- wlug - list.wlug.org.nz

Google Could Have Fixed 2FA Code-Stealing Flaw in Authenticator App Years Ago
by Peter Reutemann 08 Mar '20

08 Mar '20

'Last month, a cybersecurity firm discovered the first-ever Android malware that came with the capability to steal the 2FA (two-factor authentication) codes generated by the Google Authenticator app. The malware, discovered by researchers from ThreatFabric, was named Cerberus, and its 2FA OTP code-stealing feature was still under development, yet to have been detected in a real-world attack. According to researchers, the malware was a hybrid between a banking trojan and a remote access trojan (RAT). Once an Android user got infected, the hacker would use the malware's banking trojan features to steal credentials for mobile banking apps. If an account was protected by 2FA, and namely by the Google Authenticator app, the malware was designed to allow the Cerberus gang to connect to a user's device manually, via its RAT features. Hackers would then open the Authenticator app, generate one-time passcodes, take a screenshot of the codes, and then access the user's account. [...] Nightwatch researchers said that Google could have fixed this issue as early as October 2014, when this misconfiguration was first brought to its attention by someone on GitHub.' -- source: https://tech.slashdot.org/story/20/03/07/0918212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hack Turns Apple's iPhone Into An Android
by Peter Reutemann 07 Mar '20

07 Mar '20

'Ten years ago, David Wang pulled off a remarkable trick, installing Android on the first-generation iPhone. Now Wang and his colleagues at cybersecurity startup Corellium are doing it again with the ostentatiously titled Project Sandcastle. From a report: And Forbes got an exclusive hands-on look at their Android for iPhone product ahead of its public release scheduled for later this Wednesday. The timing is sure to have Apple fanboys rubbernecking: Corellium is in the middle of being sued by Apple. As previously reported by Forbes, in August last year, Corellium was taken to court over Apple claims the startup breached copyright laws by creating software versions of the iPhone for security and testing. The case took a surprise turn late last month when Apple subpoenaed Spanish banking giant Santander and the $50 billion U.S. military and intelligence contractor L3Harris. But Corellium has lofty ambitions for Project Sandcastle, saying that it'll actually show how Apple's walled garden, which it has fiercely protected since launching its flagship phone in 2007, can be deconstructed and taken over by others' software. "Project Sandcastle is about having fun building something new from the sand -- from the literal silicon of the hardware," said Corellium CEO Amanda Gorton, in a statement sent to Forbes. "Apple restricts iPhone users to operate inside a sandbox, but users own that hardware, and they should be able to use that hardware the way they want. So where sandboxes create limits and boundaries on the hardware that users own, sandcastles provide an opportunity to create something new and wonderful from the limitless bounds of your imagination."' -- source: https://apple.slashdot.org/story/20/03/06/1954210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

It’s Not All CUDA At The High End
by Lawrence D'Oliveiro 06 Mar '20

06 Mar '20

This item <https://www.nextplatform.com/2020/03/05/software-evolution-on-ornls-summit-…> reports on an interview with Dr Tjerk Straatsma, group lead for scientific computing at ORNL. Seems their supers have made heavy use of NVidia GPUs up to now, but this is set to change: Frontier, the next system for the OLCF, will have AMD CPUs and GPUs. To prepare for this system, software developers may want to make changes to their programming approach, with OpenMP directive-based and HIP native offloading as the most comparable to the OpenACC and CUDA approaches on Summit today. I wonder what happened to OpenCL as the cross-platform architecture for GPU computing?

1 0

Let’s Encrypt changes course on certificate revocation
by Peter Reutemann 06 Mar '20

06 Mar '20

'Earlier this week, Let's Encrypt announced that it would revoke roughly three million—2.6 percent—of its currently active certificates. Last night, however, the organization announced that it would delay the revocation of many of those certificates in the interest of Internet health. The impact of the revocation on system administrators was and is significant due to the very short window of maintenance allowed before the revocation went into effect. Roughly thirty-six hours were available from the initial announcement to the beginning of scheduled certificate revocation. Half an hour prior to the scheduled revocations, more than one million affected certificates had still not been renewed, and Let's Encrypt announced an additional delay to give administrators more time.' -- source: https://arstechnica.com/information-technology/2020/03/lets-encrypt-holds-o… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Almost Half of Mobile Malware Are Hidden Apps
by Peter Reutemann 06 Mar '20

06 Mar '20

'Certain apps are hiding themselves and stealing resources and data from mobile devices, according to a new report by security firm McAfee. From a report: This is a growing threat comprising almost half of all malicious mobile malware, and a 30% increase from 2018, said Raj Samani, chief scientist and McAfee fellow, who authored the Q1 2020 McAfee Mobile Threat Report. "This shows where the focus from criminals [is] on the mobile platform, which is in stark contrast to non-mobile malware,'' Samani said. A new malware family called LeifAccess or Shopper is taking advantage of the accessibility features in Android to create accounts, download apps, and post reviews, according to the report. LeifAccess, "is a broad campaign [and] is using alternate methods to achieve installation but thereafter trying to achieve legitimacy to the user with fake warnings," Samani said. For example, LeifAccess does not create an icon or shortcut, "so it's not immediately obvious that the app is installed ... but for some of the hidden apps within the report, malicious mobile attacks will even masquerade as a legitimate app," he said.' -- source: https://it.slashdot.org/story/20/03/04/2021233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ampere Altra is the First 80-core ARM-based Server Processor
by Peter Reutemann 06 Mar '20

06 Mar '20

'Ampere has unveiled the industry's first 80-core ARM-based 64-bit server processor today in a bid to outdo Intel and Advanced Micro Devices in datacenter chips. From a report: Ampere announced today that it has begun providing samples of the Ampere Altra processor for modern cloud and edge computing datacenters. The Ampere Altra processor runs on 210 watts and is targeted at such server applications as data analytics, artificial intelligence, database, storage, telco stacks, edge computing, web hosting, and cloud-native applications. Intel dominates about 95.5% of the server chip market with its x86-based processors, and AMD has the rest. But Ampere is targeting power-efficient, high-performance, and high-memory capacity features. Renee James, former president of Intel and CEO of Ampere, said in an interview with VentureBeat that the chip is faster than a 64-core AMD Epyc processor and Intel's 28-core high-end Xeon "Cascade Lake" chip.' -- sources: https://hardware.slashdot.org/story/20/03/04/2027230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel CSME Bug Worse Than Previously Thought
by Peter Reutemann 06 Mar '20

06 Mar '20

'Security researchers say that a bug in one of Intel's CPU technologies that was patched last year is actually much worse than previously thought. From a report: "Most Intel chipsets released in the last five years contain the vulnerability in question," said Positive Technologies in a report published today. Attacks are impossible to detect, and a firmware patch only partially fixes the problem. To protect devices that handle sensitive operations, researchers recommend replacing CPUs with versions that are not impacted by this bug. Only the latest Intel 10th generation chips are not vulnerable, researchers said. The actual vulnerability is tracked as CVE-2019-0090, and it impacts the Intel Converged Security and Management Engine (CSME), formerly called the Intel Management Engine BIOS Extension (Intel MEBx). ' -- source: https://it.slashdot.org/story/20/03/05/149222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GCHQ’s Advice For Securing Smart-Home Gadgets
by Lawrence D'Oliveiro 05 Mar '20

05 Mar '20

For those who can’t be bothered trying to understand the ins and outs of security concerns with “Internet-Of-Things” devices <https://www.theregister.co.uk/2020/03/03/ncsc_smart_gadget_security_tips/> such as cameras and baby monitors, GCHQ advises: * If your camera comes with a default password, change it to a secure one – connecting three random words which you'll remember is a good way to do this. You can usually change your password using the app you use to manage the device. * Keep your camera secure by regularly updating security software. Not only does this keep your devices secure, but often adds new features and other improvements. * If you do not use the feature that lets you remotely access the camera from the internet, it is recommended you disable it.

1 0

Let’s Encrypt discovers CAA bug, must revoke customer certificates
by Peter Reutemann 05 Mar '20

05 Mar '20

'On Leap Day, Let's Encrypt announced that it had discovered a bug in its CAA (Certification Authority Authorization) code. The bug opens up a window of time in which a certificate might be issued even if a CAA record in that domain's DNS should prohibit it. As a result, Let's Encrypt is erring on the side of security and safety rather than convenience and revoking any currently issued certificates it can't be certain are legitimate, saying: Unfortunately, this means we need to revoke the certificates that were affected by this bug, which includes one or more of your certificates. To avoid disruption, you'll need to renew and replace your affected certificate(s) by Wednesday, March 4, 2020. We sincerely apologize for the issue. If you're not able to renew your certificate by March 4, the date we are required to revoke these certificates, visitors to your site will see security warnings until you do renew the certificate.' -- source: https://arstechnica.com/information-technology/2020/03/lets-encrypt-revokin… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

Microsoft Retiring MCSA/MCSD/MCSE Certifications
by Lawrence D'Oliveiro 04 Mar '20

04 Mar '20

Came across this Microsoft article <https://www.microsoft.com/en-us/learning/community-blog-post.aspx?BlogId=8&…> (linked from this YouTube video <https://www.youtube.com/watch?v=laaGuJItNCM>) explaining that Microsoft is “retiring” its more broad-based MCSA, MCSD and MCSE certifications in favour of a range of narrower, “role-based” ones. You’ll notice in the diagram on that page that everything starts with the cloud now: Azure, Dynamics 365 and Microsoft 365. And as we know, Microsoft has previously admitted that Azure is more about Linux instances rather than Windows ones. Myself, I never understood the emphasis on vendor-specific certifications. They have a short shelf-life, requiring continual “refreshing” or “updating” to new product versions--basically another revenue stream for the vendor.

1 0

Cisco: Avoid Coronavirus, Stay Home, Use Webex
by Peter Reutemann 04 Mar '20

04 Mar '20

'Ars Technica: Networking giant Cisco is getting into the coronavirus monitoring and mitigation game with its Webex remote meeting property. The company notes that in the wake of mandates issued to employees to halt travel plans and/or work from home, traffic across its Webex backbone has increased significantly. Webex meeting traffic connecting Chinese users to global workplaces has increased by a factor of 22 since the outbreak began; traffic in other Asian countries is up by 400 percent or more, and free signup rates in impacted countries have increased 700 percent or more. In response, Cisco is offering temporarily unlimited usage (with no time restrictions) in all countries where the service is available (full list here), not just the ones worst hit by coronavirus. The company is also offering free 90-day licenses to businesses that are not currently Webex customers and offering free upgrades to customers whose current plan is insufficient to accommodate increased traffic due to the outbreak. In the worst affected countries, telepresence and remote work software like Webex is currently the only alternative to a complete shutdown of activities. In its press release, Cisco highlights the Nesbitt Center, an organization working with disabled young adults in Hong Kong. All Hong Kong schools, including the Nesbitt Center, have been required to suspend day programs during the outbreak. Webex videoconferencing has allowed the Nesbitt Center to continue delivering educational sessions despite the lockdown. Ars Technica also recommends Jitsi, a "free and open source software, offering video call and screen sharing capabilities." There's also Jitsi Meet for people "who just need to get something done on-the-fly with no setup at all." Do you have a favorite remote work software?' -- source: https://tech.slashdot.org/story/20/03/03/2013226/cisco-avoid-coronavirus-st… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

If You Like RSS, You'll Love Fraidycat
by Peter Reutemann 04 Mar '20

04 Mar '20

'J. Fergus, writing for Input: Someone finally did it. We can now follow who we want on our own terms and get that information chronologically. Fraidycat is an app and browser extension that allows just that. Though it launched in November 2019, Fraidycat recently got a massive update, widening its compatibility and adding a dark mode. The open-source tool, brought to you by Kicks Condor, is available for Linux, Mac, and Windows in addition to Mozilla Firefox and Chrome as an extension. Fraidycat definitely pulls from RSS feeds more easily, but it also works on Twitter, Instagram, and SoundCloud. You drop the link to the account you'd like to follow -- from Medium bloggers to Twitch streamers to vision board Pinterest-ers -- and set how frequently you'd like to see their posts. Label it, hit save, and posts will appear as often as you'd like. The recent update notably folds Kickstarter into the mix and collapses Twitter threads for readability.' -- source: https://tech.slashdot.org/story/20/03/03/1441254 Personally, I use the "Feeder" app on my phone for my RSS feeds: https://f-droid.org/en/packages/com.nononsenseapps.feeder/ But Fraidycat looks like an interesting project. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox: removing "Save link to Pocket" menu item
by Peter Reutemann 04 Mar '20

04 Mar '20

Hi everyone Ever got annoyed at the "Save link to Pocket" in Firefox's right-click popup menu? In case you don't use that feature (like me), here's how you can turn it off (and also re-enable): https://support.mozilla.org/en-US/kb/disable-or-re-enable-pocket-for-firefox It boils down to toggling the following setting ("about:config"): extensions.pocket.enabled Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Freedb.org Is Shutting Down
by Peter Reutemann 03 Mar '20

03 Mar '20

'Freedb, the community-generated database of music CD metadata, is shutting down on March 31, 2020. The service was set up as a free alternative to CDDB. Many CD-ripping applications pull metadata from Freedb to save the user having to type it in manually, but the service has some major limitations and has now been superseded by MusicBrainz. This wouldn't be the first time Freedb shut down. In 2006, the site shut down due to a disagreement among its developers, only to be brought back to life a few months later. It's unclear why Freedb is shutting down after all these years.' -- source: https://developers.slashdot.org/story/20/03/02/2245216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Have I Been Pwned' Is No Longer For Sale
by Peter Reutemann 03 Mar '20

