- wlug - list.wlug.org.nz

Term Of The Week: “RPA”
by Lawrence D'Oliveiro 21 May '20

21 May '20

Came across this phrase “robotic process automation” (RPA) <https://www.theregister.co.uk/2020/05/05/sba_rpa_ban/> which seems to be just another name for “web-scraping”. The site in question also offers APIs that can be used more directly to make requests and receive info. It’s just that the scraping works on a GUI designed for human users and human response times and data rates, so it creates a lot more overhead on the servers when being driven automatically with a lot of requests. Some outfits try to say that using such technology on their site is a violation of their terms of service. As one of the reader comments points out, if a company is banned from using a scraper bot that is batching its requests, and has to resort to hiring an army of humans, creating a concomitant swarm of separate login sessions, to enter the same data, the result can be even worse load on the servers.

1 1

Information Technology Asset Management (ITAM) Forum
by Lawrence D'Oliveiro 21 May '20

21 May '20

Choice quote from the founder/chairman <https://www.theregister.co.uk/2020/05/20/itam_forum_launches/>: “One of the reasons people have been interested in ITAM in the past is because they are sick of software audits and want to learn to defend themselves against audits...” Given the way the proprietary licence agreements are worded, it’s hard to see how you can avoid this and still use the same software. Further: “Ten years ago, people thought everything would be compliant in the cloud. Although software compliance is less of an issue, costs certainly aren’t planned. It is as complex as ever. Whether it's on the desktop, in the data centre or in the cloud, you’re looking at roughly 35 per cent waste across all of those platforms.” That’s a pretty high figure. It means that, when you buy proprietary software, you are paying about a 50% markup on the supposed price.

1 0

Samsung Smart TV - blocking ads
by Peter Reutemann 21 May '20

21 May '20

Hi everyone Just came across this tip on reddit for blocking ads on your Samsung Smart TV: https://www.reddit.com/r/YouShouldKnow/comments/gn7fw5/ysk_if_you_own_a_sam… Blocking "ads.samsung.com" (or similar) on the router seems to be sufficient... The above link has more domains listed for Samsung and LG. Not that I'm connecting my TV to the internet in the first place... ;-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

List Of Spreadsheet Horror Stories
by Lawrence D'Oliveiro 21 May '20

21 May '20

One of the things the European Spreadsheet Risks Interest Group likes to do is collect horror stories about the (mis)use of spreadsheets <http://eusprig.org/horror-stories.htm>. Found the link in a reader comment <https://forums.theregister.co.uk/forum/all/2020/05/19/sap_analytics_cloud_o…> to this article <https://www.theregister.co.uk/2020/05/19/sap_analytics_cloud_office_integra…> about how software company SAP, creator of a complete business analytics suite, has felt compelled to include an interface to Microsoft Excel, just because that’s what most of its customers are familiar with.

4 5

SD Cards Version 8 Are Coming
by Lawrence D'Oliveiro 20 May '20

20 May '20

According to the pic linked from this article <https://www.theregister.co.uk/2020/05/20/sd_8_for_sd_express/>, the new SD card spec uses PCIe instead of the previous “SD Bus” interface to achieve around ... is it 4GB/s, or 4Gb/s? The article says it both ways, while the diagram uses capital B throughout. The current fastest SD cards have two rows of pins; this spec adds a third row.

1 0

Linux distro review: Fedora Workstation 32
by Peter Reutemann 20 May '20

20 May '20

'Today's Linux distro review is one I've been wanting to do for quite some time—Fedora Workstation. Fedora is one of the heavyweight desktop distros of the Linux world, with a vibrant community and a strong presence at every open source convention I've ever attended. (Remember physically attending events? Ars remembers.) I never felt particularly drawn to Fedora myself, because it's a bleeding-edge distro—one targeted to the very newest software, possibly at the expense of stability. That's not what I personally want in an operating system—I fix broken things professionally; I'd prefer not to fix them personally any more than I have to. But as one of the few distros using the next-generation Wayland display server by default, Fedora made me very curious indeed. Although the screenshots taken throughout this review are of virtual machines, my first installation of Fedora Workstation (ever!) was bare metal, on the HP Dragonfly Elite G1.' -- source: https://arstechnica.com/gadgets/2020/05/linux-distro-review-fedora-workstat… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

“To Fix Social Media, We Need To Introduce Digital Socialism”
by Lawrence D'Oliveiro 20 May '20

20 May '20

Some may find this opinion piece <https://www.aljazeera.com/indepth/opinion/fix-social-media-introduce-digita…> a bit too political, I don’t know. But he does mention some interesting open-source software projects, like the various “Fediverse” networks of decentralized social-media servers, and the “LibreSocial” project, which is trying to get rid of what little centralization still exists in those networks. Where I suppose it gets controversial is where he suggests that funding for such projects could be raised by taxing the existing Big Tech firms. But certainly many would agree the open-source projects he mentions are worth pursuing regardless.

1 0

OT: NZ COVID Tracer app
by Peter Reutemann 20 May '20

20 May '20

Hi everyone Just came through on my twitter feed: the NZ COVID Traver app is ready: https://www.health.govt.nz/our-work/diseases-and-conditions/covid-19-novel-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

4 3

Microsoft Launches Windows Terminal 1.0, Unveils GPU Support and Linux GUI Apps in WSL
by Peter Reutemann 20 May '20

20 May '20

'At Build 2020 today, Microsoft gave developers a slew of new tools to coax them into using Windows over macOS or Linux. From a report: Windows Terminal is now out of preview for enterprises, and Windows Subsystem for Linux (WSL) 2 is getting support for GPUs, Linux GUI apps, and a simplified install experience. Microsoft even released a Windows Package Manager in preview. Windows 10 runs on 1 billion monthly active devices (PCs, Xbox One consoles, and HoloLens devices), making it a massive platform for developers to target. [...] Microsoft today released Windows Terminal 1.0, which means it is stable for enterprise use. The open source application features multiple tabs, panes, tear-away windows, shortcuts, Unicode and UTF-8 character support, emojis, ligatures, extensions, GPU-accelerated text rendering engine, and custom themes, styles, and configurations. Windows Terminal is for users of PowerShell, Cmd, WSL, and other command-line tools. Microsoft also unveiled WSL improvements today, including support for GPUs, Linux GUI apps, and a simplified install experience. WSL is a compatibility layer for running Linux binary executables natively on Windows. Microsoft first shared it was working on WSL 2 a year ago at Build 2019. WSL 2 is slated to arrive in the next major Windows 10 update coming later this month (brilliantly called the Windows 10 May 2020 Update), but it won't have these new features. In the second half of the year, WSL 2 will get support for GPU compute workflows. ' -- source: https://linux.slashdot.org/story/20/05/19/163224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome 83 Released With Enhanced Privacy Controls, Tab Groups Feature
by Peter Reutemann 20 May '20

20 May '20

'Google has released today version 83 of its Chrome web browser, one of the most feature-packed Chrome updates released since the browser's initial launch back in 2009. From a report: Today's v83 release includes a slew of new features. These include enhanced privacy controls, new settings for managing cookie files, a new Safety Check option, support for tab groups, new graphics for web form elements, a new API for detecting barcodes, and a new anti-XSS security feature, among many many others. The reason why Chrome 83 includes so many features is because Google canceled the Chrome 82 release due to the ongoing coronavirus pandemic. As a result, some of the Chrome 82 features were pushed into Chrome 83, while others were rescheduled for later this year.' -- source: https://slashdot.org/story/20/05/19/185244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

OpenBSD 6.7 Released
by Peter Reutemann 20 May '20

20 May '20

'New OpenBSD version. String of good news. Some of the new changes, as highlighted by Phoronix, include: - FFS2 file-system improvements including using 64-bit timestamps and block numbers by default for new installs. - Support for the Raspberry Pi 4 on ARM64 while improving the Raspberry Pi 3 support too. Raspberry Pi 2/3 support has also improved for OpenBSD ARMv7. - Better support for Rockchip systems like the Pinebook Pro. - Various SMP improvements including better AMD SMT/Core/Package detection. - A wide variety of different hardware driver improvements, including Intel AX200 WiFi device support. - A FIDO driver introduced for FIDO/U2F security keys support. - Fixed handling of USB 2.0 devices when in use on different USB 3.0 controllers. - The PowerPC OpenBSD build switched over to Clang as its default code compiler. - Various dhclient fixes. - Various security improvements. ' -- source: https://tech.slashdot.org/story/20/05/19/1935202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday
by Peter Reutemann 20 May '20

20 May '20

Hi everyone For the meeting next week, the idea was to have a distro showdown. Since not everyone had experience yet with BigBlueButton, I would like to offer a trial run on Sunday night 8pm for the presenters. That should give them a chance to sort out video and audio. I'll send out a test link to the presenters off-list later on in the week. So far, I've got: - Ian - Ubuntu 20.04 - Tom - GhostBSD - Peter - Manjaro (never used it, but we can explore it together) Anyone else wanting to demo a distro? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ZFS versus RAID: Eight Ironwolf disks, two filesystems, one winner
by Peter Reutemann 19 May '20

19 May '20

'This has been a long while in the making—it's test results time. To truly understand the fundamentals of computer storage, it's important to explore the impact of various conventional RAID (Redundant Array of Inexpensive Disks) topologies on performance. It's also important to understand what ZFS is and how it works. But at some point, people (particularly computer enthusiasts on the Internet) want numbers. First, a quick note: This testing, naturally, builds on those fundamentals. We're going to draw heavily on lessons learned as we explore ZFS topologies here. If you aren't yet entirely solid on the difference between pools and vdevs or what ashift and recordsize mean, we strongly recommend you revisit those explainers before diving into testing and results. And although everybody loves to see raw numbers, we urge an additional focus on how these figures relate to one another. All of our charts relate the performance of ZFS pool topologies at sizes from two to eight disks to the performance of a single disk. If you change the model of disk, your raw numbers will change accordingly—but for the most part, their relation to a single disk's performance will not.' -- source: https://arstechnica.com/gadgets/2020/05/zfs-versus-raid-eight-ironwolf-disk… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Re: wlug Digest, Vol 347, Issue 17 - DishTV Box
by tom butz 19 May '20

19 May '20

Hi John, I've been using the cheap one (99 dollars) and it works well. They expect the hard-disk/memory stick to be formatted FAT32. The system could do that for you. The recording format is proprietary: it's .mpg, but if you play it back, there is an enormous amount of jitter every 5 seconds or so. There is no documentation, maybe because FreeView told them to keep it secret. The USB-connection is USB2 and supplies 500 mA of power: that should be enough for a memory stick but not an ordinary HD (they usually draw about 1000 mA). I've kept an old HD out of a notebook and use it with an adapter. It's slow but I've never lost anything. Maybe there are Y-connectors around that would bump the HD's power to 1000 mA, but I've not managed to find one. The system records in ordinary density and doesn't use a lot of space. As everything is so proprietary I haven't found a way to transfer/add parts to another HD/stick. Everything sits in 1 directory with a few subdirectories. Transferring the stuff to a computer would work if you filmed the TV-screen. You would then also be able to cut out the ads. I've read somewhere that there are devices that would record HDMI-output (which the DishTV provides) on a USB-device, so that should do the job. Gameplayers use something like that to record their moves... Just an aside: recording OnDemand movies: easy if you use 'simplescreenrecorder' (Windows and Linux). It creates an MKV-file you can edit. Tom.

3 2

dish tv
by john 18 May '20

18 May '20

Hi all' Does anyone know the file format for the Dish TV sat box?? I have a replacement empty drive. No File allocation and wonder if the Dish box will format the disk to it's own system? Cheers John.

