- wlug - list.wlug.org.nz

Linksys Asks Users To Reset Passwords After Hackers Hijacked Home Routers Last Month
by Peter Reutemann 17 Apr '20

17 Apr '20

'Router vendor Linksys has locked user accounts on its Smart WiFi cloud service and is asking them to reset passwords after hackers have been observed hijacking accounts and changing router settings to redirect users to malware sites. From a report: Linksys' decision only impacts Smart WiFi accounts. Linksys Smart WiFi is a cloud-based account system that lets device owners connect to Linksys routers (and other equipment) over the internet to manage router settings. Smart WiFi is widely deployed across Linksys' router fleet, making it an ideal target for hackers who may want to hijack routers en-masse. According to a Bitdefender report published last month, this is exactly what's been recently happening. The cyber-security firm said it detected an organized campaign to break into D-Link and Linksys routers and change DNS settings.' -- source: https://it.slashdot.org/story/20/04/16/1727210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The secret behind “unkillable” Android backdoor called xHelper has been revealed
by Peter Reutemann 17 Apr '20

17 Apr '20

'In February, a researcher detailed a widely circulating Android backdoor that’s so pernicious that it survives factory resets, a trait that makes the malware impossible to remove without taking unusual measures. The analysis found that the unusual persistence was the result of rogue folders containing a trojan installer, neither of which was removed by a reset. The trojan dropper would then reinstall the backdoor in the event of a reset. Despite those insights, the researcher still didn’t know precisely how that happened. Now, a different researcher has filled in the missing pieces.' -- source: https://arstechnica.com/information-technology/2020/04/solved-how-android-b… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox To Remove Support For the FTP Protocol
by Peter Reutemann 16 Apr '20

16 Apr '20

'Mozilla has announced plans to remove support for the FTP protocol from Firefox. Going forward, users won't be able to download files via the FTP protocol and view the content of FTP links/folders inside the Firefox browser. From a report: "We're doing this for security reasons," said Michal Novotny, a software engineer at the Mozilla Corporation, the company behind the Firefox browser. "FTP is an insecure protocol and there are no reasons to prefer it over HTTPS for downloading resources," he said. "Also, a part of the FTP code is very old, unsafe and hard to maintain and we found a lot of security bugs in it in the past." Novotny says Mozilla plans to disable support for the FTP protocol with the release of Firefox 77, scheduled for release in June this year.' -- source: https://news.slashdot.org/story/20/03/19/169246 There's always FileZilla... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

NASA Uses 3D Cardboard Glasses
by Lawrence D'Oliveiro 16 Apr '20

16 Apr '20

Here’s a fun one: normally, the drivers of the Curiosity Mars rover have active-shutter 3D glasses for viewing images of the Martian terrain on their office machines. But these don’t work on the hardware that these staffers are currently using from home. So they are falling back to those cheap cardboard red-and-blue glasses that they would give out, included in the price of the ticket, at cinemas <https://www.theregister.co.uk/2020/04/15/nasa_cardboard_3d_glasses_for_curi…>.

1 0

Jailbreaking Medical Equipment
by Lawrence D'Oliveiro 16 Apr '20

16 Apr '20

A security researcher has been taking a look at a piece of “CPAP” (“Continuous Positive Airway Pressure”) equipment <https://arstechnica.com/information-technology/2020/04/firmware-jailbreak-l…>, normally used to treat sleep apnoea, just to see whether it can be adapted to function as a “BIPAP” (“Bi-Level Positive Airway Pressure”) device, i.e. a full-on ventilator. The manufacturer says no, but the researcher says yes, the device already has the essential functionality available in its firmware, just needing a patch to enable it.

1 0

A story with a happy ending
by Ian Stewart 15 Apr '20

15 Apr '20

Seven years ago, in March 2013, I discovered a bug in the BASIC programming language that is included with LibreOffice suite of applications. I found that if BASIC was requested to return a 1 to 4 x nibbles Hex string, it would return positive integers OK but it would have an error when attempting to return a negative integer. For examples: Cint(&H0) returned 0 OK Cint(&H7FFF) returned 32767 OK Cint(&HFFFF) should have returned -1, but returned an "overflow error" Cint(&H8000) should have returned -32768, but returned an "overflow error". On the 14th March 2013, I opened a case for this issue on Bugzilla and it was logged as Bug 62326 https://bugs.documentfoundation.org/show_bug.cgi?id=62326 === The most recent comment posted on this bug was two weeks ago: Comment 39 Commit Notification 2020-03-30 06:59:05 UTC Andreas Heinisch committed a patch related to this issue. It has been pushed to "master": https://git.libreoffice.org/core/commit/ffbcbbc8dcc946d4d91cc08a937c2067be5… Cleanup for tdf#130476, tdf#62323 and tdf#62326 It will be available in 7.0.0. === Version 7.0 of LibreOffice is scheduled for release in August 2020. === So.... Good things come to those who wait! cheers, Ian.

3 2

RIP John Conway
by Lawrence D'Oliveiro 15 Apr '20

15 Apr '20

One of the higher-profile victims† of Covid-19 has been mathematician John Conway, best known to most people for the invention of the cellular-automata game he called “Life”. This article <https://arstechnica.com/science/2020/04/john-conway-inventor-of-the-game-of…> has some details, including a link to a YouTube video showing a quite amazing configuration of 6 “engines” that generate an endless stream of “Corderships” that go sailing off in one direction. †Another victim I personally feel sad about is Tim Brooke-Taylor. But while I enjoyed his humour (for example in “The Goodies” and “At Last, The 1948 Show” on TV, and “I’m Sorry, I’ll Read That Again” on radio), I can’t think of anything appropriate to this group to say about him...

2 1

Samsung's S-Voice Is Shutting Down On June 1st
by Peter Reutemann 14 Apr '20

14 Apr '20

'Samsung is reportedly shutting off the servers for its S-Voice voice assistant on June 1, 2020, "at which point Samsung's original voice assistant will stop attempting to respond to your voice queries," reports Ars Technica. From the report: S-Voice arose in the early days of voice assistants, when Android OEMs were scrambling to photocopy Apple's Siri voice assistant, which launched in 2011. Samsung licensed the same underlying technology for S-Voice that Apple originally used for Siri -- Nuance Communication's voice recognition -- and set about building its Siri sibling. S-Voice was Samsung's chosen voice assistant for its smartphones until it rebooted its voice efforts with the launch of "Bixby" in 2017. Samsung's Bixby project initially grew out of an acquisition of Viv Labs, a voice-assistant company founded by members of the original Siri team (see a pattern here?). The Galaxy S8 and every device after it launched with Bixby and not S-Voice, so this shutdown should only effect older devices. SamMobile hunted down a list of applicable devices, saying "The affected models that have the S Voice icon on the app screen include the Galaxy A3, A5, A7, A8, A9, Galaxy Note FE, Galaxy Note 2, 3, 4, 5, Galaxy S3, 4, S5, S6, S6 edge in addition to the Galaxy Note Pro 12.2, Galaxy W, Galaxy Tab 4, Galaxy Tab 4 8.0/10.1, Galaxy Tab S8.4 and S10.5. ' -- source: https://mobile.slashdot.org/story/20/04/13/2336220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How Steak-umm Became The Tweeting Voice Of Reason In A Pandemic
by Lawrence D'Oliveiro 14 Apr '20

14 Apr '20

No, I had never heard of this US-based product before, either. But whoever is in charge of its Twitter account has decided to use their power for good, not for evil <https://www.techdirt.com/articles/20200410/17213944276/how-steak-umm-became…>. Consider comments like this: it can be difficult to know what to believe in a time when institutional trust is diminished and the gatekeepers of information have been dismantled, but it's more crucial now than ever before to follow a range of credentialed sources for both breaking news and data collection or this: you can maintain independent, critical thinking toward institutions without dipping into fringe conspiracies that get jumpstarted by individual anecdotes being virally spread as data. it's not easy, but it's necessary to keep any semblance of responsible online information flow or this: we're a frozen meat brand posting ads inevitably made to misdirect people and generate sales, so this is peak irony, but hey we live in a society so please make informed decisions to the best of your ability and don't let anecdotes dictate your worldview ok and this: people think it's bizarre, ironic, and funny when a frozen meat company points out the importance of critical thinking, but chances are the same message would never "go viral" if it was from a person. our society values entertainment over truth and that's a huge problem

1 0

Not actually Linux distro review deux: GhostBSD
by Peter Reutemann 14 Apr '20

14 Apr '20

'When I began work on the FreeBSD 12.1-RELEASE review last week, it didn't take long to figure out that the desktop portion wasn't going very smoothly. I think it's important for BSD-curious users to know of easier, gentler alternatives, so I did a little looking around and settled on GhostBSD for a follow-up review. GhostBSD is based on TrueOS, which itself derives from FreeBSD Stable. It was originally a Canadian distro, but—like most successful distributions—it has transcended its country of origin and can now be considered worldwide. Significant GhostBSD development takes place now in Canada, Italy, Germany, and the United States. The history of desktop-oriented BSD distros is a turbulent one. For several years, Kris Moore's PC-BSD was the go-to for "I want BSD, but I also want a ready-to-go desktop." Eventually, ixSystems—home of the FreeNAS storage distro, and the company Moore is vice president of engineering for—came to rely heavily on the server-side features developed into PC-BSD. The need at ixSystems for the foundation of PC-BSD without the associated desktop led to a rename and a fork. PC-BSD's underpinnings became TrueOS, and the desktop-friendly distribution—now based on TrueOS—became Project Trident. This state of affairs didn't last long. A year later, Project Trident declared unhappiness with TrueOS and BSD in general—mostly due to hardware support, or lack thereof. In January 2020, Trident rebased itself on Void Linux, which its developers found to be "the most BSD-like" of the potential Linux upstream distros they examined. Project Trident's departure for more Linux-y waters left several potential contenders for a desktop-focused BSD distribution. These include FuryBSD, MidnightBSD, DesktopBSD, and GhostBSD itself. I've tested PC-BSD fairly extensively in the past but have no history with any of the current desktop BSD choices. I chose GhostBSD for a first look, solely due to its prominence in Google search results for "desktop BSD distro."' -- source: https://arstechnica.com/gadgets/2020/04/not-actually-linux-distro-review-de… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linux on Laptops: ASUS Zephyrus G14 with Ryzen 9 4900HS
by Peter Reutemann 14 Apr '20

14 Apr '20

'The Zephyrus G14 is a dual-GPU gaming laptop, and Linux tends not to fare well with that setup. But it's the only Ryzen 4000 equipped laptop I have available—so it was obviously going to get Linux on it, whether it liked it or not. Since brand-new hardware generally calls for brand-new distro versions, I grabbed a fresh copy of the Ubuntu Focal Fossa beta and gave it a whirl. I have the sad duty of reporting that the results were mediocre at best.' -- source: https://arstechnica.com/gadgets/2020/04/linux-on-laptops-asus-zephyrus-g14-… >From my recent experience of setting up a GPU machine, the Nouveau driver was unusable to get a working desktop. I ended up having to use the Ubuntu server edition instead with a text-based setup, which required me to have ethernet plugged in for internet. The strangest thing on this machine is docker: after rebooting the machine, I have to restart docker before I can do anything with it... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Coronavirus: Raspberry Pi-powered ventilator to be tested in Colombia
by Peter Reutemann 14 Apr '20

14 Apr '20

'A team in Colombia is to test a ventilator made with a Raspberry Pi computer and easy-to-source parts. The design and computer code were posted online in March by a man in California, who had no prior experience at creating medical equipment. Marco Mascorro, a robotics engineer, said he built the ventilator because knew the machines were in high demand to treat Covid-19. His post prompted a flood of feedback from healthcare workers. He has used the advice to make improvements. "I am a true believer that technology can solve a lot of the problems we have right now specifically in this pandemic," he told the BBC. The Colombian team said the design was important for their South American country because parts for traditional models could be hard to obtain. By contrast, Mr Mascorro's design uses only easy-to-find parts - for example, the valves it employs can commonly be found at car and plumbing supply stores. The machine is set to be put through a fast-tracked round of tests at two institutions in Bogota - the University Hospital of the Pontifical Xavierian University and Los Andes University.' -- source: https://www.bbc.com/news/technology-52251286 -- github: https://github.com/Mascobot/pandemic-ventilator-2.0 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Not-actually Linux distro review: FreeBSD 12.1-RELEASE
by Peter Reutemann 10 Apr '20