03 Mar '20

'Troy Hunt, the owner and founder of the well-known and respected data breach notification website "Have I Been Pwned," announced in a blog post today that his website is no longer being sold and will continue running independently. The news comes several months after Hunt announced he was actively looking for a buyer. Last June, Hunt wrote: "To date, every line of code, every configuration and every breached record has been handled by me alone. There is no 'HIBP team,' there's one guy keeping the whole thing afloat. It's time for HIBP to grow up. It's time to go from that one guy doing what he can in his available time to a better-resourced and better-funded structure that's able to do way more than what I ever could on my own." Now, according to Hunt, "unexpected changes" with the business model of the party believed to be the purchaser of the service "made the deal infeasible." "It wasn't something I could have seen coming nor was it anything to do with HIBP itself, but it introduced a range of new and insurmountable barriers," writes Hunt in today's blog post. Hunt goes on to explain what's been happening since April 2019 and how the service will operate in the future. ' -- source: https://it.slashdot.org/story/20/03/02/2148230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

An Update On Microsoft's 'GitHub Arctic Vault Program'
by Peter Reutemann 02 Mar '20

02 Mar '20

'news.com.au reports: The GitHub Arctic Vault program is part of the now Microsoft-owned code repository GitHub...aimed at preserving the information for generations to come... "We chose to store GitHub's public repositories in the Arctic World Archive in Svalbard [a Norwegian island] because it is one of the most remote and geopolitically stable places on Earth and is about a mile down the road from the famous Global Seed Vault," said GitHub vice president of special projects Thomas Dohmke. Mr Dohmke said open source code in particular was worth preserving... "Ultimately, it's time to create multiple durable backups of the software our world depends on..." Other treasures include the original source code for MS-DOS (the precursor to Microsoft Windows), the open source code that powers Bitcoin, Facebook's React, and the publishing platform Wordpress... "The Arctic Code Vault was just the beginning of the GitHub Archive Program's journey to secure the world's open source code," GitHub vice president of special projects Thomas Dohmke told news.com.au. "We've partnered with multiple organisations and advisers to help us maximise the GitHub Archive Program's value and preserve all open-source software for future generations." One of those partners is Norwegian archival experts Piql, who specialise in very-long-term data storage. The company uses around 200 silver halide and polyester film reels designed to last a thousand years to store the information... ' -- source: https://developers.slashdot.org/story/20/03/01/2015212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ghostcat Bug Impacts All Apache Tomcat Versions Released in the Last 13 Years
by Peter Reutemann 01 Mar '20

01 Mar '20

'Apache Tomcat servers released in the last 13 years are vulnerable to a bug named Ghostcat that can allow hackers to take over unpatched systems. From a report: Discovered by Chinese cybersecurity firm Chaitin Tech, Ghostcat is a flaw in the Tomcat AJP protocol. AJP stands for Apache JServ Protocol and is a performance-optimized version of the HTTP protocol in binary format. Tomcat uses AJP to exchange data with nearby Apache HTTPD web servers or other Tomcat instances. Tomcat's AJP connector is enabled by default on all Tomcat servers and listens on the server's port 8009. Chaitin researchers say they discovered a bug in AJP that can be exploited to either read or write files to a Tomcat server.' -- source: https://apache.slashdot.org/story/20/02/28/184218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

NZ Domain Costs Going Up
by Lawrence D'Oliveiro 29 Feb '20

29 Feb '20

InternetNZ is seeing fewer registrations of .nz domains, so it is raising prices <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=123126…>. Apparently some are using .kiwi, and others are simply setting up pages on Facebook instead.

1 0

How Melissa Di Donato Is Going To Reinvent SUSE
by Peter Reutemann 28 Feb '20

28 Feb '20

'SUSE is one of the oldest open source companies and the first to market Linux for the enterprise. Even though it has undergone several acquisitions and a merger, it remains a strong player in the business. It has maintained its integrity and core values around open source. It continues to rely on its tried-and-tested Linux business and European markets, and generally shies away from making big moves taking big risks. Until now. SUSE appointed Melissa Di Donato as its first female CEO. She is making some serious changes to the company, from building a diverse and inclusive culture to betting on emerging technologies and taking risks. Soon after taking the helm last year, Di Donato spent the first few months traveling around the globe to meet SUSE teams and customers and get a better sense of the perception of the market about the company. Just like Red Hat CEO Jim Whitehurst, Di Donato didn’t come to the company from an open source background. She had spent the last 25 years of her career as a SUSE customer, so she did have an outsider’s perspective of the company. “I am not interested in what SUSE was when I joined. I am more interested in what we want to become,” she said.' -- source: https://www.linux.com/topic/open-source/how-melissa-di-donato-is-going-to-r… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi 4 Linux Computer Gets Twice the RAM and USB-C Power Fix
by Peter Reutemann 28 Feb '20

28 Feb '20

'Brian Fagioli, writing for BetaNews: The Raspberry Pi line has provided great little Linux computers to nerds -- its low price and small size makes it ideal for tinkering and doing projects. But also, the device has proven to be a solid media device, wonderful for watching videos and emulating classic video games. In other words, it has been a very versatile computer, serving as many things to many people. With the release of the Raspberry Pi 4, however, it finally became powerful enough to serve as a true desktop computer. By installing a Linux distribution, some people can use it for day-to-day computer use, such as web browsing, playing media, and word processing. Unfortunately, the $35 base model came with a paltry 1GB of RAM. Today, this changes, as the company has dropped the price of the 2GB version to $35, effectively doubling the memory for the base model.' -- source: https://linux.slashdot.org/story/20/02/27/1520258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Quotes From RSA
by Lawrence D'Oliveiro 27 Feb '20

27 Feb '20

Among the plethora of pithy apothegms from the panel of crypto experts at the RSA Conference <https://www.theregister.co.uk/2020/02/26/rsa_2020_panel_discussion/>: “I give fusion power a higher chance of succeeding than quantum computing.” -- Ron Rivest “Blockchain is the wrong security technology for voting. I like to think of it as bringing a combination lock to a kitchen fire.” -- Ron Rivest “Intelligence is not about playing fair, it is about succeeding.” -- Whitfield Diffie, on the Crypto AG backdooring saga “I would like to understand how right to be forgotten could be for anything except to keep the little people in line. It is not the right to be forgotten by the secret police.” -- Whitfield Diffie Of course, there were some dissenting opinions to that last one ...

1 0

Smithsonian Releases 2.8 Million Images And 3D Models Into The Public Domain
by Lawrence D'Oliveiro 27 Feb '20

27 Feb '20

Just came across this news report <https://www.techdirt.com/articles/20200225/14150743985/smithsonian-releases…> about the Smithsonian Institution making a whole bunch of stuff available for free download and reuse under a Creative Commons CC0 licence. More info on their home page <https://www.si.edu/OpenAccess>. I had a quick look at one or two 3D models from <https://3d.si.edu/cc0>, and I see OBJ, glTF (OpenGL Transfer Format) and GLB (binary version of glTF) options available. These are all open formats, well-supported in non-proprietary software.

2 1

Ars takes the new Opera R2020 browser for a spin
by Peter Reutemann 27 Feb '20

27 Feb '20

'Conclusion We've been briefly excited by lesser-known browsers many times in the last 20 years, only to eventually gravitate back to the most comfortable of the big, common options. But the tide may be turning for lesser-known options like Opera. Using the same Chromium open source browser upstream as Google Chrome and Microsoft Edge do, there aren't likely to be many compatibility surprises—at least for Windows and Mac users. The Good - Opera feels both fast and familiar (enough) for anyone accustomed to Google Chrome, Microsoft Edge, or Firefox - First-rate Linux installation and update experience - The stand-out features feel immediately useful—Snapshot, VPN, Workspaces, pinned Messengers, and My Flow all fit very neatly and obviously into our existing workflows - Chromium upstream base means sites render familiarly and accurately to Chrome or Edge users - Battery saver feature makes bloated sites feel less bloated and wasteful, even on a desktop The Bad - Unit and currency conversion is still a little wonky and limited - DRM is completely non-functional on Linux The Ugly - Many Linux users won't care about broken DRM for philosophical reasons—but they won't use a non-Libre browser, for the same philosophical reasons' -- source: https://arstechnica.com/gadgets/2020/02/browser-review-opera-r2020-and-oper… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Flaw in Billions of Wi-Fi Devices Left Communications Open To Eavesdropping
by Peter Reutemann 27 Feb '20

27 Feb '20

'Billions of devices -- many of them already patched -- are affected by a Wi-Fi vulnerability that allows nearby attackers to decrypt sensitive data sent over the air, researchers said on Wednesday at the RSA security conference. From a report: The vulnerability exists in Wi-Fi chips made by Cypress Semiconductor and Broadcom, the latter a chipmaker Cypress acquired in 2016. The affected devices include iPhones, iPads, Macs, Amazon Echos and Kindles, Android devices, Raspberry Pi 3's, and Wi-Fi routers from Asus and Huawei. Eset, the security company that discovered the vulnerability, said the flaw primarily affects Cyperess' and Broadcom's FullMAC WLAN chips, which are used in billions of devices. Eset has named the vulnerability Kr00k, and it is tracked as CVE-2019-15126. Manufacturers have made patches available for most or all of the affected devices, but it's not clear how many devices have installed the patches. Of greatest concern are vulnerable wireless routers, which often go unpatched indefinitely. "This results in scenarios where client devices that are unaffected (either patched or using different Wi-Fi chips not vulnerable to Kr00k) can be connected to an access point (often times beyond an individual's control) that is vulnerable," Eset researchers wrote in a research paper published on Wednesday. "The attack surface is greatly increased, since an adversary can decrypt data that was transmitted by a vulnerable access point to a specific client (which may or may not be vulnerable itself)."' -- source: https://mobile.slashdot.org/story/20/02/26/165207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox for Mac and Linux To Get a New Security Sandbox System
by Peter Reutemann 26 Feb '20

26 Feb '20

'Mozilla will add a new security sandbox system to Firefox on Linux and Firefox on Mac. The new technology, named RLBox, works by separating third-party libraries from an app's native code. From a report: This process is called "sandboxing," and is a widely used technique that can prevent malicious code from escaping from within an app and executing at the OS level. RLBox is an innovative project because it takes sandboxing to the next level. Instead of isolating the app from the underlying operating system, RLBox separates an app's internal components -- namely its third-party libraries -- from the app's core engine. This technique prevents bugs and exploits found inside a third-party library from impacting another project that uses the same library.' -- source: https://news.slashdot.org/story/20/02/25/2028214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox To Enable DNS-over-HTTPS by Default To US Users
by Peter Reutemann 26 Feb '20

26 Feb '20

'Mozilla will bring its new DNS-over-HTTPS security feature to all Firefox users in the U.S. by default in the coming weeks, the browser maker has confirmed. From a report: It follows a year-long effort to test the new security feature, which aims to make browsing the web more secure and private. Whenever you visit a website -- even if it's HTTPS enabled -- the DNS query that converts the web address into an IP address that computers can read is usually unencrypted. DNS-over-HTTPS, or DoH, encrypts the request so that it can't be intercepted or hijacked in order to send a user to a malicious site. These unencrypted DNS queries can also be used to snoop on which websites a user visits. DoH works at the app-level, and is baked into Firefox. The feature relies on sending DNS queries to third-party providers -- such as Cloudflare and NextDNS -- both of which will have their DoH offering baked into Firefox and will process DoH queries.' -- source: https://it.slashdot.org/story/20/02/25/1210223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

PayPal Accounts Are Getting Abused En-masse For Unauthorized Payments
by Peter Reutemann 26 Feb '20

26 Feb '20

'Hackers have found a bug in PayPal's Google Pay integration and are now using it to carry out unauthorized transactions via PayPal accounts. From a report: Since last Friday, users have reported seeing mysterious transactions pop up in their PayPal history as originating from their Google Pay account. Issues have been reported on numerous platforms, such as PayPal's forums, Reddit, Twitter, and Google Pay's Russian and German support forums. Victims reported that hackers abused Google Pay accounts to buy products using linked PayPal accounts. According to screenshots and various testimonies, most of the illegal transactions are taking place at US stores, and especially at Target stores across New York. Most of the victims appear to be German users.' -- source: https://it.slashdot.org/story/20/02/25/1213209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Open Source Licences: What, Which & Why
by Lawrence D'Oliveiro 25 Feb '20

25 Feb '20

A good overview <https://arstechnica.com/gadgets/2020/02/how-to-choose-an-open-source-licens…> for anybody having anything to do with Open Source, not just those trying to decide what licence to choose for their own projects. Basic recommendation: stick to something approved by the Open Source Initiative, and above all avoid making up a licence of your own.