1 0

Slack Now Strips Location Data From Images
by Peter Reutemann 16 May '20

16 May '20

'Slack has started to strip uploaded photos of their metadata. What may seem like an inconsequential change to how the tech giant handles storing files on its servers, it will make it far more difficult to trace photos back to their original owners. From a report: Almost every digital file -- from documents on your computer to photos taken on your phone -- contains metadata. That's data about the file itself, such as how big the file is, when it was created, and by whom. Photos and videos often include the precise coordinates of where they were taken. But that can be a problem for higher-risk Slack users, like journalists and activists, who have to take greater security precautions to keep their sources safe. The metadata inside photos can out sources, deanonymize whistleblowers, or otherwise make it easier for unfriendly governments to target individuals. Even if a journalist removes the metadata from a photo before publishing, a copy of the photo -- with its metadata -- may remain on Slack's servers. Whether a hacker breaks in or a government demands the data, it can put sources at risk' -- source: https://yro.slashdot.org/story/20/05/11/2051209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 5

ddr2 ram
by john 16 May '20

16 May '20

Some years ago, Windows Vista offered users who plugged in a USB flash drive the option of using the device as extra ram. I never actually tried this due to large amount of doubt about the functional ability of the claim. However I now have a number of Linux machines with DDR2 that I am unable to increase the physical memory of and wonder if this is a feasible option for these machines. Cheers John

5 6

Standby Fares For Those Flying Cloud
by Lawrence D'Oliveiro 14 May '20

14 May '20

New concept: “Spot” VMs on cloud services <https://www.theregister.co.uk/2020/05/13/azure_spot_vms/>. These are offered for a very low price, but equally the jobs run at very low priority, and are liable to be evicted at short notice--as little as 30 seconds, according to the article. They are there to fill up unused capacity that cannot be sold at the regular rate. But as soon as a customer appears willing to pay that rate, out you go.

1 0

3D File Manager As A Service
by Lawrence D'Oliveiro 13 May '20

13 May '20

This company called Saganworks is offering a navigable 3D world for accessing your files stored on their servers <https://blocksandfiles.com/2020/05/12/saganworks-virtual-reality-rooms-for-…>. This sort of thing has been done lots of times before, famously on SGI workstations (and seen in the “Jurassic Park” movie). I suppose Microsoft Bob also counts, in a way. Quote: “We don’t live in a 2D world, yet that’s how we’ve been retaining knowledge and memories from the time of early cave dwellers until now.” Speak for yourself, non-command-line user. Yes, the name is a contrived acronym, and also a homage to Carl Sagan ...

1 0

Ventoy USB Image Multi-Bootloader
by Lawrence D'Oliveiro 13 May '20

13 May '20

Been watching this video <https://www.youtube.com/watch?v=MYJ8du9TaxE> about a bootloader called “Ventoy”. Basically you install it onto a suitably-large USB stick, then you can just copy .iso image files of all the distros you want to try, and when you boot off that stick, it will offer a list of which OS image you want to start up. This even includes some Microsoft Windows installation images. Not everything is fully-compatible, though.

1 0

Commercial Use Of Open Source: Good & Bad
by Lawrence D'Oliveiro 13 May '20

13 May '20

<https://www.theregister.co.uk/2020/05/12/open_source_bugs/> The good news: commercial adoption of Open Source is on the up: ... almost all (99 per cent) of the codebases examined have at least one open source component and that 70 per cent of the code overall is open source. That's about twice as much as the company's 2015 report, which found only 36 per cent of audited code was open source. The bad news: the companies concerned seem to have few or no procedures in place for keeping those open-source components up to date: Ninety-one percent of the audited applications had components that are either four years out of date or have exhibited no active development for two years. In 2019 – the time-period covered by the 2020 report – the percentage of codebases containing vulnerable components rose to 75 per cent, up from 60 per cent in 2018. They also seem to be a little bit careless about the legalities: The Synopsys report also found that 68 per cent of codebases exhibited an open source license conflict and that 33 per cent of them had no identifiable license.

1 0

Eclipse Foundation Moving Base To Europe
by Lawrence D'Oliveiro 13 May '20

13 May '20

The Eclipse Foundation is “re-domiciling the legal entity that controls The Eclipse Foundation from the US to Europe” <https://www.theregister.co.uk/2020/05/12/eclipse_moves_to_europe/>. Seems like Europe is already accounting for a much bigger chunk of contributions than the US: Membership dues will eventually be stated in Euros and a new version of the membership agreement will be coming down the line to reflect the foundation's new status as a Belgian entity. This reader comment <https://forums.theregister.co.uk/forum/all/2020/05/12/eclipse_moves_to_euro…> gives some other examples of Open Source projects where either their organizations or the bulk of their contributors are not (or no longer) US-centric. E.g. The Document Foundation (which runs the LibreOffice project) is based in Berlin.

1 0

Apache 101: 0-WordPress in 15 minutes
by Peter Reutemann 13 May '20

13 May '20

'Recently, we took a look at the Caddy Web server. Today, we're going to back things up a little bit and look at the A from the classic LAMP stack: the Apache Web server. Apache has a bad reputation for being old, crusty, and low-performance—but this idea mostly stems from the persistence of ancient guides that still show users how to set it up in extremely antiquated ways. In this guide, we're going to set up an Ubuntu 20.04 droplet at Digital Ocean with an Apache Web server set up properly and capable of handling serious levels of traffic.' -- source: https://arstechnica.com/information-technology/2020/05/apache-101-0-wordpre… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Thunderbolt Bug Lets Hackers Steal Your Data in 'Five Minutes'
by Peter Reutemann 13 May '20

13 May '20

'A new set of flaws discovered in the Intel Thunderbolt port has put millions of machines at risk of local hacking. This new research by Eindhoven University's Bjorn Ruytenberg suggests that if a hacker gains access to a machine for just five minutes, they could bypass login methods to gain full data access. From a report: Thunderbolt ports are present in machines with Windows, Linux, and macOS. So, that covers a lot of computers. Ruytenberg said all Thunderbolt versions and systems shipped between 2011 to 2020 are affected and no software patch can fix these vulnerabilities. So, Intel would need to redesign silicon in order to fix these flaws. There's not much you can do here. However, with open-source software called Thunderspy, developed by Ruytenberg and their team, you can check if you're affected by the Thunderbolt bug.' -- source: https://it.slashdot.org/story/20/05/11/1450208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Microsoft Wants Notebooks
by Lawrence D'Oliveiro 12 May '20

12 May '20

One of the plans announced for Microsoft’s Visual Studio Code development environment <https://www.theregister.co.uk/2020/05/11/visual_studio_code_145_released/> is “notebooks” à la Jupyter: The team is also working on native support for notebooks, though rather than just support Jupyter notebooks (for which support already exists as part of the Python tools) the intention is to "build a Notebook solution that is unbiased and supports different styles of Notebooks". Of course, Jupyter itself already allows you to use other programming languages, not just Python. By the way, interesting to note that Jupyter is becoming the recognized reference for the notebook paradigm, as opposed to Mathematica which is where the idea originated.

1 0

ZFS 101—Understanding ZFS storage and performance
by Peter Reutemann 11 May '20

11 May '20

'As we all enter month three of the COVID-19 pandemic and look for new projects to keep us engaged (read: sane), can we interest you in learning the fundamentals of computer storage? Quietly this spring, we've already gone over some necessary basics like how to test the speed of your disks and what the heck RAID is. In the second of those stories, we even promised a follow-up exploring the performance of various multiple-disk topologies in ZFS, the next-gen filesystem you have heard about because of its appearances everywhere from Apple to Ubuntu. Well, today is the day to explore, ZFS-curious readers. Just know up front that in the understated words of OpenZFS developer Matt Ahrens, "it's really complicated." But before we get to the numbers—and they are coming, I promise!—for all the ways you can shape eight disks' worth of ZFS, we need to talk about how ZFS stores your data on-disk in the first place.' -- source: https://arstechnica.com/information-technology/2020/05/zfs-101-understandin… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Which Linux Desktop Environment is the Best?
by Peter Reutemann 11 May '20

11 May '20

'Tom's Hardware "put five of the most popular desktop environments up against each other in a no-holds-barred, seven-round face-off. We've rated GNOME, KDE, Cinnamon, Awesome and Regolith on a 10-point scale based on Installation, Applications, User Experience, User Documentation, Performance, Extensions and Configurability." It's a good read, with a detailed and thoughtful 3,700-word analysis, especially about memory performance: When you use the standard desktops, Gnome and KDE, you will likely notice that you are using a lot of memory... If you haven't noticed yet, try running htop in a separate window while you try out your choices. You should see a substantial difference with Awesome, i3 and, if you are elite, dwm. The difference in memory footprint is staggering when you start measuring. GNOME starts with somewhere in the region of 3GB at boot. This can be trimmed down by serious tweaking, but not very much. In comparison, the Awesome window manager weighs in at around 600MB... You can put a lot of eye candy and daemons before you weigh down your system as much as the others... Getting the advantage comes at a cost, though: you need to learn a few new habits to use Awesome desktop environment. Among GNOME, KDE, and Cinnamon, the article ultimately calls KDE "the most polished... decorative and versatile of the bunch. This comes at a cost, though." Cinnamon has the best balance between extensions and ease of use, while it is also fast and responsive. At the same time, it is not that heavy on resources. You can also add a wide range of extensions in the shape of widgets that send you ongoing and updated information. Regolith requires a bit more training, but it does set itself up for you so you can continue as you did with GNOME. Adding extensions and other gadgets is a bit more tricky, however... With Awesome you have to set up and practice to use it! It's easily the hardest in the group to get started with. When you are up and running, Awesome does deliver the most benefits from a resource point of view... Overall Winner: Cinnamon...because of its strong combination of user experience, performance and customization. ' -- source: https://tech.slashdot.org/story/20/05/10/1552222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Source Code For Contact-Tracing Apps
by Lawrence D'Oliveiro 10 May '20

10 May '20

The UK and Australia have both published the source code for their contact-tracing apps on GitHub <https://www.theregister.co.uk/2020/05/09/coronavirus_tracing_app_source_cod…>. And of course a lot of people are going over them with a fine-toothed comb. Some are even suggesting that one for Apple’s platform, for example, might be violating the company’s rules on using Bluetooth while running in the background. It’s hard to see how these apps won’t be a big battery drain anyway. Maybe the NZ government is wise not to make this sort of thing a priority for now.

1 0

Do Working-From-Home Developers Risk Burning Out?
by Peter Reutemann 10 May '20

10 May '20

'"Software developers, like everyone else, have had to transition to a work-from-home world," writes InfoWorld. For the users of GitHub, the COVID-19 pandemic has meant changes in work cadence and collaboration, along with an increased risk of burnout, a GitHub study of usage patterns on the Microsoft-owned code sharing site has found." In an "Octoverse spotlight" analysis published May 6, 2020, GitHub compared the first three months of 2020 with the first three months of 2019... GitHub said its analysis shows that developers have been resilient to the change wrought by COVID-19, with activity holding consistent or increasing through the crisis. But their analysis also found: - Developers are working longer, by "up to an hour per day," seven days a week. - Slightly more pushes, pull requests, reviewed pull requests, and commented issues. - More collaboration on open source projects, and less time to merge pull requests into open source projects.' -- source: https://news.slashdot.org/story/20/05/09/0158217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

3D Printed N95 Montana Mask Design Released Under GPLv3
by Peter Reutemann 10 May '20

10 May '20

'Since the COVID-19 pandemic has made Personal Protective Equipment worth it's weight in gold, Makers have been trying to help bridge the gap. While sewn masks have been the most common solution, the 3D printing community has been pitching in as well. The Montana Mask has been one of the most popular designs... Thursday, the group Make the Masks announced that the design files and STLs to print the mask have been released under the GNU General Public License v3, allowing anyone to print, sell, remix or improve the design, as long as they conform to the license. Importantly, the GPLv3 includes an international non-exclusive patent grant, meaning that even if the inventors decide to apply for a patent, it will not restrict anyone from using the design.' -- source: https://science.slashdot.org/story/20/05/09/1859238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Where Does Ad Money Go?
by Lawrence D'Oliveiro 08 May '20

08 May '20

The accounting firm PwC (does that still stand for “Price Waterhouse Coopers”?) has done a study <https://www.theregister.co.uk/2020/05/07/ad_tech_fees_sucked/> of the online ad market, to see where all the money is going. Turns out only about half the money spent by advertisers makes it all the way to the publishers, with the rest siphoned off by various intermediaries along the way (not all of them legitimate), and 15% could not be accounted for at all. Much of this trading is now done “programmatically”, between automated systems, rather than by direct agreements between humans. And these systems are more complex (i.e. “having more stages where a percentage cut can be taken”) than they need to be.

1 0

Inkscape Approaches Version 1.0
by Lawrence D'Oliveiro 08 May '20

08 May '20

Inkscape v1.0 is tentatively due to be released on May 1st. Here <https://www.theregister.co.uk/2020/04/14/16_years_inkscape_v1/> is a backgrounder on how development has been progressing. There seems to be this assumption that Apple users are important: Mac support is hugely important, thanks to the wide use of Macs in the artistic and designer community. while on the other hand, They know that macOS usage has been very small. The new version is using GTK+3, and the UI is more customizable than before. The command shell has also been improved. Finally: Is the open-source business model, or lack of it, holding back Inkscape? "We would advance much faster with even one or two full-time people," said Jeanmougin. "That has been some frustration because we only rely on donations. We get much less than what we would need to hire people."