10 Apr '20

'This month's Linux distro review isn't of a Linux distribution at all—instead, we're taking a look at FreeBSD, the original gangster of free Unix-like operating systems. The first FreeBSD release was in 1993, but the operating system's roots go further back—considerably further back. FreeBSD started out in 1992 as a patch-release of Bill and Lynne Jolitz's 386BSD—but 386BSD itself came from the original Berkeley Software Distribution (BSD). BSD itself goes back to 1977—for reference, Linus Torvalds was only seven years old then. Before we get started, I'd like to acknowledge something up front—our distro reviews include the desktop experience, and that is very much not FreeBSD's strength. FreeBSD is far, far better suited to running as a headless server than as a desktop! We're going to get a full desktop running on it anyway, because according to Lee Hutchinson, I hate myself—and also because we can't imagine readers wouldn't care about it. FreeBSD does not provide a good desktop experience, to say the least. But if you're hankering for a BSD-based desktop, don't worry—we're already planning a followup review of GhostBSD, a desktop-focused BSD distribution.' -- source: https://arstechnica.com/gadgets/2020/04/not-actually-linux-distro-review-fr… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Signal Threatens To Dump US Market If EARN IT Act Passes
by Peter Reutemann 10 Apr '20

10 Apr '20

'Signal is warning that an anti-encryption bill circulating in Congress could force the private messaging app to pull out of the U.S. market. PC Magazine reports: Since the start of the coronavirus pandemic, the free app, which offers end-to-end encryption, has seen a surge in traffic. But on Wednesday, the nonprofit behind the app published a blog post, raising the alarm around the EARN IT Act. "At a time when more people than ever are benefiting from these (encryption) protections, the EARN IT bill proposed by the Senate Judiciary Committee threatens to put them at risk," Signal developer Joshua Lund wrote in the post. Although the goal of the legislation, which has bipartisan support, is to stamp out online child exploitation, it does so by letting the U..S government regulate how internet companies should combat the problem -- even if it means undermining the end-to-end encryption protecting your messages from snoops. If the companies fail to do so, they risk losing legal immunity under Section 230 of the Communications Decency Act, which can shield them from lawsuits concerning objectionable or illegal content posted on their websites or apps. "Some large tech behemoths could hypothetically shoulder the enormous financial burden of handling hundreds of new lawsuits if they suddenly became responsible for the random things their users say, but it would not be possible for a small nonprofit like Signal to continue to operate within the United States," Lund wrote in the blog post.' -- source: https://it.slashdot.org/story/20/04/09/2014207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Meet dark_nexus, quite possibly the most potent IoT botnet ever
by Peter Reutemann 10 Apr '20

10 Apr '20

'A newly discovered botnet that preys on home routers, video recorders, and other network-connected devices is one of the most advanced Internet-of-things platforms ever seen, researchers said on Wednesday. Its list of advanced features includes the ability to disguise malicious traffic as benign, maintain persistence, and infect devices that run on at least 12 different CPUs. Researchers from antivirus provider Bitdefender described the so-called dark_nexus as a “new IoT botnet packing new features and capabilities that put to shame most IoT botnets and malware that we’ve seen.” In the three months that Bitdefender has tracked it, dark_nexus has undergone 30 version updates, as its developer has steadily added more features and capabilities.' -- source: https://arstechnica.com/information-technology/2020/04/meet-dark_nexus-quit… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chinese Cybercriminals Target High-Value Linux Servers With Weak Defenses: BlackBerry
by Peter Reutemann 10 Apr '20

10 Apr '20

'Linux malware is real and Advanced Persistent Threat (APT) groups have been infiltrating critical servers with these tools for at least eight years, according to a new report from BlackBerry. From a report: In "Decade of the RATs: Cross-Platform APT Espionage Attacks Targeting Linux, Windows and Android," security researchers found that these groups have attacked companies around the world and across all industries with goals ranging from simple cybercrime to full-blown economic espionage. The RATs report describes how five APT groups are working with the Chinese government and the remote access trojans (RATs) the cybercriminals are using to get and maintain access to Linux servers. According to the report, the groups appeared to be using WINNTI-style tooling to take aim at Linux servers and remain relatively undetected for almost a decade. These groups are targeting Red Hat Enterprise, CentOS, and Ubuntu Linux environments for espionage and intellectual property theft. The APT groups examined include the original WINNTI GROUP, PASSCV, BRONZE UNION, CASPER (LEAD), and a newly identified group BlackBerry researchers are tracking as WLNXSPLINTER. The BlackBerry researchers think all five groups are working together, given the distinct similarities in their preferred tools, tactics, and procedures.' -- source: https://linux.slashdot.org/story/20/04/09/1538218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Launches Braille Keyboard for Android Devices
by Peter Reutemann 10 Apr '20

10 Apr '20

'Google today announced the launch of a virtual braille keyboard for Android that's designed to enable those with low vision or blindness to type on their phones without additional hardware. From a report: The tech giant says it collaborated with braille developers and users to create it, and to ensure it can be used anywhere a user would normally type -- including social media, text messaging, and email apps. According to the World Health Organization, at least 2.2 billion people globally have a vision impairment or blindness. To address their needs, Google previously developed and released BrailleBack, an accessibility service for Android that helps users make use of braille devices, but BrailleBack didn't offer on-screen typing.' -- source: https://tech.slashdot.org/story/20/04/09/1831238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Windows 10 Is Getting Linux Files Integration In File Explorer
by Peter Reutemann 09 Apr '20

09 Apr '20

'Microsoft is planning to fully integrate Linux file access into the built-in File Explorer. The Verge reports: A new Linux icon will be available in the left-hand navigation pane in File Explorer, providing access to the root file system for any distros that are installed in Windows 10. The icon that will appear in File Explorer is the famous Tux, the penguin mascot for the Linux kernel. Microsoft is testing the Linux File Explorer integration in a new build of Windows 10 that's available for testers today. Previously, Windows 10 users would have to manually navigate to a UNC path to get access to Linux files from the Windows Subsystem for Linux (WSL). If you have WSL enabled, then the Tux will appear in File Explorer, and Microsoft is now seeking feedback on the integration before it's finalized as part of a future Windows 10 update. The software maker will ship this update to all Windows 10 users later this year. ' -- source: https://linux.slashdot.org/story/20/04/08/2146226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

corp.com Saved From Falling Into The Wrong Hands
by Lawrence D'Oliveiro 09 Apr '20

09 Apr '20

Seems that early versions of Windows Active Directory would offer a default path name of “corp” during setup. Back in the days before the Internet became a part of everyday life, many admins accepted this without thinking too much about it. But once you start connecting servers to the Internet, they are liable to do DNS lookups on names like this, and accidentally connecting to something like “corp.com”. So to avoid such a name from coming under the control of less-than-savoury elements, Microsoft has bought it over <https://www.theregister.co.uk/2020/04/08/microsoft_active_directory/>. One of the reader comments links to this old Microsoft blog post <https://devblogs.microsoft.com/oldnewthing/20061013-05/?p=29393>, which explains that example/default names like “Contoso” and “Fabrikam” used in Microsoft’s documentation and products were actually created by their legal department, after a careful vetting process to ensure that they are indeed entirely fictitious.

1 0

Cryptominer Linux Malware Infecting Docker Containers
by Lawrence D'Oliveiro 09 Apr '20

09 Apr '20

Seems some people are not properly securing their Docker setups <https://www.theregister.co.uk/2020/04/08/docker_malware_attacks/>, allowing the “Kinsing” malware to gain entrance and hijack your CPU time to do cryptocurrency mining.

1 0

Longtime Mozilla Leader Mitchell Baker is Now CEO
by Peter Reutemann 09 Apr '20

09 Apr '20

'On Wednesday, Mozilla chair and longtime leader Mitchell Baker was named permanent CEO of the company that makes the Firefox web browser. >From a report: Mitchell became interim CEO of Mozilla in December 2019, after former CEO Chris Beard resigned. The company conducted an external candidate search over the last eight months, and concluded the Mitchell is the right leader for Mozilla at this time, according to a company blog post published Wednesday. "Increasingly, numbers of people recognize that the internet needs attention," Baker said in another Mozilla blog post Wednesday. "Mozilla has a special, if not unique role to play here. It's time to tune our existing assets to meet the challenge. It's time to make use of Mozilla's ingenuity and unbelievable technical depth and understanding of the "web" platform to make new products and experiences. It's time to gather with others who want these things and work together to make them real."' -- source: https://tech.slashdot.org/story/20/04/08/1720218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Chrome 81 Arrives With Web NFC Origin Trial, AR Features, and Mixed Images Autoupgraded To HTTPS
by Peter Reutemann 09 Apr '20

09 Apr '20

'Google today launched Chrome 81 for Windows, Mac, Linux, Android, and iOS. Chrome 81 includes an Origin Trial of Web NFC for mobile, early Augmented Reality support, mixed images autoupgraded to HTTPS, TLS 1.0 and TLS 1.1 deprecated, and more developer features. With over 1 billion users, Chrome is both a browser and a major platform that web developers must consider. In fact, with Chrome's regular additions and changes, developers have to stay on top of everything available -- as well as what has been deprecated or removed. Among other things, Chrome 81 removes the "discard" element and FTP support.' -- source: https://slashdot.org/story/20/04/08/1641238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Tails, the Security-Focused OS, Adds Support For Secure Boot
by Peter Reutemann 09 Apr '20

09 Apr '20

'Tail OS, an operating system optimized for privacy and anonymity, has released version 4.5 this week, the first version that supports a crucial security feature named UEFI Secure Boot. From a report: Secure Boot works by using cryptographic signatures to verify that firmware files loaded during a computer's boot-up process are authentic and have not been tampered. If any of the firmware checks fail, Secure Boot has the authority to stop the boot process, preventing the operating system from launching. The feature has been available as part of the UEFI specification for almost two decades but is rarely used. The reason is because not all firmware vendors cryptographically sign their files, leaving the door open to verification errors that -- when Secure Boot is enabled -- block many operation systems from launching.' -- source: https://it.slashdot.org/story/20/04/08/1712239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google makes seamless update support mandatory in Android 11
by Peter Reutemann 09 Apr '20

09 Apr '20

'Google is putting new rules in place for Android 11: it's going to make support for Android's "seamless update" feature mandatory for devices launching with the new OS. The news comes to us via an Android source code commit first spotted by XDA Developers, which reads, "Require Virtual A/B on R launches." In English, this means the seamless update system, which requires two partitions (labeled "A" and "B"), will be required on Android R, aka Android 11. Android's seamless update system was introduced in Android 7.0 Nougat (it was actually borrowed from Chrome OS) as a way to reduce the downtime caused by OS updates and to offer a recovery mechanism in case an update applies incorrectly. Applying an update to an operating system usually means taking the OS offline for an extended period of downtime. On Android, before seamless updates, the phone would boot into recovery and could be stuck on the "Installing System Update" screen for as much as 25 minutes. That's a lot of downtime, and during this time you can't run any apps, see any text messages, or get any phone calls. The downtime happens because updating the system files requires taking the system partition offline, but the seamless update system fixes this by just having a second copy of the system partition.' -- source: https://arstechnica.com/gadgets/2020/04/google-makes-seamless-update-suppor… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Scratch Makes It To TIOBE Top 20
by Lawrence D'Oliveiro 08 Apr '20

08 Apr '20

Scratch, the graphically-based language designed to teach kids how to program, has entered TIOBE’s latest Top 20 list <https://devclass.com/2020/04/06/kids-programming-language-scratch-nails-top…>. Stats language R has also made some gains, getting into the top 10 for the first time.

