the mains since then. But just now, it won't even start up at all. I'd like someone to do some quick tests to determine if it's a feasible repair and, if so, give a cost estimate. Oh, but it was running Ubuntu, so not completely off-topic ;) All suggestions appreciated Cheers David

1 0

Allowing PBL'ed IP addresses in Postfix
by David McNab 31 Jul '20

31 Jul '20

Hi, Has anyone had experience with configuring Postfix to allow inbound client SMTP connections from NZ-based IP addresses that have been Policy Block Listed (PBL'ed) by their ISP? Spark have PBL'ed most or all of their home and small business fibre/*DSL connection IP addresses. 2degrees have PBL'ed most/all of their cellular data IP addresses. I'm trying to support a user to send email from their cellphone email client. Cheers David

4 5

Bug In Grub2 Breaks Secure Boot (Yawn)
by Lawrence D'Oliveiro 30 Jul '20

30 Jul '20

Seems a vulnerability has been found in everyone’s favourite bootloader <https://arstechnica.com/information-technology/2020/07/new-flaw-neuters-sec…> which allows a bypass of the “Secure Boot” mechanism in modern UEFI-based machines. But given that so many other bypasses already exist, nobody seems especially worried about this. For example, the article references an attempt by Microsoft to revoke the certification of (an obsolete version of) a secure bootloader from Kaspersky Lab with a vulnerability in it; the revocation caused so many headaches for users that it had to be rolled back.

1 0

NoiseTorch
by Peter Reutemann 28 Jul '20

28 Jul '20

Hi everyone Angus mentioned NoiseTorch at last night's meeting as a way of avoiding noise from being recorded when using microphones: 'NoiseTorch is an easy to use open source application for Linux with PulseAudio. It creates a virtual microphone that suppresses noise, in any application. Use whichever conferencing or VOIP application you like and simply select the NoiseTorch Virtual Microphone as input to torch the sound of your mechanical keyboard, computer fans, trains and the likes.' -- source: https://github.com/lawl/NoiseTorch Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers Stole GitHub and GitLab OAuth Tokens From Git Analytics Firm Waydev
by Peter Reutemann 28 Jul '20

28 Jul '20

'Waydev, an analytics platform used by software companies, has disclosed a security breach that occurred earlier this month. From a report: The company says that hackers broke into its platform and stole GitHub and GitLab OAuth tokens from its internal database. Waydev, a San Francisco-based company, runs a platform that can be used to track software engineers' work output by analyzing Git-based codebases. To do this, Waydev runs a special app listed on the GitHub and GitLab app stores. When users install the app, Waydev receives an OAuth token that it can use to access its customers' GitHub or GitLab projects. Waydev stores this token in its database and uses it on a daily basis to generate analytical reports for its customers. Waydev CEO and co-founder Alex Circei told ZDNet today in a phone call that hackers used a blind SQL injection vulnerability to gain access to its database, from where they stole GitHub and GitLab OAuth tokens. The hackers then used some of these tokens to pivot to other companies' codebases and gain access to their source code projects.' -- source: https://tech.slashdot.org/story/20/07/27/1918237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting suggestions?
by Peter Reutemann 26 Jul '20

26 Jul '20

Hi everyone For our first in-person meeting after the lockdown on July 27th, any ideas for topics? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

World’s Fastest Computer Is ARM
by Lawrence D'Oliveiro 26 Jul '20

26 Jul '20

Looking at the June Top500 list <https://top500.org/lists/top500/list/2020/06/>, the current number 1, Japan’s Fugaku, uses over 7 million A64FX cores and close to 5 petabytes of RAM. Numbers 2 and 3 are based on IBM’s POWER architecture, while number 4 is a Chinese RISC-based machine, which might have some resemblance to the DEC Alpha <https://en.wikipedia.org/wiki/Sunway_(processor)>, or MIPS, or not. It’s not until 5th place does x86 make an appearance.

1 0

Popular Chinese-Made Drone Is Found To Have Security Weakness
by Peter Reutemann 24 Jul '20

24 Jul '20

'Cybersecurity researchers revealed on Thursday a newfound vulnerability in an app that controls the world's most popular consumer drones, threatening to intensify the growing tensions between China and the United States. From a report: In two reports, the researchers contended that an app on Google's Android operating system that powers drones made by China-based Da Jiang Innovations, or DJI, collects large amounts of personal information that could be exploited by the Beijing government. Hundreds of thousands of customers across the world use the app to pilot their rotor-powered, camera-mounted aircraft. The world's largest maker of commercial drones, DJI has found itself increasingly in the cross hairs of the United States government, as have other successful Chinese companies. The Pentagon has banned the use of its drones, and in January the Interior Department decided to continue grounding its fleet of the company's drones over security fears. DJI said the decision was about politics, not software vulnerabilities. For months, U.S. government officials have stepped up warnings about the Chinese government's potentially exploiting weaknesses in tech products to force companies there to give up information about American users. Chinese companies must comply with any government request to turn over data, according to American officials. "Every Chinese technology company is required by Chinese law to provide information they obtain, or information stored on their networks, to Chinese authorities if requested to do so," said William R. Evanina, director of the National Counterintelligence and Security Center. "All Americans should be concerned that their images, biometrics, locational and other data stored on Chinese apps must be turned over to China's state security apparatus." The drone vulnerability, said American officials, is the kind of security hole that worries Washington.' -- source: https://it.slashdot.org/story/20/07/23/1437214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fawkes: Protecting Privacy against Unauthorized Deep Learning Models
by Lawrence D'Oliveiro 23 Jul '20

23 Jul '20

This paper <http://people.cs.uchicago.edu/%7Eravenben/publications/abstracts/fawkes-use…>, presented at USENIX Security 2020, discusses techniques for allowing you to continue to share images of yourself online while making them resistant to automated exploitation by “deep-learning” facial-recognition software. The researchers found that they could make subtle distortions to facial images, imperceptible to the human eye, that would severely confuse recognition services from major providers like Microsoft and Amazon. (Found from Bruce Schneier <https://www.schneier.com/blog/archives/2020/07/fawkes_digital_.html>.)