1 2

MPA and Amazon Ask GitHub To Suspend Kodi Add-On Developer's Account
by Peter Reutemann 08 May '20

08 May '20

'The MPA, MPA-Canada, and Amazon have filed a request with Github requesting that a Kodi add-on developer's account be deleted from the platform. Citing a copyright case and a permanent injunction handed down by Canada's Federal Court, the content companies claim that the account is still being used to infringe their rights. Github has left the account intact, however. TorrentFreak reports: In February 2018, a developer known online as 'Blamo' (aka 'Mr. Blamo') revealed that he, in common with several of his counterparts, had been threatened by content companies. From there the trail went cold but according to a complaint filed against Github this week, legal action in Canada followed. On September 7, 2018, a dozen companies including the studios of the MPA/MPA-Canada plus Amazon and Netflix launched a copyright infringement lawsuit at Canada's Federal Court against an individual "doing business" as Mr. Blamo. "In the context of that action, our clients alleged that [Blamo] notably developed, hosted, promoted and distributed infringing add-ons for the Kodi media center, which provided unauthorized access to motion pictures and television content for which the copyright is owned by our clients," the MPA writes. According to Federal Court records, Blamo did not mount any kind of defense so as a result, the matter was decided in his absence. On January 15, 2019, the Federal Court handed down a final judgment, including a declaration of infringement and a permanent injunction. "The permanent injunction enjoins and restrains [Blamo] from, inter alia, hosting, distributing or promoting infringing Kodi add-ons and their repositories, including notably the 'Blamo' repository and the "Chocolate Salty Balls' infringing add-ons," the MPA adds. The problem here is that, according to the MPA and associated companies, Blamo has a Github account where it is claimed he continues to "host and distribute infringing Kodi add-ons and their repository, including notably the Chocolate Salty Balls infringing add-on and the Blamo repository." This, the MPA says, amounts to contempt of court. What's particularly interesting here, however, is that the MPA isn't asking for the specified URLs to be deleted. Instead, it asks for Blamo's entire Github account to be deactivated instead.' -- source: https://yro.slashdot.org/story/20/05/07/2018227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apple IOS XML Bug
by Lawrence D'Oliveiro 08 May '20

08 May '20

>From <https://www.schneier.com/blog/archives/2020/05/ios_xml_bug.html>: So Siguza's exploit -- which granted an app full access to the entire file system, and more - uses malformed XML comments constructed in a way that one of iOS's XML parsers sees its declaration of entitlements one way, and another XML parser sees it another way. The XML parser used to check whether an application should be allowed to launch doesn't see the fishy entitlements because it thinks they're inside a comment. The XML parser used to determine whether an already running application has permission to do things that require entitlements sees the fishy entitlements and grants permission. Further: Implementing 4 different parsers is just asking for trouble, and the "fix" is of the crappiest sort, bolting on more crap to check they're doing the right thing in this single case. None of this is encouraging. Conway’s Law comes to mind: “any piece of software reflects the organizational structure that produced it”. 3 different XML parsers sounds like 3 different groups working on those parts of the OS, while the addition of a fourth to block the hole suggests that nobody with any responsibility for security was able to get through to any of those groups to fix their parsing.

1 0

Microsoft's GitHub Account Allegedly Hacked, 500GB Stolen
by Peter Reutemann 08 May '20

08 May '20

'A hacker claims to have stolen over 500GB of data from Microsoft's private GitHub repositories, BleepingComputer reports. From the report: This evening, a hacker going by the name Shiny Hunters contacted BleepingComputer to tell us they had hacked into the Microsoft GitHub account, gaining full access to the software giant's 'Private' repositories. The individual told us that they then downloaded 500GB of private projects and initially planned on selling it, but has now decided to leak it for free. Based on the file stamps in the leaked files, the breach may have occurred on March 28th, 2020.' -- source: https://developers.slashdot.org/story/20/05/07/1850248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Google Authenticator's First Android Update in Years Lets You Move Your Account Between Devices
by Peter Reutemann 08 May '20

08 May '20

'Google Authenticator, the company's code-based authentication app, has received its first update in three years, updating the app's interface for larger screens with more modern aspect ratios and delivering one of the platform's most-needed features. From a report: The Android version was last updated on August 22nd, 2017, while the iOS one was updated around a year ago to adjust it for iPhone X screens. Now, for the first time, Authenticator users will be able to easily transfer their account from one device to another without needing to manually transfer each code or disable and reenable two-factor authentication (2FA) on each account. The update introduces this feature through an import / export tool that lets you choose which accounts to include and transfer using a single QR code scan. It's a feature that competitor Authy has provided for quite some time, so it's refreshing to see it come to Authenticator, even if it's years late.' -- source: https://tech.slashdot.org/story/20/05/07/1450227 Finally... Could have used that a while ago... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Caddy offers TLS, HTTPS, and more in one dependency-free Go Web server
by Peter Reutemann 07 May '20

07 May '20

'Yesterday, the Caddy Web server reached an important milestone, with its 2.0.0 release. Caddy bills itself as "The Ultimate Server," with no dependencies, automatic TLS certificate obtainment and renewal, and much smaller configuration files than Apache or Nginx. Senior Technology Editor Lee Hutchinson expressed both curiosity about Caddy and his own personal inertia in the Ars slack: Caddy is an app where every time i see it or think of it i say “I should mess with it, it looks neat” and then I never do. I’ve gotten so enmeshed in my haproxy - varnish - nginx stack that breaking out feels like more trouble than it’s worth. I hadn't ever heard of Caddy until Lee mentioned it, but I know a call to action when I hear one.' -- source: https://arstechnica.com/gadgets/2020/05/caddy-offers-tls-https-and-more-in-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Firefox 76 Arrives With Password Management and Zoom Improvements
by Peter Reutemann 06 May '20

06 May '20

'Mozilla today launched Firefox 76 for Windows, Mac, and Linux. Firefox 76 includes new Firefox Lockwise password functionality, Zoom improvements, and a handful of developer features. From a report: Lockwise, the password management service formerly known as Firefox Lockbox, is getting smarter. The Firefox feature already lets you generate, manage, and protect all those passwords for streaming services, grocery deliveries, and anything else that helps during the pandemic. If you share your device with family or roommates, Lockwise in Firefox 76 can now protect your saved passwords. When you try to view or copy a password from your "Logins and Passwords" page, you will be prompted for your device's account password. [...] Firefox 76 adds support for Audio Worklets, which run custom JavaScript audio processing code for applications like VR and gaming on the web. Unlike their predecessor, ScriptProcessorNode, worklets run off the main thread in a similar way to web workers. Mozilla also notes Audio Worklets are "being adopted by some of your favorite software programs." The company specifically called out Zoom, which has become a phenomenon of its own during the pandemic. In short, you now join Zoom calls in Firefox without having to download or install the Zoom client.' -- source: https://news.slashdot.org/story/20/05/05/160252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Xiaomi Releases Browser Update Amid Accusations It Collects Private Browsing Data
by Peter Reutemann 06 May '20

06 May '20

'Xiaomi released software updates for its browser apps on Monday amid fresh accusations it's been collecting private data from people who use its phones and browser apps. CNET reports: In a blog post, Xiaomi said the update will allow you to switch off aggregated data collection while on incognito mode in its three browser apps: Mi Browser, Mi Browser Pro, and Mint Browser. The software update was rolled out on Google Play. "We believe this functionality, in combination with our approach of maintaining aggregated data in non-identifiable form, goes beyond any legal requirements and demonstrates our company's commitment to user privacy," the company said in its post. The release of the software update comes after a Forbes report published last Thursday raised concerns about the Chinese phone-maker's use of private data. It suggested Xiaomi may be collecting data on the websites users visit as well as granular information about apps used and files opened on devices. In response to the report, Xiaomi defended its practices last week saying it's "fully compliant with user privacy protection laws and regulations in the countries and regions we operate in.' -- source: https://yro.slashdot.org/story/20/05/05/2013244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu 20.04: Welcome to the future, Linux LTS disciples
by Peter Reutemann 05 May '20

05 May '20

'This is most definitely the strangest spring in a very long time, with all sorts of event and hardware delays or outright cancellations. But one thing that has arrived right on schedule? The latest version of Ubuntu Linux. Ubuntu 20.04 (Focal Fossa, as this release is known) is a Long Term Support (LTS) release, which means Ubuntu's parent company, Canonical, will provide support through 2025. The LTS releases are what Canonical calls "enterprise grade," and these tend to be conservative when it comes to adopting new technologies. The interim releases, like last year's Ubuntu 19.10, are instead where the company tends to experiment. Perhaps not surprisingly, Canonical estimates that 95 percent of all Ubuntu installations are LTS releases. Which is to say, this is a big update that the bulk of Ubuntu's user base will be upgrading to eventually. The good news for Ubuntu fans is that 20.04 has been a fantastic release in our testing. This update has been very solid in day-to-day use, and it still manages to (optionally!) include support for some cutting-edge new features, like the beginnings of a tool to manage ZFS snapshots. There's also a major kernel bump, and considerable work has gone into improving and polishing the default Yaru theme. That's a running theme in Ubuntu, where much of what makes it great are small changes and new features that individually might not be remarkable but all together create a system that is fast, stable, and hard to beat. The security improvements offered this time around almost alone make Ubuntu 20.04 a must-have upgrade. But the Ubuntu 20.04 update has plenty of new stuff for all the various Ubuntu flavors as well. So even if the default GNOME desktop doesn't excite you, there's big news in Kubuntu, Lubuntu, Ubuntu Mate, and more. There's also some good news for Raspberry Pi users, who get first-class support for the Pi 4 platform out of the box (and when I say first class, I mean, frankly, better than the official Pi distro, Raspian).' -- source: https://arstechnica.com/information-technology/2020/05/ubuntu-20-04-welcome… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Academics Turn PC Power Units Into Speakers To Leak Secrets From Air-Gapped Systems
by Peter Reutemann 05 May '20

05 May '20

'Academics from an Israeli university have published new research last week showing how an attacker could turn a computer's power supply unit into a rudimentary speaker that can secretly transmit data from an infected host using audio waves. From a report: The technique, named POWER-SUPPLaY, is the work of Mordechai Guri, the head of R&D at the Ben-Gurion University of the Negev, in Israel. Over the last half-decade, Guri has been pioneering research into new covert data exfiltration channels. The techniques Guri has been developing can be used for stealing data through unconventional means. Guri has been developing these techniques specifically for extracting data from air-gapped systems -- computers isolated on local networks with no internet access. Such computers are often used on government or corporate networks to store sensitive data, such as classified files or intellectual property. Air-gapped systems are protected by several layers of defenses, on top of the "air gap," and you need novel data transmission techniques to go around these defenses. For example, some air-gapped systems don't have speakers, because it's been proven in the past that speakers could be abused to leak information from a secure system using inaudible sound waves.' -- source: https://it.slashdot.org/story/20/05/04/176208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Purged Almost 1,000 Abusive 'Creeperware' Apps. Now Some Are Coming Back.
by Peter Reutemann 05 May '20

05 May '20

'In June 2019, a group of cybersecurity researchers notified Google of more than 1,000 potentially malicious apps on the company's Play Store that can be used to surveil, monitor, and harass users. Their findings, which have not previously been reported, eventually led to one of the largest ever mass removals of Android apps. Less than a year later, there are signs that the "creeperware," as the researchers called it, is returning. From a report: The label comprises a broad category of abusable apps, including tools for spying, spoofing phone numbers, and secretly recording video and audio. Some of those programs banned by Google have now rebranded or added disclaimers and returned to the Play Store. Meanwhile, new programs with overtly abusive purposes have slipped through the company's automated monitoring systems. The initial 1,095 apps flagged by researchers came in a variety of forms. Catch Cheating Spouse and its ilk offered stalkerware packages: Once installed on a victim's phone, the user could track the device's location, read messages, listen to calls, remotely record through the microphone, or log passwords. Many of the programs had innocuous names but hostile purposes. Spoof Text Message, for example, advertised itself with a video using the tagline "Don't like your buddy's girlfriend? Well, break them up!" Others, like GirlFriend Cell Tracker, were more explicit in their motivation. "When we reported these apps to Google initially, it felt like they didn't really know what to do with them," said Kevin Roundy, the technical director of NortonLifeLock's research group, and one of the lead members of the team that uncovered the malicious apps last June.' -- source: https://tech.slashdot.org/story/20/05/04/1528219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers Breach LineageOS Servers Via Unpatched Vulnerability
by Peter Reutemann 05 May '20