1 0

Firefox 75 Arrives With Revamped Address Bar; Mozilla To Stick With 2020 Schedule
by Peter Reutemann 08 Apr '20

08 Apr '20

'Mozilla today launched Firefox 75 for Windows, Mac, and Linux. Firefox 75 includes a revamped address bar with significant search improvements, a few performance tweaks, and a handful of developer features. You can download Firefox 75 for desktop now from Firefox.com, and all existing users should be able to upgrade to it automatically. According to Mozilla, Firefox has about 250 million active users, making it a major platform for web developers to consider. When the coronavirus crisis took hold, millions found themselves spending more time in their browsers as they learn and work from home. But the crisis is also impacting software developers. Google was forced to pause its Chrome releases, which typically arrive every six weeks. Ultimately, Chrome 81 was delayed, Chrome 82 is being skipped altogether, and Chrome 83 has been moved up a few weeks. Microsoft has followed suit with Edge's release schedule, consistent with Google's open source Chromium project, which both Chrome and Edge are based on. Mozilla wants to make clear it is not in the same boat. The company took an indirect jab at Google and Microsoft today, saying: "We've built empathy into our systems for handling difficult or unexpected circumstances. These strengths are what allow us to continue to make progress where some of our competitors have had to slow down or stop work."' -- source: https://news.slashdot.org/story/20/04/07/162246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Announces IPE, a New Code Integrity Feature for Linux
by Peter Reutemann 08 Apr '20

08 Apr '20

'Microsoft has revealed details about a new project it has been working on for Linux kernel. From a report: Named Integrity Policy Enforcement -- or IPE -- the project is a Linux security module (LSM). LSMs are optional add-ons for the Linux kernel that enable additional security features. According to a documentation page published on Monday, IPE is Microsoft's attempt to solve the code integrity problem for Linux -- an operating system the company broadly uses in its Azure cloud service. On Linux systems where IPE is enabled, system administrators can create a list of binaries that are allowed to execute and then add the verification attributes the kernel needs to check for each binary before allowing it to run. If binaries have been altered by an attacker, IPE can block the execution of the malicious code.' -- source: https://linux.slashdot.org/story/20/04/07/1615232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Backs Apple's SMS OTP Standard Proposal
by Peter Reutemann 08 Apr '20

08 Apr '20

'Google is now backing a standard proposed by Apple engineers in January to create a default format for one-time passcodes (OTP) sent via SMS to users during the two-factor authentication (2FA) process. >From a report: The standard, proposed by Apple engineers working on the Safari WebKit project, has now reached the status of official Web Platform Incubator Community Group (WICG) specification draft. "We've moved 'Origin-bound one-time codes delivered via SMS' to @wicg_, where we're working on a shared spec with our collaborators at Google. Please take a look! Updated explainer, and specification," wrote Apple's Ricky Mondello. The proposal aims to fix some issues with the current state of SMS 2FA/OTP codes, all of which have different formats, unique per the websites sending the codes.' -- source: https://apple.slashdot.org/story/20/04/07/199245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Edge Overtakes Firefox To Become the Second-Most Popular Browser
by Peter Reutemann 06 Apr '20

06 Apr '20

'It was probably just a matter of time, but the thing so many people, including everyone at Microsoft, expected finally happened: Microsoft Edge surpassed Mozilla Firefox to become the world's second most-used desktop browser. Data provided by market analysis firm NetMarketShare reveals that the whole thing happened in March, when the adoption of the Chromium-powered Microsoft Edge improved to a level that allowed it to overtake Mozilla's own browser. So right now, Microsoft Edge is the second most-used desktop browser on the planet with a share of 7.59%, while Mozilla Firefox is now third with 7.19%. As for who's leading the pack, Google Chrome continues to be number one with a share of 68.50%' -- source: https://news.slashdot.org/story/20/04/05/1727217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

Eclipse Foundation Unveils Open Source Alternative to Microsoft's 'Visual Studio Code' IDE
by Peter Reutemann 05 Apr '20

05 Apr '20

'"The Eclipse Foundation just released version 1.0 of an open-source alternative to Visual Studio Code called Eclipse Theia," reports SD Times: Theia is an extensible platform that allows developers to create multi-language cloud and desktop IDEs, allowing them to create entirely new developer experiences. According to the Eclipse Foundation, the differences between Theia and Visual Studio Code are that Theia has a more modular architecture, Theia was designed from the ground to run on desktop and cloud, and Theia was developed under community-driven and vendor-neutral governance of the Eclipse Foundation. The Theia project was started by Ericsson and TypeFox in 2016, and since then it has become an integral part of cloud solutions globally. The project approached the Eclipse Foundation about becoming a potential host in 2019. Early contributors to the project include ARM, Arduino, EclipseSource, Ericsson, Google Cloud, IBM, Red Hat, SAP, and TypeFox. "We are thrilled to see Eclipse Theia deliver on its promise of providing a production-ready, vendor-neutral, and open source framework for creating custom and white-labeled developer products," announced Mike Milinkovich, the Eclipse Foundation's executive director. "Visual Studio Code is one of the world's most popular development environments. Not only does Theia allow developers to install and reuse VS Code extensions, it provides an extensible and adaptable platform that can be tailored to specific use cases, which is a huge benefit for any organization that wants to deliver a modern and professional development experience. Congratulations to all the Theia committers and contributors on achieving this milestone." InfoWorld points out that "thus far Theia is intended to be fitted into third-party products. An end-user version is on the roadmap for release later this year." But programming columnist Mike Melanson notes that "Chances are, you've already run into Theia without even realizing it, as it already serves as the basis for Red Hat's CodeReady Workspaces, the Eclipse Foundation's own Eclipse Che, and Google Cloud Shell."' -- source: https://developers.slashdot.org/story/20/04/04/1819251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

What's New in Linux 5.6? WireGuard VPN and USB4
by Peter Reutemann 05 Apr '20

05 Apr '20

'Linux 5.6 "has a bit more changes than I'd like," Linus Torvalds posted on the kernel mailing list, "but they are mostly from davem's networking fixes pulls, and David feels comfy with them. And I looked over the diff, and none of it looks scary..." TechRadar reports that the new changes include support for USB4 and GeForce RTX 2000 series graphics cards with the Nouveau driver: Yes, Turing GPU support has arrived with the open source Nouveau driver, along with the proprietary firmware images, as Phoronix.com reports. However, don't get too excited, as re-clocking doesn't work yet (getting the GPU to operate at stock clocks), and other important pieces of the puzzle are missing (like no Vulkan support with Nouveau). For the unfamiliar, Nouveau is an alternative to Nvidia's proprietary drivers on Linux, and although it remains in a relatively rough state in comparison, it's still good to see things progressing for Linux gamers with one of Nvidia's latest cards in their PC. Linux 5.6 also introduces fresh elements on the AMD front, with better reset support for Navi and Renoir graphics cards (which helps the GPU recover if it hits a problem)... Another notable move is the introduction of WireGuard support, a newcomer VPN protocol which makes a potentially nifty alternative to OpenVPN. Linux 5.6 also supports the Amazon Echo speaker, and naturally comes with a raft of other minor improvements... Linus's post also notes that for the next release's timing they'll "play it by ear... It's not like the merge window is more important than your health, or the health of people around you." But he says he hasn't seen signs that the pandemic could affect its development (other than the possibility of distraction by the news). "I suspect a lot of us work from home even normally, and my daughter laughed at me and called me a 'social distancing champ' the other day..."' -- source: https://linux.slashdot.org/story/20/04/04/2128207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

U.S. Government: Update Chrome 80 Now, Multiple Security Concerns Confirmed
by Peter Reutemann 05 Apr '20

05 Apr '20

'Part of America's Department of Homeland Security, the Cybersecurity and Infrastructure Security Agency (CISA) "has advised users to update Google Chrome as new high-rated security vulnerabilities have been found," reports Forbes: In an April 1 posting, CISA confirmed that Google Chrome version 80.0.3987.162 "addresses vulnerabilities that an attacker could exploit to take control of an affected system," be that Windows, Mac or Linux. It went on to state that it "encourages" users and administrators to apply the update. It's not just CISA that is warning about the need to update Google Chrome. The Center for Internet Security (CIS) is a non-profit entity that works to safeguard both private and public organizations against cyber threats. In a multi-state information sharing and analysis center (MS-ISAC) advisory, it has also warned of multiple vulnerabilities in Google Chrome. The most severe of these could allow an attacker to achieve arbitrary code execution within the context of the browser... All it would take for an attacker to exploit the vulnerabilities is to get the user to visit, by way of a phishing attack or even redirection from a compromised site, a maliciously crafted web page. Beside three high-rated vulnerabilities, Forbes reports that "a further five security vulnerabilities were discovered by the Google internal security team using a combination of internal audits and fuzzing."' -- source: https://it.slashdot.org/story/20/04/04/2020211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Cheap 3D Printer Review
by Lawrence D'Oliveiro 05 Apr '20

05 Apr '20

Here’s a review <https://www.youtube.com/watch?v=M3SMUpNH_6I> of a sub-USD100 3D printer from China. Has some good discussion of quality issues in 3D printing generally, and how this relates to the printer versus the filament you use. And I learned about the “3DBenchy” benchmark reference model. Judging from the gear they have access to, LTT seems to have quite a high budget for a YouTube channel. Also some useful notes from knowledgeable users among the comments ... if you can be bothered to dig for them ...

1 0

Yet Another Processor Architecture
by Lawrence D'Oliveiro 05 Apr '20

05 Apr '20

Here’s a report <https://www.nextplatform.com/2020/04/02/tachyum-starts-from-scratch-to-etch…> on a startup creating another new, proprietary processor architecture. Proprietary or not, the standard thing to do to get software running on things like this seems to be to port the GNU toolchain. Kernel? OS? No mention of that at this stage. I don’t claim to understand all the details, but it seems to be taking ideas from lots of sources, including Intel’s Itanium (which failed to become a successor to x86). One thing I was surprised to learn is that, as the wires connecting the transistors on a chip get thinner, this also makes them slower. So you don’t get all the gain you were expecting from making them shorter and bringing things closer together. One thing is clear: the Great Wheel Of Reincarnation <https://www.deviantart.com/default-cube/art/Computer-Graphics-And-The-Wheel…> (which in this case would apply to computing generally, not just graphics) has yet to stop spinning ...

1 0

Vint Cerf 'No Longer Contagious' With Covid-19
by Peter Reutemann 05 Apr '20

05 Apr '20

'Good news — VA Public Health has certified my wife and me as no longer contagious with COVID19," tweeted 76-year-old Vint Cerf, one of the creators of the modern internet. He added one word. "Recovering!" It seemed especially appropriate that Cerf shared his news online — and that it drew positive responses from grateful people around the world, including several who use the internet in their daily lives. Cerf's tweet immediately drew positive responses from the Internet Society, as well as the chief operating officer of the Cloud Native Computing Foundation, YouTube's director of public policy, and a senior director of communications and public affairs at Google. There were also congratulatory posts from a Georgetown professor of technology and law, from Associated Press reporter Frank Bajak, and the executive director of the Global Privacy and Security by Design Centre. Cerf followed up his news with a re-tweet of Google's "Community Mobility Reports" charting our aggregate movement trends over time, and a tweet of a University of Pittsburgh press release about progress on a COVID-19 vaccine candidate. Earlier in the week Cerf also re-tweeted a humorous compilation of clips from the TV show M*A*S*H that illustrated safe practices while social distancing.' -- source: https://news.slashdot.org/story/20/04/04/0615234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Will Google Allow An Independent Peek At Its Crown Jewels?
by Lawrence D'Oliveiro 04 Apr '20

04 Apr '20

An advertising company called Foundem is suing Google <https://www.theregister.co.uk/2020/04/03/google_foundem_high_court_seo_expe…> over a drastic demotion in its search rankings and consequent damage to its business, claiming this was an anticompetitive act. Google denies this, and as part of its defence has filed documents with the court giving confidential details of how its search-ranking algorithms work. But of course the lawyers and judge don’t have the background to understand these documents. So the plaintiff wants an independent SEO expert to be able to go over them and make sense of them to the lawyers. Google is vehemently opposed to this. So now the judge has given the company a stark choice: either allow the expert access to those documents, or withdraw them from the evidence (and thereby, by Google’s own admission as to the “vital” nature of these documents for its defence, likely lose the case). Which way do you think Google will decide?

1 0

Phone-tracking of self-isolationists
by tom butz 04 Apr '20

04 Apr '20

When we had to track teenagers' nightclubbing whereabouts (they're adults now), we did the following: 1) made sure we'd written down their mobile phone-numbers (obviously) 2) remembered their names/addresses (obviously) 3) told them to leave their mobiles switched ON all the time (they'd have done that anyway to keep up with Social Media) 4) Sent them a text every hour on the hour and they'd have to reply 'OK'. We'd reimburse them the money for the texts (nice little earner if you're on a plan...). Side-effect: it boosted their self-esteem (wow, getting messages all the time - she must be popular). Was that asking too much? Fast forward to our current lockdown and the way to handle self-quarantine: 1) as above 2) as above 3) as above 4) get info from cellphone-towers to check which one they're logged in. If, for example, someone is in self-quarantine at an Auckland campground and all of a sudden's logged into the Gisborne cell-tower, that would be an indication that they're elsewhere - or that the phone had been stolen. Note that in the case of traffic accidents police already get the info from cell-towers, so they can determine if the driver - according to their phone - was in the area, logged on and texting. Piece of cake for them, according to TVNZ. BTW, there is no need for name-matching: the rental-car companies do that anyway, so the user's name could stay anonymous - until police very kindly ask/beg cap in hand for it to be released. Tom Butz.

1 0

Twitter Discloses Firefox Bug That Cached Private Files Sent or Received via DMs
by Peter Reutemann 03 Apr '20

03 Apr '20

'Social networking giant Twitter today disclosed a bug on its platform that impacted users who accessed their platform using Firefox browsers. >From a report: According to Twitter, its platform stored private files inside the Firefox browser's cache -- a folder where websites store information and files temporarily. Twitter said that once users left their platform or logged off, the files would remain in the browser cache, allowing anyone to retrieve it. The company is now warning users who share workstations or used a public computer that some of their private files may still be present in the Firefox cache. Malware present on a system could also scrape and steal this data, if ever configured to do so.' -- source: https://news.slashdot.org/story/20/04/02/2048216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Internet is Now Rife With Places Where You Can Organize Zoom-bombing Raids
by Peter Reutemann 03 Apr '20

03 Apr '20

'The internet is rife with online communities where users can go and share Zoom conference codes and request that pranksters connect and hurl insults, play pornographic material, or make death threats against other participants -- in a practice called Zoom-bombing or a Zoom raid. From a report: ZDNet began tracking the tactic since mid-March when the term was first coined following a TechCrunch article. Ever since then, Zoom-bombing incidents have increased, as articles in major news outlets like the New York Times and the BBC have made the practice a favorite pastime for all the teenagers stuck in their homes during the current coronavirus (COVID-19) quarantines. From a niche prank that started on a derelict Discord channel, Zoom-bombing has now spread to enormous proportions -- being so rampant these days that the FBI sent a nationwide alert last week, urging companies, schools, and universities to take steps to secure their Zoom channels. But as Zoom-bombing became more popular, more pranksters wanted to join on the fun, and more users wanted their friends' Zoom meetings disrupted. And as the old saying goes; where there's a demand, there's always a supply. Over the course of the past week, the number of places on the public internet where you can request a zoom raid from a gang of bored teenagers has exploded.' -- source: https://yro.slashdot.org/story/20/04/02/1937229 How to secure Zoom: https://www.netsafe.org.nz/get-into-zoom/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

National Tells PM To Stop Using Zoom At Cabinet Meetings
by Lawrence D'Oliveiro 02 Apr '20

02 Apr '20

Security concerns are being raised about the Zoom videoconferencing service, which Jacinda Ardern and her cabinet have been using in their online meetings <https://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=12321784>.

