- wlug - list.wlug.org.nz

Mozilla Lays Off 70 As It Waits For New Products To Generate Revenue
by Peter Reutemann 16 Jan '20

16 Jan '20

'According to TechCrunch, Mozilla has laid off about 70 employees today. From the report: In an internal memo, Mozilla chairwoman and interim CEO Mitchell Baker specifically mentions the slow rollout of the organization's new revenue-generating products as the reason for why it needed to take this decision. The overall number may still be higher, though, as Mozilla is still looking into how this decision will affect workers in the UK and France. In 2018, Mozilla Corporation (as opposed to the much smaller Mozilla Foundation) said it had about 1,000 employees worldwide. Baker says laid-off employees will receive "generous exit packages" and outplacement support. She also notes that the leadership team looked into shutting down the Mozilla innovation fund but decided that it needed it in order to continue developing new products. In total, Mozilla is dedicating $43 million to building new products. "You may recall that we expected to be earning revenue in 2019 and 2020 from new subscription products as well as higher revenue from sources outside of search. This did not happen," Baker writes in her memo. "Our 2019 plan underestimated how long it would take to build and ship new, revenue-generating products. Given that, and all we learned in 2019 about the pace of innovation, we decided to take a more conservative approach to projecting our revenue for 2020. We also agreed to a principle of living within our means, of not spending more than we earn for the foreseeable future." "As we look to the future, we know we must take bold steps to evolve and ensure the strength and longevity of our mission," Baker adds. "Mozilla has a strong line of sight to future revenue generation, but we are taking a more conservative approach to our finances. This will enable us to pivot as needed to respond to market threats to internet health, and champion user privacy and agency."' -- source: https://news.slashdot.org/story/20/01/15/2048210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Launches Chromium Edge for Windows 7, Windows 8, Windows 10, and macOS
by Peter Reutemann 16 Jan '20

16 Jan '20

'Microsoft today launched its new Edge browser based on Google's Chromium open source project. You can download Chromium Edge now for Windows 7, Windows 8, Windows 10, and macOS directly from microsoft.com/edge in more than 90 languages. From a report: Business features aside, there's also support for Chrome-based extensions, 4K streaming, Dolby audio, inking in PDF, and privacy tools. For the last one, it's worth noting that tracking prevention is on by default and offers three levels of control, like Firefox's tracking protection. Chrome extension support is probably the most important feature for most users. By default, extensions that have been ported over to Edge can be downloaded from the Microsoft Store. Chromium Edge also has an option to "Allow extensions from other stores" to get Chrome extensions from the Chrome Web Store. There are still a few features missing from Chromium Edge, most notably history sync and extension sync. Microsoft is working on these and some other inking functionality that it still wants to port from legacy Edge, as Microsoft is calling it. Microsoft also claims that Chromium Edge is "twice as fast as legacy Edge." Curiously, the team isn't making any claims against other browsers -- at least not yet.' -- source: https://tech.slashdot.org/story/20/01/15/187215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

More Than Half a Billion Android Users Have Installed 'Fleeceware' Apps
by Peter Reutemann 16 Jan '20

16 Jan '20

'Security researchers from Sophos say they've discovered a new set of "fleeceware" apps that appear to have been downloaded and installed by more than 600 million Android users. From a report: The term fleeceware is a recent addition to the cyber-security jargon. It was coined by UK cyber-security firm Sophos last September following an investigation that discovered a new type of financial fraud on the official Google Play Store. It refers to apps that abuse the ability for Android apps to run trial periods before a payment is charged to the user's account. By default, all users who sign up for an Android app trial period, have to cancel the trial period manually to avoid being charged. However, most users just uninstall an app when they don't like it. The vast majority of app developers interpret this action -- a user uninstalling their app -- as a trial period cancelation and don't follow through with a charge. But last year, Sophos discovered that some Android app developers didn't cancel an app's trial period once the app is uninstalled and they don't receive a specific request from the user. Sophos said it initially discovered 24 Android apps that were charging obscene fees (between $100 and $240 per year) for the most basic and simplistic apps, such as QR/barcode readers and calculators.' -- source: https://news.slashdot.org/story/20/01/15/1721256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds Versus ZFS
by Lawrence D'Oliveiro 14 Jan '20

14 Jan '20

Came across this article <https://arstechnica.com/gadgets/2020/01/linus-torvalds-zfs-statements-arent…> reporting that Linus Torvalds recommends against using Sun/Oracle’s ZFS with Linux. The licensing issue (on top of Oracle’s infamous litigiousness) is a real concern, but the author also has a problem with Torvalds’ claims over filesystem performance and whether the code base is still being maintained or not. Out of curiosity, I went to read the original discussion thread. Not far along, I came across this <https://www.realworldtech.com/forum/?threadid=189711&curpostid=189959> later clarification by Torvalds: > Please, Linus, stop being arrogant and ignorant, read this > release note and tell us why you think ZFS is more of a buzzword > and has no real maintenance. I'm talking about small details like the fact that Oracle owns the copyrights, but turned things closed-source, so the "other" ZFS project is a fork of an old code base. If you are talking about ZFS, you're talking about the Oracle version. Do you think it has a lot of development going on? I don't know. And if you're talking about OpenZFS, then yes, there's clearly maintenance there, but it has all the questions about what happens if Oracle ever decides - again - that "copyright" means something different than anybody else thinks it means. Also the Ars Technica author seemed to feel that the kernel developers closed off certain kernel symbols to non-GPL code out of “spite”, to which Torvalds replies: > Not going out of your way to support ZFS is one thing. That we > completely perfectly understand. Going out of your way to > deliberately break ZFS is another thing. The kernel developers > are being assholes for doing that! We didn't go out of our way to deliberately break anything. But we do occasionally turn symbols that aren't meant to be used outside the kernel into GPL-only, because they have some internal implementation issues. The fact is, the whole point of the GPL is that you're being "paid" in terms of tit-for-tat: we give source code to you for free, but we want source code improvements back. If you don't do that but instead say "I think this is _legal_, but I'm not going to help you" you certainly don't get any help from us. So things that are outside the kernel tree simply do not matter to us. They get absolutely zero attention. We simply don't care. It's that simple. And things that don't do that "give back" have no business talking about us being assholes when we don't care about them.

1 0

Unpatched Citrix Vulnerability Now Exploited, Patch Weeks Away
by Peter Reutemann 14 Jan '20

14 Jan '20

'On December 16, 2019, Citrix revealed a vulnerability in the company's Application Delivery Controller and Gateway products -- commercial virtual-private-network gateways formerly marketed as NetScaler and used by tens of thousands of companies. The flaw, discovered by Mikhail Klyuchnikov of Positive Technologies, could give an attacker direct access to the local networks behind the gateways from the Internet without the need for an account or authentication using a crafted Web request. Citrix has published steps to reduce the risk of the exploit. But these steps, which simply configure a responder to handle requests using the text that targets the flaw, breaks under some circumstances and might interfere with access to the administration portal for the gateways by legitimate users. A permanent patch will not be released until January 20. And as of January 12, over 25,000 servers remain vulnerable, based on scans by Bad Packets. This is not surprising, considering the number of Pulse Secure VPNs that have not yet been patched over six months after a fix was made available, despite Pulse Secure executives saying that they have "worked aggressively" to get customers to patch that vulnerability. And given that vulnerable Pulse Secure servers have been targeted now for ransomware attacks, the same will likely be true for unprotected Citrix VPN servers -- especially since last week, proof-of-concept exploits of the vulnerability began to appear, including at least two published on GitHub, as ZDNet's Catalin Cimpanu reported. "The vulnerability allows the remote execution of commands in just two HTTP requests, thanks to a directory traversal bug in the implementation of the gateway's Web interface," the report adds. "The attacks use a request for the directory '/vpn/../vpns/' to fool the Apache Web server on the gateway to point to the '/vpns/' directory without authentication. The attacks then inject a command based on the template returned from the first request." You can check for the vulnerability here. ' -- source: https://it.slashdot.org/story/20/01/13/2116206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bing Loses Out To DuckDuckGo in Google's New Android Search Engine Ballot
by Peter Reutemann 14 Jan '20

14 Jan '20

'Google announced last week the alternative search engines it will show to new Android users in the EU, with DuckDuckGo the most frequently offered choice and Bing tied for last place. From a report: EU citizens setting up Android devices from March 1 will given a choice of four search engines to use as their default, including Google. Whichever provider they chose will become the default for searches made in Chrome and through Android's home screen search box. A dedicated app for that provider will also be installed on their device. ' -- source: https://search.slashdot.org/story/20/01/13/2042211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ICANN Wants to Let VeriSign Raise Prices on .Com Domains
by Peter Reutemann 14 Jan '20