05 May '20

'Hackers have gained access to the core infrastructure of LineageOS, a mobile operating system based on Android, used for smartphones, tablets, and set-top boxes. The intrusion took place on Saturday night at around 8 pm (US Pacific coast), and was detected before the attackers could do any harm, the LineageOS team said in a statement published less than three hours after the incident. The LineageOS team said the operating system's source code was unaffected, and so were any operating system builds, which had been already paused since April 30, because of an unrelated issue. Signing keys, used to authenticate official OS distributions, were also unaffected, as these hosts were stored separately from the LineageOS main infrastructure. LineageOS developers said the hack took place after the attacker used an unpatched vulnerability to breach its Salt installation.' -- source: https://it.slashdot.org/story/20/05/04/0341202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

What Keeps Developers Happy? Contributing to Open Source
by Peter Reutemann 04 May '20

04 May '20

'This week long-time open source advocate Matt Asay warned employers that the best way to keep their developers happy was to let them contribute to open source projects: SlashData recently surveyed over 16,000 developers to see what makes them tick... what they care about. The data is collected in SlashData's State of the Developer Nation, though let me give you the tl;dr: 59% of developers contribute to open source software today. Why do they contribute? The top two reasons are: To improve coding skills and because they believe in open source. Want to keep those developers happy and employed with you? Let them contribute... [Y]our employees want to contribute both code and knowledge — they want to be part of something. Talking to Bert Hubert, founder of PowerDNS, a supplier of open source DNS software, services, and support, he stressed that an open source project must be "a fun place where people feel that they are learning things, that they're contributing things, that they're being valued." Perhaps not surprisingly, these are the same elements developers expect from their employers. By making open source a valued part of workplace expectations, employers tick both boxes. Is it an absolute requirement that you encourage your developers to contribute to open source projects? No. But many of your best developers will chafe at keeping their talents locked up behind the firewall, and other developers simply won't apply if you have a reputation for being an open source scrooge. The article was written by Matt Asay, a former COO of Canonical now working at AWS. (Right before becoming Canonical's COO, Matt answered questions from Slashdot readers). The survey he cites also found that out of 17,000 developers they talked to, just 3% said they were paid to contribute to open source. The other 97% contributed for free.' -- source: https://news.slashdot.org/story/20/05/03/1746244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Copyleft and the Cloud: Where Do We Go From Here?
by Peter Reutemann 04 May '20

04 May '20

'Free software evangelist Jeremy Allison - Sam (Slashdot reader #8,157) is a co-creator on the Samba project, a re-implementation of SMB/CIFS networking protocol, and he also works in Google's Open Source Programs Office. Now he shares his presentation at the Software Freedom Conservancy's "International Copyleft Conference." He writes: The Samba project has traditionally been one of the strongest proponents of Copyleft licensing and Free Software. However, in the Corporate Cloud-first world we find ourselves, traditional enforcement mechanisms have not been effective. How do we achieve the goals of the Free Software movement in this new world and how do we need to change what we're doing to be successful ? Traditional license enforcement doesn't seem to work well in the Cloud and for the modern software environment we find ourselves. In order to achieve the world of Free Software available for all I think we need to change our approach. Both GPLv3 and the AGPL have been rejected soundly by most developers. I would argue that we need a new way to inspire developers to adopt Free Software goals and principles, as depending on licensing has failed as licensing itself has fractured. Communication and collaboration are key to this. Stand-alone software is essentially useless. Software interoperability and published protocol and communication definitions are essential to build a freedom valuing software industry for the future The talk's title? "Copyleft and the Cloud: Where do we go from here?"' -- source: https://news.slashdot.org/story/20/05/02/180237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google's reCAPTCHA Is Being Used To Hide Phishing Pages
by Peter Reutemann 04 May '20

04 May '20

'New research from Barracuda Networks has revealed that cyber-criminals are increasingly using official reCAPTCHA walls to disguise malicious content from email security systems and trick unsuspecting users... [S]ophisticated scammers are beginning to use the Google-owned service to prevent automated URL analysis systems from accessing the actual content of phishing pages, and to make phishing sites more believable in the eyes of the victim, Barracuda Networks warned. In fact, the security solutions provider observed a single phishing campaign that sent out 128,000 emails to a variety of organizations and employees using reCAPTCHA walls to conceal fake Microsoft log-in pages. This campaign used the lure of a voicemail receipt to fool users into solving the reCAPTCHA wall before being redirected to the malicious page, with any log-in info entered then sent straight to the scammers.' -- source: https://tech.slashdot.org/story/20/05/03/1613229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Join me in taking action
by Roderick Aldridge 01 May '20

01 May '20

I just took part in an Electronic Frontier Foundation campaign titled "Help Stop the Sale of Public Interest Registry to a Private Equity Firm". Will you join me? Take action here: https://act.eff.org/action/help-stop-the-sale-of-public-interest-registry-t… In case you haven't seen this. I expect a lot of FOSS people and organisations are at risk. Roderick

5 6

ISP
by john 01 May '20

01 May '20

Hi All, I am convinced that my ISP has reduced the throttle on my UFB. They wrote and told me that due to the virus I was to get unlimited use (I had nearly 2TB of rollover) I used to think it a lucky day if I got 1.5MB but recently speeds over up to 3 MB are common. Cheers John

2 1

Xiaomi Found Recording 'Private' Web and Phone Use, Researchers Claim
by Peter Reutemann 01 May '20

01 May '20

'According to an exclusive report from Forbes, cybersecurity researcher Gabi Cirlig discovered that his Xiaomi Redmi Note 8 smartphone was watching much of what he was doing and sending that data to remote servers hosted by Chinese tech giant Alibaba, which were ostensibly rented by Xiaomi. From the report: The seasoned cybersecurity researcher found a worrying amount of his behavior was being tracked, whilst various kinds of device data were also being harvested, leaving Cirlig spooked that his identity and his private life was being exposed to the Chinese company. When he looked around the Web on the device's default Xiaomi browser, it recorded all the websites he visited, including search engine queries whether with Google or the privacy-focused DuckDuckGo, and every item viewed on a news feed feature of the Xiaomi software. That tracking appeared to be happening even if he used the supposedly private "incognito" mode. The device was also recording what folders he opened and to which screens he swiped, including the status bar and the settings page. All of the data was being packaged up and sent to remote servers in Singapore and Russia, though the Web domains they hosted were registered in Beijing. Meanwhile, at Forbes' request, cybersecurity researcher Andrew Tierney investigated further. He also found browsers shipped by Xiaomi on Google Play -- Mi Browser Pro and the Mint Browser -- were collecting the same data. Together, they have more than 15 million downloads, according to Google Play statistics. Cirlig thinks that the problems affect many more models than the one he tested. In response to the findings, Xiaomi said, "The research claims are untrue," and "Privacy and security is of top concern," adding that it "strictly follows and is fully compliant with local laws and regulations on user data privacy matters." A spokesperson did however confirm it was collecting browsing data, claiming the info was anonymized and users had consented to it. Cirlig and Tierney pointed out that Xiaomi "was also collecting data about the phone, including unique numbers for identifying the specific device and Android version," reports Forbes. "Cirlig said such 'metadata' could 'easily be correlated with an actual human behind the screen.'" The researchers also say they found their Xiaomi apps to be sending data to domains that appeared to reference Sensor Analytics, which Xiaomi says "provides a data analysis solution for Xiaomi," adding that that the collected anonymous data "are stored on Xiaomi's own servers and will not be shared with Sensor Analytics, or any other third-party companies."' -- source: https://yro.slashdot.org/story/20/04/30/237249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Virtualization on the Linux desktop—Gnome Boxes vs virt-manager
by Peter Reutemann 01 May '20

01 May '20

'In the comments of our recent GhostBSD review, reader Enduzzer casually mentioned trying out the distribution in a Gnome Boxes VM. Linux's Kernel Virtual Machine has been a mainstay of my own system administration for more than a decade—but I use virt-manager, an excellent and deeply sysadmin-ish graphical management interface. I generally describe virt-manager as "simple"—and in many ways it's much simpler than Boxes is—but there are different ways to interpret simplicity.' -- source: https://arstechnica.com/gadgets/2020/04/virtualization-on-the-linux-desktop… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Distro Showdown May
by tom butz 01 May '20

01 May '20

I have just checked microphone/camera on my Toshiba laptop running Mint 19.3: they're both ok for a remote meeting. What I could do is talk about the various Linuxes I have used, starting witn Tiny Linux, then Arch-Linux, then OpenBSD, then FreeBSD and finally Mint as well as Ubuntu14 as well as Sparky Linux. Maybe also a bit about my trials with GhostBSD. Why am I using more than 1? Mint 19.3 is the workhorse, Sparky does movies using conventional openshot as well as avidemux and Ubuntu 14 supports USB-tethering out of the box. USB-tethering is way faster than the alternatives and also very secure (as long as no-one nicks your phone). Tom Butz.

2 1

Google Play has been spreading advanced Android malware for years
by Peter Reutemann 01 May '20

01 May '20

'Hackers have been using Google Play for years to distribute an unusually advanced backdoor capable of stealing a wide range of sensitive data, researchers said on Tuesday. Researchers from security firm Kaspersky Lab have recovered at least eight Google Play apps that date back to 2018, a Kaspersky Lab representative said, but based on archive searches and other methods, the researchers believe malicious apps from the same advanced group seeded Google’s official market since at least 2016. Google removed recent versions of the malware shortly after the researchers from Kaspersky, and earlier fellow security firm Dr. Web, reported them. Apps from earlier were already removed, and it’s not clear what prompted the move. Third-party markets have also hosted the backdoored apps, and many of them remain available. Command-and-control domains were registered as early as 2015, raising the possibility the operation goes back earlier than 2016. Code in the malware and command servers it connects to contain several overlaps with a known hacking group dubbed OceanLotus (aka APT32, APT-C-00, and SeaLotus), leading researchers to believe the apps are the work of that advanced group.' -- source: https://arstechnica.com/information-technology/2020/04/sophisticated-androi… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fairphone 3 Now Available With 'de-Googled' Android /e/OS
by Peter Reutemann 01 May '20

01 May '20

'Fairphone, the European manufacturer of mobile phones with a reduced environmental impact, has announced a partnership to offer /e/OS, the most "de-Googled" and pro-privacy Android OS, on their latest model Fairphone 3. An interesting move that reminds me of the recent introduction of the Google-free Huawei Mate 30. A pithy explainer of its "privacy by design ecosystem" -- and the point of "Android without Google" -- further notes: "We have removed many pieces of code that send your personal data to remote servers without your consent. We don't scan your data in your phone or in your cloud space, and we don't track your location a hundred times a day or collect what you're doing with your apps." According to TechCrunch, the e/OS variant of the Firephone 3 ships from May 6, priced at just under 480 euros -- "a 30 euro premium on the Googley flavor of Android you get on the standard Fairphone 3." The report adds that existing owners of the Fairphone 3 can manually install /e/OS gratis via an installer on its website.' -- source: https://mobile.slashdot.org/story/20/04/29/2131230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi Gains a New 12.3-Megapixel Camera and Interchangeable Lenses
by Peter Reutemann 01 May '20

01 May '20

'The Raspberry Pi can be used for all sorts of maker projects, and the foundation has offered camera modules for it since 2013, adding vision-related functionality. The first module was a modest 5-megapixel affair that was eventually replaced by an 8-megapixel Sony sensor four years ago. Today, sees the arrival of a new much higher 12.3 megapixel quality camera, and a range of interchangeable lenses. >From a report: The new camera is compatible with all Raspberry Pi models -- from Pi 1 Model B onwards -- with the exception of early Pi Zero boards. The camera is available to buy from today for $50.' -- source: https://tech.slashdot.org/story/20/04/30/1554232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Predictive Text Patent Troll Tries To Shake Down Wikipedia
by Peter Reutemann 30 Apr '20

30 Apr '20

'WordLogic (patent troll) claims it has the rights of the concept of predictive text writing and went after the Wikimedia foundation. WordLogic offered a "discounted, lump sum fee of $30,000 in exchange for a paid-up one-time license," an easy win they thought, but Wikimedia fought back. "Wikimedia notes that (1) WordLogic's patents are invalid due to prior art, (2) that they are invalid for not covering patentable subject matter, and (3) that anyway, it doesn't even infringe on the patents if they were valid," reports Techdirt. Now we are waiting to see what will happen. Will the patent troll desist, or will it push forward?' -- source: https://news.slashdot.org/story/20/04/29/216210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Data Hoarders
by Lawrence D'Oliveiro 30 Apr '20

30 Apr '20

Turns out there’s a whole Reddit subforum devoted to the subject of digital data hoarding. And of course the activity has a long history, from well before the era of digital electronic computers <https://arstechnica.com/gaming/2020/04/digital-hoarders-our-terabytes-are-p…>.