2 1

Linux Mint 20 is 64-bit Only, Based on Ubuntu 20.04, and Named 'Ulyana'
by Peter Reutemann 01 Apr '20

01 Apr '20

'Today, we learn some new details about the upcoming Linux Mint 20. While most of the newly revealed information is positive, there is one thing that is sure to upset many Linux Mint users. First things first, Linux Mint 20 will be based on the upcoming Ubuntu 20.04. This shouldn't come as a surprise, as Mint only uses Long Term Support versions of Ubuntu, and 20.04 will be an LTS. We also now know the name of Linux Mint 20. The Mint team always uses female names, and this time they chose "Ulyana." This is apparently a Russian name meaning "youthful." So far, all of the news is positive, so what exactly will upset some users? The Linux Mint developers are finally dropping 32-bit support and will only produce 64-bit ISOs.' -- source: https://linux.slashdot.org/story/20/03/31/1842216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

OpenWRT code-execution bug puts millions of devices at risk
by Peter Reutemann 01 Apr '20

01 Apr '20

'For almost three years, OpenWRT—the open source operating system that powers home routers and other types of embedded systems—has been vulnerable to remote code-execution attacks because updates were delivered over an unencrypted channel and digital signature verifications are easy to bypass, a researcher said. OpenWRT has a loyal base of users who use the freely available package as an alternative to the firmware that comes installed on their devices. Besides routers, OpenWRT runs on smartphones, pocket computers and even laptops and desktop PCs. Users generally find OpenWRT to be a more secure choice because it offers advanced functions and its source code is easy to audit. Security researcher Guido Vranken, however, recently found that updates and installation files were delivered over unencrypted HTTPs connections, which are open to attacks that allow adversaries to completely replace legitimate updates with malicious ones. The researcher also found that it was trivial for attackers with moderate experience to bypass digital-signature checks that verify a downloaded update as the legitimate one offered by OpenWTR maintainers. The combination of those two lapses makes it possible to send a malicious update that vulnerable devices will automatically install.' -- source: https://arstechnica.com/information-technology/2020/03/openwrt-is-vulnerabl… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How The ESA Has Kept The Mars Express Probe Doing Useful Science For 16 Years
by Lawrence D'Oliveiro 01 Apr '20

01 Apr '20

Originally designed for a mission lasting one Martian year (about two Earth years), MEX <https://www.theregister.co.uk/2020/03/31/mars_express/> continues to operate even today, and looks likely to manage to stay in action for a few more years. Working around a wiring error that meant it only had 70% of the designed operating power, then dealing with unreliabilities cropping up in the Solid-State Mass Memory system, figuring out how to prolong the life of the maneouvring reaction wheels, actually having to write and upload new software written in Ada-83, where the original contractor was helpful, rather than obstructive for a change: While support had officially ended, ESA did set up a small contract with Airbus (who had acquired the original spacecraft manufacturer) in a role reversal that saw Airbus review the MEX team's work rather than the other way around. As it transpired, Airbus turned out to be hugely helpful, blowing dust off some testing tools, making suggestions and, effectively, "putting the band back together" as those who originally designed and built MEX (and had not yet shuffled off into retirement) were hauled back to offer assistance. All in all, the team operating MEX has done some amazing work so far. Bear in mind that launching probes into space is still a dicey business, prone to embarrassing failures. This is why they have to be over-engineered, then backed up with alternate recovery plans on top of alternate recovery plans.

1 0

Zoom Meetings Aren't End-to-End Encrypted, Despite Misleading Marketing
by Peter Reutemann 01 Apr '20

01 Apr '20

'Zoom, the video conferencing service whose use has spiked amid the Covid-19 pandemic, claims to implement end-to-end encryption, widely understood as the most private form of internet communication, protecting conversations from all outside parties. In fact, Zoom is using its own definition of the term, one that lets Zoom itself access unencrypted video and audio from meetings. With millions of people around the world working from home in order to slow the spread of the coronavirus, business is booming for Zoom, bringing more attention on the company and its privacy practices, including a policy, later updated, that seemed to give the company permission to mine messages and files shared during meetings for the purpose of ad targeting. Still, Zoom offers reliability, ease of use, and at least one very important security assurance: As long as you make sure everyone in a Zoom meeting connects using "computer audio" instead of calling in on a phone, the meeting is secured with end-to-end encryption, at least according to Zoom's website, its security white paper, and the user interface within the app. But despite this misleading marketing, the service actually does not support end-to-end encryption for video and audio content, at least as the term is commonly understood. Instead it offers what is usually called transport encryption.' -- source: https://it.slashdot.org/story/20/03/31/1526250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Zoom is Leaking Peoples' Email Addresses and Photos To Strangers
by Peter Reutemann 01 Apr '20

01 Apr '20

'Popular video-conferencing Zoom is leaking personal information of at least thousands of users, including their email address and photo, and giving strangers the ability to attempt to start a video call with them through Zoom. From a report: The issue lies in Zoom's "Company Directory" setting, which automatically adds other people to a user's lists of contacts if they signed up with an email address that shares the same domain. This can make it easier to find a specific colleague to call when the domain belongs to an individual company. But multiple Zoom users say they signed up with personal email addresses, and Zoom pooled them together with thousands of other people as if they all worked for the same company, exposing their personal information to one another.' -- source: https://yro.slashdot.org/story/20/03/31/201237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

HPE, Intel and Linux Foundation Team Up For Open Source Software for 5G Core
by Peter Reutemann 01 Apr '20

01 Apr '20

'HPE announced on Tuesday it's working with Intel and the Linux Foundation on a new open source software project to help automate the roll out of 5G across multiple sites. From a report: The new partnership, which will be under the Linux Foundation umbrella, is called the Open Distributed Infrastructure Management Framework. The partnership represents HPE's move into the 5G core network space as it branches out from its enterprise roots. Other partners for the open source project include AMI, Apstra, IBM's Red Hat, Tech Mahindra and World Wide Technology. HPE will also introduce an enterprise offering, the HPE Open Distributed Infrastructure Management Resource Aggregator.' -- source: https://news.slashdot.org/story/20/03/31/1947203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Keyring Concept in Ubuntu: What is It and How to Use it?
by Peter Reutemann 31 Mar '20

31 Mar '20

'f you use automatic login in Ubuntu or other Linux distributions, you might have come across a pop-up message of this sort: Enter password to unlock your login keyring The login keyring did not get unlocked when you logged into your computer. It keeps on popping up several times before disappearing if you keep on clicking cancel. You may wonder why do you keep seeing this keyring message all the time? Let me tell you something. It’s not an error. It’s a security feature. Surprised? Let me explain the keyring concept in Linux.' -- source: https://itsfoss.com/ubuntu-keyring/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Internet Pioneer Vint Cerf Tests Positive For Covid-19
by Peter Reutemann 31 Mar '20

31 Mar '20

'Tech pioneer Vint Cerf, one of the co-creators of the modern internet, has tested positive for covid-19, according to a tweet Cerf sent out Monday morning. The 76-year-old tweeted out a clip from HBO's Last Week Tonight with John Oliver about the U.S. response to the global pandemic. "I tested positive for COVID-19 and am recovering," Cerf tweeted. "Listen to what John Oliver has to say about our national response so far." Cerf helped create the modern internet in the 1970s while working at UCLA with other pioneers like Bob Kahn and Leonard Kleinrock. Cerf worked on packet switching for the APRANET under Kleinrock and TCP/IP protocols with ARPA (now DARPA), the plumbing that makes the internet function. DARPA tweeted its support of Cerf, telling him to get well soon.' -- source: https://science.slashdot.org/story/20/03/30/214250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

WireGuard VPN makes it to 1.0.0—and into the next Linux kernel
by Peter Reutemann 31 Mar '20

31 Mar '20

'We've been anticipating WireGuard's inclusion into the mainline Linux kernel for quite some time—but as of Sunday afternoon, it's official. Linus Torvalds released the Linux 5.6 kernel, which includes (among other things) an in-tree WireGuard. Phoronix has a great short list of the most interesting new features in the 5.6 kernel, as well as a longer "everything list" for those who want to make sure they don't miss anything. If this is the first time you're hearing about WireGuard, the TL;DR is that it's a relatively new VPN (Virtual Private Network) application that offers a leaner codebase, easier configuration, faster connect times, and the latest and most thoroughly peer-reviewed and approved encryption algorithms. You can find a more detailed introduction in our initial August 2018 coverage.' -- source: https://arstechnica.com/gadgets/2020/03/wireguard-vpn-makes-it-to-1-0-0-and… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

#IsTheInternetDown
by Lawrence D'Oliveiro 28 Mar '20

28 Mar '20

Parts of it, anyway. Currently having trouble accessing github.com and anz.co.nz. Well, what else is there to do? ;)

3 4

Public Crash Screens: Linux For A Change
by Lawrence D'Oliveiro 27 Mar '20

27 Mar '20

The Register runs a regular series of reports on public signage showing crash messages instead of the ones they are supposed to show. Usually these are Microsoft Windows messages, often for hilariously out-of-date versions of Windows. This one, for a change <https://www.theregister.co.uk/2020/03/24/bork_walmart/>, shows a Linux boot failure. But it is still a hilariously out-of-date version of Linux.

2 2

Moving To Life Online ... With A Vengeance
by Lawrence D'Oliveiro 26 Mar '20

26 Mar '20

ISPs are having a few hiccups adjusting to the massive increase in Internet usage, particularly in the daytime <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=123201…>. Even phone calls, it seems, are overloading the landline network: Meanwhile, Spark says the indu[s]try-wide congestion problems that stopped many voice calls getting through on Monday and Tuesday are slowly starting to ease - but the telco is still encouraging people to use internet apps like Apple Facetime, WhatsApp or Skype for calls to help ease the pressure. Yeah, push even more load onto the Internet ...

2 2

Singapore Government To Make Its Contact-Tracing App Freely Available To Developers Worldwide
by Peter Reutemann 26 Mar '20

26 Mar '20

'In a move to help the international community combat the coronavirus pandemic, the Singapore government will be making the software for its contact-tracing application TraceTogether, which has already been installed by more than 620,000 people, freely available to developers around the world. From a report: In a post on Monday, Minister-in-charge of the Smart Nation Initiative Vivian Balakrishnan said that the app, developed by the Government Technology Agency (GovTech) and the Ministry of Health, will be open-sourced. This means that the software's source code will be made freely available and may be redistributed and modified. "We believe that making our code available to the world will enhance trust and collaboration in dealing with a global threat that does not respect boundaries, political systems or economies," said Dr Balakrishnan, who is also Foreign Minister. "Together, we can make our world safer for everyone."' -- source: https://yro.slashdot.org/story/20/03/25/1651232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The exFAT Filesystem Is Coming To Linux -- Paragon Software's Not Happy About It
by Peter Reutemann 26 Mar '20

26 Mar '20

'When software and operating system giant Microsoft announced its support for inclusion of the exFAT filesystem directly into the Linux kernel back in August, it didn't get a ton of press coverage. But filesystem vendor Paragon Software clearly noticed this month's merge of the Microsoft-approved, largely Samsung-authored version of exFAT into the VFS for-next repository, which will in turn merge into Linux 5.7 -- and Paragon doesn't seem happy about it. Yesterday, Paragon issued a press release about European gateway-modem vendor Sagemcom adopting its version of exFAT into an upcoming series of Linux-based routers. Unfortunately, it chose to preface the announcement with a stream of FUD (Fear, Uncertainty, and Doubt) that wouldn't have looked out of place on Steve Ballmer's letterhead in the 1990s.' -- source: https://linux.slashdot.org/story/20/03/25/2136223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Play’s malicious app problem infects 1.7 million more devices
by Peter Reutemann 25 Mar '20