1 0

We test Mozilla’s new Wireguard-based $5/mo VPN service
by Peter Reutemann 23 Jul '20

23 Jul '20

'Mozilla, the open source company best known for the Firefox Web browser, made its VPN service generally available in the United States this month. The cross-platform VPN is based on Wireguard and delivered in partnership with well-known and especially techie-friendly VPN provider Mullvad. Mullvad itself was, to the best of our knowledge, the first publicly available VPN provider to offer Wireguard support back in 2017. The Mozilla VPN service costs $4.95 per month and offers server endpoints in 30-plus countries. It currently has VPN clients available for Windows 10, Android, and iOS—but users of other operating systems, such as MacOS and Linux, are going to have to wait. Mozilla says that support for MacOS and Linux is coming soon—but unfortunately, even if you're an advanced user who understands Wireguard configs, you can't just roll your own connection now. The service authenticates via Firefox cloud account. When you sign up for a Mozilla VPN subscription, you'll be asked to create a Firefox account if you don't already have one. The Firefox account is an SSO (Single Sign On) service which uses oauth2, much like a Google account—but it's not tied to a Google account, so even if you sign up using a Gmail address tied to an Android device, that device won't be automatically logged in. Aside from the Firefox-based oauth2 integration, Mozilla's VPN appears to effectively be a Mullvad VPN, with a different client application and different billing entity. It is a bit less expensive through Mozilla, though—Mullvad costs €5 per month. This makes Mozilla's offering about $0.80 per month cheaper, at current exchange rates.' -- source: https://arstechnica.com/gadgets/2020/07/we-test-mozillas-new-wireguard-base… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Lambton Property Management Privacy Breach
by Lawrence D'Oliveiro 22 Jul '20

22 Jul '20

A whole bunch of tenants who have had dealings with Lambton Property Management have had their confidential personal details compromised, according to TVNZ <https://www.tvnz.co.nz/one-news/new-zealand/thousands-kiwis-could-have-had-…>, <https://www.tvnz.co.nz/one-news/new-zealand/second-researcher-gains-access-…>. Neither of those articles gives much detail about the nature of the breach, but going to the source <https://cybernews.com/security/new-zealand-property-management-company-leak…> confirms it’s another instance of the all-too-frequent situation of an improperly-secured public cloud area.

1 0

Fwd: [NZLUG] Free intro course
by Peter Reutemann 22 Jul '20

22 Jul '20

Apologies for cross-posting... Cheers, Peter ---------- Forwarded message --------- From: DL Neil <...> Date: Wed, Jul 22, 2020 at 4:47 PM Subject: [NZLUG] Free intro course To: NZ Linux Users Group <nzlug(a)lists.nzoss.org.nz> Video-based course providing a basic introduction to Linux. Video 1. What are Linux, open source software, and a distribution? Video 2. Introduction to the shell Video 3. Kernel and user spaces Video 4. Orientation to the graphical user interface Video 5. File management in Linux Video 6. The file system hierarchy Video 7. Editing files using Vim Video 8. Organizing users and groups Video 9. File permissions Video 10. Managing software Video 11. Configuring networking Video 12. Controlling system startup processes Video 13. Introduction to containers Video 14. Overview of cockpit Video 15. Learning more about Red Hat Enterprise Linux 8 https://www.redhat.com/en/services/training/rh024-red-hat-linux-technical-o… -- Regards, =dn _______________________________________________ NZLUG mailing list NZLUG(a)lists.nzoss.org.nz http://lists.nzoss.org.nz/mailman/listinfo/nzlug -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Incognito Mode Detection Still Works in Chrome Despite Promise To Fix
by Peter Reutemann 22 Jul '20

22 Jul '20

'Websites are still capable of detecting when a visitor is using Chrome's incognito (private browsing) mode, despite Google's efforts last year to disrupt the practice. From a report: It is still possible to detect incognito mode in Chrome, and all the other Chromium-based browsers, such as Edge, Opera, Vivaldi, and Brave, all of which share the core of Chrome's codebase. Furthermore, developers have taken the scripts shared last year and have expanded support to non-Chrome browsers, such as Firefox and Safari, allowing sites to block users in incognito mode across the board. Currently, there is no deadline for a new Chrome update to block incognito mode detections, however, today, Google might be interested more than ever in fixing this issue' -- source: https://yro.slashdot.org/story/20/06/04/1857211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