1 4

A bit of light relief!!
by john 30 Apr '20

30 Apr '20

A plain computer illiterate guy rings tech support to report that his computer is faulty. Tech: What’s the problem? User: There is smoke coming out of the power supply. Tech: (keep quite) Tech: You’ll need a new power supply. User: No, I don’t! I just need to change the startup files. Tech: Sir, the power supply is faulty. You’ll need to replace it. User: No way! Someone told me that I just needed to change the startup and it will fix the problem! All I need is for you to tell me the command. Tech support:: 10 minutes later, the User is still adamant that he is right. The tech is frustrated and fed up. Tech support:: (hush hush) Tech: Sorry, Sir. We don’t normally tell our customers this, but there is an undocumented DOS command that will fix the problem. User: I knew it! Tech : Just add the line LOAD NOSMOKE.COM at the end of the CONFIG.SYS. Let me know how it goes. 10 minutes later. User : It didn’t work. The power supply is still smoking. Tech : Well, what version of DOS are you using? User : MS-DOS 6.22 . Tech : That’s your problem there. That version of DOS didn’t come with NOSMOKE. Contact Microsoft and ask them for a patch that will give you the file. Let me know how it goes. 1 hour later. User : I need a new power supply. Tech support : How did you come to that conclusion? Tech support : (hush hush) User : Well, I rang Microsoft and told him about what you said, and he started asking questions about the make of power supply. Tech: Then what did he say? User: He told me that my power supply isn’t compatible with NOSMOKE. Cheers John..

1 0

OS Vulnerabilities
by Lawrence D'Oliveiro 29 Apr '20

29 Apr '20

While fixes for security bugs on the Linux platform usually come out quickly, there do seem to be a lot of laggards in deploying them <https://www.theregister.co.uk/2020/04/28/vulnerabilities_report_9_million/>. Why is this? The researchers speculate that "Windows admins are more accustomed to regular reboots after decades of conditioning," while "tooling for managing Linux fleets at scale generally lags behind that of Windows." Also perhaps the Linux installations include a lot of embedded/IoT devices that never get manufacturer updates.

1 0

Alternatives To The OOM Killer
by Lawrence D'Oliveiro 29 Apr '20

29 Apr '20

By default, if a process asks for more (virtual) memory, the Linux kernel never says no. (It can be easily configured to do so, if you want.) Therefore, it is possible for a process to try to access more memory than the system has available. This situation triggers the dreaded “OOM Killer” <https://lwn.net/Articles/317814/>, which hunts around for resource-hogging processes and kills them according to a priority scheme that nobody quite understands. To avoid things getting this bad, various people have come up with alternatives in the form of userspace daemons that monitor system resource usage, and implement their own (configurable) rules for killing processes before things get dire enough to wake up the OOM Killer. The announcement of Fedora 32 mentions <https://www.theregister.co.uk/2020/04/28/red_hat_summit/> the inclusion of one of these solutions, “EarlyOOM”. Looking at the project’s <https://github.com/rfjakob/earlyoom> readme page shows mention of two others: “nohang” (written in Python) and “oomd” (from Facebook). I see all three available as standard Debian packages, at least as of Debian Unstable.

1 0

One Space Or Two?
by Lawrence D'Oliveiro 29 Apr '20

29 Apr '20

>From the “Yet Another Subject For A Holy War” Department, Microsoft is planning for the next update to Word to flag two spaces after a full stop and before the next sentence as a typo <https://www.theregister.co.uk/2020/04/27/microsoft_roundup/>. Two spaces after a full stop was long-standing practice for typewritten text, and carried over to some extent to computer users. But with the advent of WYSIWYG word processing and proportional fonts, it became more common to adopt the practice of typeset text, and only put one space after a full stop, before the next sentence. Where do you stand? Microsoft ran a poll on the question, and it seems the majority favoured a single space.

3 3

Lenovo is joining Dell in the “OEM Linux Laptop” club
by Peter Reutemann 28 Apr '20

28 Apr '20

'It looks like Lenovo may upstage Dell as the big name in OEM Linux laptops—not counting specialty retailers like System76, of course. Red Hat and Lenovo are announcing pre-installed and factory-supported Fedora Workstation on several models of ThinkPad laptops at Red Hat Summit this week. Dell's Linux support has generally been limited to one or two very specific laptops—first, the old Atom-powered netbooks and, more recently, the XPS 13 Developer Edition line. Lenovo is planning a significantly broader Linux footprint in its lineup. Fedora Workstation will be a selectable option during purchase for the Thinkpad P1 Gen2, Thinkpad P53, and Thinkpad X1 Gen8 laptops—and Lenovo may offer even broader model support in the future. Lenovo Senior Linux Developer Mark Pearson, who will be the featured guest in the May 2020 Fedora Council Video Meeting, expresses the company's stance on forthcoming integration: "Lenovo is excited to become a part of the Fedora community. We want to ensure an optimal Linux experience on our products. We are committed to working with and learning from the open source community."' -- source: https://arstechnica.com/gadgets/2020/04/lenovo-is-joining-dell-in-the-oem-l… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers Are Exploiting a Sophos Firewall Zero-day
by Peter Reutemann 28 Apr '20

28 Apr '20

'Cyber-security firm Sophos has published an emergency security update to patch a zero-day vulnerability in its XG enterprise firewall product that was being abused in the wild by hackers. From a report: Sophos said it first learned of the zero-day on late Wednesday, April 22, after it received a report from one of its customers. The customer reported seeing "a suspicious field value visible in the management interface." After investigating the report, Sophos determined this was an active attack and not an error in its product. "The attack used a previously unknown SQL injection vulnerability to gain access to exposed XG devices," Sophos said in a security advisory today. Hackers targeted Sophos XG Firewall devices that had their administration (HTTPS service) or the User Portal control panel exposed on the internet. Sophos said the hackers used the SQL injection vulnerability to download a payload on the device. This payload then stole files from the XG Firewall.' -- source: https://tech.slashdot.org/story/20/04/27/162211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New CPU Performance Testing Concludes AMD Beats Intel
by Peter Reutemann 27 Apr '20

27 Apr '20

'If you're looking for the best gaming CPU or the best CPU for desktop applications, there are only two choices to pick from: AMD and Intel. That fact has spawned an almost religious following for both camps, and the resulting flamewars, that make it tricky to get unbiased advice about the best choice for your next processor. But in many cases, the answer is actually very clear. In fact, for most users, it's a blowout win in AMD's favor. That's an amazing reversal of fortunes for the chipmaker after it teetered on the edge of bankruptcy a mere three years ago, making its turnaround all the more impressive as it continues to upset the entrenched Intel that enjoyed a decade of dominance... Pricing is the most important consideration for almost everyone, and AMD is hard to beat in the value department. The company offers a plethora of advantages, like bundled coolers and full overclockability on all models, not to mention complimentary software that includes the innovative Precision Boost Overdrive auto-overclocking feature. You also benefit from the broad compatibility of Socket AM4 motherboards that support both forward and backward compatibility, ensuring that not only do you get the most bang for your processor buck, but also your motherboard investment. AMD also allows overclocking on all but its A-Series motherboards (see our article on how to overclock AMD Ryzen), which is another boon for users. And, in this battle of AMD vs Intel CPUs, we haven't even discussed the actual silicon yet. AMD's modern processors tend to offer either more cores or threads and faster PCIe 4.0 connectivity at every single price point. "We're not covering laptop or server chips," the article notes, adding "There's a clear winner overall, but which brand of CPU you should buy depends most on what kind of features, price and performance are important to you." Still, it's noteworthy that AMD beats Intel in 7 out of 10 comparisons. The three in which Intel won were gaming performance ("only because we measure strictly by the absolute top performance possible"), drivers and software ("the company has an army of software developers [and] a decade of dominance also finds most software developers optimizing almost exclusively for Intel architectures"), and overclocking, where Intel "has far more headroom and much higher attainable frequencies. "Just be prepared to pay for the privilege."' -- source: https://slashdot.org/story/20/04/26/1622236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

distro showdown for virtual meeting in May?
by Peter Reutemann 26 Apr '20

26 Apr '20

Hi everyone What about a distro showdown for our (virtual) WLUG meeting in May? For instance: - GhostBSD - Ubuntu 20.04 - Manjaro - Arch - Gentoo - ... People can just demo a single distro for a few minutes via BigBlueButton (you can share your screen real easy with BBB). Thoughts? Volunteers? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Virtual meetings?
by Peter Reutemann 24 Apr '20

24 Apr '20

Hi everyone Our last meeting moved to virtual Google Hangout on short notice, which probably explained the low turnout. My question is, whether speakers and attendees would be willing to move to virtual ones, to keep our little community together and going? The last meeting was done with Google Hangouts, as it allows sharing the screen as well. Doesn't have to be Hangouts, it was simply convenient as a lot of people have gmail accounts. Open to viable alternatives. Stay safe! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

4 7

Why You Need A Bigger OS Partition
by Lawrence D'Oliveiro 24 Apr '20

24 Apr '20

root(a)theon:~ # apt-get install games-all Reading package lists... Done Building dependency tree Reading state information... Done The following additional packages will be installed: 0ad 0ad-data 0ad-data-common 7kaa 7kaa-data a7xpg a7xpg-data abe abe-data ace-of-penguins alex4 alex4-data armagetronad armagetronad-common asc asc-data asc-music atomix atomix-data bastet beep berusky berusky-data biniax2 biniax2-data blobby blobby-data bloboats blobwars blobwars-data blockattack bsdgames btanks btanks-data burgerspace bzflag-client bzflag-data caveexpress caveexpress-data cgoban chromium-bsu chromium-bsu-data cultivation darkplaces dreamchess dreamchess-data empire enigma enigma-data enigma-doc epiphany epiphany-data extremetuxracer extremetuxracer-data famfamfam-flag-png flare-engine flare-game flightgear flightgear-data-ai flightgear-data-all flightgear-data-base flightgear-data-models flightgear-phi ... ufoai-sound ufoai-textures unknown-horizons warmux warmux-data warzone2100 warzone2100-data warzone2100-music wesnoth wesnoth-1.14 wesnoth-1.14-aoi wesnoth-1.14-core wesnoth-1.14-data wesnoth-1.14-did wesnoth-1.14-dm wesnoth-1.14-dw wesnoth-1.14-ei wesnoth-1.14-httt wesnoth-1.14-l wesnoth-1.14-low wesnoth-1.14-music wesnoth-1.14-nr wesnoth-1.14-sof wesnoth-1.14-sota wesnoth-1.14-sotbe wesnoth-1.14-thot wesnoth-1.14-trow wesnoth-1.14-tsg wesnoth-1.14-ttb wesnoth-1.14-utbs widelands widelands-data xmoto xmoto-data Suggested packages: 7kaa-music bzflag-server freeciv-client-extras freeciv-sound-standard fretsonfire-game games-adventure games-arcade games-board games-c++-dev games-card games-chess games-console games-content-dev games-education games-emulator games-fps games-java-dev games-minesweeper games-mud games-perl-dev games-platform games-programming games-puzzle games-python3-dev games-racing games-rogue games-rpg games-shootemup games-simulation games-sport games-strategy games-tetris games-toys games-typing libopenal0a libsimage-dev libbullet2 libjs-jquery-flot-docs libjs-angularjs libswt-gtk-4-java minissdpd mumble minetest-mod-moreblocks minetest-mod-moreores minetest-mod-pipeworks minetest-server minetestmapper xqf openttd-opensfx pioneers-metaserver freecell-solver-bin pysolfc-cardsets python3-pil.imagetk-dbg python-pygame-doc spring-javaai teeworlds-server ufoai-server ufoai-uforadiant Recommended packages: fretsonfire The following NEW packages will be installed: ... 0 upgraded, 327 newly installed, 0 to remove and 86 not upgraded. Need to get 9,962 MB of archives. After this operation, 14.7 GB of additional disk space will be used. Do you want to continue? [Y/n] Time was when 30-40GB was sufficient for an OS partition. But not any more. This is why, when I upgraded my boot drive a few weeks ago, I allocated 100GB for the OS.