25 Mar '20

'Google Play, the company’s official repository for Android apps, has once again been caught hosting fraudulent and potentially malicious apps, with the discovery of more than 56 apps—many of them for children—that were installed on almost 1.7 million devices. Tekya is a family of malware that generates fraudulent clicks on ads and banners delivered by agencies including Google’s AdMob, AppLovin’, Facebook, and Unity. To give the clicks the air of authenticity, the well-obfuscated code causes infected devices to use Android’s “MotionEvent” mechanism to imitate legitimate user actions. At the time researchers from security firm Check Point discovered them, the apps went undetected by VirusTotal and Google Play Protect. Twenty-four of the apps that contained Tekya were marketed to children. Google removed all 56 of the apps after Check Point reported them. The discovery “highlights once again that the Google Play Store can still host malicious apps,” Check Point researchers Israel Wernik, Danil Golubenko, and Aviran Hazum wrote in a post published on Tuesday. “There are nearly 3 million apps available from the store, with hundreds of new apps being uploaded daily–making it difficult to check that every single app is safe. Thus, users cannot rely on Google Play’s security measures alone to ensure their devices are protected.”' -- source: https://arstechnica.com/information-technology/2020/03/found-malicious-goog… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Launches New Initiative With Scroll To Fund Publishers
by Peter Reutemann 25 Mar '20

25 Mar '20

'Firefox, the global web browser from Mozilla, is launching a new subscription product Tuesday called the "Firefox Better Web initiative," and it will feature former Chartbeat CEO Tony Haile's new product Scroll as a launch partner. From a report: It's uncommon for a web browser to launch a product that's explicitly tied to paying out publishers. Scroll's business is all about paying publishers for their content while giving users a better ad experience. The test pilot for the product, which is a subscription to a privacy-first Firefox extension, will only be available in the U.S. The money from a membership ($4.99 monthly, $2,99 for first six months) goes directly to fund publishers and writers.' -- source: https://news.slashdot.org/story/20/03/24/145235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Meet the Chinese OS That's Trying To Shift the Country Off Windows
by Peter Reutemann 25 Mar '20

25 Mar '20

'China's homegrown operating systems haven't made much of a dent on the global stage. Now there's a Linux-based system that's aimed at weaning the country off Windows. From a report: UOS, or Unified Operating System, hit a new milestone after its first stable release in January: Union Tech's OS can now boot in 30 seconds on China-made chips. It's an important step as Chinese tech companies look to reduce their dependence on US-made software and hardware. The struggles of ZTE and Huawei illustrate this clearly: The former was reliant on chips made in the US to produce smartphones, while the latter has the difficult task of selling Android handsets outside China without Google apps or services. The "current international climate" has made it imperative for China to have its own foundational software to avoid being cut off by the US, said the general manager of Union Tech, Liu Wenhan. While Chinese operating systems currently account for less than 1% of the market, Liu said he expects them to grow to 20% to 30% in the future. Integrating homegrown Chinese chips could be the biggest accomplishment of UOS if it pans out. Although Chinese computer chips still don't approach the sophistication of those created by US-based companies, Union Tech said that it is actively working with Chinese chipmakers like Loongson and Sunway to facilitate the gradual replacement of American technology in the Chinese government and pillar industries. In December, Beijing ordered all government offices and public institutions to remove foreign computer equipment and software within three years.' -- source: https://tech.slashdot.org/story/20/03/24/1918223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Says Hackers Are Attacking Windows Users With a New Unpatched Bug
by Peter Reutemann 24 Mar '20

24 Mar '20

'Microsoft says attackers are exploiting a previously undisclosed security vulnerability found in all supported versions of Windows, including Windows 10. From a report: But the software giant said there is currently no patch for the vulnerability. The security flaw, which Microsoft deems "critical" -- its highest severity rating -- is found in how Windows handles and renders fonts, according to the advisory posted Monday. The bug can be exploited by tricking a victim into opening a malicious document. Once the document is opened -- or viewed in Windows Preview -- an attacker can remotely run malware, such as ransomware, on a vulnerable device. The advisory said that Microsoft was aware of hackers launching "limited, targeted attacks," but did not say who was launching the attacks or at what scale.' -- source: https://tech.slashdot.org/story/20/03/23/1846216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

WLUG meeting (virtual)
by Peter Reutemann 23 Mar '20

23 Mar '20

Hi everyone Thanks to Aarons tireless efforts, we can have our WLUG meeting despite COVID-19, though in virtual form via Youtube and Google Hangouts (see links below). As a refresher for the topic: The voice interface represents another big shift in user interfaces, and could be as big a shift as the shift from switches to terminals, the switch from terminals to windowed GUIs, or the switch from full computers to small touchscreen devices. Unfortunately, right now most of these devices are little more than a telephone for talking to a server in the cloud. That is a big problem for privacy, and presents the user with a false choice between access and privacy. Today's computers are capable of handling a verbal interface without requiring a cloud service to handle all of your requests. Aaron Chantrill is one of the developers on the Naomi Project, a free and open source voice assistant (https://projectnaomi.com) It is a plugin based system based on Jasper (http://jasperproject.github.io/) and depending on how the user chooses to configure it, can run totally offline. In this presentation, Aaron would like to introduce people to the Naomi Project, talk about the benefits of a verbal interface, talk about the current architectures of virtual assistants, and ways in which that architecture can be altered to provide better privacy, and also do a comparison of offline speech to text and text to speech solutions, including Pocketsphinx, Mozilla Deepspeech, Kaldi, and Julius. Finally, He will invite people to participate in building and improving Naomi. There is a lot to do and much of it is both engaging and cutting-edge. Aaron recorded a video of his presentation that you can watch here before the virtual meeting: https://youtu.be/8383A_t7iKQ The slides are available as well: https://github.com/aaronchantrill/NaomiPresentation/raw/master/Presentation… The Google Hangouts link for the Question & Answer session: https://hangouts.google.com/hangouts/_/calendar/ZHJhc2t5QGdtYWlsLmNvbQ.3j6l… Meetup link: https://www.meetup.com/WaikatoLinuxUsersGroup/events/269578787/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

[OT] The Doctor Who Helped Defeat Smallpox Explains What’s Coming
by Lawrence D'Oliveiro 23 Mar '20

23 Mar '20

I realize this isn’t part of the topic of this group, but this article <https://arstechnica.com/science/2020/03/the-doctor-who-helped-defeat-smallp…> seems to me important enough that everyone should read it. It’s an interview with epidemiologist Larry Brilliant, who was part of the group that helped eradicate smallpox, and who gave a TED talk 14 years ago about what the next epidemic would look like, that is proving rather prescient right now. He gives an overview of where we are at in the knowledge of the SARS-Cov-2† virus that is causing the current COVID-19‡ pandemic. In short, as new as this virus is, it’s going to follow a lot of the same sort of behaviour as every past infectious viral disease. On facemasks: The N95 mask itself is extremely wonderful. The pores in the mask are three microns wide. The virus is one micron wide. So you get people who say, well, it's not going to work. But you try having three big, huge football players who are rushing for lunch through a door at lunchtime—they're not going to get through. In the latest data I saw, the mask provided 5x protection. That's really good. But we have to keep the hospitals going and we have to keep the health professionals able to come to work and be safe. So masks should go where they’re needed the most: in taking care of patients. †Official name of the virus ‡Official name of the disease caused by the virus

1 0

Critical bugs in dozens of Zyxel and Lilin IoT models under active exploit
by Peter Reutemann 22 Mar '20

22 Mar '20

'Criminals are exploiting critical flaws to corral Internet-of-things devices from two different manufacturers into botnets that wage distributed denial-of-service attacks, researchers said this week. Both DVRs from Lilin and storage devices from Zyxel are affected, and users should install updates as soon as possible. Multiple attack groups are exploiting the Lilin DVR vulnerability to conscript them into DDoS botnets known as FBot, Chalubo, and Moobot, researchers from security firm Qihoo 360 said on Friday. The latter two botnets are spinoffs of Mirai, the botnet that used hundreds of thousand of IoT devices to bombard sites with record-setting amounts of junk traffic. The DVR vulnerability stems from three flaws that allow attackers to remotely inject malicious commands into the device. The bugs are: (1) hard-coded login credentials present in the device, (2) command-injection flaws, and (3) arbitrary file reading weaknesses. The injected parameters affect the device capabilities for file transfer protocol, network time protocol, and the update mechanism for network time protocol.' -- source: https://arstechnica.com/information-technology/2020/03/lilin-dvrs-and-zyxel… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Using Employer’s Proprietary Software From Home? It’ll Cost You
by Lawrence D'Oliveiro 21 Mar '20

21 Mar '20

Never mind the security pitfalls of employees working from home, now there are additional licensing headaches to worry about as well, with proprietary software <https://www.theregister.co.uk/2020/03/20/surge_in_home_working/>: ... some vendors have curious rules about remote access to their applications that incur additional fees. Rich Gibbons, a licensing trainer at IT Asset Management (ITAM), noted that Citrix and/or Remote Desktop Services are "the easiest way to quickly become non-compliant with a LOT of vendors." ... Security is one thing, but in the midst of a global pandemic, does anyone care about licensing? "You're not going to get audited right now," Gibbons told The Reg. "But in six months or whenever this is over, you need to know what you've done."

1 0

Open-Source Project Spins Up 3D-Printed Ventilator Validation Prototype In Just One Week
by Peter Reutemann 20 Mar '20

20 Mar '20

'In a great example of what can happen when smart, technically-oriented people come together in a time of need, an open-source hardware project started by a group including Irish entrepreneur Colin Keogh and Breeze Automation CEO and co-founder Gui Calavanti has produced a prototype ventilator using 3D-printed parts and readily available, inexpensive material. The ventilator prototype was designed and produced in just seven days, after the project spun up on Facebook and attracted participation from over 300 engineers, medical professionals and researchers. The prototype will now enter into a validation process by the Irish Health Services Executive (HSE), the country's health regulatory body. This will technically only validate it for use in Ireland, which ironically looks relatively well-stocked for ventilator hardware, but it will be a key stamp of approval that could pave the way for its deployment across countries where there are shortages, including low-income nations. The group behind the ventilator also recently changed the focus of their Facebook community, renaming the group from the Open Source Ventilator Project to the Open Source COVID19 Medical Supplies community. They're looking at expanding their focus to finding ways to cheaply and effectively build and validate other needed equipment, including protective gear like masks, sanitizer and protective face guards for front-line healthcare workers.' -- source: https://science.slashdot.org/story/20/03/19/2047232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Samba and the French Government
by Peter Reutemann 20 Mar '20

20 Mar '20

>From the Catalyst March newsletter: 'For many years, several French Ministries have entrusted Samba with the role of authentication for Windows desktop machines - using Samba's Domain Controller capability. As modern versions of Windows began phasing out the NT4 Domain Control protocols, it became imperative for the French Ministries to upgrade to Active Directory. Thanks to the long-standing success they had had with Samba, the Ministries were keen to continue to use Samba, this time as an Active Directory (AD) Domain Controller (DC). However, the French Ministries faced a problem: the new AD domains would need to be combined so that a single domain serves a whole ministry, not just a single site. This meant that Samba needed to upscale. Samba was successfully operating in the smaller ministries of the French Government, however, scaling from a thousand users up to 100,000 users for the ministry of Finance was a new challenge that required Catalyst's Samba experts.' -- source: https://www.catalyst.net.nz/client-work/samba-and-french-government Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Windows Subsystem for Linux is making inroads with developers
by Peter Reutemann 20 Mar '20

20 Mar '20

'Last week, Microsoft and Canonical (the company behind the Ubuntu Linux distribution) were scheduled to host a developer conference focused on the Windows Subsystem for Linux (WSL) at Microsoft's Redmond campus. Ars was invited, and I had plane tickets in hand—but the physical conference was canceled at the last minute due to the coronavirus. Note that I did say the physical conference was canceled—WSLconf itself went on, with 22 speakers and 21 talks given. Virtual attendees were reportedly more than double the (sold out) physical attendee registration and included developers from all around the world. Presentations were given over the Bluejeans videoconferencing platform, and Canonical's Developer Advocate Hayden Barnes says that the recorded sessions will be made generally available soon.' -- source: https://arstechnica.com/information-technology/2020/03/the-windows-subsyste… Probably useful for developers that are stuck on Windows, but I'm not gonna trade my Linux Desktop for that horrible Windows one... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Pixar Co-Founders Win Turing Award
by Lawrence D'Oliveiro 19 Mar '20

19 Mar '20

Pat Hanrahan and Ed Catmull split the latest ACM Turing award between them <https://www.theregister.co.uk/2020/03/18/pixar_founders_turing_award/>, in recognition of their pioneering work in computer graphics. Catmull has his name in the “Catmull-Clark” subdivision algorithm commonly used in 3D modellers to turn polygonal shapes into more curvy ones. He headed the Computer Graphics Lab at the New York Institute of Technology (NYIT), started in 1974, with the help of a load of funding from a wealthy benefactor. Among their many projects, NYIT tried to create what would have been, in 1984, the first feature-length movie done entirely in CG. It was called “The Works”. Unfortunately they never got much further than tantalizing fragments <https://www.youtube.com/watch?v=jgzAqRyhjVs>. Hanrahan was a key figure in the creation of the RenderMan renderer at Pixar. What was pioneering about that was the concept of a “shader”, written in a specialized programming language designed for describing how light reacts with a material. This was the “RenderMan Shading Language”. The same idea led to GLSL which became part of OpenGL later, and also the “Open Shading Language” (OSL) created and open-sourced at Sony Pictures ImageWorks, and adopted by many 3D software apps, including Blender.