SUSE Releases Major Linux Update
by Peter Reutemann 22 Jul '20

22 Jul '20

'SUSE has released the next versions of its flagship operating system, SUSE Linux Enterprise (SLE) 15 Service Pack 2 and its latest infrastructure management program, SUSE Manager 4.1. ZDNet reports: SLE 15 SP2 is available on the x86-64, Arm, IBM POWER, IBM Z, and LinuxONE hardware architectures. This new Linux server edition is based on the Linux 5.3 kernel. This new kernel release includes upstream features such as utilization clamping support in the task scheduler, and power-efficient userspace waiting. Other new and noteworthy features include: - Support for migration from openSUSE Leap to SUSE Linux Enterprise Server (SLES). With this, you can try the free, community openSUSE Linux distro, and then, if you find it's a good choice for your business, upgrade to SLES. - Extended Package Search. By using the new Zypper, SUSE's command line package manager, command option -- zypper search-packages -- sysadmins can now search across all SUSE repositories, even unenabled ones. This makes it easier for administrators to find required software packages. - SLE Software Development Kit (SDK) is now integrated into SLE. Development packages are packaged alongside regular packages. - Python 3: SLE 15 offers full support for Python 3 development. SLE still supports Python 2 for the time being. - 389 Directory Server replaces OpenLDAP as the LDAP directory service. - Repository Mirroring Tool (RMT) replaces Subscription Management Tool (SMT). RMT allows mirroring SUSE repositories and custom repositories. You can then register systems directly with RMT. In environments with tightened security, RMT can also proxy other RMT servers. - Better business continuity with improved SLE Live Patching. SUSE claims Live Patching increases system uptime by up to 12 months. SLE Live Patching is also now available for IBM Z and LinuxONE mainframe architectures. As for SUSE Manager 4.1, this is an improved open-source infrastructure management and automation solution that lowers costs, identifies risk, enhances availability, and reduces complexity in edge, cloud, and data center environments. With SUSE Manager you can keep servers, VMs, containers, and clusters secure, healthy, compliant, and low maintenance whether in private, public, or hybrid cloud. That's especially important these days thanks to coronavirus pandemic IT staff disruptions. SUSE Manager 4.1 can also be used with the Salt DevOps program. Its vertical-market brother, SUSE Manager for Retail 4.1, is optimized and tailored specifically for retail. This release comes with enhancements for small store operations, enhanced offline capabilities and image management over Wi-Fi, and enhanced virtual machine management and monitoring capabilities. Simultaneously it can scale retail environments to tens of thousands of end-point devices and help modernize point-of-service rollouts.' -- source: https://linux.slashdot.org/story/20/07/21/2152237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Brings Procmon To Linux
by Peter Reutemann 21 Jul '20

21 Jul '20

'ProcMon for Linux is Microsoft's newest open-source Linux software. ProcMon is a rewritten and re-imagined version of its Processor Monitor found on Windows within their Sysinternals suite. From a report: Microsoft explains, "The Procmon is a Linux reimagining of the classic Procmon tool from the Sysinternals suite of tools for Windows. Procmon provides a convenient and efficient way for Linux developers to trace the syscall activity on the system."' -- source: https://it.slashdot.org/story/20/07/20/205232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Source Code of Covid Tracker Ireland App Goes Global With Linux Project
by Peter Reutemann 21 Jul '20

21 Jul '20

'The Linux Foundation Public Health initiative has chosen the Covid Tracker Ireland app as one of its first two open-source Covid-19 projects. From a report: Since its launch, more than 1.3m people have downloaded the Covid Tracker Ireland app, which was developed to help track the future spread of the coronavirus. Now, the app has been chosen as one of the first two open-source contact-tracing projects by the newly established Linux Foundation Public Health (LFPH) initiative. Nearform, the Waterford-based company that developed the app with the HSE, has been made one of the initiative's seven premium members, along with Cisco, Doc.ai, Geometer, IBM, Tencent and VMware. Under the project name 'Covid Green', the source code of the Irish app is being made available for other public health authorities and their developers across the world to use and customise. As part of the agreement, Nearform will manage the source code repository on GitHub. In its announcement, the LFPH pointed to the "extraordinarily high" adoption rate of the Covid Tracker Ireland app.' -- source: https://linux.slashdot.org/story/20/07/20/168224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

BadPower Attack Corrupts Fast Chargers To Melt or Set Your Device on Fire
by Peter Reutemann 21 Jul '20

21 Jul '20

'Chinese security researchers said they can alter the firmware of fast chargers to cause damage to connected (charging) systems, such as melt the components, or even set devices on fire. Iwastheone shares a report: The technique, named BadPower, was detailed last week in a report published by Xuanwu Lab, a research unit of Chinese tech giant Tencent. According to researchers, BadPower works by corrupting the firmware of fast chargers -- a new type of charger that was developed in the past few years to speed up charging times. A fast charger looks like any typical charger but works using special firmware. This firmware "talks" to a connected device and negotiates a charging speed, based on the device's capabilities. If a fast-charging feature is not supported, the fast charger delivers the standard 5V, but if the device can handle bigger inputs, the fast charger can deliver up to 12V, 20V, or even more, for faster charging speeds. The BadPower technique works by altering the default charging parameters to deliver more voltage than the receiving device can handle, which degrades and damages the receiver's components, as they heat up, bend, melt, or even burn.' -- source: https://tech.slashdot.org/story/20/07/20/1624200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Could Pine64's Cheap Linux Smartphone Replace Your PC?
by Peter Reutemann 20 Jul '20

20 Jul '20

'TechRadar reports on Pine64's new "PinePhone Convergence Package" handset, calling it "a Linux desktop you can keep in your pocket" that can be used as a PC when plugged into an external display and a keyboard. The device costs just $199 and is aimed primarily at Linux enthusiasts. The PinePhone Linux smartphone is based on the Alpine Linux-based PostmarketOS that can be used both in smartphone and desktop modes... The main component that transforms the PinePhone into a PC-like device is its USB-C docking bar that features an HDMI display output, two USB Type-A connectors, and a 10/100Mb Ethernet port. The idea of using a smartphone with an external display and keyboard to run certain applications has not gained much traction neither with HP's Elite x3 Windows Phone 10 handset nor with Samsung's smartphones with its DeX software. Perhaps, since Linux community is generally more inclined to experiment with their gadgets (and their time), Pine64's PinePhone Convergence has a better chance to be actually used as a desktop by its owners. ' -- source: https://linux.slashdot.org/story/20/07/19/2252214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

'Mozilla VPN' Launches in Six Countries
by Peter Reutemann 20 Jul '20

20 Jul '20

'"Starting today, there's a VPN on the market from a company you trust," Mozilla announced Wednesday. Mozilla VPN is now officially available for Windows and Android in six countries: the U.S., Canada, the U.K., Singapore, Malaysia, and New Zealand, and it'll be coming to even more countries later this year, reports the Verge: The service is available for $4.99 a month, and, like other VPNs, it's designed to make your web-browsing more private and secure. As part of the move, the service is being rebranded from Firefox Private Network to Mozilla VPN, a change that was announced last month. Mozilla argues that its VPN service has a couple of advantages over its many competitors. It says it should offer a faster browsing experience in many cases because it's based on a protocol with less than a third of the lines of code of an average VPN service provider. The company is also banking on the reputation it's built up with its privacy-focused browser, and it adds that it only collects the information it needs to run a service and doesn't keep user data logs. The VPN's launch follows beta trials in the US, which also included tests of a VPN built directly into the Firefox browser. Last month, Mozilla announced that it would be testing asking users to pay $2.99 a month for unlimited usage of the extension, which is designed to mask your traffic within the browser rather than at a system-wide level.' -- source: https://tech.slashdot.org/story/20/07/19/0437230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