1 0

When in Doubt: Hang Up, Look Up, and Call Back
by Peter Reutemann 24 Apr '20

24 Apr '20

'Many security-conscious people probably think they'd never fall for a phone-based phishing scam. But if your response to such a scam involves anything other than hanging up and calling back the entity that claims to be calling, you may be in for a rude awakening. Brian Krebs: Here's how one security and tech-savvy reader got taken for more than $10,000 in an elaborate, weeks-long ruse. Today's lesson in how not to get scammed comes from "Mitch," the pseudonym I picked for a reader in California who shared his harrowing tale on condition of anonymity. Mitch is a veteran of the tech industry -- having worked in security for several years at a fairly major cloud-based service -- so he's understandably embarrassed that he got taken in by this confidence scheme. On Friday, April 17, Mitch received a call from what he thought was his financial institution, warning him that fraud had been detected on his account. Mitch said the caller ID for that incoming call displayed the same phone number that was printed on the back of his debit card. But Mitch knew enough of scams to understand that fraudsters can and often do spoof phone numbers. So while still on the phone with the caller, he quickly logged into his account and saw that there were indeed multiple unauthorized transactions going back several weeks. Most were relatively small charges -- under $100 apiece -- but there were also two very recent $800 ATM withdrawals from cash machines in Florida. If the caller had been a fraudster, he reasoned at the time, they would have asked for personal information. But the nice lady on the phone didn't ask Mitch for any personal details. Instead, she calmly assured him the bank would reverse the fraudulent charges and said they'd be sending him a new debit card via express mail. After making sure the representative knew which transactions were not his, Mitch thanked the woman for notifying him, and hung up. The following day, Mitch received another call about suspected fraud on his bank account. Something about that conversation didn't seem right, and so Mitch decided to use another phone to place a call to his bank's customer service department -- while keeping the first caller on hold. "When the representative finally answered my call, I asked them to confirm that I was on the phone with them on the other line in the call they initiated toward me, and so the rep somehow checked and saw that there was another active call with Mitch," he said. "But as it turned out, that other call was the attackers also talking to my bank pretending to be me."' -- source: https://it.slashdot.org/story/20/04/23/1933254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

NordVPN Unveils First Mainstream WireGuard Virtual Private Network
by Peter Reutemann 23 Apr '20

23 Apr '20

'One of the largest VPN companies, NordVPN, is rolling out NordLynx -- it's first mainstream WireGuard virtual private network for its Windows, Mac, Android and iOS client-software applications. ZDNet reports: NordVPN's own tests have shown NordLynx easily outperforms the other protocols, IKEv2/IPsec and OpenVPN. How much faster? According to NordVPN's 256,886 speed tests, "When a user connects to a nearby VPN server and downloads content that's served from a content delivery network (CDN) within a few thousand miles/kilometers, they can expect up to twice higher download and upload speed." While speed is what customers will notice, security experts like WireGuard for its code's simplicity. With only about 4,000 lines of code, WireGuard's code can be comprehensively reviewed by a single individual. Besides WireGuard, NordVPN adds in its double Network Address Translation (NAT) system to protect users' privacy. This enables users to establish a secure VPN connection while storing no identifiable user data on a server. You're assigned a dynamic local IP address that remains assigned only while the session is active. User authentication is done with the help of a secure external database. To switch to NordLynx, users need to update their NordVPN app to the latest version. The NordLynx protocol can be chosen manually from the Settings menu. ' -- source: https://tech.slashdot.org/story/20/04/22/2029227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

From The “Too Much Time On Their Hands” Department ...
by Lawrence D'Oliveiro 23 Apr '20

23 Apr '20

... comes this pure-CSS recreation <https://www.theregister.co.uk/2020/04/22/windows_98_css/> of the “Windows-98” look for your web pages. Personally, I can relate to this comment of the author: “Buttons just don't look like buttons anymore, it's so sad”. Basically, UI experts nowadays seem to be concentrating more on fashion, and the whole concept of “usability testing” has gone out the window.

1 0

Stripe Is Silently Recording Your Movements On Its Customers' Websites
by Peter Reutemann 23 Apr '20

23 Apr '20

'Michael Lynch, blogger and former software engineer at Microsoft and Google, discovered that the payment processing platform Stripe and its official JavaScript library records all browsing activity on its customers' websites and reports it back to the company. Lynch says this data includes the following: 1. Every URL the user visits on my site, including pages that never display Stripe payment forms 2. Telemetry about how the user moves their mouse cursor while browsing my site 3. Unique identifiers that allow Stripe to correlate visitors to my site against other sites that accept payment via Stripe In his blog post, Lynch shares what he found, who else it affects, and how you can limit Stripe's data collection in your web applications. Here's how he says he made the discovery: I discovered this by accident while adding paid plans to my portfolio rebalancer. As part of development, I was using an HTTP proxy that allows me to inspect HTTP traffic from my browser. After successfully implementing my app's payment flow with Stripe, I noticed that every page navigation generated a new HTTP POST request to a Stripe URL. This was strange because none of the pages I visited contained any calls to Stripe's library. In fact, my app doesn't collect payment information from users until they create an account, but Stripe was making HTTP requests when I landed on my app's homepage as a brand new user with no cookies or stored credentials. "I looked around for an official disclosure from Stripe about this behavior, but I couldn't find anything," adds Lynch. "The closest I found is this vague paragraph on their npm package description, which the Stripe support rep quoted to me: 'To best leverage Stripe's advanced fraud functionality, ensure that Stripe.js is loaded on every page, not just your checkout page. This allows Stripe to detect anomalous behavior that may be indicative of fraud as customers browse your website.'" "The privacy policy is a bit more specific about the data they collect, but it implies that they're collecting this data on stripe.com rather than on customer sites," writes Lynch. "Worryingly, the privacy policy also includes loose wording that allows Stripe to sell this data to advertisers: 'When you visit our Sites or online services, both we and certain third parties collect information about your online activities over time and across different sites to provide you with advertising about products and services tailored to your individual interests.'"' -- source: https://yro.slashdot.org/story/20/04/22/0023222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Vivaldi Browser Gets Built-in Tracking Blocker, Goes GA on Android
by Peter Reutemann 23 Apr '20

23 Apr '20

'Vivaldi, the browser launched by former Opera CEO Jon von Tetzchner, has long positioned itself as a highly customizable alternative to Chrome and Firefox for power users. Today, the team is launching version 3.0 of its desktop browser, with built-in tracker and ad blockers, and it's bringing its Android browser out of beta. From a report: I've long been a fan of Vivaldi, but the company was relatively late to the tracking protection game. Now it's doubling down by integrating a blocklist powered by DuckDuckGo's Tracker Radar. Like competing browsers, Vivaldi offers three blocking levels that users can easily toggle on and off for individual websites. Those blocking levels are relatively blunt, though, with the options to either block trackers, block trackers and ads, or disable blocking. Competitors like Edge offer slightly more nuanced options for blocking trackers, though I would expect Vivaldi to adopt a similar scheme over time.' -- source: https://slashdot.org/story/20/04/22/1550251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Edge TV Now Online-Only
by Lawrence D'Oliveiro 22 Apr '20

22 Apr '20

If there is anybody else besides me who wondered what happened to Edge TV, as of the beginning of this month it is no longer on Freeview, it can now only be viewed as an online stream <https://www.stuff.co.nz/entertainment/tv-radio/113928839/the-edge-tv-remove…>. In the last few days of June, there was a promo announcing that it was going HD, but I don’t recall it mentioning that it was leaving the broadcast airwaves. Quote: MediaWorks chief executive Michael Anderson says the move is in line with audience trends, which show people primarily consume music videos online. While that may be mostly true, personally I would go look for videos on YouTube after seeing them first on Edge TV.

6 12

Discord Switching From Go To Rust
by Lawrence D'Oliveiro 22 Apr '20

22 Apr '20

Came across this blog post <https://blog.discordapp.com/why-discord-is-switching-from-go-to-rust-a190bb…> explaining why Discord, which has been using Google’s Go language to implement its services, has now decided to rewrite them in Mozilla’s Rust. The problem was garbage collection. Go has a similar memory-allocation model to Java or LISP, where you can create objects and simply forget about them when you don’t need them any more, and a background process will automatically reclaim the storage at some point. The trouble is, that reclamation process (the “garbage collector”) tends to be the source of performance bottlenecks in the system. Not to mention that the memory usage of your program can grow to fill all available space, unless you impose arbitrary limits on it. Languages like Perl and Python use a hybrid model, where objects have reference counts attached to them, keeping track of how many other objects or variables still point to them, so they can be automatically freed when the count goes to zero. There are cases where this isn’t enough, and in those cases a full garbage-collection process kicks in. One benefit that I certainly observe with this is that memory usage for a program can remain reasonable, even after it has been running for a long time. Rust avoids the whole issue in a clever way, by having the compiler enforce memory-ownership restrictions in the language itself, so memory can be correctly allocated and freed without resorting to a garbage collector. The result is that Rust can achieve significantly higher performance than Go, while avoiding most of the attendant risks of dumping the whole responsibility for memory management on the programmer, as is done in languages like C++ and C.

1 1

Google Wants To Phase Out Browser User-Agent Strings
by Lawrence D'Oliveiro 21 Apr '20

21 Apr '20

Google wants to reduce the large amount of information browsers typically pack into the “User-Agent” header lines they send out, but this has been delayed for now <https://www.theregister.co.uk/2020/04/20/google_useragent_string_revision/>. This makes sense. Sites should not be changing their behaviour based on how browsers identify themselves, but on what functionality they actually support. But I wonder what this will mean for sites that routinely block the default user agents for scripting tools like wget and Python’s urllib ... But who is objecting to Google’s plan? Advertisers, who are apparently relying on user-agent checks as an important part of their mechanism for detecting ad fraud. Which is quite an incredible admission, really.

1 0

GhostBSD
by tom butz 21 Apr '20

21 Apr '20

There still are several BSDs around: OpenBSD, NetBSD, FreeBSD, TrueOS and GhostBSD. They usually lack desktops, but GhostBSD has got one, and it looks good. I started with the latest version, 20 something: that one didn't work properly for me Then I used 18.10 where there were issues with the LAN, and finally everything worked using 19.10 - both on my laptop and an old Macmini. BTW, I've also installed it on an external USB3-drive (500 GB) and it can boot from it. GhostBSD supports the ZFS-filesystem and will read/write from/to msdos and linux filesystems. I haven't tried writing to an ext4 system, only read from ext-sticks. You need to do some extra work to enable read/write to extfat. LAN and WiFi worked well and Firefox is very fast. My laptop has 6 GB of RAM and I ran everything in single-user mode, just to get some extra speed. Thanks go to Peter who found the older versions on a US-server - GhostBSD is made in Canada. Tom Butz.

1 0

XCP-ng Motors Along
by Lawrence D'Oliveiro 20 Apr '20

20 Apr '20

First I heard of this XCP-ng project, which aims to produce an open-source version (!) of XenServer <https://www.theregister.co.uk/2020/04/20/xcpng_100000_download_milestone_an…>. To add to the surprise, it is actually getting support from the Xen Project.