14 Jan '20

'VeriSign has released a "proposed agreement" with ICANN to amend their exclusive .com registry agreement to allow them to raise the price of dotcom registrations up to 28% every six years. Those new terms "are now open to public comment" -- and the Register points out that ICANN's decision seems to come with a corresponding $20 million for ICANN: Operator of the dot-com registry, Verisign, has decided to pay DNS overseer ICANN $4 million a year for the next five years in order to "educate the wider ICANN community about security threats." Even though the generous $20 million donation has nothing to do with ICANN signing off on an extension of the dot-com contract until 2024, the "binding letter of intent" [PDF] stating the exact amount of funding will be appended to the registry agreement that Verisign has with ICANN to run the dot-com registry. That extension lifts a price freeze put in place several years ago and will allow Verisign to increase prices by seven per cent a year [in each of the last four years of each six year contract renewal]. It's an increase that we calculated was worth $993 million and which the stock market appeared to agree with when it raised the company's share price by 16 per cent when the agreement was first flagged in November 2018... ICANN explains the $20 million this time will be used to "support ICANN's initiatives to preserve and enhance the security, stability and resiliency of the DNS, including root server system governance, mitigation of DNS security threats, promotion and/or facilitation of DNSSEC deployment, the mitigation of name collisions, and research into the operation of the DNS." Which is all entirely above board and not at all shady.' -- source: https://tech.slashdot.org/story/20/01/13/0512230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

linux.conf.au: 2020 live streams
by Peter Reutemann 13 Jan '20

13 Jan '20

Hi everyone This just came through on my twitter feed, the live feeds of linux.conf.au 2020: https://www.youtube.com/playlist?list=PLD8dAKx4J2I45efawJoyCJ0CGjqi7Q78w -- source: https://twitter.com/xfxf/status/1216514835057238016 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

This Year's Y2K20 Bug Came Directly From 'A Lazy Fix' to the Y2K Bug
by Peter Reutemann 13 Jan '20

13 Jan '20

'Slashdot reader The8re still remembers the Y2K bug. Now he shares a New Scientist article explaining how it led directly to this year's Y2020 bug -- which affected more than just parking meters: WWE 2K20, a professional wrestling video game, also stopped working at midnight on 1 January 2020. Within 24 hours, the game's developers, 2K, issued a downloadable fix. Another piece of software, Splunk, which ironically looks for errors in computer systems, was found to be vulnerable to the Y2020 bug in November. The company rolled out a fix to users the same week -- which include 92 of the Fortune 100, the top 100 companies in the US.... The Y2020 bug, which has taken many payment and computer systems offline, is a long-lingering side effect of attempts to fix the Y2K, or millennium bug. Both stem from the way computers store dates. Many older systems express years using two numbers -- 98, for instance, for 1998 -- in an effort to save memory. The Y2K bug was a fear that computers would treat 00 as 1900, rather than 2000. Programmers wanting to avoid the Y2K bug had two broad options: entirely rewrite their code, or adopt a quick fix called "windowing", which would treat all dates from 00 to 20, as from the 2000s, rather than the 1900s. An estimated 80 percent of computers fixed in 1999 used the quicker, cheaper option. "Windowing, even during Y2K, was the worst of all possible solutions because it kicked the problem down the road," says Dylan Mulvin at the London School of Economics.... Another date storage problem also faces us in the year 2038. The issue again stems from Unix's epoch time: the data is stored as a 32-bit integer, which will run out of capacity at 3.14 am on 19 January 2038.' -- source: https://it.slashdot.org/story/20/01/12/0221226 Laziness always bites you in the bum in the end... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

'Why I Finally Switched from Chrome to Firefox - and You Should Too'
by Peter Reutemann 13 Jan '20

13 Jan '20

'In 2018 an associate technology editor at Fast Company's Co.Design wrote an article titled "Why I'm switching from Chrome to Firefox and you should too." Today shanen shared a similar article from Digital Trends. Their writer announces that after years of experimenting with both browsers, they've also finally switched from Chrome to Mozilla Firefox -- "and you should too." The biggest draw for me was, of course, the fact that Mozilla Firefox can finally go toe-to-toe with Google Chrome on the performance front, and often manages to edge it out as well... Today, in addition to being fast, Firefox is resource-efficient, unlike most of its peers. I don't have to think twice before firing up yet another tab. It's rare that I'm forced to close an existing tab to make room for a new one. On Firefox, my 2015 MacBook Pro's fans don't blast past my noise-canceling headphones, which happened fairly regularly on Chrome as it pushed my laptop's fans to their helicopter-like limits to keep things running. This rare balance of efficiency and performance is the result of the countless under-the-hood upgrades Firefox has rolled out in the last couple of years... Its Enhanced Tracking Protection framework keeps your identity safe by blocking trackers and cookies that otherwise follow you around the internet and collect sensitive information you probably didn't even know you were giving up. On top of that, Firefox can warn if a website is covertly mining cryptocurrency in the background. Most of these protections kick in by default and you have an exhaustive set of options to customize them the way you want. Firefox also lets you look into just how invasive a website is. It actively updates your personal privacy report so you can check how many trackers it has shut overall and for a specific website... What really clinched the switch to Mozilla Firefox was the fact that it's the only cross-platform browser that's not running Google's open-source Chromium platform. Microsoft's Edge, Brave, Opera, Vivaldi -- each of these browsers run on Chromium, accelerating Google's dominance over the web even when you're not directly using a Chrome user. Firefox, on the other hand, is powered by Mozilla's in-house Gecko engine that's not dependent on Chromium in any way. It may not seem like as vital of a trait as I make it sound, but it truly is, even though Chromium is open-source. Google oversees a huge chunk of the web, including ads, browser, and search, and this supremacy has allowed the company to pretty much run a monopoly and set its own rules for the open internet... Mozilla as a company has, despite a rocky journey, often taken bold stances in complex situations. In the Cambridge Analytica aftermath, Mozilla announced it would no longer run Facebook advertisements, cutting off direct marketing to over 2 billion users. In a world of tech companies taking frail, facile shots at protecting user privacy and barely delivering on their commitments, Mozilla is a breath of fresh air and you no longer have to live with any compromises to support it.' -- source: https://news.slashdot.org/story/20/01/11/2246247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds: Avoid Oracle's ZFS Kernel Code Until 'Litigious' Larry Signs Off
by Peter Reutemann 12 Jan '20

12 Jan '20

'"Linux kernel head Linus Torvalds has warned engineers against adding a module for the ZFS filesystem that was designed by Sun Microsystems -- and now owned by Oracle -- due to licensing issues," reports ZDNet: As reported by Phoronix, Torvalds has warned kernel developers against using ZFS on Linux, an implementation of OpenZFS, and refuses to merge any ZFS code until Oracle changes the open-source license it uses. ZFS has long been licensed under Sun's Common Development and Distribution License as opposed to the Linux kernel, which is licensed under GNU General Public License (GPL). Torvalds aired his opinion on the matter in response to a developer who argued that a recent kernel change "broke an important third-party module: ZFS". The Linux kernel creator says he refuses to merge the ZFS module into the kernel because he can't risk a lawsuit from "litigious" Oracle -- which is still trying to sue Google for copyright violations over its use of Java APIs in Android -- and Torvalds won't do so until Oracle founder Larry Ellison signs off on its use in the Linux kernel. "If somebody adds a kernel module like ZFS, they are on their own. I can't maintain it and I cannot be bound by other people's kernel changes," explained Torvalds. "And honestly, there is no way I can merge any of the ZFS efforts until I get an official letter from Oracle that is signed by their main legal counsel or preferably by Larry Ellison himself that says that yes, it's OK to do so and treat the end result as GPL'd," Torvalds continued. "Other people think it can be OK to merge ZFS code into the kernel and that the module interface makes it OK, and that's their decision. But considering Oracle's litigious nature, and the questions over licensing, there's no way I can feel safe in ever doing so."' -- source: https://linux.slashdot.org/story/20/01/11/0421238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Computer stuff
by Noel Villamor 12 Jan '20

12 Jan '20

Hi, I cleaned my garage and I have some stuff which might be useful to some - see attached pdf. Email me back if you need my address for pickup. I live in Fitzroy. With regards, Noel

2 2

Hundreds of Millions of Cable Modems Are Vulnerable To New Cable Haunt Vulnerability
by Peter Reutemann 11 Jan '20

11 Jan '20

'A team of four Danish security researchers has disclosed this week a security flaw that impacts cable modems that use Broadcom chips. From a report: The vulnerability, codenamed Cable Haunt, is believed to impact an estimated 200 million cable modems in Europe alone, the research team said today. The vulnerability impacts a standard component of Broadcom chips called a spectrum analyzer. This is a hardware and software component that protects the cable modem from signal surges and disturbances coming via the coax cable. The component is often used by internet service providers (ISPs) in debugging connection quality. On most cable modems, access to this component is limited for connections from the internal network. The research team says the Broadcom chip spectrum analyzer lacks protection against DNS rebinding attacks, uses default credentials, and also contains a programming error in its firmware.' -- source: https://it.slashdot.org/story/20/01/10/1914204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox gets patch for critical 0-day that’s being actively exploited
by Peter Reutemann 10 Jan '20