1 0

Purism Librem Mini is a Tiny Linux Desktop
by Peter Reutemann 19 Mar '20

19 Mar '20

'Today, we get another diminutive desktop option, but this one is designed for Linux and privacy. From a report: Yes, Purism is finally launching a tiny desktop, and it will come pre-installed with the Debian-based PureOS. Called "Librem Mini," the cute bugger has 4 USB-A ports on the front, along with a 3.5mm audio jack, and the power button. On the rear, there are two more USB-A ports, a single USB-C port, Ethernet, HDMI, DisplayPort, and the power port. "Announcing the Purism Librem Mini. Our small form-factor mini-PC that puts freedom, privacy and security first. We're really excited about the Librem Mini, it's a device our community have wanted and we've wanted to offer for some time. The Librem Mini is accessible, small, light and powerful featuring a new 8th gen quad core i7 processor, up to 64 GB of fast DDR4 memory and 4k 60 fps video playback. It's a desktop for your home or oïfce, a media center for your entertainment, or an expandable home server for your files and applications," says Purism.' -- source: https://linux.slashdot.org/story/20/03/18/1654232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Open Source Against The Virus
by Lawrence D'Oliveiro 18 Mar '20

18 Mar '20

A researcher at Google has published plans for an Arduino-based DIY ventilator, in case hospitals run short of officially-approved units for patients <https://www.theregister.co.uk/2020/03/18/diy_ventilator_shortage/>. Quite a few other links there to homebrew efforts to address other ways to help deal with Covid-19. All potentially quite risky and unregulated, of course. So let’s just hope we won’t need any of it. And on a sad note: Meanwhile, technician Christian Fracassi reportedly <https://metro.co.uk/2020/03/16/firm-refuses-give-blueprint-coronavirus-equi…> helped make a 3D printed valve that helped save at least 10 lives at a hospital in Italy, although he may now face legal action from the company whose parts he copied.

1 0

Text processing in the shell
by Peter Reutemann 18 Mar '20

18 Mar '20

Hi everyone Just came across this article, which also has real-world examples: 'One of the things that makes the shell an invaluable tool is the amount of available text processing commands, and the ability to easily pipe them into each other to build complex text processing workflows. These commands can make it trivial to perform text and data analysis, convert data between different formats, filter lines, etc. When working with text data, the philosophy is to break any complex problem you have into a set of smaller ones, and to solve each of them with a specialized tool.' -- source: https://blog.balthazar-rouberol.com/text-processing-in-the-shell Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

meeting next Monday - cancelled
by Peter Reutemann 18 Mar '20

18 Mar '20

Hi everyone Due to COVID-19, we are cancelling all WLUG meetings for the foreseeable future. Stay safe and we'll see you again when things are back to normal! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

meeting next Monday (in theory)
by Peter Reutemann 16 Mar '20

16 Mar '20

Hi everyone At this stage, the university is monitoring the COVID-19 situation but (to my knowledge) isn't closing yet nor is it curtailing meetings such as ours. However, this could change any day and I will post an update when this should happen. So, at this stage we have an exciting WLUG meeting scheduled for next Monday: 'The voice interface represents another big shift in user interfaces, and could be as big a shift as the shift from switches to terminals, the switch from terminals to windowed GUIs, or the switch from full computers to small touchscreen devices. Unfortunately, right now most of these devices are little more than a telephone for talking to a server in the cloud. That is a big problem for privacy, and presents the user with a false choice between access and privacy. Today's computers are capable of handling a verbal interface without requiring a cloud service to handle all of your requests. Aaron Chantrill is one of the developers on the Naomi Project, a free and open source voice assistant (https://projectnaomi.com) It is a plugin based system based on Jasper (http://jasperproject.github.io/) and depending on how the user chooses to configure it, can run totally offline. In this presentation, Aaron would like to introduce people to the Naomi Project, talk about the benefits of a verbal interface, talk about the current architectures of virtual assistants, and ways in which that architecture can be altered to provide better privacy, and also do a comparison of offline speech to text and text to speech solutions, including Pocketsphinx, Mozilla Deepspeech, Kaldi, and Julius. Finally, He will invite people to participate in building and improving Naomi. There is a lot to do and much of it is both engaging and cutting-edge.' Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/266792000/ https://gettogether.community/events/3276/wlug-meeting/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ice Lake GPU underperforming? Put it in powersave mode. Wait, what?
by Peter Reutemann 16 Mar '20

16 Mar '20

'Back in December, Linux users were starting to notice that Ice Lake-equipped laptops were getting better framerates in powersave mode than in performance mode. This Tuesday, Intel developer Francisco Jerez released a patchset to address the conundrum. Jerez begins by noting the fact that if your system bottleneck is I/O, boosting CPU performance won't help—the CPU can't process more data if the I/O subsystem isn't providing it fast enough. "In IO-bound scenarios (by definition) the throughput of the system doesn't improve with increasing CPU frequency beyond the threshold value at which the IO device becomes the bottleneck." Jerez goes on to note that pointlessly boosting the CPU into turbo frequencies when there's no additional data for it to process doesn't just hurt power efficiency. In the case of laptop designs, there's typically no room for desktop- or server-style "overengineering"—you've got limited space as well as limited power. This means, among other things, that there's only so much cooling to go around. "With the current governors [...] the CPU frequency tends to oscillate with the load, often with an amplitude far into the turbo range, leading to severely reduced energy efficiency." This is particularly likely to become a problem in games, where the GPU portions of the processor get a much bigger workout than the x86 CPU itself. If you unnecessarily boost CPU frequency, you waste your TDP budget dealing with unnecessary waste heat from the CPU—which may in turn require throttling the GPU, since you've already eaten through your thermal overhead.' -- source: https://arstechnica.com/gadgets/2020/03/power-management-is-hard-linux-patc… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Internet 'is Not Working For Women and Girls', Says Sir Tim Berners-Lee
by Peter Reutemann 13 Mar '20

13 Mar '20

'Women and girls face a "growing crisis" of online harms, with sexual harassment, threatening messages and discrimination making the web an unsafe place to be, Sir Tim Berners-Lee has warned. The inventor of the world wide web said the "dangerous trend" in online abuse was forcing women out of jobs, causing girls to skip school, damaging relationships and silencing female opinions, prompting him to conclude that "the web is not working for women and girls." "The world has made important progress on gender equality thanks to the unceasing drive of committed champions everywhere," Berners-Lee wrote in an open letter to mark the web's 31st birthday on Thursday. "But I am seriously concerned that online harms facing women and girls -- especially those of colour, from LGBTQ+ communities and other marginalised groups -- threaten that progress."' -- source: https://tech.slashdot.org/story/20/03/12/1436247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 74 Slams Facebook In Solitary Confinement: Browser Add-On Stops Social Network Stalking Users Across the Web
by Peter Reutemann 13 Mar '20

13 Mar '20

'Tim Anderson reporting via The Register: The first thing users will see after updating to Mozilla's latest browser, Firefox 74, is a prompt to install the Facebook Container add-on. The Facebook Container add-on is not new, but has been enhanced in its latest version, 2.1.0, with the ability to add custom sites to the container so that you can "login with Facebook wherever you need to." The purpose of the Facebook Container is to let you continue to use Facebook but without having the social network site track your browsing elsewhere. "Installing this extension closes your Facebook tabs, deletes your Facebook cookies, and logs you out of Facebook," say the docs. When you visit Facebook and log in, the cookies it plants are isolated to the container. This prevents Facebook Like buttons and embedded comments from working on other sites. There is also an issue with sites that require or offer a Facebook login, which you can now overcome by adding those sites to the container. Sites are added by clicking a fence icon and selecting "Allow site in Facebook container." The effect is like having two web browsers, one in which you are logged into Facebook and subject to potential tracking on any site which has Facebook content, and another where Facebook has no knowledge of you.' -- source: https://news.slashdot.org/story/20/03/12/2027215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Modern RAM Used For Computers, Smartphones Still Vulnerable To Rowhammer Attacks
by Peter Reutemann 13 Mar '20

13 Mar '20

'According to new research published today, modern RAM cards are still vulnerable to Rowhammer attacks despite extensive mitigations that have been deployed by manufacturers over the past six years. These mitigations, collectively referred to as Target Row Refresh (TRR), are a combination of software and hardware fixes that have been slowly added to the design of modern RAM cards after 2014 when academics disclosed the first-ever Rowhammer attack. But in a new research paper titled today and titled "TRRespass: Exploiting the Many Sides of Target Row Refresh," a team of academics from universities in the Netherlands and Switzerland said they developed a generic tool named TRRespass that can be used to upgrade the old Rowhammer attacks to work on the new-and-improved TRR-protected RAM cards. The new upgraded attacks work on both DIMM and LPDDR4 memory types, and can be used to retrieve encryption keys from memory, or escalate an attacker's access right to sudo/SYSTEM-level.' -- source: https://it.slashdot.org/story/20/03/12/2042242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Security Practices At The CIA
by Lawrence D'Oliveiro 13 Mar '20

13 Mar '20

The trial of an ex-CIA operative accused of leaking some military-grade hacking tools <https://www.schneier.com/blog/archives/2020/03/cia_dirty_laund.html> has exposed some embarrassing details about the security practices of an organization that, you would expect, has security as its core mission. They regularly used (and freely circulated) rubbish passwords for services on their intranet for the elite “Operational Support Branch”, the excuse being that access to that intranet was already being tightly controlled. The old adage that “a system is only as secure as its weakest point”? They have heard of it...

1 0

Want To Use An Open-Source, Royalty-Free Video Codec? Pay Up, Please!
by Lawrence D'Oliveiro 13 Mar '20

13 Mar '20

A company called Sisvel is assembling a pool of patents claiming to cover the AV1 video codec <https://www.techdirt.com/articles/20200312/04075244087/former-refrigerator-…>. They expect to eventually have an arsenal of about 2000 patents, for which they will demand licence fees. If you remember, AV1 was created precisely to avoid the patent morass that surrounds H.265 aka HEVC.

1 0

Microsoft delivers emergency patch to fix wormable Windows 10 flaw
by Peter Reutemann 13 Mar '20

13 Mar '20

'Microsoft on Thursday released an unscheduled fix for a critical security bug that makes it possible for attackers to remotely execute malicious code that can spread from vulnerable machine to vulnerable machine without requiring any interaction from users. The flaw, in version 3 of Microsoft's implementation of the Server Message block protocol, is present only in 32- and 64-bit Windows 10 versions 1903 and 1909 for clients and servers. Although the vulnerability is difficult to exploit in a reliable way, Microsoft and outside researchers consider it critical because it opens large networks to "wormable" attacks, in which the compromise of a single machine can trigger a chain reaction that causes all other Windows machines to quickly become infected. That's the scenario that played on with the WannaCry and NotPetya in 2017. In a bulletin accompanying Thursday's patch, Microsoft said it has no evidence the flaw is being actively exploited, but the company went on to label the bug as "exploitation more likely." That designation means malicious actors will probably develop and use exploits in the future.' -- source: https://arstechnica.com/information-technology/2020/03/microsoft-delivers-e… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Windows has a new wormable vulnerability, and there’s no patch in sight
by Peter Reutemann 12 Mar '20

12 Mar '20

'Word leaked out on Tuesday of a new vulnerability in recent versions of Windows that has the potential to unleash the kind of self-replicating attacks that allowed the WannaCry and NotPetya worms to cripple business networks around the world. The vulnerability exists in version 3.1.1 of the Server Message Block, the service that’s used to share files, printers, and other resources on local networks and over the Internet. Attackers who successfully exploit the flaw can execute code of their choice on both servers and end-user computers that use the vulnerable protocol, Microsoft said in this bare-bones advisory. The flaw, which is tracked as CVE-2020-0796, affects Windows 10, versions 1903 and 1909 and Windows Server versions 1903 and 1909, which are relatively new releases that Microsoft has invested huge amounts of resources hardening against precisely these types of attacks. Patches aren’t available, and Tuesday’s advisory gave no timeline for one being released. Asked if there was a timeline for releasing a fix, a Microsoft representative said, “Beyond the advisory you linked, nothing else to share from Microsoft at this time.” In the meantime, Microsoft said vulnerable servers can be protected by disabling compression to block unauthenticated attackers from exploiting the vulnerability against an SMBv3 server. Users can use the following PowerShell command to turn off compression without needing to reboot the machine: Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" DisableCompression -Type DWORD -Value 1 -Force That fix won't protect vulnerable client computers or servers if they connect to a malicious SMB service, but in that scenario, the attacks aren't wormable. Microsoft also recommended users block port 445, which is used to send SMB traffic between machines.' -- source: https://arstechnica.com/information-technology/2020/03/windows-has-a-new-wo… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Before it sued Google for copying from Java, Oracle got rich copying IBM’s SQL
by Peter Reutemann 11 Mar '20