1 0

As Raspberry Pi Sales Skyrocket, Eben Upton Applauds Efforts of Open Hardware Community
by Peter Reutemann 20 Apr '20

20 Apr '20

'"Sales of Raspberry Pi's single-board computers hit 640,000 in March, the second-biggest month for sales since they started selling," reports TechRepublic, "as consumers flocked to inexpensive ways to work and learn from home." But that's not all, Eben Upton tells them: With the pandemic having highlighted shortages in personal protective equipment (PPE), 3D-printing manufacturers and hobbyists have been building face shields printed on plastic acetate that can be quickly assembled and delivered to hospitals, for free. "A lot of that is Pi-driven," Upton explained, noting that OctoPrint, which is the most popular platform for managing 3D printers, runs on Raspberry Pi... "[M]aking face shields seems to be a community effort. You have people with a home printer, printing these things once a week and then going to a post office and sending them," he said. "Then you'll have some people sat in a hack space receiving the parcels, cutting the acetate and the elastic, assembling them into face shields then sending them to the hospital. It's amazing." Upton suggested this effort could eventually be ramped up to a "massively distributed scale", with the benefit of open source being that, once you have a good design that works, it can be rapidly iterated. In the long term, this could even include the ventilators themselves, he said. "One thing we're seeing with this is people finding a niche within which open hardware really works," he said. ' -- source: https://news.slashdot.org/story/20/04/19/0154201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Will Companies Cut Open Source Investment Because of COVID-19?
by Peter Reutemann 20 Apr '20

20 Apr '20

'The editor of TFIR posed an interesting question to Rob Hirschfeld, the Founder/CEO of RackN (which automates and integrates bare-metal infrastructure). Will the financial impact of the COVID-19 pandemic affect the sustainability of open source software? Hirschfeld responded: "The idea that big companies are maintaining open-source projects for the community good is going to get tested, as companies look for places where they can conserve revenue. I think that's a really critical thing." "The same is going to be true with open-source startups that are hoping to monetize support or consulting but have no real gate across the front of their infrastructure... Companies might decide they can use the open-source project and not pay the sustaining engineers that are working in that project. "These are really serious concerns about the whole open-source model, which relies on goodwill and free money."' -- source: https://news.slashdot.org/story/20/04/19/0452247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Supply-chain attack hits RubyGems repository with 725 malicious packages
by Peter Reutemann 20 Apr '20

20 Apr '20

'More than 725 malicious packages downloaded thousands of times were recently found populating RubyGems, the official channel for distributing programs and code libraries for the Ruby programming language. The malicious packages were downloaded almost 100,000 times, although a significant percentage of those are likely the result of scripts that automatically crawl all 158,000 packages available in the repository, Tomislav Pericin, the cofounder and chief software architect of security firm ReversingLabs, told Ars. All of them originated from just two user accounts: “JimCarrey” and “PeterGibbons.” The accounts, which ReversingLabs suspects may be the work of a single individual, used a variation of typosquatting—the technique of giving a malicious file or domain a name that's similar to a commonly recognizable name—to give the impression they were legitimate. For instance, “atlas-client,” a booby-trapped package with 2,100 downloads, was a stand-in for the authentic “atlas_client” package. More than 700 of the packages were uploaded from February 16 to 25.' -- source: https://arstechnica.com/information-technology/2020/04/725-bitcoin-stealing… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Cloudflare tool can tell you if your ISP has deployed BGP fixes
by Peter Reutemann 20 Apr '20

20 Apr '20

'For more than an hour at the beginning of April, major sites like Google and Facebook sputtered for large swaths of people. The culprit wasn't a hack or a bug. It was problems with the internet data routing standard known as the Border Gateway Protocol, which had allowed significant amounts of web traffic to take an unexpected detour through a Russian telecom. For Cloudflare CEO Matthew Prince, it was the last straw. BGP disruptions happen frequently, generally by accident. But BGP can also be hijacked for large-scale spying, data interception, or as a sort of denial of service attack. Just last week, United States Executive Branch agencies moved to block China Telecom from offering services in the US, because of allegedly malicious activity that includes BGP attacks. Companies like Cloudflare sit on the front lines of the BGP blowback. And while the company can't fix the problem directly, it can call out those that are slow to contribute defenses.' -- source: https://arstechnica.com/information-technology/2020/04/new-cloudflare-tool-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Growth In Surveillance May Be Hard To Scale Back After Pandemic, Experts Say
by Peter Reutemann 19 Apr '20

19 Apr '20

Long-time Slashdot reader AmiMoJo quotes the Guardian: 'The coronavirus pandemic has led to an unprecedented global surge in digital surveillance, researchers and privacy advocates around the world have said, with billions of people facing enhanced monitoring that may prove difficult to roll back. Governments in at least 25 countries are employing vast programmes for mobile data tracking, apps to record personal contact with others, CCTV networks equipped with facial recognition, permission schemes to go outside and drones to enforce social isolation regimes. The methods have been adopted by authoritarian states and democracies alike and have opened lucrative new markets for companies that extract, sell, and analyse private data. One of the world's foremost experts on mobile phone surveillance said the pandemic had created a '9/11 on steroids' that could lead to grave abuses of power. "Most of these measures don't have sunset clauses. They could establish what many people are describing as a new normal," Ron Deibert, who heads the Citizen Lab at the University of Toronto, said in an interview with the Guardian. The article provides examples from China, Russia, India, Europe, and the United States, and provides a link to an index of new coronavirus-related surveillance measures related to the coronavirus outbreak. The digital rights lead at the group behind the list says "This isn't just an issue with authoritarian governments. This is happening across the world."' -- source: https://yro.slashdot.org/story/20/04/18/0717228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Tor Project Lays Off 37% of Its Staff
by Peter Reutemann 19 Apr '20

19 Apr '20

'The Tor Project's executive director Isabela Bagueros writes: Tor, like much of the world, has been caught up in the COVID-19 crisis. Like many other nonprofits and small businesses, the crisis has hit us hard, and we have had to make some difficult decisions. We had to let go of 13 great people who helped make Tor available to millions of people around the world. We will move forward with a core team of 22 people, and remain dedicated to continuing our work on Tor Browser and the Tor software ecosystem. The world won't be the same after this crisis, and the need for privacy and secure access to information will become more urgent. In these times, being online is critical and many people face ongoing obstacles to getting and sharing needed information. We are taking today's difficult steps to ensure the Tor Project continues to exist and our technology stays available. We are terribly sad to lose such valuable teammates, and we want to let all our users and supporters know that Tor will continue to provide privacy, security, and censorship circumvention services to anyone who needs them. Mashable reminds its readers that "Those wishing to make sure the specifics of their online browsing remain their own personal business can donate to Tor's non-profit organization. "Because with more and more of our lives happening online for the foreseeable future, it's a good idea to have an organization working to protect what little digital privacy we have left."' -- source: https://yro.slashdot.org/story/20/04/18/1129249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

After 8 Years of Remote-Access Trojans Attacks, Can We Still Say Linux is Secure?
by Peter Reutemann 19 Apr '20

19 Apr '20

'Remember when BlackBerry reported Advanced Persistent Threat groups have been infiltrating critical Linux servers for at least eight years? What's the lesson to be learned? LinuxSecurity Founder Dave Wreski argues "Although it may be easy to blame the rise in attacks targeting Linux in recent years on security vulnerabilities in the operating system as a whole, this is simply not the truth. The majority of exploits on Linux systems can be attributed to misconfigured servers and poor administration." Writing for Linux Security, Slashdot reader b-dayyy gathered some additional responses: Some experts argue that it is the popularity of Linux that makes it a target. Joe McManus, Director of Security at Canonical, explains: "Linux and, particularly Ubuntu, are incredibly secure systems but, that being said, it is their popularity that makes them a target." Ian Thornton-Trump, a threat intelligence expert and the CISO at Cyjax, adds: "From an economic and mission perspective, it makes sense for a threat actor to invest in open-source skills for flexibility and the ability to target the systems where the good stuff is happening." Despite the increasing number of threats targeting Linux systems, there is still a sound argument for the inherent security of Linux, which can be attributed to the core fundamentals of Open Source. Due to the transparency of open-source code and the constant scrutiny that this code undergoes by a vibrant global community, vulnerabilities are identified and remedied quicker than flaws that exist in the opaque source code of proprietary software and operating systems. Threat actors recognize this, and are still directing the majority of their attacks at proprietary operating systems. These attacks do; however, serve as a much-needed wakeup call for the security community that more needs to be done to protect Linux servers. BlackBerry's report reveals that security solutions and defensive coverage available within Linux environments is "immature at best". Endpoint protection, detection and response products are inadequately utilized by too many Linux users, and endpoint solutions available for Linux systems are often insufficient in combating advanced exploits. Eric Cornelius, Chief Product Officer at BlackBerry, evaluates: "Security products and services that support Linux, offerings that might detect and give us insight into a threat like this, are relatively lacking compared to other operating systems, and security research about APT use of Linux malware is also relatively sparse." ' -- source: https://it.slashdot.org/story/20/04/19/0040223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apple > Ikea
by Lawrence D'Oliveiro 17 Apr '20

17 Apr '20

Guess how much it costs to get the castor wheel kit for your new Apple Mac Pro <https://www.theregister.co.uk/2020/04/16/apple_mac_pro_699_dollar_wheels/>. I wonder what other furnishing-related items Apple could sell. How about a nice doily to go on top?

1 0

New Jersey Needs COBOL Programmers!
by Lawrence D'Oliveiro 17 Apr '20

17 Apr '20

The Governor of the US state of New Jersey is appealing for help in maintaining their elderly COBOL-based mainframe systems <https://www.theregister.co.uk/2020/04/05/new_jersey_seeks_cobol_volunteers/> that process welfare benefit requests. The volume of requests has gone up a lot lately, and the systems are having trouble coping. By the way, I don’t understand this “ugly side of technical debt” phrase. Does technical debt have a pretty side?

3 4

Linksys Asks Users To Reset Passwords After Hackers Hijacked Home Routers Last Month
by Peter Reutemann 17 Apr '20

17 Apr '20

'Router vendor Linksys has locked user accounts on its Smart WiFi cloud service and is asking them to reset passwords after hackers have been observed hijacking accounts and changing router settings to redirect users to malware sites. From a report: Linksys' decision only impacts Smart WiFi accounts. Linksys Smart WiFi is a cloud-based account system that lets device owners connect to Linksys routers (and other equipment) over the internet to manage router settings. Smart WiFi is widely deployed across Linksys' router fleet, making it an ideal target for hackers who may want to hijack routers en-masse. According to a Bitdefender report published last month, this is exactly what's been recently happening. The cyber-security firm said it detected an organized campaign to break into D-Link and Linksys routers and change DNS settings.' -- source: https://it.slashdot.org/story/20/04/16/1727210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The secret behind “unkillable” Android backdoor called xHelper has been revealed
by Peter Reutemann 17 Apr '20

17 Apr '20

'In February, a researcher detailed a widely circulating Android backdoor that’s so pernicious that it survives factory resets, a trait that makes the malware impossible to remove without taking unusual measures. The analysis found that the unusual persistence was the result of rogue folders containing a trojan installer, neither of which was removed by a reset. The trojan dropper would then reinstall the backdoor in the event of a reset. Despite those insights, the researcher still didn’t know precisely how that happened. Now, a different researcher has filled in the missing pieces.' -- source: https://arstechnica.com/information-technology/2020/04/solved-how-android-b… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox To Remove Support For the FTP Protocol
by Peter Reutemann 16 Apr '20

16 Apr '20

'Mozilla has announced plans to remove support for the FTP protocol from Firefox. Going forward, users won't be able to download files via the FTP protocol and view the content of FTP links/folders inside the Firefox browser. From a report: "We're doing this for security reasons," said Michal Novotny, a software engineer at the Mozilla Corporation, the company behind the Firefox browser. "FTP is an insecure protocol and there are no reasons to prefer it over HTTPS for downloading resources," he said. "Also, a part of the FTP code is very old, unsafe and hard to maintain and we found a lot of security bugs in it in the past." Novotny says Mozilla plans to disable support for the FTP protocol with the release of Firefox 77, scheduled for release in June this year.' -- source: https://news.slashdot.org/story/20/03/19/169246 There's always FileZilla... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

NASA Uses 3D Cardboard Glasses
by Lawrence D'Oliveiro 16 Apr '20

16 Apr '20

Here’s a fun one: normally, the drivers of the Curiosity Mars rover have active-shutter 3D glasses for viewing images of the Martian terrain on their office machines. But these don’t work on the hardware that these staffers are currently using from home. So they are falling back to those cheap cardboard red-and-blue glasses that they would give out, included in the price of the ticket, at cinemas <https://www.theregister.co.uk/2020/04/15/nasa_cardboard_3d_glasses_for_curi…>.

1 0

Jailbreaking Medical Equipment
by Lawrence D'Oliveiro 16 Apr '20

16 Apr '20

A security researcher has been taking a look at a piece of “CPAP” (“Continuous Positive Airway Pressure”) equipment <https://arstechnica.com/information-technology/2020/04/firmware-jailbreak-l…>, normally used to treat sleep apnoea, just to see whether it can be adapted to function as a “BIPAP” (“Bi-Level Positive Airway Pressure”) device, i.e. a full-on ventilator. The manufacturer says no, but the researcher says yes, the device already has the essential functionality available in its firmware, just needing a patch to enable it.