2 1

EU Commission To Staff: Switch To Signal Messaging App
by Peter Reutemann 25 Feb '20

25 Feb '20

'The European Commission has told its staff to start using Signal, an end-to-end-encrypted messaging app, in a push to increase the security of its communications. From a report: The instruction appeared on internal messaging boards in early February, notifying employees that "Signal has been selected as the recommended application for public instant messaging." The app is favored by privacy activists because of its end-to-end encryption and open-source technology. "It's like Facebook's WhatsApp and Apple's iMessage but it's based on an encryption protocol that's very innovative," said Bart Preneel, cryptography expert at the University of Leuven. "Because it's open-source, you can check what's happening under the hood," he added. Signal was developed in 2013 by privacy activists. It is supported by a nonprofit foundation that has the backing of WhatsApp founder Brian Acton, who had left the company in 2017 after clashing with Facebook's leadership.' -- source: https://tech.slashdot.org/story/20/02/24/1430211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apple To Release First ARM Mac Without Intel Processor in Next 18 Months, Predicts Kuo
by Peter Reutemann 25 Feb '20

25 Feb '20

Since we were talking about ARM chips at last night's meeting, this seems an interesting bit of news: 'Ming-Chi Kuo is out with a new analyst note today and the most interesting part of his forecast is that Apple will release its first Mac with an ARM processor in the first half of 2021. From a report: Kuo is predicting that one of Apple's new products to be released within the next 12-18 months will be a Mac with an in-house processor, instead of using an Intel CPU. There have been growing reports over the last couple of years about Apple making the switch to a custom-designed ARM processor for its Macs and today's report gives a concrete timeframe for when to expect that launch, which has actually held true since Kuo's prediction back in 2018. Since the coronavirus outbreak, Kuo highlights that Apple has been "more aggressive" with its funding for research, development, and production of 5nm process chips that are expected to show up in the first Macs with ARM CPUs. That's because 5nm chips will be integral to iPhone, iPad later this year, as well as Macs come 2021.' -- source: https://apple.slashdot.org/story/20/02/24/184242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Tablet converted from Win10 to Linux
by Ian Stewart 25 Feb '20

25 Feb '20

Hi Guys, A correction to my story at last nights meeting about converting a tablet from running Win10 to running Debian LXDE. In looking back at the notes I made during this installation, the tablet was an ACER Switch 10 - Model SW5-012. It's CPU is an Intel Atom Processor Z3735F, 4x core, 64-bit, 1.33GHz. Last night I thought its CPU was an ARM chip. However it seems that this CPU has a similarity to ARM in that it needs to initially boot images written in 32-bit code in order to start booting the 64 bit Linux. Although I didn't succeed, in theory I could have installed a 64-bit Ubuntu LXDE 19.10 version, and got it to boot by putting 32 bit images into the /boot partition. That is according to this<https://www.instructables.com/id/Linux-Kiosk-Tablet-From-Acer-Aspire-Switch…> document. Instead I used the debian-live-10.2.0-i386-lxde.iso image and booted it from a USB stick to do an installation to the tablets MMC drive. At the moment the Debian Live team only produce i386 and AMD64 iso's. They do not produce an ARM iso. So the installation approach I took with this tablet, wouldn't work with Mike's PINEBook Pro (ARM) laptop. cheers, Ian.

1 0

Gopher's Rise and Fall Shows How Much We Lost When Monopolists Stole the Net
by Peter Reutemann 23 Feb '20

23 Feb '20

'Science-fiction writer, journalist and longtime Slashdot reader, Cory Doctorow, a.k.a. mouthbeef, writes: The Electronic Frontier Foundation (EFF) just published the latest installment in my case histories of "adversarial interoperability" -- once the main force that kept tech competitive. Today, I tell the story of Gopher, the web's immediate predecessor, which burrowed under the mainframe systems' guardians and created a menu-driven interface to campus resources, then the whole internet. Gopher ruled until browser vendors swallowed Gopherspace whole, incorporating it by turning gopher:// into a way to access anything on any Gopher server. Gopher served as the booster rocket that helped the web attain a stable orbit. But the tools that Gopher used to crack open the silos, and the moves that the web pulled to crack open Gopher, are radioactively illegal today. If you wanted do to Facebook what Gopher did to the mainframes, you would be pulverized by the relentless grinding of software patents, terms of service, anticircumvention law, bullshit theories about APIs being copyrightable. Big Tech blames "network effects" for its monopolies -- but that's a counsel of despair. If impersonal forces (and not anticompetitive bullying) are what keeps tech big then there's no point in trying to make it small. Big Tech's critics swallow this line, demanding that Big Tech be given state-like duties to police user conduct -- duties that require billions and total control to perform, guaranteeing tech monopolists perpetual dominance. But the lesson of Gopher is that adversarial interoperability is judo for network effects.' -- source: https://tech.slashdot.org/story/20/02/21/2240222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Dongle!!
by john 21 Feb '20

21 Feb '20

Hi All, Anyone care to help me with this issue please?? I just bought a USB Bluetooth adapter the icon on the desktop states ' standard: Detected Distance:255;Current State:gone; Status:No bluetooth device configured... Simulation mode (locking disabled)' Output from terminal. lsusb. Bus 003 Device 002: ID 0a12:0001 Cambridge Silicon Radio, Ltd Bluetooth Dongle (HCI mode) Output from "dmesg" 15.616762] Bluetooth: Core ver 2.22 [ 15.616785] NET: Registered protocol family 31 [ 15.616786] Bluetooth: HCI device and connection manager initialized [ 15.616790] Bluetooth: HCI socket layer initialized [ 15.616793] Bluetooth: L2CAP socket layer initialized [ 15.616800] Bluetooth: SCO socket layer initialized [ 18.714533] Bluetooth: BNEP (Ethernet Emulation) ver 1.3stan [ 18.714536] Bluetooth: BNEP filters: protocol multicast [ 18.714542] Bluetooth: BNEP socket layer initialized [ 20.153867] IPv6: ADDRCONF(NETDEV_UP): enp1s0: link is not ready [ 20.246093] r8169 0000:01:00.0 enp1s0: link down [ 20.246348] IPv6: ADDRCONF(NETDEV_UP): enp1s0: link is not ready [ 20.258191] IPv6: ADDRCONF(NETDEV_UP): wlx0019e08c5078: link is not ready [ 20.289093] IPv6: ADDRCONF(NETDEV_UP): wlx0019e08c5078: link is not ready [ 20.548998] IPv6: ADDRCONF(NETDEV_UP): wlx0019e08c5078: link is not ready [ 21.932491] wlx0019e08c5078: authenticate with 18:f1:45:96:63:4b [ 21.937373] wlx0019e08c5078: send auth to 18:f1:45:96:63:4b (try 1/3) [ 21.939214] wlx0019e08c5078: authenticated [ 21.939962] wlx0019e08c5078: associate with 18:f1:45:96:63:4b (try 1/3) [ 21.942561] wlx0019e08c5078: RX AssocResp from 18:f1:45:96:63:4b (capab=0x431 status=0 aid=1) [ 21.943456] wlx0019e08c5078: associated [ 21.981876] IPv6: ADDRCONF(NETDEV_CHANGE): wlx0019e08c5078: link becomes ready [ 26.871648] Bluetooth: RFCOMM TTY layer initialized [ 26.871656] Bluetooth: RFCOMM socket layer initialized [ 26.871663] Bluetooth: RFCOMM ver 1.11

2 1

Google launches the Android 11 Developer Preview today
by Peter Reutemann 21 Feb '20

21 Feb '20

'It's a bit earlier than the usual March release, but today Google is launching the first Android 11 Developer Preview. This first OS preview is coming to the Pixel 2, 3, 3a, and 4, along with generic system images for Project Treble devices. It also has a new name. Typically these releases have been denoted by a letter—Android 10 was the "Android Q Preview"—and while Android 11 is still called "Android R" internally, publicly this is the "Android 11 Developer Preview" to all us non-Googlers. True to form, Google has already started with the Spinal Tap references and starts the blog post with a dial that goes to 11. For now we're just working off a giant blog post with lots of bullet points, and nearly zero screenshots, so we're not sure what the scope of this release is really like. We'll have a hands-on later, but for now, here are some highlights. Android 10—The Ars Technica Review One of the most-used features of Android 11 will probably be a new "one-time permission" option for apps that want to access location, microphone, and camera data. In Android 10, Google added the ability to grant a permission to an app only when it was running in the foreground, and now users will be able to grant access to a permission a single time. This is already in iOS, and it makes a lot of sense for certain apps.' -- source: https://arstechnica.com/gadgets/2020/02/google-launches-the-android-11-deve… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

The Linux Foundation Identifies Most Important Open-Source Software Components and Their Problems
by Peter Reutemann 21 Feb '20

21 Feb '20

'The Linux Foundation's Core Infrastructure Initiative (CII) and the Laboratory for Innovation Science at Harvard (LISH) have revealed -- in "Vulnerabilities in the Core, a preliminary report and Census II of open-source software" -- the most frequently used components and the vulnerabilities they share. From a report: This Census II analysis and report is the first major study of its kind but isn't a final analysis. It takes important first steps and lays out a methodology for understanding and addressing open-source software structural and security complexities. Specifically, it also identifies the most commonly used free and open-source software (FOSS) components in production applications and examines them for potential vulnerabilities. To create this work, CII and LISH partnered with Software Composition Analysis (SCAs) and application security companies such as Snyk and Synopsys Cybersecurity Research Center. They combined private usage data with publicly available datasets for identifying over 200 of the most used open-source software projects. These are not the programs -- Apache, MySQL, Linux -- that probably spring to your mind. For all their foundational importance, it's the small building block programs that are most widely used. They may be small, sometimes less than a hundred lines of code (LoC), but they're vital. As Frank Nagle, a professor at Harvard Business School and co-director of the Census II project, said: "FOSS was long seen as the domain of hobbyists and tinkerers. However, it has now become an integral component of the modern economy and is a fundamental building block of everyday technologies like smart phones, cars, the Internet of Things, and numerous pieces of critical infrastructure. Understanding which components are most widely used and most vulnerable will allow us to help ensure the continued health of the ecosystem and the digital economy."' -- source: https://news.slashdot.org/story/20/02/20/1349241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft To Bring Its Defender Antivirus Software To iOS and Android
by Peter Reutemann 21 Feb '20

21 Feb '20

'Microsoft said today it plans to bring its antivirus software, Defender Advanced Threat Protection, to phones and other devices running Apple's iOS and Google's Android. From a report: The software, also called Defender ATP, is already available on Windows and MacOS. It offers features like preventive protection, post-breach detection and automated investigation and response, according to Microsoft. When it comes to mobile devices, Microsoft's Rob Lefferts said that the Defender software could help companies protect employees from things like malware and phishing attacks. Apple's and Google's app stores are "pretty safe," Lefferts said, but "malware does happen on those platforms."' -- source: https://it.slashdot.org/story/20/02/20/1928225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

VPN
by john 20 Feb '20

20 Feb '20

Are any of the Mozilla add-ons listed in the attachment a good thing to add to Firefox? Cheers John...

2 1

Mozilla's Standalone Firefox VPN is Now Available in Beta
by Peter Reutemann 20 Feb '20

20 Feb '20

'Mozilla has a new virtual private network service and if you have a Chromebook, a Windows 10 computer or an Android device in the US, you can start using a beta version now. From a report: Called Firefox Private Network, the new service is designed to function as a full-device VPN and give better protection when surfing the web or when using public Wi-Fi networks. The company offers two options: a free browser-extension version, which it launched in beta last year, that provides 12 one-hour VPN passes when using the Firefox browser and a Firefox account; and a second, $4.99-a-month option that provides a more complete VPN service across your whole device. The new paid option, which runs off of servers provided by Swedish open-source VPN company Mullvad, can protect up to five devices with one account. It allows for faster browsing and streaming, and gives you the ability to tap into servers located in "30-plus countries" for masking your location data.' -- source: https://news.slashdot.org/story/20/02/19/1910233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Why fixing security vulnerabilities in medical devices, IoT is so hard
by Peter Reutemann 20 Feb '20

20 Feb '20

'When your family opened up that brand-new computer when you were a kid, you didn’t think of all of the third-party work that made typing in that first BASIC program possible. There once was a time when we didn't have to worry about which companies produced all the bits of licensed software or hardware that underpinned our computing experience. But recent malware attacks and other security events have shown just how much we need to care about the supply chain behind the technology we use every day. The URGENT/11 vulnerability, the subject of a Cybersecurity and Infrastructure Security Agency advisory issued last July, is one of those events. It forces us to care because it affects multiple medical devices. And it serves as a demonstration of how the software component supply chain and availability of support can affect the ability of organizations to update devices to fix security bugs—especially in the embedded computing space. URGENT/11 is a vulnerability in the Interpeak Networks TCP/IP stack (IPNet), which was licensed out to multiple vendors of embedded operating systems. IPNet also became the main networking stack in Wind River VxWorks, until Wind River acquired Interpeak in 2006 and stopped supporting IPNet. (Wind River itself was acquired by Intel in 2009 and spun off in 2018.) But the end of support didn’t stop several other manufacturers from continuing to use IPNet. When critical bugs were discovered in IPNet, it set off a scare among the numerous medical device manufacturers that run it as part of their product build.' -- source: https://arstechnica.com/information-technology/2020/02/medical-device-vulne… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 73 Attack Dog
by Lawrence D'Oliveiro 19 Feb '20

19 Feb '20

Did my roughly-monthly update of Debian Unstable yesterday, and got yet another new version of Firefox. Quite sobering to see the extra protections being triggered now, on sites that I regularly visit. I got a warning earlier today about fingerprinters on aljazeera.com, though on revisiting the site a minute ago these no longer show up. Still an amazing number of cross-site tracking cookies, also present on arstechnica.com. The report for the latter shows a couple of fingerprinters currently being blocked, even though I got no explicit warning about that. It also says that “cryptominers” are blocked by default, but when I visited a certain well-known torrent-search site which has a policy of mining bitcoins on users’ machines, it didn’t show any present on that site, even though I could still hear my machine’s fans cranking up from the increased CPU load (which went away when I closed that tab).