10 Jan '20

'Mozilla has released a new version of Firefox that fixes an actively exploited zero-day that could allow attackers to take control of users' computers. In an advisory, Mozilla rated the vulnerability critical and said it was "aware of targeted attacks in the wild abusing this flaw." The US Cybersecurity and Infrastructure Security Agency said one or more exploits were "detected in the wild" and warned that attacks could be exploited to "take control of an affected system." The Mozilla advisory credited researchers at China-based Qihoo 360 with reporting the flaw. No other details about the attacks were immediately available. Neither Mozilla nor Qihoo 360 responded to emails asking for more information. CVE-2019-17026, as the vulnerability is indexed, is a type confusion, a potentially critical error that can result in data being written to, or read from, memory locations that are normally off-limits. These out-of-bounds reads may allow attackers to discover memory locations where malicious code is stored so that protections such as address space layout randomization can be bypassed. Out-of-bounds reads can also cause crashes. The flaw is fixed in Tuesday's release of Firefox 72.0.1. The patch came a day after version 72 fixed 11 other vulnerabilities, six of which were rated high. Three of those six bugs might make it possible for attackers to run malicious code on affected computers.' -- source: https://arstechnica.com/information-technology/2020/01/firefox-gets-patch-f… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

4 3

Huawei Unveils OpenEuler, CentOS-Based Linux Distribution
by Peter Reutemann 10 Jan '20

10 Jan '20

'Huawei has released the source code of openEuler, its distribution of Linux based on CentOS. The operating system was formally launched by Huawei in September 2019 in response to U.S. sanctions, which had briefly affected the company's access to Windows and Android operating systems. The source code has now been published on Gitee, the Chinese version of Github. OpenEuler comprises two organizations on Gitee, one for source code and one for package sources. The openEuler organization was keen to highlight two particular packages, iSulad and A-Tune, among the openEuler source code. "iSulad is a lightweight gRPC service-based container runtime. Compared to runc, iSulad is written in C, but all interfaces are compatible with OCI. A-Tune is a system software to auto-optimize the system adaptively to multiple scenarios with embedded AI-engine." The announcement continues: "You will also see several infrastructure-supported projects that set up the community's operating systems... these systems are built on the Huawei Cloud through script automation." Among the package sources, covered by the src-openeuler organization on Gitee, are around 1,000 packages with versions in both ARM64 and X86 architecture packages. Huawei claims its developers have made a number of enhancements to ARM64 openEuler code to improve multi-core efficiency. It is also working on a "green computing" ecosystem with Linaro and the Green Industry Alliance. At the moment, the organization claims, there are more than 50 contributors and just under 600 commits. The openEuler community has around 20 SIGs or project groups.' -- source: https://tech.slashdot.org/story/20/01/09/058218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How Ars tests Wi-Fi gear (and you can, too)
by Peter Reutemann 09 Jan '20

09 Jan '20

'The tools and methodology we test Wi-Fi with are open source—so you can use them, too. After our review of Google's Nest Wi-Fi kit last fall, we received an unexpected request: Ars reader GerbilMagnus hopped into the comments and asked for an explainer about how we test Wi-Fi. Machination minutiae hadn't necessarily struck us as something of interest, but ask and you shall receive dear readers. Today, we're taking GerbilMagnus' lead and taking readers behind the scenes of our Wi-Fi testing process—we'll also toss in a little theory and practice along the way. If you want to try our methods at home, know up front that you don't necessarily have to replicate our entire test setup to start seeing useful results for yourself. But if you want to put the latest and greatest mesh gear through the gauntlet, we'll absolutely cover everything from top to bottom before we're done.' -- source: https://arstechnica.com/gadgets/2020/01/how-ars-tests-wi-fi-gear-and-you-ca… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Chrome To Hide Notification Spam Starting February 2020
by Peter Reutemann 09 Jan '20

09 Jan '20

'Following in Mozilla's footsteps, Google announced today plans to hide notification popup prompts inside Chrome starting next month, February 2020. ZDNet reports: According to a blog post published today, Google plans to roll out a "quieter notification permission UI that reduces the interruptiveness of notification permission requests." The change is scheduled for Google Chrome 80, scheduled for release on February 4, next month. Starting with Chrome 80 next month, Google's browser will also block most notification popups by default, and show an icon in the URL bar, similar to Firefox. When Chrome 80 launches next month, a new option will be added in the Chrome settings section that allows users to enroll in the new "quieter notification UI." Users can enable this option as soon as Chrome 80 is released, or they can wait for Google to enable it by default as the feature rolls out to the wider Chrome userbase in the following weeks. According to Google, the new feature works by hiding notification requests for Chrome users who regularly dismiss notification prompts. Furthermore, Chrome will also automatically block notification prompts on sites where users rarely accept notifications. ' -- source: https://it.slashdot.org/story/20/01/08/0632203 Nice to see the "[f]ollowing in Mozilla's footsteps". :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Half of the Websites Using WebAssembly Use it for Malicious Purposes
by Peter Reutemann 09 Jan '20

09 Jan '20

'Around half of the websites that use WebAssembly, a new web technology, use it for malicious purposes, according to academic research published last year. From a report: WebAssembly is a low-level bytecode language that was created after a joint collaboration between all major browser vendors. It introduces a new binary file format for transmitting code from a web server to a browser. Once it reaches the browser, WebAssembly code (Wasm) executes with near-native speed, similar to compiled C, C++, or Rust code. WebAssembly was created for both speed and performance. Due to its binary machine-friendly format, Wasm code is smaller than its equivalent JavaScript form, but also many times faster when executing. This has made WebAssembly the next incarnation of Adobe Flash, allowing websites to run complex CPU-intensive code without freezing a browser, a task for which JavaScript was never designed or optimized for.' -- source: https://it.slashdot.org/story/20/01/08/1421216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Coming Soon: The Web “Thin Client”
by Lawrence D'Oliveiro 08 Jan '20

08 Jan '20

Here’s a new trend to watch out for: it’s being called “browser isolation” <https://www.theregister.co.uk/2020/01/07/cloudflare_buys_s2/>: S2 developed a ... headless version of Chromium – the open-source foundation of Chrome and about two dozen other browsers – that runs in the cloud and intercepts calls to the browser's Skia graphics layer. "Before it actually draws anything virtual, we intercept those Skia calls, we tokenize them, we compress them, we send them through to any HTML5 browser, where we redraw them locally, right on the machine," Remington explained. "We use WebAssembly. We push a little Skia library that runs local in your browser, any browser. ... Turns out, it's very secure, because that is not an attack vector. It's only draw commands." ... According to Harnett, S2's scheme results in a 60 per cent bandwidth savings. "People are surprised when we say that in many cases, it's faster than local" ...

1 0

PGP keys, software security, and much more threatened by new SHA1 exploit
by Peter Reutemann 08 Jan '20

08 Jan '20

'Three years ago, Ars declared the SHA1 cryptographic hash algorithm officially dead after researchers performed the world’s first known instance of a fatal exploit known as a "collision" on it. On Tuesday, the dead SHA1 horse got clobbered again as a different team of researchers unveiled a new attack that’s significantly more powerful. The new collision gives attackers more options and flexibility than were available with the previous technique. It makes it practical to create PGP encryption keys that, when digitally signed using SHA1 algorithm, impersonate a chosen target. More generally, it produces the same hash for two or more attacker-chosen inputs by appending data to each of them. The attack unveiled on Tuesday also costs as little as $45,000 to carry out. The attack disclosed in 2017, by contrast, didn’t allow forgeries on specific predetermined document prefixes and was evaluated to cost from $110,000 to $560,000 on Amazon’s Web Services platform, depending on how quickly adversaries wanted to carry it out. The new attack is significant. While SHA1 has been slowly phased out over the past five years, it remains far from being fully deprecated. It’s still the default hash function for certifying PGP keys in the legacy 1.4 version branch of GnuPG, the open-source successor to PGP application for encrypting email and files. Those SHA1-generated signatures were accepted by the modern GnuPG branch until recently, and were only rejected after the researchers behind the new collision privately reported their results. Git, the world's most widely used system for managing software development among multiple people, still relies on SHA1 to ensure data integrity. And many non-Web applications that rely on HTTPS encryption still accept SHA1 certificates. SHA1 is also still allowed for in-protocol signatures in the Transport Layer Security and Secure Shell protocols.' -- source: https://arstechnica.com/information-technology/2020/01/pgp-keys-software-se… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 72 Arrives With Fingerprinting Blocked By Default, Picture-in-Picture on macOS and Linux
by Peter Reutemann 08 Jan '20

08 Jan '20

'Mozilla today launched Firefox 72 for Windows, Mac, Linux, and Android. Firefox 72 includes fingerprinting scripts blocked by default, less annoying notifications, and Picture-in-Picture video on macOS and Linux. There isn't too much else here, as Mozilla has now transitioned Firefox releases to a four-week cadence (from six to eight weeks).' -- source: https://news.slashdot.org/story/20/01/07/143225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome OS Has Stalled Out
by Peter Reutemann 07 Jan '20