1 0

A story with a happy ending
by Ian Stewart 15 Apr '20

15 Apr '20

Seven years ago, in March 2013, I discovered a bug in the BASIC programming language that is included with LibreOffice suite of applications. I found that if BASIC was requested to return a 1 to 4 x nibbles Hex string, it would return positive integers OK but it would have an error when attempting to return a negative integer. For examples: Cint(&H0) returned 0 OK Cint(&H7FFF) returned 32767 OK Cint(&HFFFF) should have returned -1, but returned an "overflow error" Cint(&H8000) should have returned -32768, but returned an "overflow error". On the 14th March 2013, I opened a case for this issue on Bugzilla and it was logged as Bug 62326 https://bugs.documentfoundation.org/show_bug.cgi?id=62326 === The most recent comment posted on this bug was two weeks ago: Comment 39 Commit Notification 2020-03-30 06:59:05 UTC Andreas Heinisch committed a patch related to this issue. It has been pushed to "master": https://git.libreoffice.org/core/commit/ffbcbbc8dcc946d4d91cc08a937c2067be5… Cleanup for tdf#130476, tdf#62323 and tdf#62326 It will be available in 7.0.0. === Version 7.0 of LibreOffice is scheduled for release in August 2020. === So.... Good things come to those who wait! cheers, Ian.

3 2

RIP John Conway
by Lawrence D'Oliveiro 15 Apr '20

15 Apr '20

One of the higher-profile victims† of Covid-19 has been mathematician John Conway, best known to most people for the invention of the cellular-automata game he called “Life”. This article <https://arstechnica.com/science/2020/04/john-conway-inventor-of-the-game-of…> has some details, including a link to a YouTube video showing a quite amazing configuration of 6 “engines” that generate an endless stream of “Corderships” that go sailing off in one direction. †Another victim I personally feel sad about is Tim Brooke-Taylor. But while I enjoyed his humour (for example in “The Goodies” and “At Last, The 1948 Show” on TV, and “I’m Sorry, I’ll Read That Again” on radio), I can’t think of anything appropriate to this group to say about him...

2 1

Samsung's S-Voice Is Shutting Down On June 1st
by Peter Reutemann 14 Apr '20

14 Apr '20

'Samsung is reportedly shutting off the servers for its S-Voice voice assistant on June 1, 2020, "at which point Samsung's original voice assistant will stop attempting to respond to your voice queries," reports Ars Technica. From the report: S-Voice arose in the early days of voice assistants, when Android OEMs were scrambling to photocopy Apple's Siri voice assistant, which launched in 2011. Samsung licensed the same underlying technology for S-Voice that Apple originally used for Siri -- Nuance Communication's voice recognition -- and set about building its Siri sibling. S-Voice was Samsung's chosen voice assistant for its smartphones until it rebooted its voice efforts with the launch of "Bixby" in 2017. Samsung's Bixby project initially grew out of an acquisition of Viv Labs, a voice-assistant company founded by members of the original Siri team (see a pattern here?). The Galaxy S8 and every device after it launched with Bixby and not S-Voice, so this shutdown should only effect older devices. SamMobile hunted down a list of applicable devices, saying "The affected models that have the S Voice icon on the app screen include the Galaxy A3, A5, A7, A8, A9, Galaxy Note FE, Galaxy Note 2, 3, 4, 5, Galaxy S3, 4, S5, S6, S6 edge in addition to the Galaxy Note Pro 12.2, Galaxy W, Galaxy Tab 4, Galaxy Tab 4 8.0/10.1, Galaxy Tab S8.4 and S10.5. ' -- source: https://mobile.slashdot.org/story/20/04/13/2336220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How Steak-umm Became The Tweeting Voice Of Reason In A Pandemic
by Lawrence D'Oliveiro 14 Apr '20

14 Apr '20

No, I had never heard of this US-based product before, either. But whoever is in charge of its Twitter account has decided to use their power for good, not for evil <https://www.techdirt.com/articles/20200410/17213944276/how-steak-umm-became…>. Consider comments like this: it can be difficult to know what to believe in a time when institutional trust is diminished and the gatekeepers of information have been dismantled, but it's more crucial now than ever before to follow a range of credentialed sources for both breaking news and data collection or this: you can maintain independent, critical thinking toward institutions without dipping into fringe conspiracies that get jumpstarted by individual anecdotes being virally spread as data. it's not easy, but it's necessary to keep any semblance of responsible online information flow or this: we're a frozen meat brand posting ads inevitably made to misdirect people and generate sales, so this is peak irony, but hey we live in a society so please make informed decisions to the best of your ability and don't let anecdotes dictate your worldview ok and this: people think it's bizarre, ironic, and funny when a frozen meat company points out the importance of critical thinking, but chances are the same message would never "go viral" if it was from a person. our society values entertainment over truth and that's a huge problem

1 0

Not actually Linux distro review deux: GhostBSD
by Peter Reutemann 14 Apr '20

14 Apr '20

'When I began work on the FreeBSD 12.1-RELEASE review last week, it didn't take long to figure out that the desktop portion wasn't going very smoothly. I think it's important for BSD-curious users to know of easier, gentler alternatives, so I did a little looking around and settled on GhostBSD for a follow-up review. GhostBSD is based on TrueOS, which itself derives from FreeBSD Stable. It was originally a Canadian distro, but—like most successful distributions—it has transcended its country of origin and can now be considered worldwide. Significant GhostBSD development takes place now in Canada, Italy, Germany, and the United States. The history of desktop-oriented BSD distros is a turbulent one. For several years, Kris Moore's PC-BSD was the go-to for "I want BSD, but I also want a ready-to-go desktop." Eventually, ixSystems—home of the FreeNAS storage distro, and the company Moore is vice president of engineering for—came to rely heavily on the server-side features developed into PC-BSD. The need at ixSystems for the foundation of PC-BSD without the associated desktop led to a rename and a fork. PC-BSD's underpinnings became TrueOS, and the desktop-friendly distribution—now based on TrueOS—became Project Trident. This state of affairs didn't last long. A year later, Project Trident declared unhappiness with TrueOS and BSD in general—mostly due to hardware support, or lack thereof. In January 2020, Trident rebased itself on Void Linux, which its developers found to be "the most BSD-like" of the potential Linux upstream distros they examined. Project Trident's departure for more Linux-y waters left several potential contenders for a desktop-focused BSD distribution. These include FuryBSD, MidnightBSD, DesktopBSD, and GhostBSD itself. I've tested PC-BSD fairly extensively in the past but have no history with any of the current desktop BSD choices. I chose GhostBSD for a first look, solely due to its prominence in Google search results for "desktop BSD distro."' -- source: https://arstechnica.com/gadgets/2020/04/not-actually-linux-distro-review-de… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linux on Laptops: ASUS Zephyrus G14 with Ryzen 9 4900HS
by Peter Reutemann 14 Apr '20

14 Apr '20

'The Zephyrus G14 is a dual-GPU gaming laptop, and Linux tends not to fare well with that setup. But it's the only Ryzen 4000 equipped laptop I have available—so it was obviously going to get Linux on it, whether it liked it or not. Since brand-new hardware generally calls for brand-new distro versions, I grabbed a fresh copy of the Ubuntu Focal Fossa beta and gave it a whirl. I have the sad duty of reporting that the results were mediocre at best.' -- source: https://arstechnica.com/gadgets/2020/04/linux-on-laptops-asus-zephyrus-g14-… >From my recent experience of setting up a GPU machine, the Nouveau driver was unusable to get a working desktop. I ended up having to use the Ubuntu server edition instead with a text-based setup, which required me to have ethernet plugged in for internet. The strangest thing on this machine is docker: after rebooting the machine, I have to restart docker before I can do anything with it... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Coronavirus: Raspberry Pi-powered ventilator to be tested in Colombia
by Peter Reutemann 14 Apr '20

14 Apr '20

'A team in Colombia is to test a ventilator made with a Raspberry Pi computer and easy-to-source parts. The design and computer code were posted online in March by a man in California, who had no prior experience at creating medical equipment. Marco Mascorro, a robotics engineer, said he built the ventilator because knew the machines were in high demand to treat Covid-19. His post prompted a flood of feedback from healthcare workers. He has used the advice to make improvements. "I am a true believer that technology can solve a lot of the problems we have right now specifically in this pandemic," he told the BBC. The Colombian team said the design was important for their South American country because parts for traditional models could be hard to obtain. By contrast, Mr Mascorro's design uses only easy-to-find parts - for example, the valves it employs can commonly be found at car and plumbing supply stores. The machine is set to be put through a fast-tracked round of tests at two institutions in Bogota - the University Hospital of the Pontifical Xavierian University and Los Andes University.' -- source: https://www.bbc.com/news/technology-52251286 -- github: https://github.com/Mascobot/pandemic-ventilator-2.0 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Not-actually Linux distro review: FreeBSD 12.1-RELEASE
by Peter Reutemann 10 Apr '20

10 Apr '20

'This month's Linux distro review isn't of a Linux distribution at all—instead, we're taking a look at FreeBSD, the original gangster of free Unix-like operating systems. The first FreeBSD release was in 1993, but the operating system's roots go further back—considerably further back. FreeBSD started out in 1992 as a patch-release of Bill and Lynne Jolitz's 386BSD—but 386BSD itself came from the original Berkeley Software Distribution (BSD). BSD itself goes back to 1977—for reference, Linus Torvalds was only seven years old then. Before we get started, I'd like to acknowledge something up front—our distro reviews include the desktop experience, and that is very much not FreeBSD's strength. FreeBSD is far, far better suited to running as a headless server than as a desktop! We're going to get a full desktop running on it anyway, because according to Lee Hutchinson, I hate myself—and also because we can't imagine readers wouldn't care about it. FreeBSD does not provide a good desktop experience, to say the least. But if you're hankering for a BSD-based desktop, don't worry—we're already planning a followup review of GhostBSD, a desktop-focused BSD distribution.' -- source: https://arstechnica.com/gadgets/2020/04/not-actually-linux-distro-review-fr… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Signal Threatens To Dump US Market If EARN IT Act Passes
by Peter Reutemann 10 Apr '20

10 Apr '20

'Signal is warning that an anti-encryption bill circulating in Congress could force the private messaging app to pull out of the U.S. market. PC Magazine reports: Since the start of the coronavirus pandemic, the free app, which offers end-to-end encryption, has seen a surge in traffic. But on Wednesday, the nonprofit behind the app published a blog post, raising the alarm around the EARN IT Act. "At a time when more people than ever are benefiting from these (encryption) protections, the EARN IT bill proposed by the Senate Judiciary Committee threatens to put them at risk," Signal developer Joshua Lund wrote in the post. Although the goal of the legislation, which has bipartisan support, is to stamp out online child exploitation, it does so by letting the U..S government regulate how internet companies should combat the problem -- even if it means undermining the end-to-end encryption protecting your messages from snoops. If the companies fail to do so, they risk losing legal immunity under Section 230 of the Communications Decency Act, which can shield them from lawsuits concerning objectionable or illegal content posted on their websites or apps. "Some large tech behemoths could hypothetically shoulder the enormous financial burden of handling hundreds of new lawsuits if they suddenly became responsible for the random things their users say, but it would not be possible for a small nonprofit like Signal to continue to operate within the United States," Lund wrote in the blog post.' -- source: https://it.slashdot.org/story/20/04/09/2014207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Meet dark_nexus, quite possibly the most potent IoT botnet ever
by Peter Reutemann 10 Apr '20

10 Apr '20

'A newly discovered botnet that preys on home routers, video recorders, and other network-connected devices is one of the most advanced Internet-of-things platforms ever seen, researchers said on Wednesday. Its list of advanced features includes the ability to disguise malicious traffic as benign, maintain persistence, and infect devices that run on at least 12 different CPUs. Researchers from antivirus provider Bitdefender described the so-called dark_nexus as a “new IoT botnet packing new features and capabilities that put to shame most IoT botnets and malware that we’ve seen.” In the three months that Bitdefender has tracked it, dark_nexus has undergone 30 version updates, as its developer has steadily added more features and capabilities.' -- source: https://arstechnica.com/information-technology/2020/04/meet-dark_nexus-quit… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0