VPN With 'Strict No-Logs Policy' Exposed Millions of User Log Files
by Peter Reutemann 19 Jul '20

19 Jul '20

'An unprotected database belonging to the VPN service UFO VPN was exposed online for more than two weeks. Contained within the database were more than 20 million logs including user passwords stored in plain text. User of both UFO VPN free and paid services are affected by the data breach which was discovered by the security research team at Comparitech. Despite the Hong Kong-based VPN provider claiming to have a "strict no-logs policy" and that any data collected is anonymized, Comparitech says that "based on the contents of the database, users' information does not appear to be anonymous at all." A total of 894GB of data was exposed, and the API access records and user logs included: Account passwords in plain text; VPN session secrets and tokens; IP addresses of both user devices and the VPN servers they connected to; Connection timestamps; Geo-tags; Device and OS characteristics; and URLs that appear to be domains from which advertisements are injected into free users' web browsers. Comparitech notes that this runs counter to UFO VPN's privacy policy.' -- source: https://it.slashdot.org/story/20/07/17/2338230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

LibreOffice Ructions
by Lawrence D'Oliveiro 17 Jul '20

17 Jul '20

From <https://www.theregister.com/2020/07/16/libreoffice_ecosystem_beyond_utterly…>: Michael Meeks: “Words fail me to express how beyond-utterly-broken the existing TDF / desktop model is for the ecosystem around selling desktop LibreOffice.” As you may know, LibreOffice is overseen by The Document Foundation, which is a charity registered in Germany. And it currently has about €1.5 million in the bank. However, owing to peculiarities of German law (or maybe just the way they are interpreting it), none of that money is actually allowed to be spent on software development.

1 0

The Pros & Cons Of Virtual Meetings
by Lawrence D'Oliveiro 17 Jul '20

17 Jul '20

<https://www.theregister.com/2020/07/16/virtual_internet_governance_meeting_…>: The move to virtual meetings among internet governance bodies has had mixed results ... “Previously, physical intergovernmental meetings were represented by a select few per economy that could afford to travel to these closed-door meetings. Economies with smaller travel budgets and small delegations tend to be at a disadvantage in terms of getting their views adequately represented.” But smaller nations may have another problem: unreliable internet access. ... “In addition, virtual meetings do not lend themselves well to effective ‘corridor chats’, where many private conversations and negotiations take place at the sidelines of the meeting. ...” “Remote participants in a virtual meeting generally come with pre-baked positions that sometimes become intractable due to the lack of opportunities for proper engagement ... [resulting in] the inability to reach a compromise in an effective and efficient manner.”

1 0

New Pine64 phones with upgraded hardware begin shipping in August
by Peter Reutemann 17 Jul '20

17 Jul '20

'Yesterday, Pine64 announced the end of the PinePhone UBPorts Community Edition campaign—but more importantly, the company declared the beginning of the postmarketOS Community Edition campaign. The base version of the new run of PinePhones shares the same $149 price point and the same basic technical specs as the original developer edition—but there's also a new, upgraded "Convergence Package" available at $199. Before anyone gets too excited, we need to make something clear—these devices, while attractively priced, should be considered beta gadgets for tinkerers to experiment and play with. They are not yet fully functional phones, and in their current development status, they are unlikely to be anyone's full-time daily-usage smartphone. The apps don't all work yet—including making calls—and battery life still leaves a lot to be desired.' -- source: https://arstechnica.com/gadgets/2020/07/pine64-launches-postmarketos-editio… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome 84 Arrives With SameSite Cookie Changes, Web OTP API and Web Animations
by Peter Reutemann 17 Jul '20

17 Jul '20

'Google today launched Chrome 84 for Windows, Mac, Linux, Android, and iOS. Chrome 84 resumes SameSite cookie changes, includes the Web OTP API and Web Animations API, and removes older Transport Layer Security (TLS) versions. [...] First deprecated with Chrome 81 in April, TLS 1.0 and TLS 1.1 have now been completely removed with Chrome 84. This is notable for anyone who manages a website, even if they donâ(TM)t use Chrome at home or at work. TLS is a cryptographic protocol designed to provide communications security over a computer network -- websites use it to secure all communications between their servers and browsers. TLS also succeeds Secure Sockets Layer (SSL) and thus handles the encryption of every HTTPS connection.' -- source: https://it.slashdot.org/story/20/07/16/1444257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

NSA On Securing VPNs
by Lawrence D'Oliveiro 16 Jul '20

16 Jul '20

Bruce Schneier reports <https://www.schneier.com/blog/archives/2020/07/nsa_on_securing.html> on an advisory from the US National Security Agency on how to secure your VPN setup. The document is available in a 10-page or 2-page version. The tips can be summarized as * Reduce the VPN gateway attack surface * Verify on CNSSP-15-compliant algorithms are in use * Avoid using default settings * Remove unused or non-compliant cryptography suites * Apply vendor-provided updates The one about not using default settings I found interesting, the explanation given being that “many vendors provide default configurations, automated configuration scripts, or graphical user interface wizards to aid in the deployment of VPNs”, but that these tools/defaults may prioritize ease of setup over security, and therefore enable extra options that should not be enabled. The longer version gives detailed configuration examples.