07 Jan '20

'Speaking of Chromebooks, David Ruddock, opines at AndroidPolice: Chrome OS' problems really became apparent to me when Android app compatibility was introduced, around five years ago. Getting Android apps to run on Chrome OS was simultaneously one of the Chrome team's greatest achievements and one of its worst mistakes. In 2019, two things are more obvious than ever about the Android app situation on Chrome. The first is that the "build it and they will come" mantra never panned out. Developers never created an appreciable number of Android app experiences designed for Chrome (just as they never did for Android tablets). The second is that, quite frankly, Android apps are very bad on Chrome OS. Performance is highly variable, and interface bugs are basically unending because most of those apps were never designed for a point-and-click operating system. Sure, they crash less often than they did in the early days, but anyone saying that Android apps on Chrome OS are a good experience is delusional. Those apps are also a crutch that Chrome leans on to this day. Chrome OS doesn't have a robust photo editor? Don't worry, you can download an app! Chrome doesn't have native integration with cloud file services like Box, Dropbox, or OneDrive? Just download the app! Chrome doesn't have Microsoft Office? App! But this "solution" has basically become an insult to Chrome's users, forcing them to live inside a half-baked Android environment using apps that were almost exclusively designed for 6" touchscreens, and which exist in a containerized state that effectively firewalls them from much of the Chrome operating system. As a result, file handling is a nightmare, with only a very limited number of folders accessible to those applications, and the task of finding them from inside those apps a labyrinthine exercise no one should have to endure in 2019. This isn't a tenable state of affairs -- it's computing barbarism as far as I'm concerned. And yet, I've seen zero evidence that the Chrome team intends to fix it. It's just how it is. But Android apps, so far as I can tell, are basically the plan for Chrome. Certainly, Linux environment support is great for enthusiasts and developers, but there are very few commonly-used commercial applications available on Linux, with no sign that will change in the near future. It's another dead end. And if you want an even more depressing picture of Chrome's content ecosystem, just look at the pitiable situation with web apps.' -- source: https://developers.slashdot.org/story/20/01/06/1626227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

“Open Source” Journalism
by Lawrence D'Oliveiro 06 Jan '20

06 Jan '20

This week’s “Listening Post” on Al Jazeera (viewable here <https://www.aljazeera.com/programmes/listeningpost/2019/09/xinjiang-story-c…>) talks, in the latter part, about this new phenomenon of “open source” journalism. My understanding is, the meaning of “source” here is not that of “source code” familiar to software developers, but “source of information” as understood by journalists. That means getting information from public sources available to all. Even a tightly-controlled society like China makes a surprising amount of information freely available online--more than it really wants to make available, sometimes. And this information can be pieced together like a puzzle by perceptive investigators, to point to conclusions which can be directly at odds with public pronouncements from Government officials.

1 1

Linus Torvalds Calls Blogger's Linux Scheduler Tests 'Pure Garbage'
by Peter Reutemann 06 Jan '20

06 Jan '20

'On Wednesday Phoronix cited a blog post by C++ game developer Malte Skarupke claiming his spinlocks experiments had discovered the Linux kernel had a scheduler issue affecting developers bringing games to Linux for Google Stadia. Linus Torvalds has now responded: The whole post seems to be just wrong, and is measuring something completely different than what the author thinks and claims it is measuring. First off, spinlocks can only be used if you actually know you're not being scheduled while using them. But the blog post author seems to be implementing his own spinlocks in user space with no regard for whether the lock user might be scheduled or not. And the code used for the claimed "lock not held" timing is complete garbage. It basically reads the time before releasing the lock, and then it reads it after acquiring the lock again, and claims that the time difference is the time when no lock was held. Which is just inane and pointless and completely wrong... [T]he code in question is pure garbage. You can't do spinlocks like that. Or rather, you very much can do them like that, and when you do that you are measuring random latencies and getting nonsensical values, because what you are measuring is "I have a lot of busywork, where all the processes are CPU-bound, and I'm measuring random points of how long the scheduler kept the process in place". And then you write a blog-post blamings others, not understanding that it's your incorrect code that is garbage, and is giving random garbage values... You might even see issues like "when I run this as a foreground UI process, I get different numbers than when I run it in the background as a batch process". Cool interesting numbers, aren't they? No, they aren't cool and interesting at all, you've just created a particularly bad random number generator... [Y]ou should never ever think that you're clever enough to write your own locking routines.. Because the likelihood is that you aren't (and by that "you" I very much include myself -- we've tweaked all the in-kernel locking over decades, and gone through the simple test-and-set to ticket locks to cacheline-efficient queuing locks, and even people who know what they are doing tend to get it wrong several times). There's a reason why you can find decades of academic papers on locking. Really. It's hard. "It really means a lot to me that Linus responded," the blogger wrote later, "even if the response is negative." They replied to Torvalds' 1,500-word post on the same mailing list -- and this time received a 1900-word response arguing "you did locking fundamentally wrong..." The fact is, doing your own locking is hard. You need to really understand the issues, and you need to not over-simplify your model of the world to the point where it isn't actually describing reality any more... Dealing with reality is hard. It sometimes means that you need to make your mental model for how locking needs to work a lot more complicated...' -- source: https://linux.slashdot.org/story/20/01/06/012251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Open Source Initiative Co-Founder Bruce Perens Resigns, Citing Move Toward License 'That Isn't Freedom Respecting'
by Peter Reutemann 06 Jan '20

06 Jan '20

'Bruce Perens (Slashdot reader #3872) co-founded the Open Source Initiative with Eric Raymond in 1998. But on Thursday Perens posted "it seems to me that the organization is rather enthusiastically headed toward accepting a license that isn't freedom respecting. Fine, do it without me, please. "I asked Patrick to cancel my membership, and I would have unsubscribed from OSI lists, including this one, if your server was working..." The issue is a new software license drafted by lawyer Van Lindberg called the Cryptographic Autonomy License (or CAL). Another open-source-community leader familiar with the debate -- who spoke with The Register on condition of anonymity -- claimed Lindberg lobbied OSI directors privately to green-light the license, contrary to an approval process that's supposed to be carried out in public. "I don't think that's an appropriate characterization," said Lindberg, of law firm Dykema, in a phone interview with The Register. "I think there are number of people who from the beginning made up their minds about the Cryptographic Autonomy License. You'll see a lot of people jumping onto any pretext they can find in order to oppose it. With regard to this idea of lobbying, there have been procedural-type communications that I think are entirely reasonable," he added. "But all the substantive debate has been on the license review and license discussion forums...." Perens said he resigned because the OSI appears to have already decided to accept the license. He said he's headed in a different direction, which he called "coherent open source." "We've gone the wrong way with licensing," he said, citing the proliferation of software licenses. He believes just three are necessary, AGPLv3, the LGPLv3, and Apache v2. Meanwhile, the Cryptographic Autonomy License is envisioned for use with the distributed development platform Holo, notes the Register: According to Holo co-founder Arthur Brock, distributed peer-to-peer software needs a license that addresses cryptographic key rights, which is why the Cryptographic Autonomy License has been proposed. "We are trying to say: the only valid way to use our code is if that developer's end-users are the sole authors and controllers of their own private crypto keys," he wrote in a post last year. Lindberg said the Cryptographic Autonomy License is applicable to current web applications but it more meaningful in the context of distributed workloads and distributed computation, which he contends will become more important as people seek alternatives to the centralization of today's cloud-based systems. "A lot of people are very concerned about this concept of owning your data, owning your computer, having the ability to really control your computing experience and have it not be controlled by your cloud provider," said Lindberg. Perens said, "It's a good goal but it means you now need to have a lawyer to understand the license and to respond to your users." Slashdot asked Bruce Perens for details on "Coherent Open Source." Here's what he wrote back...' -- source: https://news.slashdot.org/story/20/01/05/208249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Dell's Upcoming XPS 13 Linux Laptop Includes a Fingerprint Reader
by Peter Reutemann 06 Jan '20

06 Jan '20

'If you've been following the steady march of progress from Dell's Linux-first Project Sputnik team, you're no doubt aware that the "Developer Edition" variant of the XPS 13 is one of the finest Linux-ready ultrabooks you can buy. Just ahead of CES 2020, Dell is pushing out a few more improvements including a feature that's been hotly requested: fingerprint-reader support. It's one of several enhancements Dell is promising to Linux users for its 10th-generation XPS 13, including a new maximum of 32GB RAM and a redesigned "InfinityEdge" display that adds even more screen real estate, resulting in an adjusted 16:10 aspect ratio to match... Details on fingerprint-reader support are still a bit vague, but Dell says it will be released shortly after the system's February 2020 launch as an OTA (over-the-air) update, and then as part of the preloaded Ubuntu Developer Edition image it ships with the system. Dell's lead on Project Sputnik developer systems, Barton George, also blogged about Dell's new 86-inch 4K interactive touch monitor, as well as their upcoming Latitude 9510 notebook and 2-in-1 laptops, promising "a new ultra-premium class of products" offering 5G mobile broadband capabilities, AI-based productivity capabilities, and 30-plus hours of battery life. The blog post ends by noting that "While project Sputnik is the most visible Linux-based offerings from Dell, it is only a small fraction of the over 150 systems that make up Dell's Linux portfolio."' -- source: https://linux.slashdot.org/story/20/01/05/0137242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linux Kernel Developers and Commits Dropped in 2019
by Peter Reutemann 06 Jan '20

06 Jan '20

'Phoronix reports that on New Year's Day, the Linux kernel's Git source tree showed 27,852,148 lines of code, divided among 66,492 files (including docs, Kconfig files, user-space utilities in-tree, etc). Over its lifetime there's been 887,925 commits, and around 21,074 different authors: During 2019, the Linux kernel saw 74,754 commits, which is actually the lowest point since 2013. The 74k commits is compares to 80k commits seen in both 2017 and 2018, 77k commits in 2016, and 75k commits in both 2014 and 2015. Besides the commit count being lower, the author count for the year is also lower. 2019 saw around 4,189 different authors to the Linux kernel, which is lower than the 4,362 in 2018 and 4,402 in 2017. While the commit count is lower for the year, on a line count it's about average with 3,386,347 lines of new code added and 1,696,620 lines removed... Intel and Red Hat have remained the top companies contributing to the upstream Linux kernel.' -- source: https://linux.slashdot.org/story/20/01/04/2335200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Employee error to blame for massive data leak, Wyze says
by Peter Reutemann 02 Jan '20