1 0

Google Confirms It Again Removed Alleged Spying Tool ToTok From Google Play
by Peter Reutemann 18 Feb '20

18 Feb '20

'Google has confirmed that the popular messaging app ToTok, which is actually a spying tool used by the United Arab Emirates to track the activities of those who download it, has again been removed from the Play Store. But this time they declined to comment as to why. TechCrunch reports: Reached for comment, Google confirmed to TechCrunch that it removed the app from Google Play. In addition, Google noted the enforcement was not done in response to any external direction or request. That means the U.S. government did not get involved here, rather that Google chose to remove the app itself -- likely for a policy violation. According to The NYT's original report, ToTok had been downloaded millions of times from both Apple and Google's app stores by customers across the Middle East, Europe, Asia, Africa and North America in the few months since its launch. Citing unnamed U.S. intelligence sources, the report claimed the app had been used to track its users' "every conversation, movement, relationship, appointment, sound, and image." At the time of the app's removal, Google said the app had violated unspecified Google Play policies. The app had over 10 million installs by then, app intelligence firm Sensor Tower says. In January, ToTok's website announced the app was again available for download. The updated version submitted to Google Play included a new dialog that requested authorization to access and sync users' contact list, Vice reported. Oddly, this updated version of ToTok never ranked on Google Play's charts again.' -- source: https://yro.slashdot.org/story/20/02/17/2136251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bug In WordPress Plugin Can Let Hackers Wipe Up To 200,000 Sites
by Peter Reutemann 18 Feb '20

18 Feb '20

'WordPress site owners who use commercial themes provided by ThemeGrill are advised to update one of the plugins that come installed with these themes in order to patch a critical bug that can let attackers wipe their sites. The vulnerability resides in ThemeGrill Demo Importer, a plugin that ships with themes sold by ThemeGrill, a web development company that sells commercial WordPress themes. The plugin, which is installed on more than 200,000 sites, allows site owners to import demo content inside their ThemeGrill themes so they'll have examples and a starting point on which they can build their own sites. However, in a report published yesterday, WordPress security firm WebARX says that older versions of the ThemeGrill Demo Importer are vulnerable to remote attacks from unauthenticated attackers. Remote hackers can send a specially crafted payload to vulnerable sites and trigger a function inside the plugin. The vulnerable function resets the site's content to zero, effectively wiping the content of all WordPress sites where a ThemeGrill theme is active, and the vulnerable plugin is installed. Furthermore, if the site's database contains a user named "admin," then the attacker is granted access to that user with full administrator rights over the site.' -- source: https://it.slashdot.org/story/20/02/17/2111235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux distro review: Intel’s own Clear Linux OS
by Peter Reutemann 18 Feb '20

18 Feb '20

'Intel's Clear Linux distribution has been getting a lot of attention lately, due to its incongruously high benchmark performance. Although the distribution was created and is managed by Intel, even AMD recommends running benchmarks of its new CPUs under Clear Linux in order to get the highest scores. Recently at Phoronix, Michael Larabel tested a Threadripper 3990X system using nine different Linux distros, one of which was Clear Linux—and Intel's distribution got three times as many first-place results as any other distro tested. When attempting to conglomerate all test results into a single geometric mean, Larabel found that the distribution's results were, on average, 14% faster than the slowest distributions tested (CentOS 8 and Ubuntu 18.04.3). There's not much question that Clear Linux is your best bet if you want to turn in the best possible benchmark numbers. The question not addressed here is, what's it like to run Clear Linux as a daily driver? We were curious, so we took it for a spin.' -- source: https://arstechnica.com/gadgets/2020/02/linux-distro-review-intels-own-clea… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Samsung's Changes To Android Are Making Its Phones Less Secure, Says Google
by Peter Reutemann 18 Feb '20

18 Feb '20

'Google scolded Samsung this week for an issue discovered on the Korean phone maker's Galaxy A50. From a report: Google says Samsung made "unnecessary changes to Android's core kernel," adding the changes Samsung made threaten rather than strengthen the phone's security. The tech giant has a vested interest in making sure Android is secure for OEMs and end users alike. Earlier this week Google announced it has made measurable efforts to limit malicious apps on its Google Play Store and it's clamping down on the permissions apps can request, resulting in a 98% reduction in requests for access to user's call history and text messages. It's also been tackling more worrying bugs, like self-reinstalling ones. But in this instance, it's a hardware partner that's causing the problems. In a detailed blog post from Google's Project Zero Team, researcher Jann Honn outlines the exact issue with Samsung's changes to the Android kernel on the A50. Samsung's changes included a security feature to restrict an attacker from reading or modifying user data, but Honn says the move is "futile" and rather than bolstering security, it introduces vulnerabilities that could increase an attacker's ability to arbitrarily execute code.' -- source: https://tech.slashdot.org/story/20/02/17/1656204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday
by Peter Reutemann 17 Feb '20

17 Feb '20

Hi everyone We have a WLUG meeting next Monday: "Michael Cree will demo his Pinebook Pro and talk about his experiences with it, as well as challenges that he has (or still has to) overcome." Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/266791995/ https://gettogether.community/events/3275/wlug-meeting/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Alternative Browser 'Waterfox' Acquired By System1
by Peter Reutemann 17 Feb '20

17 Feb '20

'Waterfox is an open-source web browser for x64, ARM64, and PPC64LE systems, "intended to be speedy and ethical, and maintain support for legacy extensions dropped by Firefox, from which it is forked," according to Wikipedia. (Its tabs also still have angled sides with rounded corners.) Friday Waterfox's original creator, 24-year-old Alexandros Kontos, announced that the browser "now has funding and a development team, so Waterfox can finally start to grow!" after its acquisition by a company called System1. I started Waterfox when I was 16. It was a way for me to understand how large software projects worked and the Mozilla documentation was a great introduction... I've touted Waterfox as an ethical and privacy friendly browser... I never wanted Waterfox to be a part of the hyper-privacy community. It would just feel like standards that would be impossible to uphold, especially for something such as a web browser on the internet. Throughout the years people have always asked about Waterfox and privacy, and if they've ever wanted more than it can afford, I've always pushed them to use Tor. Waterfox was here for customisations and speed, with a good level of privacy... I wasn't doing anything with Waterfox except developing it and making some money via search. Why I kept going throughout the years, I'll never know... System1 has been to Waterfox a search syndication partner. Essentially a way to have a search engine partnership (such as Bing) is through them, because companies such as Microsoft are too big and too busy to talk to small players such as Waterfox... It's probably the one easy way a browser can make money without doing anything dodgy, and it's a way I've been happy to do it without having to compromise Waterfox (and will be the same way System1 makes money from Waterfox -- nothing else). People also don't seem to understand what System1 does... "Now I can finally focus on making Waterfox into a viable alternative to the big browsers," Kontos concludes. Long-time Slashdot reader Freshly Exhumed contextualized the news with this brief history of the alternate browser ecosystem: As the usage share of web browsers continues to show a lopsideded dominance by Google Chrome, many previously-independent browsers have fallen by the wayside or have been reinvented as Chrome variants (i.e. Opera, Edge, Brave). Apple forges on with its Safari browser while other, smaller projects tend to be quite limited for multi-platform users, such as Dolphin and Bromite. Mozilla continues independently with Firefox for almost every platform, while variants such as Pale Moon and Sea Monkey have attempted to provide products that avoid drastic and/or controversial changes made by Mozilla but sometimes do not match the multi-platform support of Firefox. Let us not forget Tor, the Firefox-based anonymity-focused browser. Alex Kontos is a developer who attempted to provide continuity with dropped Firefox capabilities in his multi-platform Waterfox browser, proudly declaring that Firefox's user data sharing and telemetry collection was not included. For that privacy focus a certain popularity of Waterfox occurred. Now Kontos has revealed that his Waterfox project has been sold to System1, a company describing itself as "a consumer internet and applications company with the most powerful audience expansion platform in the industry." ' -- source: https://tech.slashdot.org/story/20/02/16/2146256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Chrome Will Soon Start Blocking Insecure Downloads
by Peter Reutemann 17 Feb '20

17 Feb '20

'"Google has revealed plans to initially warn Chrome users about 'insecure' downloads and eventually block them outright," reports The Verge. The warnings will begin in April: "Today we're announcing that Chrome will gradually ensure that secure (HTTPS) pages only download secure files," Joe DeBlasio of the Chrome security team wrote in a blog post. "Insecurely-downloaded files are a risk to users' security and privacy. For instance, insecurely-downloaded programs can be swapped out for malware by attackers, and eavesdroppers can read users' insecurely-downloaded bank statements." Beginning with Chrome 82, due for release in April, Chrome will warn users if they're about to download mixed content executables from a secure website. Then, when version 83 is released, those executable downloads will be blocked and the warning will be applied to archive files. PDFs and .doc files will get the warning in Chrome 84, with audio, images, text, and video files displaying it by version 85. Finally, all mixed content downloads — a non-secure file coming from a secure site — will be blocked as of the release of Chrome 86. Right now, Google is estimating an October release for that build of the popular web browsing.' -- source: https://tech.slashdot.org/story/20/02/16/1926231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Do We Need To Talk About 'Cloud Neutrality'?
by Peter Reutemann 17 Feb '20

17 Feb '20

'"A multibillion-dollar, privately-owned infrastructure is now essential to the modern internet economy," writes Wired. And if you care about net neutrality, "That should freak you out." [T]here's an even bigger issue brewing, and it's time to start talking about it: cloud neutrality. "While its name sounds soft and fluffy," Microsoft president and general counsel Brad Smith and coauthor Carol Ann Browne write in their recent book, Tools and Weapons: The Promise and the Peril of the Digital Age, "in truth the cloud is a fortress...." Each data center costs hundreds of millions of dollars to build and many millions more to maintain; and you pretty much can't build a successful new company without them. So, thank goodness for Microsoft, right? The book means to portray this might and power as both a source of wonder and an enabling feature of the modern economy. To me, it reads like a threat. The cloud economy exists at the pleasure, and continued profit, of a handful of companies. The internet is no longer the essential enabler of the tech economy. That title now belongs to the cloud. But the infrastructure of the internet, at least, was publicly financed and subsidized. The government can set rules about how companies have to interact with their customers. Whether and how it sets and enforces those rules isn't the point, for now. It can. That's not the case with the cloud. This infrastructure is solely owned by a handful of companies with hardly any oversight. [Besides Microsoft, the article also notes Google and Amazon.] The potential for abuse is huge, whether it's through trade-secret snooping or the outright blocking, slowing, or hampering of transmission. No one seems to be thinking about what could happen if these behemoths decide it's against their interests to have all these barnacles on their flanks. They should be. Cloud companies "are essentially incubating and hosting their competition..." the article points out. "The problem is that few have the resources to replicate the cloud infrastructure, should the landlords suddenly turn on their tenants."' -- source: https://tech.slashdot.org/story/20/02/16/1847204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

OpenPower Foundation Releases a Friendly EULA For IBM's Power ISA RISC
by Peter Reutemann 17 Feb '20

17 Feb '20

'Michael Larabel, of Phoronix, writes that the OpenPower Foundation has released a license agreement for Hardware Vendors to implement the Power ISA RISC instruction set in their processors. Hugh Blemings, the Director of OpenPower, was responsible for ensuring that the EULA is favourable and friendly towards Libre and Open Hardware projects and businesses. Of particular interest is that IBM's massive patent portfolio is automatically granted, royalty-free as long as two conditions apply: firstly, the hardware must be fully and properly Power ISA compliant, and secondly, the implementor must not "try it on" as a patent troll. Innovation in the RISC space just got a little more interesting. "Amidst the fully free and open RISC-V ISA making headway into the computing market, and ARM feeling pressured to loosen up its licensing, it seems they figured that it's best to join the party early," argues Hackaday.' -- source: https://news.slashdot.org/story/20/02/16/1743222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox, Wordpress Move to Support Lazy Loading of Images and iFrames
by Peter Reutemann 17 Feb '20

17 Feb '20

'"Lazy Loading" would augment HTML's <img> tag (and <iframe> tag) with two new attributes -- "eager" (to load immediately) and "lazy" (to load only when it becomes relevant in the viewport). Felix Arntz, a developer programs engineer at Google (and a WordPress core committer) notes the updates in the HTML specification for the lazy loading attributes, adding that it's "already supported by several browsers, including Chrome and Edge" and also the Android browser and Opera. And lazy loading can now also be toggled on for Firefox 75 Nightly users, reports Neowin, though it's disabled by default: It's not clear if it will be enabled by the time Firefox 75 reaches the stable branch but according to comments on the Bugzilla thread, it's in high demand. Previously, websites could employ lazy loading by using JavaScript but now lazy loading syntax is supported directly in the web browser. The implementation in Firefox comes after Google added the feature to its browser. Google's Arntz has also written a post describing a proposal to begin lazy-loading images by default in Wordpress. The proposed solution is available as a feature plugin WP Lazy Loading in the plugin repository. The plugin is being developed on GitHub. Your testing and feedback will be much appreciated.' -- source: https://news.slashdot.org/story/20/02/16/0229240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FSF Sends Microsoft A Blank Hard Drive For Sending Back The Windows 7 Source Code
by Peter Reutemann 16 Feb '20

16 Feb '20

'The Free Software Foundation sent Microsoft a hard drive for Valentine's Day -- along with a petition calling for the release of the source code for Windows 7 (which is no longer supported by Microsoft): It's as easy as copying the source code, giving it a license notice, and mailing it back to us. As the author of the most popular free software license in the world, we're ready to give them all of the help we can. All they have to do is ask. We want them to show exactly how much love they have for the "open source" software they mention in their advertising. If they really do love free software -- and we're willing to give them the benefit of the doubt -- they have the opportunity to show it to the world. We hope they're not just capitalizing on the free software development model in the most superficial and exploitative way possible: by using it as a marketing tool to fool us into thinking that they care about our freedom. Together, we've stood up for our principles. They can reject us, or ignore us, but what they cannot do is stop us. We'll go on campaigning, until all of us are free.' -- source: https://tech.slashdot.org/story/20/02/15/0213242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linux is Ready for the End of Time
by Peter Reutemann 16 Feb '20