1 0

Microsoft urges patching severe-impact, wormable server vulnerability
by Peter Reutemann 16 Jul '20

16 Jul '20

'Microsoft is urgently advising Windows server customers to patch a vulnerability that allows attackers to take control of entire networks with no user interaction and, from there, rapidly spread from computer to computer. The vulnerability, dubbed SigRed by the researchers who discovered it, resides in Windows DNS, a component that automatically responds to requests to translate a domain into the IP address computers need to locate it on the Internet. By sending maliciously formed queries, attackers can execute code that gains domain administrator rights and, from there, take control of an entire network. The vulnerability, which doesn’t apply to client versions of Windows, is present in server versions from 2003 to 2019. SigRed is formally tracked as CVE-2020-1350. Microsoft issued a fix as part of this month's Update Tuesday.' -- source: https://arstechnica.com/information-technology/2020/07/microsoft-urges-patc… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

SoftBank To Sell ARM?
by Lawrence D'Oliveiro 15 Jul '20

15 Jul '20

Just four years after acquiring it, SoftBank now wants to sell off Arm Holdings, the company that creates (and licenses) designs for ARM chips <https://www.theregister.com/2020/07/14/softbank_considering_arm_sale_report/>. Besides SoftBank’s well-known string of recent investment missteps, there was this interesting quote: Speaking to The Register, one company insider said SoftBank was dissatisfied with Arm's business model and wanted it to charge more for royalties. But if it does that, it just makes alternatives like RISC-V look more competitive.

1 0

Rust Code In The Linux Kernel?
by Lawrence D'Oliveiro 14 Jul '20

14 Jul '20

Looks like several kernel developers, up to and including Linus Torvalds himself, are receptive <https://www.theregister.com/2020/07/13/rust_code_in_linux_kernel/> towards including code written in Mozilla’s Rust language in the Linux kernel. Albeit Torvalds sees it being used, initially at least, in parts “not very central to the kernel itself”, like drivers. A principal feature of Rust is the strict way it manages memory pointers, to limit the scope for common mistakes like memory leaks and double-frees. But unlike other languages like Java, Go or Kotlin, it does not bake the overhead of garbage collection into the language itself. This makes it more suitable for high-performance and lower-level tasks than those languages. More info here: <https://www.rust-lang.org/>.

1 0

Microsoft’s Dotnet Core Runs Better On Linux Than Windows
by Lawrence D'Oliveiro 14 Jul '20

14 Jul '20

Microsoft now has a (pre-release) extension for Visual Studio <https://www.theregister.com/2020/07/13/microsoft_visual_studio_gets_net/> so that you can not only deploy your Dotnet Core application on Linux, you can now debug it on a genuine Linux environment as well, using WSL 2. Mentioned in passing in that report are a couple of stories of developers finding their apps run better on cloud Linux instances than on Windows ones. So it seems the only thing left running on Windows proper is Visual Studio itself.

1 0

Microsoft Dropping PHP For Windows
by Lawrence D'Oliveiro 13 Jul '20

13 Jul '20

I didn’t know that Microsoft had been offering “official” PHP builds for Windows versions up to 7.x, but that is now due to end <https://www.theregister.com/2020/07/10/microsoft_php/>: they will not supply builds for PHP 8.0 or later. Also interesting to note in the article that Windows IIS’ share of the web server market has fallen precipitously lately, and has become a poor third (or even fourth) behind Apache and Nginx. And Google!?

2 1

Linus Torvalds Hopes Intel's AVX-512 'Dies A Painful Death'
by Peter Reutemann 13 Jul '20

13 Jul '20

'"Linux creator Linus Torvalds had some choice words today on Advanced Vector Extensions 512 (AVX-512) found on select Intel processors," reports Phoronix: In a mailing list discussion stemming from the Phoronix article this week on the compiler instructions Intel is enabling for Alder Lake (and Sapphire Rapids), Linus Torvalds chimed in. The Alder Lake instructions being flipped on in GCC right now make no mention of AVX-512 but only AVX2 and others, likely due to Intel pursuing the subset supported by both the small and large cores in this new hybrid design being pursued. The lack of seeing AVX512 for Alder Lake led Torvalds to comment: I hope AVX512 dies a painful death, and that Intel starts fixing real problems instead of trying to create magic instructions to then create benchmarks that they can look good on. I hope Intel gets back to basics: gets their process working again, and concentrate more on regular code that isn't HPC or some other pointless special case. I've said this before, and I'll say it again: in the heyday of x86, when Intel was laughing all the way to the bank and killing all their competition, absolutely everybody else did better than Intel on FP loads. Intel's FP performance sucked (relatively speaking), and it matter not one iota. Because absolutely nobody cares outside of benchmarks. The same is largely true of AVX512 now - and in the future... After several more paragraphs, Torvalds reaches his conclusion. "Stop with the special-case garbage, and make all the core common stuff that everybody cares about run as well as you humanly can." Phoronix notes that Torvalds' comments came "just weeks after he switched to AMD Ryzen Threadripper for his primary development rig."' -- source: https://linux.slashdot.org/story/20/07/12/1729255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Whither Dotnet Core?
by Lawrence D'Oliveiro 10 Jul '20

10 Jul '20

From <https://www.theregister.com/2020/07/09/net_core_still_a_microsoft/>, people are wondering why there isn’t a greater uptake of Microsoft’s cross-platform, open-source versions of Dotnet and C#: "What's up with non-.NET developers thinking C# is a Windows only, corporate bloatware language? It's not 2005 any more." Yeah, but it’s not clear why we would want *cross-platform* bloatware ...

1 0

“I Am Not A Number!”
by Lawrence D'Oliveiro 10 Jul '20

10 Jul '20

>From <https://www.theregister.com/2020/07/09/bork/>: Your updated gas balance is: £NaN “We want ... calculation.” “You won’t get it!” “By hook or by crook, we will.”