02 Jan '20

'Loads of folks found brand-new Wyze surveillance cameras under their trees or in their stockings this Christmas. And on Boxing Day, the company itself unwrapped a whole new world of trouble for everyone who uses its products, confirming a data leak that may have exposed personal data for millions of users over the course of a few weeks. Wyze first found out about the problem on the morning of December 26, company cofounder Dongsheng Song said in a corporate blog post. The company's investigation confirmed that user data was "not properly secured" and was exposed from December 4 onward. The database in question was basically a copy of the production database that Wyze created to work with, Song explained. Data points left exposed include user email addresses, camera nicknames, Wi-Fi network information, Wyze device information, some tokens associated with Alexa integrations, and "body metrics for a small number of product beta testers."' -- source: https://arstechnica.com/tech-policy/2019/12/surveillance-camera-company-wyz… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Vivaldi To Change User-Agent String To Chrome Due To Unfair Blocking
by Peter Reutemann 20 Dec '19

20 Dec '19

'Because some internet websites unfairly block browsers from accessing their services, starting with Vivaldi 2.10, released today, the Vivaldi browser plans to disguise itself as Chrome to allow users to access websites that unfairly block them. From a report: Vivaldi will do this by modifying its default user-agent (UA) string to the UA string used by Chrome. A UA string is a piece of text that browsers send to websites when they initiate a connection. The UA String contains data about the browser type, rendering engine, and operating system. For example, a UA string for Firefox on Windows looks like this: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0. UA strings have been in use since the 90s. For decades, websites have used UA agent strings to fine-tune performance and features or block outdated browsers. However, many website owners these days use UA strings to block users from accessing their sites. Some do it because they're not willing to deal with browser-specific bugs, some do it because of pettiness, while big tech companies like Google and Microsoft have done it (and continue to do it) to sabotage competitors on the browser market.' -- source: https://tech.slashdot.org/story/19/12/19/2041250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Nebula VPN routes between hosts privately, flexibly, and efficiently
by Peter Reutemann 20 Dec '19

20 Dec '19

'Last month, the engineering department at Slack—an instant messaging platform commonly used for community and small business organization—released a new distributed VPN mesh tool called Nebula. It's difficult to coherently explain Nebula in a nutshell. According to the people on Slack's engineering team, they asked themselves "what is the easiest way to securely connect tens of thousands of computers, hosted at multiple cloud service providers in dozens of locations around the globe?" And (developing) Nebula was the best answer they had. It's a portable, scalable overlay networking tool that runs on most major platforms, including Linux, MacOS, and Windows, with some mobile device support planned for the near future. Nebula-transmitted data is fully encrypted using the Noise protocol framework, which is also used in modern, highly security-focused projects such as Signal and WireGuard. Unlike more traditional VPN technologies—including WireGuard—Nebula automatically and dynamically discovers available routes between nodes and sends traffic down the most efficient path between any two nodes rather than forcing everything through a central distribution point.' -- source: https://arstechnica.com/gadgets/2019/12/nebula-vpn-routes-between-hosts-pri… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Facebook is Building an Operating System So it Can Ditch Android
by Peter Reutemann 20 Dec '19

20 Dec '19

'Facebook doesn't want its hardware like Oculus and Portal to be at the mercy of Google because they rely on its Android operating system. >From a report: That's why Facebook has tasked a co-author of Microsoft's Windows NT named Mark Lucovsky with building the social network an operating system from scratch, according the The Information's Alex Heath. "We really want to make sure the next generation has space for us," says Facebook's VP of hardware Andrew 'Boz' Bosworth. "We don't think we can trust the marketplace or competitors to ensure that's the case. And so we're gonna do it ourselves." By moving to its own OS, Facebook could have more freedom to bake social interaction -- and hopefully privacy -- deeper into its devices. It could also prevent a disagreement between Google and Facebook from derailing the roadmaps of Oculus, Portal, or future gadgets. One added bonus of moving to a Facebook-owned operating system? It could make it tougher to force Facebook to spin out some of its acquisitions, especially if Facebook goes with Instagram branding for its future augmented reality glasses.' -- source: https://tech.slashdot.org/story/19/12/19/1747243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apple, Google, and Amazon team up to create “CHIP,” a new smart home standard
by Peter Reutemann 19 Dec '19

19 Dec '19

'Apple, Google, Amazon, and the Zigbee Alliance have all teamed up to make a new smart home standard. The new working group went live today under the name of "Project Connected Home over IP" with announcement blog posts from Google, Apple, Zigbee, and a new website, connectedhomeip.com. The name doesn't sound too catchy until you realize "Connected Home over IP" abbreviates to "CHIP" which, across all these blog posts, is quietly used only a single time in the official FAQ. According to the new website, "The goal of the Connected Home over IP project is to simplify development for manufacturers and increase compatibility for consumers." But thanks to XKCD, we all know that one new standard to "unite them all" often just results in making one additional standard available, but assuming the companies involved actually support their own standard, this could—maybe—make things easier for consumers.' -- source: https://arstechnica.com/gadgets/2019/12/apple-google-and-amazon-team-up-for… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hate Speech Row: Fine Or Jail Anyone Who Calls People Boffins, Geeks or Eggheads, Psychology Nerd Demands
by Lawrence D'Oliveiro 19 Dec '19

19 Dec '19

>From <https://www.theregister.co.uk/2019/12/18/nerds_hate_speech/>: Labeling super-smart people with terms like nerd, geek, or boffin is hate speech, and should be punishable as such, argues lecturer and Harley-Street psychotherapist Dr Sonja Falck. ... She then embarked on a “contextual analysis of literature” and decided that calling someone a boffin was equivalent to the worst racial slurs. A couple of points occur to me. One is, one should be careful of the logical pitfalls of arguing “A is no better than B”. Because the flip side of that is that you are also saying “B is no worse than A”. In the process of trying to demonize A, and in the absence of any additional evidence for your position, you could be seen to be trivializing B. The other point is that targeted groups seem to be granted a licence to own terms which are used as slurs against them. These terms become accepted as commonplace inside the group, that nobody outside is allowed to use.

1 0

IoT is becoming popular
by leoole123＠yandex.ru 19 Dec '19

19 Dec '19

Smart technologies are rapidly spreading among ordinary users. More and more intelligent and remotely controlled equipment appears in our lives. But let’s see not from the user’s side. Let’s mind like a creator’s. Where is it better to place a “control center”? More and more integrators are transferring their capacities to the public cloud; there is formed a system for management. Labels from all things come through the gateways and are processed directly in the cloud. If the Internet connection is interrupted, all modules continue to work, and immediately after the appearance of the connections are synchronized. More details here: https://www.sim-networks.com/en/blog/iot-solutions-in-sim-cloud

1 0

Open Source Gets No Respect, Episode #310
by Lawrence D'Oliveiro 18 Dec '19

18 Dec '19

The developer of FUSE for macOS <https://www.theregister.co.uk/2019/12/16/fuse_macos_closed_source/> found that, while many companies were including his software in their commercial products, they were curiously reluctant to offer him any actual monetary support for his work. So he took the drastic step of making the latest version closed-source. While it continues to be available for non-commercial use at no charge, commercial vendors will need to license it for inclusion in their products. The result? He has actually got a bunch of licensing deals signed now.

2 1

Dyktando
by jakub.adecki＠interia.pl 18 Dec '19

18 Dec '19

Zachęcaj swojeg dzieco aby uczyło się ortografi. Zasady gramatyki i ortografii są konieczne do sukcesu w życiu. Za każdym razem warto dokonać korekty niewłaściwej pisowni. Dlatego tak ważne jest systematyczne ćwiczenie i nauka prawidłowej pisowni wyrazów. Sprawdź https://dyktanda.pl/

1 0

Microsoft Begins Accepting Extensions For Its Edge Chromium Browser
by Peter Reutemann 18 Dec '19

18 Dec '19

'Microsoft's new Chromium-based Edge browser is now open to developers to submit extensions. The updated version of Edge is set to launch on January 15. From a report: Microsoft says that if a developer has already created an extension for Google Chrome, there shouldn't be any additional work to port it over to Edge Chromium. The browser will be the new default delivered to all 900 million Windows 10 users, so developers should have no reason not to port their extensions over.' -- source: https://slashdot.org/story/19/12/17/1621248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla To Add Second DNS-over-HTTPS (DoH) Provider in Firefox
by Peter Reutemann 18 Dec '19