16 Feb '20

'January 19, 2038 is for Linux what Y2K was for mainframe and PC computers in 2000, reports ZDNet. It's the day that the value for time "runs out of numbers" and, in the case of 32-bit Unix-based operating systems like Linux and older versions of macOS, "starts counting time with negative numbers..." "But the fixes are underway to make sure all goes well when that fatal time rolls around." nickwinlund77 shared their report: Linux developers have seen this coming for decades. So, Linux kernel developer Arnd Bergmann and others have been working on a repair. These corrections are now in the forthcoming Linux 5.6 kernel. Bergmann explained, "Linux-5.6, or my backport of the patches to 5.4, should be the first release that can serve as a base for a 32-bit system designed to run beyond year 2038." There are some caveats: - All user space must be compiled with a 64-bit time_t, which will be supported in the coming musl-1.2 and glibc-2.32 releases, along with installed kernel headers from Linux-5.6 or higher. - Applications that use the system call interfaces directly need to be ported to use the time64 syscalls added in Linux-5.1 in place of the existing system calls. - Applications that use a private copy of kernel uapi header files or their contents may need to update to the Linux-5.6 version. - A few remaining interfaces cannot be changed to pass a 64-bit time_t in a compatible way, so they must be configured to use CLOCK_MONOTONIC times... After we fix this, we won't have to worry about 64-bit Linux running out of seconds until 15:30:08 GMT Sunday, December 4, 29,227,702,659. Personally, I'm not going to worry about that one.' -- source: https://linux.slashdot.org/story/20/02/15/0247201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Signal Is Finally Bringing Its Secure Messaging To the Masses
by Peter Reutemann 15 Feb '20

15 Feb '20

'[Cryptographer and coder known as Moxie Marlinspike] has always talked about making encrypted communications easy enough for anyone to use. The difference, today, is that Signal is finally reaching that mass audience it was always been intended for -- not just the privacy diehards, activists, and cybersecurity nerds that formed its core user base for years -- thanks in part to a concerted effort to make the app more accessible and appealing to the mainstream. That new phase in Signal's evolution began two years ago this month. That's when WhatsApp cofounder Brian Acton, a few months removed from leaving the app he built amid post-acquisition clashes with Facebook management, injected $50 million into Marlinspike's end-to-end encrypted messaging project. Acton also joined the newly created Signal Foundation as executive chairman. The pairing up made sense; WhatsApp had used Signal's open source protocol to encrypt all WhatsApp communications end-to-end by default, and Acton had grown disaffected with what he saw as Facebook's attempts to erode WhatsApp's privacy. Since then, Marlinspike's nonprofit has put Acton's millions -- and his experience building an app with billions of users -- to work. After years of scraping by with just three overworked full-time staffers, the Signal Foundation now has 20 employees. For years a bare-bones texting and calling app, Signal has increasingly become a fully featured, mainstream communications platform. With its new coding muscle, it has rolled out features at a breakneck speed: In just the last three months, Signal has added support for iPad, ephemeral images and video designed to disappear after a single viewing, downloadable customizable "stickers," and emoji reactions. More significantly, it announced plans to roll out a new system for group messaging, and an experimental method for storing encrypted contacts in the cloud. Many of those features might sound trivial. They certainly aren't the sort that appealed to Signal's earliest core users. Instead, they're what Acton calls "enrichment features." They're designed to attract normal people who want a messaging app as multifunctional as WhatsApp, iMessage, or Facebook Messenger but still value Signal's widely trusted security and the fact that it collects virtually no user data. Wired explains how adding simple-sounding enhancements can require significant feats of security engineering to fit within Signal's privacy constraints. Adding downloadable customizable stickers, for example, "required designing a system where every sticker 'pack' is encrypted with a 'pack key,'" reports Wired. "That key is itself encrypted and shared from one user to another when someone wants to install new stickers on their phone, so that Signal's server can never see decrypted stickers or even identify the Signal user who created or sent them." For Signal's new group messaging, Signal partnered with Microsoft Research to invent a novel form of "anonymous credentials" that let a server gatekeep who belongs in a group, but without ever learning the members' identities.' -- source: https://it.slashdot.org/story/20/02/14/2216214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

UK West Midlands Police Warn Against Evils Of Kali Linux
by Lawrence D'Oliveiro 15 Feb '20

15 Feb '20

A poster was recently issued <https://www.theregister.co.uk/2020/02/14/silly_police_infosec_parental_advi…> by the West Midlands Regional Organised Crime Unit, also bearing the logo of the National Crime Agency, warning parents to watch out for certain signs of delinquency on their children’s computer, such as use of virtual machines, Kali Linux, Discord and various other things. The NCA have disavowed any knowledge of the poster.

1 0

An Old Android Virus is Reinstalling Itself Even After Factory Resets
by Peter Reutemann 14 Feb '20

14 Feb '20

'A particularly persistent malware infection has been spreading amongst Android phones -- and removing it only seems to bring it back with a vengeance. From a report: The Trojan xHelper, which Malwarebytes first wrote about last year, is reportedly re-spawning on devices where it's already been removed. If virus-removal software doesn't take care of a nasty infection, a hard reset will usually do the trick. But users report that even a full factory reset of an infected device doesn't wipe xHelper out completely. Within an hour the malware is usually back and ready to wreak havoc.' -- source: https://it.slashdot.org/story/20/02/13/1745252 The above news article has a link on how to remove it. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

500 Chrome Extensions Secretly Uploaded Private Data From Millions of Users
by Peter Reutemann 14 Feb '20

14 Feb '20

'More than 500 browser extensions downloaded millions of times from Google's Chrome Web Store surreptitiously uploaded private browsing data to attacker-controlled servers, researchers said on Thursday. Ars Technica reports: The extensions were part of a long-running malvertising and ad-fraud scheme that was discovered by independent researcher Jamila Kaya. She and researchers from Cisco-owned Duo Security eventually identified 71 Chrome Web Store extensions that had more than 1.7 million installations. After the researchers privately reported their findings to Google, the company identified more than 430 additional extensions. Google has since removed all known extensions. "In the case reported here, the Chrome extension creators had specifically made extensions that obfuscated the underlying advertising functionality from users," Kaya and Duo Security Jacob Rickerd wrote in a report. "This was done in order to connect the browser clients to a command and control architecture, exfiltrate private browsing data without the users' knowledge, expose the user to risk of exploit through advertising streams, and attempt to evade the Chrome Web Store's fraud detection mechanisms." The extensions were mostly presented as tools that provided various promotion- and advertising-as-a service utilities. In fact, they engaged in ad fraud and malvertising by shuffling infected browsers through a maze of sketchy domains. Each plugin first connected to a domain that used the same name as the plugin (e.g.: Mapstrek[.]com or ArcadeYum[.]com) to check for instructions on whether to uninstall themselves. The plugins then redirected browsers to one of a handful of hard-coded control servers to receive additional instructions, locations to upload data, advertisement feed lists, and domains for future redirects. Infected browsers then uploaded user data, updated plugin configurations, and flowed through a stream of site redirections. The researchers say the campaign dates back to at least January 2019, but it's possible that the operators were active "as early as 2017."' -- source: https://yro.slashdot.org/story/20/02/13/2355237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Announces Windows 10X
by Lawrence D'Oliveiro 13 Feb '20

13 Feb '20

A report <https://www.theregister.co.uk/2020/02/12/microsoft_previews_windows_10x/> on major new changes coming to the architecture of Microsoft Windows. This includes locking up all Win32 apps, that is to say the majority of Windows apps (now considered “legacy”), in a sandbox where they are strictly limited in what they can do to your OS, and even your documents. Access by the user to these apps is constrained through a channel very similar to RDP, which is normally only used for remote access. Interesting to see that, in 2020, Microsoft is still battling “OS rot”, which computer humourist Verity Stob was making fun of nearly two decades ago.

1 0

KDE Plasma 5.18 Released
by Peter Reutemann 12 Feb '20

12 Feb '20

'The KDE community today announced the release of Plasma 5.18. This version of the popular desktop environment is the latest long-term supported release and brings an emoji selector, user feedback capabilities, a global edit mode, and improvements to System Settings, the Discover software manager, widgets, GTK integration and much more.' -- source: https://news.slashdot.org/story/20/02/11/224207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 73 Arrives With Default Zoom Level and Readability Backplate
by Peter Reutemann 12 Feb '20

12 Feb '20

'Mozilla today released Firefox 73 for Windows, Mac, Linux, and Android. Firefox 73 includes a default zoom level setting, a readability backplate option, and a handful of developer features.' -- source: https://news.slashdot.org/story/20/02/11/1953208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

One of the most destructive botnets can now spread to nearby Wi-Fi networks
by Peter Reutemann 12 Feb '20

12 Feb '20

'Over the past half decade, the Emotet malware has emerged as a top Internet threat that pillages people’s bank accounts and installs other types of malware. The sophistication of its code base and its regularly evolving methods for tricking targets into clicking on malicious links—in September, for instance, it began a spam run that addresses recipients by name and quotes past emails they sent or received—has allowed it to spread widely. Now, Emotet is adopting yet another way to spread: using already compromised devices to infect devices connected to nearby Wi-Fi networks. World’s most destructive botnet returns with stolen passwords and email in tow Last month, Emotet operators were caught using an updated version that uses infected devices to enumerate all nearby Wi-Fi networks. It uses a programming interface called wlanAPI to profile the SSID, signal strength, and use of WPA or other encryption methods for password-protecting access. Then, the malware uses one of two password lists to guess commonly used default username and password combinations. After successfully gaining access to a new Wi-Fi network, the infected device enumerates all non-hidden devices that are connected to it. Using a second password list, the malware then tries to guess credentials for each user connected to the drive. In the event no connected users are infected, the malware tries to guess the password for the administrator of the shared resource.' -- source: https://arstechnica.com/information-technology/2020/02/one-of-the-most-dest… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bash Insulter
by Lawrence D'Oliveiro 12 Feb '20

12 Feb '20

How would you like your shell (Bash or Zsh) to insult you every time you typed a wrong command? You need wait no longer, just install this <https://gitlab.com/dwt1/bash-insulter>. Of course, the insults list is customizable. The guy who wrote it also runs the DistroTube channel on YouTube <https://www.youtube.com/channel/UCVls1GmFKf6WlTraIb_IaJg/videos>.

2 1

South Korea's Government Explores Move From Windows To Linux Desktop
by Peter Reutemann 11 Feb '20

11 Feb '20

'In May 2019, South Korea's Interior Ministry announced plans to look into switching to the Linux desktop from Windows. It must have liked what it saw. According to the Korean news site Newsis, the South Korean Ministry of Strategy and Planning has announced the government is exploring moving most of its approximately 3.3 million Windows computers to Linux. The reason for this is simple. It's to reduce software licensing costs and the government's reliance on Windows. As Choi Jang-hyuk, the head of the Ministry of Strategy and Finance, said, "We will resolve our dependency on a single company while reducing the budget by introducing an open-source operating system." How much? South Korean officials said it would cost 780 billion won (about $655 million) to move government PCs from Windows 7 to Windows 10. [...] Windows will still have a role to play for now on South Korean government computers. As the Aju Business Daily, a South Korean business news site, explained: Government officials currently use two physical, air-gapped PCs. One is external for internet use, and the other is internal for intranet tasks. Only the external one will use a Linux-based distro. Eventually, by 2026, most civil servants will use a single Windows-powered laptop. On that system, Windows will continue to be used for internal work, while Linux will be used as a virtual desktop via a Linux-powered cloud server. This looks to eventually end up as a Desktop-as-a-Service (DaaS) model. The report notes that the Ministry of National Defense and National Police Agency are already using the Ubuntu Linux 18.04 LTS-based Harmonica OS 3.0. "Meanwhile, the Korean Postal Service division is moving to TMaxOS," reports ZDNet. "The Debian Linux-based South Korean Gooroom Cloud OS is also being used by Defense and the Ministry of Public Administration and Security."' -- source: https://linux.slashdot.org/story/20/02/10/2133246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Companies That Buy Data Derived From Scraping the Contents of Your Email Inbox
by Peter Reutemann 11 Feb '20

11 Feb '20

'The popular Edison email app, which is in the top 100 productivity apps on the Apple app store, scrapes users' email inboxes and sells products based off that information to clients in the finance, travel, and e-Commerce sectors. The contents of Edison users' inboxes are of particular interest to companies who can buy the data to make better investment decisions, according to a J.P. Morgan document obtained by Motherboard. On its website Edison says that it does "process" users' emails, but some users did not know that when using the Edison app the company scrapes their inbox for profit. Motherboard has also obtained documentation that provides more specifics about how two other popular apps -- Cleanfox and Slice -- sell products based on users' emails to corporate clients. Some of the companies listed in the J.P. Morgan document sell data sourced from "personal inboxes," the document adds. A spokesperson for J.P. Morgan Research, the part of the company that created the document, told Motherboard that the research "is intended for institutional clients." That document describes Edison as providing "consumer purchase metrics including brand loyalty, wallet share, purchase preferences, etc." The document adds that the "source" of the data is the "Edison Email App." On the product section of its website, Edison offers "Edison Trends" and "Trends Direct." The company says it can provide "Detailed behavior patterns to improve your customers' experience and business results." Edison is just one of several companies that offer free email apps which then sell anonymized or pseudonymized data derived from users' inboxes. Another company that mines inboxes called Foxintelligence has data that comes from users of the Cleanfox app, which tidies up users' inboxes. Some of the "examples of clients" mentioned in a confidential Foxintelligence presentation include PayPal, consulting giants Bain & Company, and McKinsey & Company. "A spreadsheet containing data from Rakuten's Slice, an app that scrapes a user's inbox so they can better track packages or get their money back once a product goes down in price, contains the item that an app user bought from a specific brand, what they paid, and an unique identification code for each buyer," adds Motherboard. "An email obtained by Motherboard appeared to show the price for access to Rakuten data for one product category as over $100,000."' -- source: https://yro.slashdot.org/story/20/02/10/2158242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Windows 10 Start Menu Now Harasses Firefox Users
by Peter Reutemann 11 Feb '20