11 Mar '20

'More than a decade ago, Google re-implemented the Java programming language as part of its new Android mobile operating system. Oracle, the owner of Java, then sued Google for copyright infringement in 2010. Later this month, the Supreme Court will hear oral arguments in this epic copyright case that will have huge implications for the entire software industry—and that could cost Google billions of dollars. Google says it has done nothing wrong. Copyright law specifically excludes "systems" and "methods of operation" from copyright protection. Google argues that the aspects of Java it copied—function names, argument types, and so forth—fit squarely into these exceptions. Google also argues that copyright's fair use doctrine allows for this kind of copying. The case is being closely watched by the software industry. Companies like Microsoft and IBM have warned that Oracle's stance could create chaos for the industry. They argue that making this kind of copying illegal would not only create legal headaches for a lot of software companies—it would be bad for customers, too. Software companies copy software interfaces—known in industry jargon as application programming interfaces (APIs)—of their competitors' products all the time. This allows competing software products to be interoperable so that a customer can take software designed to work on one platform and re-use it on another. That means lower switching costs for customers. It also means lower barriers for entry for software startups, since it's easier to sell a new product if it's compatible with a software product that customers already know and trust. If anyone should understand the importance of such copying, it's Oracle. After all, Oracle got its start in the 1970s selling a database product based on the then-new structured query language (SQL). SQL was invented by IBM. And Oracle doesn't seem to have gotten a license to use it. If Oracle wins its legal battle, one ironic result will be to make the software industry less hospitable to future startups like Oracle. Incumbent software companies would have a greater ability to lock customers into their own proprietary standards. Startups wouldn't be allowed to do what Oracle did four decades ago: make its product compatible with an established competitor, then make that interoperability a selling point. As I'll explain below, Oracle's copying of SQL seems pretty similar to Google's copying of Java. But an Oracle spokeswoman disagrees. "It’s an incorrect premise, comparing apples with broccoli, and being completely divorced from the facts of the case," she wrote in a Tuesday email.' -- source: https://arstechnica.com/tech-policy/2020/03/before-it-sued-google-for-copyi… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 74 Arrives With Stricter Add-on Rules, TLS 1.0 and TLS 1.1 Disabled
by Peter Reutemann 11 Mar '20

11 Mar '20

'Mozilla today launched Firefox 74 for Windows, Mac, and Linux. Firefox 74 includes stricter rules for add-ons, TLS 1.0 and TLS 1.1 disabled by default, and a handful of developer features.' -- source: https://news.slashdot.org/story/20/03/10/1515248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu 20.04’s zsys adds ZFS snapshots to package management [Updated]
by Peter Reutemann 11 Mar '20

11 Mar '20

'Last October, an experimental ZFS installer showed up in Eoan Ermine, the second interim Ubuntu release of 2019. Next month, Focal Fossa—Ubuntu's next LTS (Long Term Support) release—is due to drop, and it retains the ZFS installer while adding several new features to Ubuntu's system management with the fledgling zsys package. Phoronix reported this weekend that zsys is taking snapshots prior to package-management operations now, so we decided to install the latest Ubuntu 20.04 daily build and see how the new feature works.' -- source: https://arstechnica.com/gadgets/2020/03/ubuntu-20-04s-zsys-adds-zfs-snapsho… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AMD Processors From 2011 To 2019 Vulnerable To Two New Attacks
by Peter Reutemann 11 Mar '20

11 Mar '20

'AMD processors manufactured between 2011 and 2019 (the time of testing) are vulnerable to two new attacks, research published this week has revealed (PDF). The two new attacks impact the security of the data processed inside the CPU and allow the theft of sensitive information or the downgrade of security features. The research team said it notified AMD of the two issues in August 2019, however, the company has not released microcode (CPU firmware) updates, claiming these "are not new speculation-based attacks," a statement that the research team disagrees with. The two new attacks target a feature of AMD CPUs known as the L1D cache way predictor. Introduced in AMD processors in 2011 with the Bulldozer microarchitecture, the L1D cache way predictor is a performance-centric feature that reduces power consumption by improving the way the CPU handles cached data inside its memory. A high-level explanation is available below: "The predictor computes a uTag using an undocumented hash function on the virtual address. This uTag is used to look up the L1D cache way in a prediction table. Hence, the CPU has to compare the cache tag in only oneway instead of all possible ways, reducing the power consumption." The two new attacks were discovered after a team of six academics [...] reverse-engineered this "undocumented hashing function" that AMD processors were using to handle uTag entries inside the L1D cache way predictor mechanism. Knowing these functions, allowed the researchers to recreate a map of what was going on inside the L1D cache way predictor and probe if the mechanism was leaking data or clues about what that data may be. While the attacks can be patched, AMD denies that these two new attacks are a concern, claiming they "are not new speculation-based attacks" and that they should be mitigated through previous patches for speculative execution side channel vulnerabilities. The research team says AMD's response is "rather misleading," and that the attacks still work on fully-updated operating systems, firmware, and software even today.' -- source: https://it.slashdot.org/story/20/03/09/2347202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Popular VPN and Ad-Blocking Apps Are Secretly Harvesting User Data
by Peter Reutemann 11 Mar '20

11 Mar '20

'Sensor Tower, a popular analytics platform for tech developers and investors, has been secretly collecting data from millions of people who have installed popular VPN and ad-blocking apps for Android and iOS, a BuzzFeed News investigation has found. These apps, which don't disclose their connection to the company or reveal that they feed user data to Sensor Tower's products, have more than 35 million downloads. Since 2015, Sensor Tower has owned at least 20 Android and iOS apps. Four of these -- Free and Unlimited VPN, Luna VPN, Mobile Data, and Adblock Focus -- were recently available in the Google Play store. Adblock Focus and Luna VPN were in Apple's App Store. Apple removed Adblock Focus and Google removed Mobile Data after being contacted by BuzzFeed News. The companies said they continue to investigate. Once installed, Sensor Tower's apps prompt users to install a root certificate, a small file that lets its issuer access all traffic and data passing through a phone. The company told BuzzFeed News it only collects anonymized usage and analytics data, which is integrated into its products. Sensor Tower's app intelligence platform is used by developers, venture capitalists, publishers, and others to track the popularity, usage trends, and revenue of apps. Randy Nelson, Sensor Tower's head of mobile insights, said the company's apps do not collect sensitive data or personally identifiable information and that "the vast majority of these apps listed are now defunct (inactive) and a few are in the process of sunsetting." But, as BuzzFeed points out, most of the apps are no longer available "because they were removed due to policy violations."' -- source: https://yro.slashdot.org/story/20/03/10/0148245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel CPUs Vulnerable To New LVI Attacks
by Peter Reutemann 11 Mar '20

11 Mar '20

'A team of academics from universities across the world, along with vulnerability researchers from Bitdefender, today disclosed a new security flaw in Intel processors. From a report: Named Load Value Injection, or LVI for short, this is a new class of theoretical attacks against Intel CPUs. While the attack has been deemed only a theoretical threat, Intel has released firmware patches to mitigate attacks against current CPUs, and fixes will be deployed at the hardware (silicon design) level in future generations.' -- source: https://it.slashdot.org/story/20/03/10/176200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DuckDuckGo is Good Enough For Regular Use
by Peter Reutemann 10 Mar '20

10 Mar '20

'Jake Voytko, who previously worked at Google, writing in a blog post: [...] Let's move away from Google's competitive advantages. How does DuckDuckGo perform for most of my search traffic? DuckDuckGo does a good job. I haven't found a reason to switch back to Google. I combed through my browser's history of DuckDuckGo searches. I compared it to my Google search history. When I fell back to Google, I often didn't find what I wanted on Google either. Most of my searches relate to my job, which means that most of my searches are technical queries. DuckDuckGo serves good results for my searches. I'll admit that I'm a paranoid searcher: I reformat error strings, remove identifiers that are unique to my code, and remove quotes before searching. I'm not sure how well DuckDuckGo would handle copy/pasted error strings with lots of quotes and unique identifiers. This means that I don't know if DuckDuckGo handles all technical searches well. But it does a good job for me. There are many domains where Google outperforms DuckDuckGo. Product search and local search are some examples. I recently made a window plug. It was much easier to find which big-box hardware stores had the materials I need with Google. I also recently bought a pair of ANC headphones. I got much better comparison information starting at Google. Google also shines with sparse results like rare programming error messages. If you're a programmer, you know what I'm talking about: imagine a Google search page with three results. One is a page in Chinese that has the English error string, one is a forum post that gives you the first hint that you need to solve the problem, and one is the error string in the original source code in Github. DuckDuckGo often returns nothing for these kinds of searches. Even though Google is better for some specific domains, I am confident that DuckDuckGo can find what I need. When it doesn't, Google often doesn't help either.' -- source: https://search.slashdot.org/story/20/03/09/1554252 I've been using DuckDuckGo for a number of years exclusively now and I agree with the author that when I can't find it with DDG, I can't find it with Google either. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

How Wikipedia's Volunteers Became the Web's Best Weapon Against Misinformation
by Peter Reutemann 10 Mar '20

10 Mar '20

'Fast Company just published a 4,000 appreciation of Wikipedia's volunteer editors: [W]hile places like Facebook, YouTube, and Twitter struggle to fend off a barrage of false content, with their scattershot mix of policies, fact-checkers, and algorithms, one of the web's most robust weapons against misinformation is an archaic-looking website written by anyone with an internet connection, and moderated by a largely anonymous crew of volunteers. "I think there's a part of that that is encouraging, that says that a radically open, collaborative worldwide project can build one of the most trusted sites on the internet," says Ryan Merkley, the chief of staff at the Wikimedia Foundation, the 400-person nonprofit that provides support to Wikipedia's community of editors. "There's another piece of that that is quite sad," he adds, "because it's clear that part of being one of the most trusted sites on the internet is because everything else has collapsed around us...." [U]nlike parts of the web where toxic information tends to spread, the encyclopedia has one big advantage: Its goal is not to "scale." It's not selling anything, not incentivizing engagement, not trying to get you to spend more time on it. Thanks to donations from thousands of donors around the world, there are no advertisers or investors to please, no algorithms to gather data or stir up emotions or personalize pages; everyone sees the same thing. That philanthropic spirit drives Wikipedia's volunteers, too, who come to the website not to share memes or jokes or even discuss the news but, marvelously, to build a reliable account of reality.... Despite the trolls and propagandists, the majority of errors, especially on controversial and highly trafficked pages, go away within minutes or hours, thanks to its phalanx of devoted volunteers. (Out of Wikipedia's 138 million registered users, about 138,000 have actively edited in the past month.) The site is self-governed according to a Byzantine body of rules that aim for courtesy and a "show your work" journalistic ethics built on accurate and balanced reporting. Vigilant community-built bots can alert Wikipedians to some basic suspicious behavior, and administrators can use restrictions to temporarily lock down the most vulnerable pages, keeping them safe from fly-by editors who are not logged in. "Most of these edits are small improvements to phrasing or content," says a 73-year-old retired physicist from Massachusetts who's done hundreds of edits himself. He adds that "a few are masterpieces, and some are vandalism."' -- source: https://news.slashdot.org/story/20/03/09/0346251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Brave Says it Will Generate Random Browser Fingerprints To Preserve User Privacy
by Peter Reutemann 10 Mar '20

10 Mar '20

'The Brave browser is working on a feature that will randomize its "fingerprint" every time a user visits a website in an attempt to preserve the user's privacy. From a report: Brave's decision comes as online advertisers and analytics firms are moving away from tracking users via cookies to using fingerprints. [...] "The unfortunate truth about all these approaches is that, despite being well-intentioned, none of them are very effective in preventing fingerprinting," the Brave team said of other browser makers' approaches. "The enormous diversity of fingerprinting surface in modern browsers makes these 'block', 'lie' or 'permission' approaches somewhere between insufficient and useless, unfortunately," they added. "Brave's new approach aims to make every browser look completely unique, both between websites and between browsing sessions," Brave developers said.' -- source: https://yro.slashdot.org/story/20/03/09/1822258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FSF Plans to Launch 'Forge', a Code-Hosting/Collaboration Platform
by Peter Reutemann 09 Mar '20