1 0

Chrome and Firefox Are Getting Support For the New AVIF Image Format
by Peter Reutemann 10 Jul '20

10 Jul '20

'The new lightweight and royalty-free AVIF image format is coming to web browsers. Work is almost complete on adding AVIF support to Google Chrome and Mozilla Firefox. From a report: The new image format is considered one of the lightest and most optimized image compression formats, and has already gained praise from companies such as Netflix, which considers it superior to existing image formats such as JPEG, PNG, and even the newer WebP. The acronym of AVIF stands for AV1 Image File Format. As its name hints, AVIF is based on AV1, which is a video codec that was developed in 2015, following a collaboration between Google, Cisco, and Xiph.org (who also worked with Mozilla). At the time, the three decided to pool their respective in-house video codecs (VPX, Thor, and Daala) to create a new one (AV1) that they planned to offer as an open-source and royalty-free alternative to all the commercial video codecs that had fragmented and clogged the video streaming market in the late 2000s and early 2010s.' -- source: https://news.slashdot.org/story/20/07/09/202235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Creates “Open Usage Commons”
by Lawrence D'Oliveiro 09 Jul '20

09 Jul '20

From <https://www.theregister.com/2020/07/08/google_trademarks_open_usage_commons/>, Google is creating an organization specifically to deal with trademark issues, entirely separate from code. FSF Europe’s Alexander Sander says: “Trademarks issues are becoming more and more relevant for Free Software. This development is mainly due to the fact that Free Software is increasingly and successfully used in the commercial sector.” True, that. Consider the stoush between Debian and Mozilla over the “Firefox” trademark and branding, and the consequent creation of the “Iceweasel” fork. (Looks like that was eventually resolved amicably.) However, note this counterpoint from the Linux Foundation: "Under US trademark law you are not able to effectively separate ownership of a project mark from control of the underlying open source project."

1 0

Over 100 Wi-Fi Routers Fail Major Security Test -- Protect Yourself Now
by Peter Reutemann 09 Jul '20

09 Jul '20

'Tom's Guide: Using its own analytical software, the [Fraunhofer Institute] tested the most recently available firmware for 117 home Wi-Fi models currently sold in Europe, including routers from ASUS, D-Link, Linksys, Netgear, TP-Link, Zyxel and the small German brand AVM. The models themselves were not physically tested. A full list of the tested models and firmware is on GitHub. The institute was not able to examine the firmware of 10 more models, mostly from Linksys. The report notes (PDF) that many firmware updates are issued without fixing known flaws. So what can you do? You can make sure that the next router you buy automatically installs firmware updates. You can check to see whether your current router does so, or makes it fairly easy to install firmware updates manually. You should also make sure that the administrative password for your router has been changed from the factory default password. (Check the list of default passwords at https://www.routerpasswords.com.) You should also check its administrative interface to make sure that UPnP and remote access are disabled. And if your router was first released more than 5 years ago, consider buying a newer model unless it meets all of the above criteria. Alternatively, you could try to "flash" your older router to run more secure open-source router firmware such as OpenWrt, DD-WRT or Tomato. "The worst case regarding high severity CVEs [widely known flaws] is the Linksys WRT54GL powered by the oldest kernel found in our study," the report said, noting that this model uses the 2.4.20 kernel from 2002. "There are 579 high severity CVEs affecting this product." "That particular model last had its firmware updated in January 2016, one of the oldest firmwares in the study," adds Tom's Guide. "The Linksys WRT54GL was first released in 2005 and is still sold today, even though it handles Wi-Fi protocols only up to 802.11g. However, the WRT54G series is possibly the best-selling family of Wi-Fi routers ever..."' -- source: https://mobile.slashdot.org/story/20/07/08/2058240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

Google and Canonical Bring Flutter Apps To Linux and the Snap Store
by Peter Reutemann 09 Jul '20

09 Jul '20

'Google is partnering with the Ubuntu Desktop team at Canonical to bring Linux support to its open source UI framework Flutter. Today's Linux alpha announcement also means Flutter developers can now deploy their apps to the Snap Store. Flutter group product manager Tim Sneath argues this is a big milestone because UI frameworks rarely become versatile and powerful enough for an operating system to depend on. He pointed to Windows being written in C++ rather than .NET, even for applets like the Calculator. Sneath also believes this shows Canonical is willing to invest in a first-class way to build apps for Linux, making Flutter on Linux an official part of Ubuntu. Additionally, enterprises can feel confident about picking Flutter -- it's more evidence of its longevity and technical excellence, Sneath said.' -- source: https://linux.slashdot.org/story/20/07/08/1722203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linux Company SUSE Outbids Competitors for Fast-growing Startup Rancher Labs
by Peter Reutemann 09 Jul '20

09 Jul '20

'SUSE, a Linux distribution company controlled by private equity firm EQT, has agreed to acquire Rancher Labs, a start-up with technology that helps organizations run software in virtual containers across many servers. From a report: The companies announced the deal Wednesday but didn't disclose the terms. Two people familiar with the deal said SUSE is paying $600 million to $700 million. The transaction suggests that even during a recession, demand remains high for technology that can enable companies to operate more efficiently. Talks between the companies began in the spring, and the process became competitive with additional bids, Ursheet Parikh, a partner at Rancher backer Mayfield Fund, told CNBC on Tuesday. There were "lots of Zoom calls," Parikh said. In the past few years, with the rise of start-ups such as Docker, containers became a trendy alternative to more traditional virtualization technology for running applications on each computer server in a company data center. Amazon, Microsoft and other cloud providers came out with services that developers can use to place code in containers, and in 2017 SUSE introduced its own service for managing containers. The companies haven't finalized integration plans as the deal still faces regulatory approval.' -- source: https://linux.slashdot.org/story/20/07/08/147202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Suspends Firefox Send Service While It Addresses Malware Abuse
by Peter Reutemann 09 Jul '20