11 Feb '20

'The "Suggested" section on the Windows 10 Start Menu used to just promote its own apps, reports MSPowerUser. But for some users (who haven't disable Microsoft's "Suggestions"), that menu is now showing a new kind of ad listing: The listing displays "Still using Firefox? Microsoft Edge is here", to all users of the former -- even with the latter already installed. The ad provides a link to download the chromium-based browser. Undoubtedly, the suggestions won't end here. Microsoft is reportedly planning to sprawl similar ads out to Wordpad, to encourage users to download official Office apps. The Windows Latest blog points out that Microsoft's "Suggestions" can be "permanently disabled with a few tweaks unlike the Chrome ads in Google search results."' -- source: https://news.slashdot.org/story/20/02/10/0014245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Suspicion and Anger Towards Microsoft Rises After Windows 10 Search Failure
by Peter Reutemann 10 Feb '20

10 Feb '20

'Earlier this week, searching in Windows 10 was broken, "with a black bar showing where search results should be, even for those who tried to perform a local search of their files." Microsoft issued a fix and blamed the issue on a "third-party networking fiber provider". But unfortunately, Microsoft's fix isn't working for everyone -- and that's just the beginning. Long-time Slashdot reader Futurepower(R) shares Forbes' report: Second, and more worryingly, Microsoft's explanation doesn't add up and it has prompted serious questions to be asked about how the operating system works and what personal data it is sharing. Popular Microsoft pundit Woody Leonard led the charge, writing: "If you believe that yesterday's worldwide crash of Windows 10 Search was caused by a bad third-party fiber provider, I have a bridge to sell you." In an open letter to new Windows head Panos Panay, Susan 'Patch Lady' Bradley was similarly sceptical, noting that today "we all found out that our local search boxes are somehow dependent on some service working at Microsoft." She attacked the company for a lack of transparency and gave it a maximum 'Pinocchio score' for a lack of trust... Similarly, Engadget writer Richard Lawler revealed that users were now trying to hack the Windows 10 registry to disconnect their local file searches from Microsoft servers "and I can't say I blame them after this episode. Microsoft owes users a better explanation than this and should make sure it's impossible for offline features to get taken out when the cloud is having an issue." In fact, Forbes writes that "the aforementioned Windows 10 registry hack appears to be the only 100% fix for this issue and it also disconnects Bing and Cortana online services from Windows 10 search." And then on Saturday the Windows Latest blog also noticed that Microsoft's release notes for Windows 10 20H1 Build 19035 reveal that Microsoft is apparently now delaying the roll-out of a widely-anticipated "Optional Updates" option. "It appears that the new Optional updates experience will come out in October/November 2020, not this spring as previously planned."' -- source: https://tech.slashdot.org/story/20/02/09/2241212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel's 'Clear Linux' Distro Beats Ubuntu and Windows 10 -- on an AMD Laptop
by Peter Reutemann 10 Feb '20

10 Feb '20

'Intel's Clear Linux distribution looks like it could be the best operating system to run on cheap AMD hardware, with benchmarks showing it outperforms Windows 10 and Ubuntu on a $199 laptop with a budget AMD Ryzen 3200U processor. The Phoronix website ran a series of benchmarks on a super-cheap AMD laptop from Walmart, and found that Intel Clear Linux beat popular Linux distros Fedora and Ubuntu for 78% of the tests. Not only is it remarkable that a relatively unknown Linux distro is so easily outperforming established operating systems, the fact that Intel is the company behind the distro is particularly ironic. As you can imagine, Clear Linux is optimized for Intel processors, but it seems like it works brilliantly on AMD hardware as well.' -- source: https://linux.slashdot.org/story/20/02/08/1849207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Almost Every Website You Visit Records Exactly How Your Mouse Moves
by Peter Reutemann 09 Feb '20

09 Feb '20

'Medium's technology blog OneZero reports that many websites today use a service that collects all of your mouse movements, enabling "replays" of every move. "What surprised me was that the software even recorded when I shook my mouse around while deciding what to click on. It felt like observing digital body language." Session replay services have been around for over a decade and are widely used. One service, called FullStory, lists popular sites like Zillow, TeeSpring, and Jane as clients on its website. Another, called LogRocket, boasts Airbnb, Reddit, and CarFax, and a third called Inspectlet lists Shopify, ABC, and eBay among its users. They bill themselves as tools for designing sites that are easy to use and increase desired user behavior, such as buying an item. If many users add items to their cart, but then abandon the purchase at a certain rough part of the checkout process, for instance, the service helps site owners figure out how to change the site's design to nudge users over the checkout line... FullStory even has a feature that tracks what it calls "rage clicks." This is when a user gets frustrated with a site and starts angrily clicking over and over. In a semi-related story, a reporter for The Markup also recently discovered Amazon had apparently collected 90,000 rows of timestamped data about every tap they'd made on their Kindle.' -- source: https://yro.slashdot.org/story/20/02/08/002242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Elementary OS Wants to Crowdfund a Better Distro-Independent 'AppCenter for Everyone'
by Peter Reutemann 09 Feb '20

09 Feb '20

'In 2017 Elementary OS built a pay-what-you-want app store -- funded with $10,000 raised on IndieGogo. Now they're trying to raise another $10,000 for a one-week, in-person sprint in Denver, Colorado, Forbes reports, to upgrade the store while bringing an even grander concept to reality: That concept comprises 4 main goals: - Enable open source developers to monetize their apps on every other Linux distribution - Empower developers to ship apps with cutting-edge technologies - Improve privacy, security, and stability - Streamline the payments process On the technical side of things, the team plans to rebuild AppCenter's backend from the ground up to enable newer technologies developers are asking for, and they're rallying behind the Flatpak packaging format to get it done. They've already been collaborating with the FlatHub team, and plan to bring in developers from Endless and GNOME to ensure that "our solution can be reused and improved by other Flatpak stores and the greater open source desktop ecosystem." For a donation of $10, "you'll have your name immortalized in the AppCenter code on GitHub," explains a promotional video. (There's already 70 backers who have claimed this perk.) In fact, "Less than 8 hours ago we launched #AppCenterForEveryone, and we're 50% funded," announced an update Friday on Twitter. The campaign's web page shared this note of appreciation. "With your support, we'll be able to accelerate the timeline on adopting cutting edge technology and making an even more competitive Open Source operating system and a compelling foundation for all Flatpak stores."' -- source: https://linux.slashdot.org/story/20/02/08/1813251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Security In 2020: Revisited
by Lawrence D'Oliveiro 08 Feb '20

08 Feb '20

Security guru Bruce Schneier revisits <https://www.schneier.com/blog/archives/2020/02/security_in_202_1.html> an essay he wrote 10 years ago, looking ahead in security-related computing trends. If you can stomach the neologisms: Trend over the decade up to 2010: * deperimeterization -- the realization that securing the boundary isn’t enough, you have to have defence in depth. Also known as “submarine warfare”. Trends already becoming apparent in 2010: * consumerization -- the idea that computing needs in workplaces will be following the trends in consumer devices, not leading them * decentralization -- or rather, recentralization in the cloud Trends he forecast in 2010: * deconcentration -- the replacement of general-purpose computers with special-purpose devices. But he also includes special-purpose apps installed on more general-purpose devices like smartphones. * decustomerization -- the idea that we get more of our IT functionality without any business relationship. But beware the maxim: “if you’re not paying for the product, then you are the product”. Also this has been tried with hardware before without success, but he thinks it’s something that will be tried again. * depersonization -- software agents taking decisions on your behalf. Gadgets in your house (and your car) won’t even need you to manage them.

1 0

Google Fixes No-User-Interaction Bug In Android's Bluetooth Component
by Peter Reutemann 08 Feb '20

08 Feb '20

'Google has patched this week a critical security flaw in Android's Bluetooth component. If left unpatched, the vulnerability can be exploited without any user interaction and can even be used to create self-spreading Bluetooth worms. Researchers said that exploiting the bug requires no user interaction. All that is required is that the user has Bluetooth enabled on his device. However, while this requirement would have limited the attack surface in past years, it does not today since modern Android OS versions ship with Bluetooth enabled by default and many Android users use Bluetooth-based headphones meaning the Bluetooth service is likely to be enabled on many handsets. The bug can lead to remote code execution and the hijacking of a device. Fixes for the bug are available via the Android February 2020 Security Bulletin, which has been available for download starting this week. Android 9 and earlier are impacted.' -- source: https://tech.slashdot.org/story/20/02/07/0220203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Testing Disk Performance With fio
by Lawrence D'Oliveiro 07 Feb '20

07 Feb '20

Intro to a tool I hadn’t heard of before <https://arstechnica.com/gadgets/2020/02/how-fast-are-your-disks-find-out-th…>, but for which standard packages are available for Debian and derivatives. Lets you do all kinds of performance tests on your persistent storage (disks, SSDs), including hammering them with multiple concurrent I/O requests. Also I see Debian has “gfio”, which is a GUI front end based on GTK. (Just a quick *sigh* to see someone else use the old cliché of referring to magnetic media as “rust”. FYI, rust isn’t magnetic.)

2 1

Google Does Badly
by Lawrence D'Oliveiro 04 Feb '20

04 Feb '20

Kind of fun to read this report <https://www.aljazeera.com/ajimpact/alphabet-shares-fall-google-misses-sales…>, saying Google’s parent company Alphabet had its “worst fourth-quarter revenue growth since 2015”. Then you look at the numbers, showing ad revenue was up about 17% year-on-year, and while costs also went up: That left profit of $10.67bn, or $15.35 per share, compared with the analysts' average estimate of $8.787bn, or $12.53 per share. That’s right, Google was substantially *more* profitable than analysts were expecting. And yet its share price still apparently fell 3% after the news came out. That’s Wall Street for you...

1 0

A Reminder Of Why Removable Disk Packs Went Out Of Fashion
by Lawrence D'Oliveiro 04 Feb '20

04 Feb '20

Tricky things, removeable storage devices. Requiring fine tolerances between medium and drive is just asking for trouble. Here <https://www.theregister.co.uk/2020/02/03/who_me/> is a story of how a crash in one removeable 1960s-era unit ended up destroying a whole string of disk drives. I can remember also reading, in an old Computer Centre bulletin from an Australian university archived on Bitsavers, an item on their policy on removeable drive cartridges: you could only use cartridges allocated by them, you were not allowed to bring in cartridges from elsewhere. A similar thing happened to me, when the Zip drive in my 1998-vintage PowerMac G3 developed the infamous “click of death”, I only killed a couple of cartridges before I realized I should never use that drive again. Nowadays we have SD cards and hot-pluggable USB drives, which are a bit more robust against such failure modes. Or are they ... ?

1 0

Google Maps Hacks, Or, A Traffic Jam In A Cart
by Lawrence D'Oliveiro 04 Feb '20

04 Feb '20

A German artist named Simon Weckert has tricked Google Maps into thinking a major traffic jam was going on, simply by pulling a cart full of old mobile phones around Berlin <https://www.theregister.co.uk/2020/02/03/google_maps_hack_cartful_phones/>.

1 0

Cringely Predicts IBM 'Disappears Into Red Hat'
by Peter Reutemann 03 Feb '20

03 Feb '20

'Tech pundit Robert X. Cringely has been sharing technology predictions every January for over two decades -- and he made another big one on Friday: IBM has three divisions — Global Technology Services (GTS), Global Business Services (GBS), and Red Hat. GTS is the legacy IT business, GBS is the professional services business invented by Lou Gerstner to save IBM the last time it was in huge trouble, and Red Hat is Linux. GTS — that part of IBM most of us still think of as IBM — will probably be sold by summer. Either it will go to private equity (depends on the total debt load) or it will be sold to HPE or maybe to Oracle. Either way, it's not a likely success story, but [current CEO Ginni] Rometty has no real choice. IBM is, at this point, smoke, mirrors, and buybacks. The GTS windfall will land in Ginni's final quarter, juicing her payout, which might be the major point of the deal... IBM's new CEO is Arvind Krishna, formerly head of the Cognitive Computing unit — IBM's cloud guy. Except Cognitive Computing was never really cloud. Cognitive has been a mishmash of cloud, supported by revenue streams that are anything but cloud. It's cloud in name only and will be the part that goes next summer, possibly with Mr. Krishna still at its head. The next chairman of IBM after Rometty will be current Red Hat CEO Jim Whitehurst. If Whitehurst is as smart as I think he is, he started yesterday looking for a new job. It's not that he really intends to leave, but as the next savior of IBM, Ginni et al will pay anything to keep him. Cut your new deal now, Jim, while demand is greatest....Whitehurst will turn IBM into Red Hat, which will take HQ to North Carolina and mean most of the remaining GBS staff will be gone in a year... It still won't save IBM. They'll go down in the coming year or two along with the rest of the industry we used to call IT... Let's just say that IBM's loss is AWS's gain.' -- source: https://linux.slashdot.org/story/20/02/02/0448233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

MIT Numerical Courses Moving From MATLAB To Julia
by Lawrence D'Oliveiro 03 Feb '20

03 Feb '20

Came across this <https://github.com/mitmath/julia-mit> repo, which is an intro to the Julia language. Apparently this is increasingly being used in place of MATLAB in numerical-computation courses at MIT. Why not Python? Because it is fine as long as you can use existing computational kernels, but as soon as you need custom ones, it gets slow if you do them in Python, or requires special skills to write them in C or Fortran, and make them callable from Python. Julia incorporates a “just-in-time” compiler using LLVM to achieve speed close to that of C in this case. Why not MATLAB? Because it is proprietary: Unlike Matlab, [Julia] is free/open-source software, which eliminates licensing headaches and allows you to look inside the Julia implementation to see how it works (since Julia is mostly written in Julia, its code is much more readable than a language like Python that is largely implemented in low-level C). They do like using Julia in Jupyter notebooks. I see a few .ipynb files in the repos for other courses (along with a few .pptx ones as well, unfortunately). Also several “.jmd” files, which look like some variety of markdown.