09 Mar '20

'The Free Software Foundation (FSF) announced plans to launch a public code hosting and collaboration platform ("forge") this year. Members of the FSF tech team are currently reviewing ethical web-based software that will help teams work on their projects, with features like merge requests, bug tracking, and other common tools. "Infrastructure is very important for free software, and it's unfortunate that so much free software development currently relies on sites that don't publish their source code, and require or encourage the use of proprietary software," FSF wrote in a blog post. "Our GNU ethical repository criteria aim to set a high standard for free software code hosting, and we hope to meet that with our new forge." As of now, the team said it has been researching a list of candidate programs and analyzing them in terms of ethical and practical criteria. The FSF blog post adds that "We plan on contributing improvements upstream for the new forge software we choose, to boost its score on those criteria... "We'll communicate with the upstream developers to request improvements and help clarify any questions related to the ethical repository criteria."' -- source: https://developers.slashdot.org/story/20/03/08/0323217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Blu-ray discs on Linux
by Ian Young 08 Mar '20

08 Mar '20

Hello all, Having acquired a laptop with a Blu-ray drive and then a Blu-ray disc I had a go at playing the disc with various live Linux versions. The closest was having the disc recognised and opening a player window (VLC iirc) but alas with no sound or vision. Other attempts failed with messages about no AACs being available or being unable to recognise the disc. A cursory survey of various web sources indicates that the best plan is to give up or use Windows. Anyone managed to get anywhere with this in Linux? The disc in question is by the band King Crimson live in Mexico titled Meltdown. Described as NTSC, Zone ABC, LPCM playable in all B-R players and drives. Thanks ~ Ian Y

2 1

FreeNAS and TrueNAS Are Merging
by Peter Reutemann 08 Mar '20

08 Mar '20

'FreeNAS is a free and open source operating system designed for network-attached storage (NAS) devices. For much of the past decade, the project has been led by the folks at iXsystems, which has also produced an enterprise version of the software called TrueNAS. Now iXsystems has announced that FreeNAS and TrueNAS are merging. Moving forward there will be a single operating system called TrueNAS rather than two different, but closely related operating systems. According to the company, the latest versions of the operating systems (FreeNAS 11.3 and TrueNAS 11.3) already share about 95-percent of the same source code. Starting with TrueNAS 12, there will only be a single OS image. But the company will offer two editions: TrueNAS CORE: open source edition TrueNAS Enterprise: commercial version with enterprise management and support.' -- source: https://news.slashdot.org/story/20/03/06/234216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

EFF: .Org Sale 'Threatens Instability and Dysfunction'
by Peter Reutemann 08 Mar '20

08 Mar '20

'In a scathing editorial, EFF continues to oppose Ethos Capital's plan to buy the PIR's .org domain registry for $1.1 billion, arguing that "the current system is stable and functional, and changing it threatens to introduce instability and dysfunction with no countervailing benefit to the community..." "[W]hile there is nothing currently wrong with .ORG, there is a lot that could go wrong if this deal moves forward." Ethos and PIR have repeatedly defended the proposed deal by arguing that converting PIR to a privately owned, for-profit enterprise will allow it to offer "new products and services," but without explaining what those new offerings might be. On Thursday, they finally admitted that they actually don't know what additional products and services .ORG registrants want or need, citing a lack of market research... The for-profit PIR that Ethos envisions would be a fundamentally different organization than today's PIR, and we have serious concerns about its business model and financial stability. Nothing we've heard from PIR and Ethos has convinced us that PIR should be transformed from something that we all know works to something that's unproven. To the contrary, the Ethos deal raises concrete dangers of censorship, financial and technical instability, and price-gouging of non-commercial .ORG registrants. And despite making their case for months, proponents of the deal haven't identified any specific benefits it would impart to .ORG users. ICANN can, and should, reject this change to the .ORG registry. But that time is running out; ICANN's current deadline to make a decision is Friday, March 20. You can still speak out: the ICANN Board is holding a public forum next week, Monday March 9 at 10am-11:30am Eastern Daylight Time. Anyone can join by videoconference and address the Board.' -- source: https://yro.slashdot.org/story/20/03/07/0619231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Edge Browser Scores Worst in Test of Telemetry Privacy
by Peter Reutemann 08 Mar '20

08 Mar '20

'"New academic research published last month looked at the phone-home [telemetry] features of six of today's most popular browsers and found that the Brave browser sent the smallest amount of data about its users back to the browser maker's servers," reports ZDNet: The research, conducted by Douglas J. Leith, a professor at Trinity College at the University of Dublin, looked at Google Chrome, Mozilla Firefox, Apple Safari, Brave, Microsoft Edge (the new Chromium-based version), and the Yandex Browser. "In the first (most private) group lies Brave, in the second Chrome, Firefox, and Safari, and in the third (least private) group lie Edge and Yandex...." [T]he professor found evidence that Chrome, Firefox, and Safari all tagged telemetry data with identifiers that were linked to each browser instance. These identifiers allowed Google, Mozilla, and Apple to track users across browser restarts, but also across browser reinstalls... [T]he most intrusive phoning-home features were found in the new version of Microsoft Edge and the official Yandex Browser. According to Prof. Leith, both used unique identifiers that were linked to the device's hardware, rather than the browser installation. Tracking users by hardware allows Microsoft and Yandex to follow users across installations and potentially link browser installs with other apps and online identities. The professor said that Edge collected the hardware UUID of the user's computer, an identifier that cannot be easily changed or deleted without altering a computer's hardware. Similarly, Prof. Leith also found that Yandex transmitted a hash of the hardware serial number and MAC address to its backend servers. "As far as we can tell this behaviour [in Edge and Yandex] cannot be disabled by users," the professor said. The article also points out that Brave was the only browser that didn't use search autocomplete functionality to collect and send back information on a user's visited web pages. (Even though this can be disabled in Firefox, Chrome, and Safari, it's on by default.) But Edge and Yandex "also sent back information about visited web pages that did not appear to be related to the search autocomplete feature, suggesting the browsers had other ways to track users' browsing habits."' -- source: https://apple.slashdot.org/story/20/03/07/0054219 A couple of articles on how to turn off telemetry within Firefox: https://www.askvg.com/tip-disable-telemetry-and-data-collection-in-mozilla-… https://www.howtogeek.com/557929/how-to-see-and-disable-the-telemetry-data-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Could Have Fixed 2FA Code-Stealing Flaw in Authenticator App Years Ago
by Peter Reutemann 08 Mar '20

08 Mar '20

'Last month, a cybersecurity firm discovered the first-ever Android malware that came with the capability to steal the 2FA (two-factor authentication) codes generated by the Google Authenticator app. The malware, discovered by researchers from ThreatFabric, was named Cerberus, and its 2FA OTP code-stealing feature was still under development, yet to have been detected in a real-world attack. According to researchers, the malware was a hybrid between a banking trojan and a remote access trojan (RAT). Once an Android user got infected, the hacker would use the malware's banking trojan features to steal credentials for mobile banking apps. If an account was protected by 2FA, and namely by the Google Authenticator app, the malware was designed to allow the Cerberus gang to connect to a user's device manually, via its RAT features. Hackers would then open the Authenticator app, generate one-time passcodes, take a screenshot of the codes, and then access the user's account. [...] Nightwatch researchers said that Google could have fixed this issue as early as October 2014, when this misconfiguration was first brought to its attention by someone on GitHub.' -- source: https://tech.slashdot.org/story/20/03/07/0918212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hack Turns Apple's iPhone Into An Android
by Peter Reutemann 07 Mar '20

07 Mar '20

'Ten years ago, David Wang pulled off a remarkable trick, installing Android on the first-generation iPhone. Now Wang and his colleagues at cybersecurity startup Corellium are doing it again with the ostentatiously titled Project Sandcastle. From a report: And Forbes got an exclusive hands-on look at their Android for iPhone product ahead of its public release scheduled for later this Wednesday. The timing is sure to have Apple fanboys rubbernecking: Corellium is in the middle of being sued by Apple. As previously reported by Forbes, in August last year, Corellium was taken to court over Apple claims the startup breached copyright laws by creating software versions of the iPhone for security and testing. The case took a surprise turn late last month when Apple subpoenaed Spanish banking giant Santander and the $50 billion U.S. military and intelligence contractor L3Harris. But Corellium has lofty ambitions for Project Sandcastle, saying that it'll actually show how Apple's walled garden, which it has fiercely protected since launching its flagship phone in 2007, can be deconstructed and taken over by others' software. "Project Sandcastle is about having fun building something new from the sand -- from the literal silicon of the hardware," said Corellium CEO Amanda Gorton, in a statement sent to Forbes. "Apple restricts iPhone users to operate inside a sandbox, but users own that hardware, and they should be able to use that hardware the way they want. So where sandboxes create limits and boundaries on the hardware that users own, sandcastles provide an opportunity to create something new and wonderful from the limitless bounds of your imagination."' -- source: https://apple.slashdot.org/story/20/03/06/1954210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

It’s Not All CUDA At The High End
by Lawrence D'Oliveiro 06 Mar '20

06 Mar '20

This item <https://www.nextplatform.com/2020/03/05/software-evolution-on-ornls-summit-…> reports on an interview with Dr Tjerk Straatsma, group lead for scientific computing at ORNL. Seems their supers have made heavy use of NVidia GPUs up to now, but this is set to change: Frontier, the next system for the OLCF, will have AMD CPUs and GPUs. To prepare for this system, software developers may want to make changes to their programming approach, with OpenMP directive-based and HIP native offloading as the most comparable to the OpenACC and CUDA approaches on Summit today. I wonder what happened to OpenCL as the cross-platform architecture for GPU computing?

1 0

Let’s Encrypt changes course on certificate revocation
by Peter Reutemann 06 Mar '20

06 Mar '20

'Earlier this week, Let's Encrypt announced that it would revoke roughly three million—2.6 percent—of its currently active certificates. Last night, however, the organization announced that it would delay the revocation of many of those certificates in the interest of Internet health. The impact of the revocation on system administrators was and is significant due to the very short window of maintenance allowed before the revocation went into effect. Roughly thirty-six hours were available from the initial announcement to the beginning of scheduled certificate revocation. Half an hour prior to the scheduled revocations, more than one million affected certificates had still not been renewed, and Let's Encrypt announced an additional delay to give administrators more time.' -- source: https://arstechnica.com/information-technology/2020/03/lets-encrypt-holds-o… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Almost Half of Mobile Malware Are Hidden Apps
by Peter Reutemann 06 Mar '20

06 Mar '20

'Certain apps are hiding themselves and stealing resources and data from mobile devices, according to a new report by security firm McAfee. From a report: This is a growing threat comprising almost half of all malicious mobile malware, and a 30% increase from 2018, said Raj Samani, chief scientist and McAfee fellow, who authored the Q1 2020 McAfee Mobile Threat Report. "This shows where the focus from criminals [is] on the mobile platform, which is in stark contrast to non-mobile malware,'' Samani said. A new malware family called LeifAccess or Shopper is taking advantage of the accessibility features in Android to create accounts, download apps, and post reviews, according to the report. LeifAccess, "is a broad campaign [and] is using alternate methods to achieve installation but thereafter trying to achieve legitimacy to the user with fake warnings," Samani said. For example, LeifAccess does not create an icon or shortcut, "so it's not immediately obvious that the app is installed ... but for some of the hidden apps within the report, malicious mobile attacks will even masquerade as a legitimate app," he said.' -- source: https://it.slashdot.org/story/20/03/04/2021233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ampere Altra is the First 80-core ARM-based Server Processor
by Peter Reutemann 06 Mar '20

06 Mar '20

'Ampere has unveiled the industry's first 80-core ARM-based 64-bit server processor today in a bid to outdo Intel and Advanced Micro Devices in datacenter chips. From a report: Ampere announced today that it has begun providing samples of the Ampere Altra processor for modern cloud and edge computing datacenters. The Ampere Altra processor runs on 210 watts and is targeted at such server applications as data analytics, artificial intelligence, database, storage, telco stacks, edge computing, web hosting, and cloud-native applications. Intel dominates about 95.5% of the server chip market with its x86-based processors, and AMD has the rest. But Ampere is targeting power-efficient, high-performance, and high-memory capacity features. Renee James, former president of Intel and CEO of Ampere, said in an interview with VentureBeat that the chip is faster than a 64-core AMD Epyc processor and Intel's 28-core high-end Xeon "Cascade Lake" chip.' -- sources: https://hardware.slashdot.org/story/20/03/04/2027230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel CSME Bug Worse Than Previously Thought
by Peter Reutemann 06 Mar '20

06 Mar '20

'Security researchers say that a bug in one of Intel's CPU technologies that was patched last year is actually much worse than previously thought. From a report: "Most Intel chipsets released in the last five years contain the vulnerability in question," said Positive Technologies in a report published today. Attacks are impossible to detect, and a firmware patch only partially fixes the problem. To protect devices that handle sensitive operations, researchers recommend replacing CPUs with versions that are not impacted by this bug. Only the latest Intel 10th generation chips are not vulnerable, researchers said. The actual vulnerability is tracked as CVE-2019-0090, and it impacts the Intel Converged Security and Management Engine (CSME), formerly called the Intel Management Engine BIOS Extension (Intel MEBx). ' -- source: https://it.slashdot.org/story/20/03/05/149222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0