18 Dec '19

'Mozilla has announced that NextDNS would be joining Cloudflare as the second DNS-over-HTTPS (DoH) provider inside Firefox. From a report: The browser maker says NextDNS passed the conditions imposed by its Trusted Recursive Resolver (TRR) program, and can now be added as a second option for DoH inside Firefox. These conditions include (1) limiting the data NextDNS collects from the DoH server used by Firefox users; (2) being transparent about the data they collect; and (3) promising not to censor, filter, or block DNS traffic unless specifically requested by law enforcement. DNS-over-HTTPS, or DoH, is a new feature that was added to Firefox last year. When enabled, it encrypts DNS traffic coming in and out of the browser. DNS traffic is not only encrypted but also moved from port 53 (for DNS traffic) to port 443 (for HTTPS traffic), effectively hiding DNS queries and replies inside the browser's normal stream of HTTPS content. This encrypted DNS traffic reaches a so-called DoH resolver. Here, the DoH traffic is decrypted and the DoH resolver makes the DNS query on the user's behalf, receives the result, encrypts it, and sends it back to the user's browser -- also disguised inside encrypted HTTPS content.' -- source: https://tech.slashdot.org/story/19/12/17/1922254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Npm Team Warns of New 'Binary Planting' Bug
by Peter Reutemann 17 Dec '19

17 Dec '19

' The team behind npm, the biggest package manager for JavaScript libraries, issued a security alert yesterday, advising all users to update to the latest version (6.13.4) to prevent "binary planting" attacks. From a report: Npm (Node.js Package Manager) devs say the npm command-line interface (CLI) client is impacted by a security bug -- a combination between a file traversal and an arbitrary file (over)write issue. The bug can be exploited by attackers to plant malicious binaries or overwrite files on a user's computer. The vulnerability can be exploited only during the installation of a boobytrapped npm package via the npm CLI. "However, as we have seen in the past, this is not an insurmountable barrier," said the npm team, referring to past incidents where attackers planed backdoored or boobytrapped packages on the official npm repository. Npm devs say they've been scanning the npm portal for packages that may contain exploit code designed to exploit this bug, but have not seen any suspicious cases. "That does not guarantee that it hasn't been used, but it does mean that it isn't currently being used in published packages on the [official npm] registry," npm devs said.' -- source: https://it.slashdot.org/story/19/12/16/1513245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Halts Chrome 79 Rollout After It Breaks Some Android Apps
by Peter Reutemann 16 Dec '19

16 Dec '19

'Chrome 79 is creating an issue with WebView (the Android component that allows apps to display content from the web), reports 9to5Google: On Friday morning, Android developers reliant on WebView and local storage began encountering an issue where their apps lost data after users updated to version 79 of WebView. Those affected took to Chromium's bug tracker, and have described the incident as a "catastrophe" and "major issue." To end users, it's as if apps were entirely reset and just downloaded for the first time. This includes saved data disappearing or being logged out. Given the level of system opacity, most will blame developers for a problem that's out of their hands. By that afternoon, Google engineers responded and isolated the issue to "profile layout changes" where "local storage was missed off the list of files migrated." A member of the Chromium team apologized Saturday morning, with the Chrome/WebView rollout halted after 50% of devices already received the update. At the highest priority level (P0), Google is currently "working on a solution that minimizes the data loss, and that can be rolled out safely." The last guidance for a patch is 5-7 days.' -- source: https://tech.slashdot.org/story/19/12/15/181240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Link in Bio' is a Slow Knife
by Peter Reutemann 15 Dec '19

15 Dec '19

'Anil Dash: We don't even notice it anymore -- "link in bio." It's a pithy phrase, usually found on Instagram, which directs an audience to be aware that a pertinent web link can be found on that user's profile. Its presence is so subtle, and so pervasive, that we barely even noticed it was an attempt to kill the web. Links on the web are incredibly powerful. There are decades of theory behind the role of hyperlinks in hypertext -- did you know in most early versions, links were originally designed to be two-way? You'd be able to see every page on the web that links to this one. But even in the very simple form that we've ended up with on the World Wide Web for the last 30 years, links are incredibly powerful, opening up valuable connections between unexpected things. For a closed system, those kinds of open connections are deeply dangerous. If anyone on Instagram can just link to any old store on the web, how can Instagram -- meaning Facebook, Instagram's increasingly-overbearing owner -- tightly control commerce on its platform? If Instagram users could post links willy-nilly, they might even be able to connect directly to their users, getting their email addresses or finding other ways to communicate with them. Links represent a threat to closed systems. Here's the thing, though: people like links. So closed systems have to present a pressure release valve. Hashtags are a great way out. They use the semiotics of links (early versions of hashtags on social platforms were really barely more than automated links to a search for a particular term) but are also constrained by the platforms they live on. A hashtag is easier to gather into a database, to harvest, to monetize. It's much easier, sure, but it also doesn't have all the messiness of a real link. Instagram doesn't have to worry that clicking on its hashtags will accidentally lead people to Twitter, or vice versa.' -- source: https://tech.slashdot.org/story/19/12/12/1540216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Building Your Own Open Source, Privacy-Protecting Voice Assistant With A Raspberry Pi
by Peter Reutemann 15 Dec '19

15 Dec '19

'PC Magazine's "tech nerd" Whitson Gordon writes that "Once you start using a smart speaker to set reminders, play the news, or turn the lights on, it's hard to go back." But if you want the convenience of voice control without the data-collecting tech giant behind the scenes, an open-source project called Mycroft is a great alternative. And you can run it right on a Raspberry Pi. Mycroft is a free, open-source voice assistant designed to run on Linux-based devices... Mycroft has been around for quite a few years, but it's recently gained a bit more notoriety thanks to privacy concerns surrounding data collection at Amazon and Google. Unlike those assistants, Mycroft only collects data if you opt in during setup. And for the users who do opt in, Mycroft promises never to sell your data to advertisers or third parties -- instead, it only uses it to help developers improve the product. Mycroft even uses the privacy-focused DuckDuckGo as its search engine instead of Google when you ask for information. Mycroft makes its own smart speaker called the Mark I, though it's currently sold out with a new Mark II (video here) on the way. However, since the project is open-source, you can install Mycroft on just about any Linux machine, including the Raspberry Pi (thanks to a pre-made build called Picroft). Using Mycroft on the Pi is free, but you can also subscribe to a $1.99-per-month plan to help support its development -- you'll even get a few goodies, like other voices that sound more lifelike than the default robotic voice.' -- source: https://hardware.slashdot.org/story/19/12/14/1954242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi Foundation Sells Its 30,000,000th Raspberry Pi
by Peter Reutemann 15 Dec '19

15 Dec '19

'In a reply to a Twitter post, Raspberry Pi Foundation's CEO Eben Upton announced that they have sold their thirty-millionth Raspberry Pi. "We don't get sales returns from our licensees until month end," Upton acknowledged in a later tweet, but "at the end of November, we were at 29.8Mu, with a monthly run rate of 500-600ku..."' -- source: https://build.slashdot.org/story/19/12/14/203231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Managing Spectre/Meltdown-Style Vulnerabilities At AWS
by Lawrence D'Oliveiro 15 Dec '19

15 Dec '19

Some insights <https://www.theregister.co.uk/2019/12/10/linux_kernel_aws/> into the different priorities often faced by different groups faced with the same problem. Linux kernel developer Greg Kroah-Hartman says to avoid most of these “MDS” (“Microarchitectural Data Sampling”) vulnerabilities, you must turn off Intel’s hyperthreading, full stop. Amazon, on the other hand, find that the resulting 30-40% performance loss is unacceptable for many of their customers. So they have come up with a tweaked scheduler algorithm for their Linux kernels that avoids running two different guests on the same physical core at the same time. With this and other careful management, they claim to be able to keep their customers safe from each other, with much less dramatic performance impact. But then you have the downside that the mainline kernel is not interested in accepting patches with such narrow applicability. Of course Amazon would like to come up with something they will accept, just to reduce their own maintenance burden.

1 0

Mozilla To Force All Add-on Devs To Use 2FA To Prevent Supply-Chain Attacks
by Peter Reutemann 14 Dec '19

14 Dec '19

'Mozilla announced this week that all developers of Firefox add-ons must enable a two-factor authentication (2FA) solution for their account. From a report: "Starting in early 2020, extension developers will be required to have 2FA enabled on AMO [the Mozilla Add-Ons portal]," said Caitlin Neiman, Add-ons Community Manager at Mozilla. "This is intended to help prevent malicious actors from taking control of legitimate add-ons and their users," Neiman added. When this happens, hackers can use the developers' compromised accounts to ship tainted add-on updates to Firefox users. Since Firefox add-ons have a pretty privileged position inside the browser, an attacker can use a compromised add-on to steal passwords, authentication/session cookies, spy on a user's browsing habits, or redirect users to phishing pages or malware download sites. These types of incidents are usually referred to as supply-chain attacks.' -- source: https://it.slashdot.org/story/19/12/13/152239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Two of China's Largest Tech Firms Are Uniting To Create a New 'Domestic OS'
by Peter Reutemann 13 Dec '19

13 Dec '19

'The two biggest OS (operating system) makers in China announced plans last week to unite and jointly build a new "domestic operating system." From a report: The two companies are China Standard Software (CS2C) and Tianjin Kylin Information (TKC), two of China's largest software firms, with known ties to the Beijing government. Both companies are known on the local Chinese OS market. CS2C created "China's Windows XP clone," known as the NeoKylin OS, and TKC is the current steward of Kylin, China's first-ever homegrown operating system. CS2C and TKC plan to set up a new company in which they'll become investors, and through which the new joint OS will be developed. The new company will handle the new operating system's development, technological decisions, marketing, branding, financials, and sales. The current Kylin and NeoKylin operating systems will serve as a base for the new OS, the two said.' -- source: https://tech.slashdot.org/story/19/12/12/146246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Russian Police Raid NGINX Moscow Office
by Peter Reutemann 13 Dec '19