09 Jul '20

'Mozilla has temporarily suspended the Firefox Send file-sharing service as the organization investigates reports of abuse from malware operators and while it adds a "Report abuse" button. The browser maker took down the service today after ZDNet reached out to inquire about Firefox Send's increasing prevalence in current malware operations. Since last year, several malware operations have hosted payloads on the service. This includes ransomware gangs like REvil/Sodinokibi, financial crime crews like FIN7, the Zloader and Ursnif banking trojans operations, and government surveillance groups targeting human rights defenders. Reasons include the fact that Firefox Send doesn't have an Report Abuse mechanism, all file uploads are encrypted (useful to dodge malware scanners), and the Firefox URL is whitelisted in most orgs (useful for bypassing email filters).' -- source: https://news.slashdot.org/story/20/07/08/1811228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

LibreOffice Getting More Commercial?
by Lawrence D'Oliveiro 08 Jul '20

08 Jul '20

Seems that a major policy announcement is coming up from The Document Foundation (the outfit behind LibreOffice) on July 15th. In the meantime, some hints have (unintentionally) leaked out <https://www.theregister.com/2020/07/07/libreoffice_community_protests_at_in…>, such as the about-box in LO 7.0 saying “The personal edition is supported by volunteers and intended for individual use”.

1 0

New H.266 VCC Codec Up To 50% More Efficient Than Previous Standard
by Peter Reutemann 07 Jul '20

07 Jul '20

'The Fraunhofer Heinrich Hertz Institute on Tuesday announced the H.266 Versatile Video Coding codec, which will power more data-efficient video capture and transmission on future iPhones. AppleInsider reports: Apple adopted the predecessor to the new codec, H.265/HEVC, in iOS 11. The updated video codec, which was developed after years of research and standardization, will bring a number of tangible benefits to future iPhone users. In its announcement, the Fraunhofer HHI said that H.266 will reduce data requirements by around 50% thanks to improved compression. With the previous HEVC codec, it took about 10GB of data to transmit a 90-minute ultra-high definition (UHD) video. H.266 can do that with 5GB. The codec, as detailed in a 500-page specification, was designed from the ground up for use with 4K and 8K streaming. It'll allow users to store more high-definition video and reduce the amount of data on cellular networks.' -- source: https://apple.slashdot.org/story/20/07/06/219225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds Likes His New AMD Threadripper System
by Peter Reutemann 06 Jul '20

06 Jul '20

'This week Linus Torvalds and Dirk Hohndel re-created their keynote conversation for a special all-virtual edition of the Open Source Summit and Embedded Linux Conference North America. ZDNet reports: While COVID-19 has slowed down many technologies, while speeding up other tech developments, it hasn't affected Linux development much at all. "None of my co-developers have been hugely impacted either. I was worried for a while because one of our developers was offline for a month or two.... [But,] it turned out that it was just RSI [repetitive strain injury], and RSI is kind of an occupational hazard to deal with." He added. "One of the things that is so interesting about the Linux community is how much it has always been email-based and remote, how rarely we get together in person...." Torvalds trusts this new build. Indeed, he ran his end of the videoconference from his new developer machine running the first release candidate of 5.8. Thinking of his new AMD Threadripper 3970x-based processor-powered developer desktop, Torvalds later added that, although he had been concerned about its fan noise it actually works well for him. Torvalds moved to this new homebrew computer because he needed the speed. "My 'allmodconfig' test builds are now three times faster than they used to be." That's important because Torvalds "strives to do about 20 to 30 [pull requests] a day, which is above my limit, ... [but] in order to do that, [he needs] a lot of computing power. ' -- source: https://linux.slashdot.org/story/20/07/03/2349231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 5

Mexico Bans Home PC Repair, Non-OEM OS Installs
by Lawrence D'Oliveiro 04 Jul '20

04 Jul '20

The Mexican “Cámara de Diputados” (“Chamber of Deputies” or lower house of the Mexican Congress) has just passed a law, according to DistroTube <https://www.youtube.com/post/UgyENs4zc_xx-uyL3-N4AaABCQ> (referencing this <https://twitter.com/YourAnonCentral/status/1278172057486766080> Twitter thread), seemingly making any kind of modifications to your own electronic devices illegal. This includes things like changing the hard drive or installing a non-OEM OS (e.g. a Linux distro).

1 0

Ads Are Taking Over Samsung's Galaxy Smartphones
by Peter Reutemann 02 Jul '20

02 Jul '20

'Max Weinbach, writing for Android Police: I have been using Samsung phones every day for almost 4 years. It was because Samsung had fantastic hardware paired with --depending on the year -- good software. 2020 is the first year in a while I'm not using a Samsung phone as my daily driver. The reason? Ads. Ads in Samsung phones never really bothered me, at least not until the past few months. It started with the Galaxy Z Flip. A tweet from Todd Haselton of CNBC is what really caught my eye. Samsung had put an ad from DirectTV in the stock dialer app. This is really something I never would have expected from any smartphone company, let alone Samsung. It showed up in the "Places" tab in the dialer app, which is in partnership with Yelp and lets you search for different businesses directly from the dialer app so you don't need to Google somewhere to find the address or phone number. I looked into it, to see if this was maybe a mistake on Yelp's part, accidentally displaying an ad where it shouldn't have, but nope. The ad was placed by Samsung, in an area where it could blend in so they could make money. Similar ads exist throughout a bunch of Samsung apps. Samsung Music has ads that look like another track in your library. Samsung Health and Samsung Pay have banners for promotional ads. The stock weather app has ads that look like they could be news. There is also more often very blatant advertising in most of these apps as well. Samsung Music will give you a popup ad for Sirius XM, even though Spotify is built into the Samsung Music app. You can hide the SiriusXM popup, but only for 7 days at a time. A week later, it will be right back there waiting for you. Samsung will also give you push notification ads for new products from Bixby, Samsung Pay, and Samsung Push Service. ' -- source: https://slashdot.org/story/20/07/01/196224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Removes 25 Android Apps Caught Stealing Facebook Credentials
by Peter Reutemann 01 Jul '20