2 1

The State Of Video Streaming In NZ
by Lawrence D'Oliveiro 03 Feb '20

03 Feb '20

Apple’s TV+ streaming service is coming soon, followed by Disney’s one <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=122666…>. Note: Disney+ will break Sky's longtime near-monopoly on Disney content in these parts. Disney says that, ultimately, Disney+ will be the exclusive home of its content. So to get a comparable range of TV content to that you currently have free-to-air, you are going to have to subscribe to two or three or maybe more different streaming services. The increasing multitude of things to pay for isn’t about choice, but about no choice at all.

1 2

Should Huawei Just Abandon Android?
by Peter Reutemann 03 Feb '20

03 Feb '20

'Due to a U.S. government ban on sales to Huawei, Google revoked its license for popular apps last spring (including Gmail and the Play Store). But this week Huawei executive Fred Wangfei suggested that even if that ban is lifted, Huawei would continue developing its own app ecosystem instead to avoid the possibility of future political complications. The vice president of risk management and partner relations at Huawei later called those remarks "incorrect," while elsewhere Huawei issued a slightly different statement -- that "An open Android ecosystem is still our first choice, but if we are not able to continue to use it, we have the ability to develop our own." But BGR was already noting that Huawei "is ready to invest $3 billion this year to incentivize more than 4,000 developers to improve its Huawei Mobile Services system. Another billion is reserved for marketing purposes." And Android Authority suggests Huawei should stick to its original statement. "Maybe it's time for Huawei to go all-in on Harmony OS and do what it can to bring a viable alternative to Android and iOS..." If there's any company today that has the financial resources and raw talent necessary to bring in a viable third choice for smartphone operating systems, it's Huawei... Sure, it would be a long-term investment and there would inevitably be short-term losses as the company tries to find its footing and develop Harmony OS to have its own identity. But it would prevent something like the Huawei ban from happening to the company again as well as further the company's ambitions as not only a smartphone manufacturer but as a technology creator.... Huawei would have major difficulties in encouraging wide adoption of Harmony OS for one major reason: it's Huawei. The Huawei ban exists because the United States government doesn't trust Huawei and there are numerous (as yet unproven) accusations against the company related to espionage, IP theft, fraud, and even violations of international treaties... Huawei is already in a bad situation. It's going to need to dig itself out of the hole it's in regardless, so why not use this opportunity to turn lemons into lemonade and develop Harmony OS as a viable third option on the way? Maybe the industry needs a shake-up... Maybe a new operating system is just the kind of fire OEMs need to turn the market around. Maybe a real, potent threat that the billions of people who use Android and iOS just might jump ship to something else would scare companies into taking some real risks. As I said earlier, there aren't too many companies out there right now that could do this, but Huawei could. ' -- source: https://tech.slashdot.org/story/20/02/01/0152225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linus Torvalds Pulls WireGuard VPN into Linux 5.6 Kernel Source Tree
by Peter Reutemann 02 Feb '20

02 Feb '20

'"The WireGuard VPN protocol will be included into the next Linux kernel as Linus Torvalds has merged it into his source tree for version 5.6," reports TechRadar: While there are many popular VPN protocols such as OpenVPN, WireGuard has made a name for itself by being easy to configure and deploy as SSH... The WireGuard protocol is a project from security researcher and kernel developer Jason Donenfeld who created it as an alternative to both IPsec and OpenVPN. Since the protocol consists of around just 4,000 lines of code as opposed to the 100,000 lines of code that make up OpenVPN, it is much easier for security experts to review and audit for vulnerabilities. While WireGuard was initially released for the Linux kernel, the protocol is now cross-platform and can be deployed on Windows, macOS, BSD, iOS and Android. Ars Technica notes that with Linus having merged WireGuard into the source tree, "the likelihood that it will disappear between now and 5.6's final release (expected sometime in May or early June) is vanishingly small." WireGuard's Jason Donenfeld is also contributing AVX crypto optimizations to the kernel outside the WireGuard project itself. Specifically, Donenfeld has optimized the Poly1305 cipher to take advantage of instruction sets present in modern CPUs. Poly1305 is used for WireGuard's own message authentication but can be used outside the project as well — for example, chacha20-poly1305 is one of the highest-performing SSH ciphers, particularly on CPUs without AES-NI hardware acceleration. Other interesting features new to the 5.6 kernel will include USB4 support, multipath TCP, AMD and Intel power management improvements, and more.' -- source: https://it.slashdot.org/story/20/02/01/1846256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

OpenBSD Mail Server Bug Allowed Remotely Executing Shell Commands As Root
by Peter Reutemann 02 Feb '20

02 Feb '20

'This week a remotely-exploitable vulnerability (granting root privileges) was discovered in OpenSMTPD (OpenBSD's implementation of server-side SMTP). ZDNet notes that the library's "portable" version "has also been incorporated into other OSes, such as FreeBSD, NetBSD, and some Linux distros, such as Debian, Fedora, Alpine Linux, and more." To exploit this issue, an attacker must craft and send malformed SMTP messages to a vulnerable server... OpenSMTPD developers have confirmed the vulnerability and released a patch earlier Wednesday -- OpenSMTPD version 6.6.2p1... The good news is that the bug was introduced in the OpenSMTPD code in May 2018 and that many distros may still use older library versions, not affected by this issue. For example, only in-dev Debian releases are affected by this issue, but not Debian stable branches, which ship with older OpenSMTPD versions. Technical details and proof of concept exploit code are available in the Qualys CVE-2020-7247 security advisory. Hackaday has a more detailed description of the vulnerability, while the Register looks at the buggy C code. Interestingly, Qualys researchers exploited this vulnerability using a technique from the Morris Worm of 1988.' -- source: https://it.slashdot.org/story/20/02/01/2254237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Moves To Monetize Thunderbird, Transfers Project To New Subsidiary
by Peter Reutemann 31 Jan '20

31 Jan '20

'The Mozilla Foundation announced today that it was moving its Thunderbird email client to a new subsidiary named the MZLA Technologies Corporation. From a report: Mozilla said that Thunderbird will continue to remain free and open source, but by moving the project away from its foundation into a corporate entity they will be able to monetize the product and pay for its development easier than before. Currently, Thunderbird is primarily being kept alive through charitable donations from the product's userbase. "Moving to MZLA Technologies Corporation will not only allow the Thunderbird project more flexibility and agility, but will also allow us to explore offering our users products and services that were not possible under the Mozilla Foundation," said Philipp Kewisch, Mozilla Product Manager. "The move will allow the project to collect revenue through partnerships and non-charitable donations, which in turn can be used to cover the costs of new products and services," Kewisch added.' -- source: https://tech.slashdot.org/story/20/01/29/1430253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

64-Bit Times On 32-Bit Linux
by Lawrence D'Oliveiro 31 Jan '20

31 Jan '20

Some more patches have gone into the Linux kernel <https://www.theregister.co.uk/2020/01/30/linux_5_6_2038/> to allow 32-bit builds to deal with times past the year-2038 barrier. Basically the fix involves offering a 64-bit alternative to the original time_t type, without the whole app having to go 64-bit. One point I noticed is that certain filesystems (e.g. ext2, presumably ext3 as well) store on-disk fields with 32-bit timestamps, so if you’re using one of these, you’ll have to reformat the disks as well. And that would apply even if you’re already using a 64-bit OS.

1 0

GetTogether.community - alternative to meetup.com
by Peter Reutemann 30 Jan '20

30 Jan '20

Hi everyone Based on our discussions at the AGM on Monday night... Next year, I'll be advertising our meetings also on GetTogether, a free/open-source alternative to meetup.com. If you've been using meetup.com, please consider helping me test-drive GetTogether by creating an account and joining the WLUG team/group. WLUG is accessible here on GetTogether: https://gettogether.community/waikato-linux-users-group/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

autoremove
by john 29 Jan '20

29 Jan '20

Hi all, At our last meeting Tom was concerned about Linux bloating with surplus files. I have always found this to seldom be the case due to : a. The new download removes the older files or: b. The command autoremove clears the unused kernels and other not required files. eg. john(a)polomint:~$ sudo apt autoremove Reading package lists... Done Building dependency tree Reading state information... Done The following packages will be REMOVED: linux-headers-4.15.0-72 linux-headers-4.15.0-72-generic linux-image-4.15.0-72-generic linux-modules-4.15.0-72-generic linux-modules-extra-4.15.0-72-generic 0 upgraded, 0 newly installed, 5 to remove and 4 not upgraded. After this operation, 332 MB disk space will be freed. Do you want to continue? [Y/n] Cheers John..

1 0

Intel Is Patching Its 'Zombieload' CPU Security Flaw For the Third Time
by Peter Reutemann 28 Jan '20

28 Jan '20

'For the third time in less than a year, Intel has disclosed a new set of vulnerabilities related to the speculative functionality of its processors. On Monday, the company said it will issue a software update "in the coming weeks" that will fix two more microarchitectural data sampling (MDS) or Zombieload flaws. This latest update comes after the company released two separate patches in May and November of last year. Compared to the MDS flaws Intel addressed in those two previous patches, these latest ones have a couple of limitations. To start, one of the vulnerabilities, L1DES, doesn't work on Intel's more recent chips. Moreover, a hacker can't execute the attack using a web browser. Intel also says it's "not aware" of anyone taking advantage of the flaws outside of the lab. In response to complaints of the company's piecemeal approach, Intel said that it has taken significant steps to reduce the danger the flaws represent to its processors. "Since May 2019, starting with Microarchitectural Data Sampling (MDS), and then in November with TAA, we and our system software partners have released mitigations that have cumulatively and substantially reduced the overall attack surface for these types of issues," a spokesperson for the company said. "We continue to conduct research in this area -- internally, and in conjunction with the external research community.' -- source: https://it.slashdot.org/story/20/01/27/2126231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

European Processor Initiative
by Lawrence D'Oliveiro 28 Jan '20

28 Jan '20

Here’s a report <https://www.nextplatform.com/2020/01/27/european-processor-initiative-readi…> on a Europe-wide effort to produce a processor chip for an “exascale” supercomputer. It will have an ARM CPU core, with a RISC-V-based accelerator and a few other special-purpose units on the side. I was intrigued to see mention of an “AI-inspired bfloat16 format”. Floating-point numbers commonly come in 32-bit and 64-bit sizes. There is also a “half-precision” 16-bit format, with reduced precision and dynamic range, commonly used in computer graphics, for example. This new format keeps the full dynamic range of 32-bit floats, at the expense of even further reduced precision. Apparently this works better for various machine-learning algorithms.