13 Dec '19

'Russian police have raided today the Moscow offices of NGINX, Inc., a subsidiary of F5 Networks and the company behind the internet's most popular web server technology. From a report: Equipment was seized and employees were detained for questioning. Moscow police executed the raid after last week the Rambler Group filed a copyright violation against NGINX Inc., claiming full ownership of the NGINX web server code. The Rambler Group is the parent company of rambler.ru, one of Russia's biggest search engines and internet portals. According to copies of the search warrant posted on Twitter today, Rambler claims that Igor Sysoev developed NGINX while he was working as a system administrator for the company, hence they are the rightful owner of the project. Sysoev created NGINX in the early 2000s and open-sourced the NGINX code in 2004. In 2009, he founded NGINX, Inc., a US company, to provide adjacent tools and support services for NGINX deployments. The company is based in San Francisco, but has offices all over the world, including Moscow. The NGINX server's source code is still free and managed through an open-source model, although a large chunk of the project's primary contributors are NGINX, Inc. employees, who have a firm grip on the project's stewardship.' -- source: https://news.slashdot.org/story/19/12/12/175245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Inside the Podcast that Hacks Ring Camera Owners Live on Air
by Peter Reutemann 13 Dec '19

13 Dec '19

'In the NulledCast podcast hackers livestream the harassment of Ring camera owners after accessing their devices. Hundreds of people can listen. From a report: A blaring siren suddenly rips through the Ring camera, startling the Florida family inside their own home. "It's your boy Chance on Nulled," a voice says from the Ring camera, which a hacker has taken over. "How you doing? How you doing?" "Welcome to the NulledCast," the voice says. The NulledCast is a podcast livestreamed to Discord. It's a show in which hackers take over people's Ring and Nest smarthome cameras and use their speakers to talk to and harass their unsuspecting owners. In the example above, Chance blared noises and shouted racist comments at the Florida family. "Sit back and relax to over 45 minutes of entertainment," an advertisement for the podcast posted to a hacking forum called Nulled reads. "Join us as we go on completely random tangents such as; Ring & Nest Trolling, telling shelter owners we killed a kitten, Nulled drama, and more ridiculous topics. Be sure to join our Discord to watch the shows live." Software to hack Ring cameras has recently become popular on the forum. The software churns through previously compromised email addresses and passwords to break into Ring cameras at scale. This has led to a recent spate of hacks that have occurred both during the podcast and at other times, several of which have been covered by local media outlets. In Brookhaven a hacker shouted at a sleeping woman through her hacked Ring camera to wake-up. In Texas, a hacker demanded a couple pay a bitcoin ransom. Hackers targeted a family in DeSoto County, Mississippi, and spoke through the device to one of the young children.' -- source: https://yro.slashdot.org/story/19/12/12/204240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Customizing A KDE Desktop
by Lawrence D'Oliveiro 11 Dec '19

11 Dec '19

A video <https://www.youtube.com/watch?v=uyz4-KZOzyI> showing how to set up KDE with an Apple-style dock and the application menu at the top of the screen (with some extra widgets added). Not something I would do myself, but it shows how configurable KDE can be.

1 0

Intel’s SGX coughs up crypto keys when scientists tweak CPU voltage
by Peter Reutemann 11 Dec '19

11 Dec '19

'To counter the growing sophistication of computer attacks, Intel and other chip makers have built digital vaults into CPUs to segregate sensitive computations and secrets from the main engine computers use. Now, scientists have devised an attack that causes the Software Guard Extensions—Intel's implementation of this secure CPU environment to divulge cryptographic keys and induce potentially dangerous memory errors. Plundervault, as the attack has been dubbed, starts with the assumption that an attacker is able to run privileged software on a targeted computer. While that's a lofty prerequisite, it's precisely the scenario Intel's SGX feature is designed to protect against. The chipmaker bills SGX as a private region that uses hardware-based memory encryption to isolate sensitive computations and data from malicious processes that run with high privilege levels. Intel goes as far as saying that "Only Intel SGX offers such a granular level of control and protection." But it turns out that subtle fluctuations in voltage powering the main CPU can corrupt the normal functioning inside the SGX. By subtly increasing or decreasing the current delivered to a CPU—operations known as "overvolting" and "undervolting"—a team of scientists has figured out how to induce SGX faults that leak cryptographic keys, break integrity assurances, and potentially induce memory errors that could be used in other types of attacks.' -- source: https://arstechnica.com/information-technology/2019/12/scientists-pluck-cry… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Teams is the First Office App For Linux
by Peter Reutemann 11 Dec '19

11 Dec '19

'Microsoft today launched Microsoft Teams for Linux in public preview. No, that's not a typo -- Microsoft Teams is indeed the first Office app that the company has ported to Linux. You can download Microsoft Teams as a native Linux package in .deb and .rpm formats from here.' -- source: https://linux.slashdot.org/story/19/12/10/1715255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Are You One Of Avast's 400 Million Users? This Is Why It Collects And Sells Your Web Habits.
by Peter Reutemann 11 Dec '19

11 Dec '19

'Avast, the multibillion-dollar Czech security company, doesn't just make money from protecting its 400 million users' information. It also profits in part because of sales of users' Web browsing habits and has been doing so since at least 2013. From a report: That's led to some labelling its tools "spyware," the very thing Avast is supposed to be protecting users from. Both Mozilla and Opera were concerned enough to remove some Avast tools from their add-on stores earlier this month, though the anti-virus provider says it's working with Mozilla to get its products back online. But recently appointed chief executive Ondrej Vlcek tells Forbes there's no privacy scandal here. All that user information that it sells cannot be traced back to individual users, he asserts. Here's how it works, according to Vlcek: Avast users have their Web activity harvested by the company's browser extensions. But before it lands on Avast servers, the data is stripped of anything that might expose an individual's identity, such as a name in the URL, as when a Facebook user is logged in. All that data is analysed by Jumpshot, a company that's 65%-owned by Avast, before being sold on as "insights" to customers. Those customers might be investors or brand managers. What do those customers get? Vlcek says Jumpshot, which was initially acquired in 2013, provides "insights on how cohorts of users on the internet use the web." For instance, it could show a percentage of visitors who went from one website to another. That could be useful to anyone monitoring an advertising campaign. "Typical customers would be, for example, investors, who would be interested in how online companies are doing in terms of their new campaigns," the new Avast chief explains. Say Amazon launches a new product -- Jumpshot could determine how much interest it's getting online.' -- source: https://it.slashdot.org/story/19/12/10/1922243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Releases Chrome 79 With New Features Including an Option To Freeze Tabs and Back-Forward Caching
by Peter Reutemann 11 Dec '19

11 Dec '19

'Google today released Chrome 79 for Windows, Mac, Linux, Chrome OS, Android, and iOS users. This release comes with security and bug fixes, but also with new features such as built-in support for the Password Checkup tool, real-time blacklisting of malicious sites via the Safe Browsing API, general availability of Predictive Phishing protections, a ban on loading HTTPS "mixed content," support for tab freezing, a new UI for the Chrome Sync profile section, and support for a back-forward caching mechanism. ZDNet has outlined each new feature in-depth.' -- source: https://yro.slashdot.org/story/19/12/10/1959205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Gets Dinged By IRD Over Transfer Pricing
by Lawrence D'Oliveiro 10 Dec '19

10 Dec '19

Microsoft has been forced to cough up $25 million to the New Zealand tax authorities over its shifting around of profits between international subsidiaries <https://www.theregister.co.uk/2019/12/09/oracle_facing_kiwi_tax_probe/>, and now Oracle is facing scrutiny over similar tax fiddles.