01 Jul '20

'Google has removed this month 25 Android apps from the Google Play Store that were caught stealing Facebook credentials. From a report: Before being taken down, the 25 apps were collectively downloaded more than 2.34 million times. The malicious apps were developed by the same threat group and despite offering different features, under the hood, all the apps worked the same. According to a report from French cyber-security firm Evina shared with ZDNet today, the apps posed as step counters, image editors, video editors, wallpaper apps, flashlight applications, file managers, and mobile games. The apps offered a legitimate functionality, but they also contained malicious code. Evina researchers say the apps contained code that detected what app a user recently opened and had in the phone's foreground. If the app was Facebook, the malicious app would overlay a web browser window on top of the official Facebook app and load a fake Facebook login page (see image below: blue bar = actual Facebook app, black bar = phishing page).' -- source: https://tech.slashdot.org/story/20/06/30/1411202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android's AirDrop Competitor Is Coming Soon
by Peter Reutemann 01 Jul '20

01 Jul '20

'Android's long-awaited "Nearby Sharing" feature, which allows you to share files between Android devices wirelessly, is rolling out to beta testers. Android Police reports: Nearby Sharing may appear slightly differently depending on the type of content you try to share. In all cases, it shows up as an app in the apps list on the share sheet, but you may also get a smaller prompt just under the content preview, more like it did in the previous Android 11 video leak. We tested it on a Pixel 4 XL and Pixel 3a running Android 10, but the appearance may also vary on other versions of Android. Note that Nearby Share works for both files like photos or videos, as well as other shareable content like Tweets and URLs. It probably works with a lot of things. Select Nearby Share in the share sheet as the target, and you're prompted to turn on the feature, if it's the first time you've used it. The quick setup process lets you configure your default device name and device visibility settings, though those can also be changed later. Once you have it enabled, Nearby Sharing starts looking for other nearby devices. The interface is pretty simple: A big X in the top left corner backs you out, your avatar on the right takes you to a settings pane that lets you configure things like your device name, visibility, and which mechanism to use to make the transfer (i.e., whether to use your internet connection for small files, to stick to Wi-Fi, or to always share offline). Google says Nearby Share is currently in limited testing via the Play Services beta: "We're currently conducting a beta test of a new Nearby Share feature that we plan to share more information on in the future. Our goal is to launch the feature with support for Android 6+ devices as well as other platforms."' -- source: https://mobile.slashdot.org/story/20/06/30/2014259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apple Declined To Implement 16 Web APIs in Safari Due To Privacy Concerns
by Peter Reutemann 30 Jun '20

30 Jun '20

'Apple said last week that it declined to implement 16 new web technologies (Web APIs) in Safari because they posed a threat to user privacy by opening new avenues for user fingerprinting. Technologies that Apple declined to include in Safari because of user fingerprinting concerns include: Web Bluetooth - Allows websites to connect to nearby Bluetooth LE devices. Web MIDI API - Allows websites to enumerate, manipulate and access MIDI devices. Magnetometer API - Allows websites to access data about the local magnetic field around a user, as detected by the device's primary magnetometer sensor. Web NFC API - Allows websites to communicate with NFC tags through a device's NFC reader. Device Memory API - Allows websites to receive the approximate amount of device memory in gigabytes. Network Information API - Provides information about the connection a device is using to communicate with the network and provides a means for scripts to be notified if the connection type changes. Battery Status API - Allows websites to receive information about the battery status of the hosting device. Web Bluetooth Scanning - Allows websites to scan for nearby Bluetooth LE devices. Ambient Light Sensor - Lets websites get the current light level or illuminance of the ambient light around the hosting device via the device's native sensors. [...] The vast majority of these APIs are only implemented in Chromium-based browsers, and very few on Mozilla's platform. Apple claims that the 16 Web APIs above would allow online advertisers and data analytics firms to create scripts that fingerprint users and their devices. ' -- source: https://apple.slashdot.org/story/20/06/29/1456247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

A decidedly non-Linux distro walkthrough: Haiku R1/beta2
by Peter Reutemann 30 Jun '20

30 Jun '20

'Earlier this month, the Haiku project released the second beta of its namesake operating system, Haiku. Haiku is the reimagining of a particularly ambitious, forward-looking operating system from 1995—Be, Inc.'s BeOS. BeOS was developed to take advantage of Symmetrical Multi-Processing (SMP) hardware using techniques we take for granted today—kernel-scheduled pre-emptive multitasking, ubiquitous multithreading, and BFS—a 64-bit journaling filesystem of its very own. [...] In June 2020—nineteen years after OpenBeOS was born, and sixteen after its rename to Haiku—the project released its second beta distribution. The project still adheres to backward application compatibility with 1990s BeOS—although only in its 32-bit version, which I did not test.' -- source: https://arstechnica.com/gadgets/2020/06/a-decidedly-non-linux-distro-walkth… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Firefox 79 Stable Will Let Users Test Unreleased Features Using 'Experiments'
by Peter Reutemann 28 Jun '20

28 Jun '20

'Both Edge and Chrome already allow users to try unreleased, experimental features (by typing about:flags in the address bar). Soon there'll be a similar "Firefox Experiments" option starting in Firefox 79. Slashdot reader techtsp shares this report from the Windows Club: Mozilla has a dedicated Experimental Features page on MDN just for that. But limiting experimental features to Firefox's Nightly channel has a limitation: A fairly limited number of "curious" users. Now, extending some of these experimental features to stable releases will increase the scope of "Firefox Experiments" as a whole... This option will allow users to enable/disable experimental features under Preferences... [In Firefox 79] Navigate to Preferences by entering about:preferences in the browser's address bar or click the gear icon and got to "Preferences." Discover and set browser.preferences.experimental to True. Now, you should be able to see the "Firefox Experiments" menu under Firefox 79 Preferences.' -- source: https://tech.slashdot.org/story/20/06/27/0321206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0