1 0

ProtonVPN Open Sources All Its Code
by Peter Reutemann 28 Jan '20

28 Jan '20

'ProtonVPN open sourced its code this week, ZDNet reports: On Tuesday, the virtual private network (VPN) provider, also known for the ProtonMail secure email service, said that the code backing ProtonVPN applications on every system -- Microsoft Windows, Apple macOS, Android, and iOS -- is now publicly available for review in what Switzerland-based ProtonVPN calls "natural" progression. "There is a lack of transparency and accountability regarding who operates VPN services, their security qualifications, and whether they fully conform to privacy laws like GDPR," the company says. "Making all of our applications open source is, therefore, a natural next step." Each application has also undergone a security audit by SEC Consult, which ProtonVPN says builds upon a previous partnership with Mozilla... The source code for each app is now available on GitHub (Windows, macOS, Android, iOS). "As a community-supported organization, we have a responsibility to be as transparent, accountable, and accessible as possible," ProtonVPN says. "Going open source helps us to do that and serve you better at the same time." They're also publishing the results of an independent security audit for each app. "As former CERN scientists, publication and peer review are a core part of our ethos..." the company wrote in a blog post. They also point out that Switzerland has some of the world's strongest privacy laws -- and that ProtonVPN observes a strict no-logs policy. But how do they feel about their competition? "Studies have found that over one-third of Android VPNs actually contain malware, many VPNs suffered from major security lapses, and many free VPN services that claimed to protect privacy are secretly selling user data to third parties."' -- source: https://yro.slashdot.org/story/20/01/27/0352244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Do Emails Contribute to Global Warming?
by Peter Reutemann 28 Jan '20

28 Jan '20

'"Cut back on email if you want to fight global warming," read the headline on a recent article at Bloomberg: [A]ll those messages require energy to preserve them. And despite the tech industry's focus on renewables, the advents of streaming and artificial intelligence are only accelerating the amount of fossil fuels burned to keep data servers up. Right now, data centers consume about 2 percent of the world's electricity, but that is expected to reach 8 percent by 2030. Moreover, only about 6 percent of all data ever created is in active use today, according to research from Hewlett Packard Enterprise. That means 94 percent is sitting in a vast "landfill" with a massive carbon footprint. "It's costing us the equivalent of maintaining the airline industry for data we don't even use," said Andrew Choi, a senior research analyst at Parnassus Investments, a $27 billion environmental, social and governance firm in San Francisco. Kirk Bresniker, chief architect of Hewlett Packard Labs, said these server farms use energy both to retain your data and when you use it... And when you empty the email trash, you probably aren't actually erasing the data. Multiple copies of even decade-old emails are stored on servers around the world, still using energy... Bresniker says the tech industry is "flying blind" when it comes to the true cost of storing data. The picture is clouded by a constant stream of efficiency and memory upgrades, increased renewable power and AI aimed at data-center efficiency. "We don't really understand what the footprint is," he said... The sum of all the world's data in 2018 was 33 zettabytes — 33 trillion gigabytes — but by 2025 it could increase fivefold, to 175 zettabytes, according to International Data Corp. Every day, the world produces about 2.5 quintillion bytes of data... Computing workloads are likely to more than double as more AI comes online, more devices are connected and people do more work in the cloud... Choi says the problem is getting too big, too fast... Training an AI model emits about as much carbon as the lifetime emissions associated with running five cars' -- source: https://hardware.slashdot.org/story/20/01/27/0149253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 5.5 Released
by Peter Reutemann 28 Jan '20

28 Jan '20

'Linus Torvalds has announced Linux 5.5 release, codenamed as Kleptomaniac Octopus.The latest version of the open source operating system kernel brings RAID1 with 3- and 4- copies to btrfs filesystem, ext4 gets direct I/O via iomap together with fscrypt supporting smaller block sizes, and you can now use SMB as root filesystem. AMD OverDrive overclocking is now supported on Navi GPUS, wake-on-voice on newer Google Chromebooks is now supported. Added was a Logitech keyboard driver. KUnit is a new unit testing framework for the kernel. There are many more new features which you can read about on Kernel Newbies changelog page. For downloads visit The Linux Kernel Archives.' -- source: https://linux.slashdot.org/story/20/01/27/144259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Leaked Documents Expose the Secretive Market for Your Web Browsing Data
by Peter Reutemann 28 Jan '20

28 Jan '20

'An antivirus program used by hundreds of millions of people around the world is selling highly sensitive web browsing data to many of the world's biggest companies, a joint investigation by Motherboard and PCMag has found. From the report: Our report relies on leaked user data, contracts, and other company documents that show the sale of this data is both highly sensitive and is in many cases supposed to remain confidential between the company selling the data and the clients purchasing it. The documents, from a subsidiary of the antivirus giant Avast called Jumpshot, shine new light on the secretive sale and supply chain of peoples' internet browsing histories. They show that the Avast antivirus program installed on a person's computer collects data, and that Jumpshot repackages it into various different products that are then sold to many of the largest companies in the world. Some past, present, and potential clients include Google, Yelp, Microsoft, McKinsey, Pepsi, Sephora, Home Depot, Conde Nast, Intuit, and many others. Some clients paid millions of dollars for products that include a so-called "All Clicks Feed," which can track user behavior, clicks, and movement across websites in highly precise detail.' -- source: https://yro.slashdot.org/story/20/01/27/1453226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Has Banned Nearly 200 Malicious Firefox Add-ons Over the Last Two Weeks
by Peter Reutemann 28 Jan '20

28 Jan '20

'Over the past two weeks, Mozilla's add-on review team has banned 197 Firefox add-ons that were caught executing malicious code, stealing user data, or using obfuscation to hide their source code. From a report: The add-ons have been banned and removed from the Mozilla Add-on (AMO) portal to prevent new installs, but they've also been disabled in the browsers of the users who already installed them. The bulk of the ban was levied on 129 add-ons developed by 2Ring, a provider of B2B software. The ban was enforced because the add-ons were downloading and executing code from a remote server. According to Mozilla's rules, add-ons must self-contain all their code, and not download code dynamically from remote locations. Mozilla has recently begun strictly enforcing this rule across its entire add-on ecosystem. A similar ban for downloading and executing remote code in users' Firefox browsers was also levied against six add-ons developed by Tamo Junto Caixa, and three add-ons that were deemed fake premium products (their names were not shared).' -- source: https://news.slashdot.org/story/20/01/27/1646207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux on laptops: Ubuntu 19.10 on the HP Dragonfly Elite G1
by Peter Reutemann 28 Jan '20

28 Jan '20

'Last month, Ars Associate Reviewer Valentina Palladino treated us to a thorough hands-on review of HP's ultra-sleek, ultra-chic Dragonfly Elite G1. Shortly afterward at CES, HP announced a second-generation Dragonfly Elite, the G2, with Ice Lake CPU, optional LTE modem, and more. We haven't had a chance to get our hands on the G2 yet—but while we wait, we wanted to evaluate the Elite G1 not only with the OEM Windows it ships with, but with a fresh Linux installation. We can't evaluate a laptop with every possible Linux distribution, but in the case of noteworthy designs like the Dragonfly Elite, we want to at least see if one of the more popular distros installs cleanly, detects all the hardware, and is a good daily driver. Our first try was Ubuntu 18.04.3, "Bionic Beaver," the most recent Long Term Support release of Ubuntu. For the most part, the installation went well—the keyboard and touchpad were responsive, the screen looked fine, and so forth—but unfortunately, the Intel Wi-Fi chipset used in the Dragonfly Elite is new enough that 18.04.3 doesn't have an in-kernel driver. If you're a hardcore Linux type, that might not be enough to stop you—you have many possible options, such as installing a backported newer version of the Linux kernel—but we wanted to see if we could get a "just works" experience rather than a "percussive maintenance required" experience, so we regretfully shelved Ubuntu 18.04.3 and went to the newest interim Ubuntu release—October 2019's 19.10 "Eoan Ermine." Again, the actual installation went fine—but this time, we have Wi-Fi as well without touching a thing. Success!' -- source: https://arstechnica.com/gadgets/2020/01/linux-on-laptops-ubuntu-19-10-on-th… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apps for PC
by danny.techfizz＠gmail.com 28 Jan '20

28 Jan '20

In this website, we can see the topics like Best apps for smartphones and PC, Apps for PC, Latest mobile news, How to fix etc. https://www.bolsterfizz.com/

2 1

The GlossnGlass are the best bridal makeup artist in bangalore
by Gloss andglass 28 Jan '20

28 Jan '20

The GlossnGlass are the best bridal makeup artist in bangalore go beyond just creating immaculate makeup looks. We also train and produce the finest makeup artists through our professional makeup artist courses.With a team of expert trainers from the makeup industry, our makeup academy offers various intensive professional and personal grooming courses. Visit : https://www.glossnglass.com/courses.html

1 0

The GlossnGlass are the best bridal makeup artist in bangalore
by Glossandglassblr＠Gmail.Com 28 Jan '20

28 Jan '20

<a href="https://https://www.maachairtransplantbangalore.com/">bridal makeup in bangalore</a> Hair fall! It’s not easy to deal with it, every individual irrespective of their gender both male and female commonly in their day to day lifestyle they face this major problem, but maac deals with hair plantation in bangalore. Hair fall can happen due to many possible causes including genetics, hormonal imbalance, lack of sleep, stress, improper diet, certain medications, chemical salon services etc. And for many people hair fall or thinning of hair mostly results in loss of self –esteem and leads to depression, anxiety and other emotional issues.

1 0

Re: prp treatment in bangalore
by mailinglist 27 Jan '20

27 Jan '20

Sent from my Samsung Galaxy smartphone.In was wondering... But then, a lot of email addresses, mine included, sound a bit odd but are from totally legit people. Don't really have the time to moderate posts initially from everyone signing up till I'm satisfied that they are OK... :-(This doesn't happen too often. Lots of spam gets caught and I (though not so much recently ) just quickly check and discard whatever needs review. Maybe wait and see.Or if someone knows of any changes to the mailing list host....

1 0

Librem 5 phone hands-on—Open source phone shows the cost of being different
by Peter Reutemann 26 Jan '20

26 Jan '20

'It is hard to do something truly different in the smartphone industry. Companies, especially smaller companies, are all working from the same parts bin with the same manufacturing partners. You take your Qualcomm SoC, your Samsung display, and your Sony camera sensor—and you take a flight to China and visit Foxconn, which, in addition to manufacturing, will even do engineering for you if you want. Smartphones are so samey because they have an established, for-hire supply chain that has a certain way of doing things, and it's much cheaper, faster, and easier if you just "go with the flow" and do what everyone else is doing. Big companies like Samsung and Apple have enough money, control, and connections to move the supply chain in whatever direction they want. In terms of smaller companies, though, there is a single one trying to blaze its own path: Purism, the maker of open source Linux laptops, is building the Librem 5 smartphone. Not only is the OS open source and based on GNU/Linux—not Android—the hardware is open source, too. The core components have open source firmware, and there are even public hardware schematics. This is as close as you're going to get to a totally open source smartphone. If you haven't noticed, open source smartphone hardware is not a thing that existed before now. There have been phones that run open source builds of Android, but those are full of closed-source firmware from non-open components. The usual hardware companies cautiously guard their hardware designs and drivers, and Purism's hardline stance on open source has ruled out almost the entire established smartphone supply chain. As the company writes in a blog post, "When we first approached hardware manufacturers almost two years ago with this project most of them instantly said 'No, sorry, impossible, we can not help you'." Others warned us, that it could never work, that it was too complicated, 'the industry does not do that,' and so forth." What followed was a long and winding road, but after two years of work, Purism is finally shipping the Librem 5 smartphones to customers. We were able to spend a few days with a device, and it's definitely one of the most unusual smartphones in recent memory. The thing to keep in mind here is that Purism has taken on an absolutely gargantuan task. It somehow scraped together a new supply chain of mostly open source components, it came up with a smartphone design from scratch, and it is building its own smartphone distribution of Linux. Two years is not enough time to do this. The OS and app package is not nearly finished, and it lacks basic smartphone functionality. The hardware is nearly finished, but you'll have a hard time taking advantage of it right now since the power management isn't really implemented, and support for things like the cameras are non-existent. If you really want open source smartphones to be a thing, though, this is where you need to start. The Librem 5 is a proof of concept.' -- source: https://arstechnica.com/gadgets/2020/01/librem-5-phone-hands-on-a-proof-of-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel CPU Chip Shortages
by Lawrence D'Oliveiro 24 Jan '20

24 Jan '20

This article <https://www.theregister.co.uk/2020/01/20/intel_hpe_xeon_shortage/> talks about the shortage of Intel server chips. But it also mentions that Intel’s attempts to crank up production of these is “to the detriment of desktop and mobile parts”. So there are shortages of CPU chips all round, and AMD is benefiting somewhat from this. Who is buying most of these server chips? It appears it’s not actual hardware vendors like Dell, HP etc, who apparently only buy about half a million CPUs per year each. These are dwarfed by “hyperscaler” companies that are named by one commenter as Alibaba, AWS, Azure, Baidu, Facebook, Google and Tencent, each taking over a million CPUs per year.

1 1

Apple's Privacy Software Allowed Users To Be Tracked, Says Google
by Peter Reutemann 23 Jan '20

23 Jan '20

'Google researchers have exposed details of multiple security flaws in its rival Apple's Safari web browser that allowed users' browsing behavior to be tracked, despite the fact that the affected tool was specifically designed to protect their privacy. From a report: The flaws, which were ironically found in an anti-tracking feature known as Intelligent Tracking Prevention, were first disclosed by Google to Apple in August last year. In a soon-to-be published paper seen by the Financial Times, researchers in Google's cloud team have since identified five different types of potential attack that could have resulted from the vulnerabilities, allowing third parties to obtain "sensitive private information about the user's browsing habits." "You would not expect privacy-enhancing technologies to introduce privacy risks," said Lukasz Olejnik, an independent security researcher who has seen the paper. "If exploited or used, [these vulnerabilities] would allow unsanctioned and uncontrollable user tracking. Apple rolled out Intelligent Tracking Prevention in 2017, with the specific aim of protecting Safari browser users from being tracked around the web by advertisers' and other third-parties' cookies.' -- source: https://tech.slashdot.org/story/20/01/22/2119245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Wine 5.0 Released
by Peter Reutemann 22 Jan '20

22 Jan '20

'Wine 5.0 has been released today and contains over 7,400 bug fixes and numerous audio and graphics improvements that will increase performance in gaming on Linux. With the release of Wine 5.0, WineHQ hopes to resolve many of these issues, with the main improvements being: -Builtin modules in PE format: To make games think Wine is a real Windows environment, most Wine 5.0 modules have been converted into the PE format rather than ELF binaries. It is hoped that this will allow copy-protection and anti-cheat programs to not flag games running under Wine as being modified. -Multi-monitor support: Multiple displays adapters and multi-monitor configurations are now supported under Wine. -XAudio2 reimplementation: XAudio2 libraries have been added back to Wine and will use the FAudio library for better compatibility. -Vulkan 1.1 support: "The Vulkan driver supports up to version 1.1.126 of the Vulkan spec."' -- source: https://tech.slashdot.org/story/20/01/21/223205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0