1 0

Draft algorithm charter
by Roderick Aldridge 10 Dec '19

10 Dec '19

The Government is calling for feedback on the draft algorithm charter. May interest Peter, others? We want your feedback on a draft algorithm charter, an enduring commitment for government agencies to use algorithms in a fair, ethical and transparent way. Draft algorithm charter for consultation <https://data.govt.nz/assets/Uploads/Draft-Algorithm-Charter-for-consultatio…> [PDF 255 KB] Draft algorithm charter for consultation <https://data.govt.nz/use-data/analyse-data/government-algorithm-transparenc…> [HTML] Algorithm assessment report <https://data.govt.nz/use-data/analyse-data/government-algorithm-transparenc…> Computer algorithms are now a fundamental element of data analytics. Algorithms support the services that government provides to people in New Zealand and to help deliver new, innovative, and well targeted policies to achieve government aims. https://data.govt.nz/use-data/analyse-data/government-algorithm-transparenc… Rod

3 4

Yahoo Groups Is Winding Down and All Content Will Be Permanently Removed
by Peter Reutemann 10 Dec '19

10 Dec '19

'Yahoo announced on Wednesday that it is winding down its long-running Yahoo Groups site. From a report: As of October 21, users will no longer be able to post new content to the site, and on December 14 Yahoo will permanently delete all previously posted content. "You'll have until that date to save anything you've uploaded," an announcement post reads. Yahoo Groups, launched in 2001, is a cross between a platform for mailing lists and internet forums. Groups can be interacted with on the Yahoo Groups site itself, or via email. In the 18 years that it existed, numerous niche communities made a home on the platform. Now, with the site's planned obsolescence, users are looking for ways to save their Groups history.' -- source: https://tech.slashdot.org/story/19/10/16/1928228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

WireGuard VPN is a step closer to mainstream adoption
by Peter Reutemann 10 Dec '19

10 Dec '19

'As of this morning, Linux network stack maintainer David Miller has committed the WireGuard VPN project into the Linux "net-next" source tree. Miller maintains both net and net-next—the source trees governing the current implementation of the Linux kernel networking stack and the implementation of the next Linux kernel's networking stack, respectively. This is a major step forward for the WireGuard VPN project. Net-next gets pulled into the new Linux kernel during its two-week merge window, where it becomes net. With WireGuard already a part of net-next, this means that—barring unexpected issues—there should be a Linux kernel 5.6 release candidate with built-in WireGuard in early 2020. Mainline kernel inclusion of WireGuard should lead to significantly higher uptake in projects and organizations requiring virtual private network capability. Normal, day-to-day Linux users probably won't see in-kernel WireGuard until late 2020. Ubuntu is one of the faster-moving mainstream distributions, and its next Long Term Support (LTS) release is in April 2020. But the Linux 5.6 kernel and Ubuntu 20.04 will likely be in release candidate status at the same time, so its inclusion in 20.04 seems unlikely. The interim 20.10 Ubuntu release seems like a much safer bet for Canonical's first use of a 5.6 or later kernel. Red Hat Enterprise Linux (RHEL) inclusion will likely be a year or more beyond that; the current RHEL 8.1 shipped in May 2019 with the 4.18 kernel, which was already 9 months old. Although highly speculative, it's also possible that WireGuard could land in-kernel on Ubuntu 20.04 even without the 5.6 kernel—Donenfeld offered to do the work backporting WireGuard into earlier Ubuntu kernels directly. Donenfeld also stated today that a 1.0 WireGuard release is "on the horizon."' -- source: https://arstechnica.com/gadgets/2019/12/wireguard-vpn-is-a-step-closer-to-m… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Users Can Now Use Disney+ After DRM Fix
by Peter Reutemann 09 Dec '19

09 Dec '19

'"Linux users can now stream shows and movies from the Disney+ streaming service after Disney lowered the level of their DRM requirements," reports Bleeping Computer: When Disney+ was first launched, Linux users who attempted to watch shows and movies were shown an error stating "Something went wrong. Please try again. If the problem persists, visit the Disney+ Help Center (Error Code 83)." As explained by Hans de Goede, this error was being caused by the Disney+ service using the highest level of security for the Widevine Digital Rights Management (DRM) technology. As some Linux and Android devices did not support this higher DRM security level, they were unable to stream Disney+ shows in their browsers... Yesterday, Twitter users discovered that Disney+ had suddenly started working on Linux browsers after the streaming service tweaked their DRM security levels... Even with Disney+ lowering the DRM requirements, users must first make sure DRM is enabled in the browser. For example, Disney+ will not work with Firefox unless you enable the "Play DRM-controlled content" setting in the browser.' -- source: https://linux.slashdot.org/story/19/12/08/169213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Debian Begins Vote On Supporting Non-Systemd Init Options
by Peter Reutemann 09 Dec '19

09 Dec '19

"It's been five years already since the vote to transition to systemd in Debian over Upstart," reports Phoronix, noting that the Debian developer community has now begun a 20-day ranked-choice vote on eight different proposals for "'init system diversity' and just how much Debian developers care (or not) in supporting alternatives to systemd." -- source: https://linux.slashdot.org/story/19/12/08/2131220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Qualcomm To Offer GPU Driver Updates On Google Play Store For Some Snapdragon Chips
by Peter Reutemann 08 Dec '19

08 Dec '19

'At its Snapdragon Summit in Maui, Hawaii this week, Qualcomm unveiled the new Snapdragon 865 Mobile Platform, which enable next year's flagship 5G Android phones with more performance, a stronger Tensor-based AI processor and a very interesting new forthcoming feature not yet offered for any smartphone platform to date. The company announced that it will eventually start delivering driver updates for its Adreno GPU engines on board the Snapdragon 865 as downloadable packages via the Google Play Store. This is big news for smartphones, as GPU drivers are rarely updated out of band, if ever, and typically have to wait for the next major Android release. And even then, many OEMs don't bother putting in the effort to ensure that mobile GPUs are running the most current graphics drivers from Qualcomm. The process, which would have to be pre-qualified by major OEMs as well, will be akin to what the PC GPU 3D graphics driver ecosystem has been benefiting from for a long time, for maximum performance and compatibility. Unfortunately, at least currently, GPU driver update support is limited to only the Adreno 650 core on board the new Snapdragon 865, which currently supports updating drivers in this fashion. Here's hoping this program is met with success and Qualcomm will begin to enable the feature for legacy and new midrange Snapdragon platforms as well.' -- source: https://tech.slashdot.org/story/19/12/06/2132212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Keybase Moves To Stop Onslaught of Spammers on Encrypted Message Platform
by Peter Reutemann 07 Dec '19

07 Dec '19

'Keybase started off as co-founder and developer Max Krohn's "hobby project" -- a way for people to share PGP keys with a simple username-based lookup. Then Chris Coyne (who also was cofounder of OkCupid and SparkNotes) got involved and along came $10.8 million in funding from a group of investors led by Andreesen Horowitz. And then things got increasingly more complicated. Keybase aims to make public-key encryption accessible to everyone, for everything from messaging to file sharing to throwing a few crypto-coins someone's way. But because of that level of accessibility, Keybase faces a very OkCupid kind of problem: after drawing in people interested in easy public-key crypto-based communications and then drawing in blockchain lovers with its partnership with (and funding from) Stellar.org, Keybase has also drawn in spammers and scammers. And that has brought a host of alerts and messages that have made what was once a fairly clear communications channel into one clogged with unwanted alerts, messages, and other unpleasantry -- raising a chorus of complaints in Keybase's open chat channel. It turns out there's a reason spell check keeps wanting to tell me that Keybase should be spelled "debase." Keybase's leadership is promising to do something to fix the spam problem -- or at least make it easier to report and block abusers. In a blog post, Krohn and Coynes wrote, "To be clear, the current spam volume isn't dire, YET. Keybase still works great. But we should act quickly." But the measures promised by Keybase won't completely eliminate the issue. And Keybase execs have no interest in getting involved with additional steps that they see as censorship. "Keybase is a private company and we do retain our rights to kick people out," the co-founders said in the blog post. "That hammer will not be used because someone is mostly disliked, as long as they're playing nicely on Keybase."' -- source: https://it.slashdot.org/story/19/12/06/1610259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Linux Vulnerability Lets Attackers Hijack VPN Connections
by Peter Reutemann 06 Dec '19

06 Dec '19

'Security researchers found a new vulnerability allowing potential attackers to hijack VPN connections on affected *NIX devices and inject arbitrary data payloads into IPv4 and IPv6 TCP streams. They disclosed the security flaw tracked as CVE-2019-14899 to distros and the Linux kernel security team, as well as to others impacted such as Systemd, Google, Apple, OpenVPN, and WireGuard. The vulnerability is known to impact most Linux distributions and Unix-like operating systems including FreeBSD, OpenBSD, macOS, iOS, and Android. A currently incomplete list of vulnerable operating systems and the init systems they came with is available below, with more to be added once they are tested and found to be affected: Ubuntu 19.10 (systemd), Fedora (systemd), Debian 10.2 (systemd), Arch 2019.05 (systemd), Manjaro 18.1.1 (systemd), Devuan (sysV init), MX Linux 19 (Mepis+antiX), Void Linux (runit), Slackware 14.2 (rc.d), Deepin (rc.d), FreeBSD (rc.d), and OpenBSD (rc.d). This security flaw "allows a network adjacent attacker to determine if another user is connected to a VPN, the virtual IP address they have been assigned by the VPN server, and whether or not there is an active connection to a given website," according to William J. Tolley, Beau Kujath, and Jedidiah R. Crandall, Breakpointing Bad researchers at University of New Mexico. "Additionally, we are able to determine the exact seq and ack numbers by counting encrypted packets and/or examining their size. This allows us to inject data into the TCP stream and hijack connections," the researchers said.' -- source: https://linux.slashdot.org/story/19/12/05/2022205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Polo – A Modern Light-weight File Manager for Linux
by Peter Reutemann 06 Dec '19

06 Dec '19

'Polo is a modern, light-weight and advanced file manager for Linux, that comes with a number of advanced features that are not present in many commonly used file managers or file browsers on Linux distributions. It comes with multiple panes with multiple tabs in each pane, support for archive creation, extraction and browsing, support for cloud storage, support for running KVM images, support for modifying PDF documents and image files, support for writing ISO files to UDB drives and much more.' -- source: https://www.tecmint.com/polo-file-manager-for-linux/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Strange email
by john 06 Dec '19

06 Dec '19

I just received a email as follows: for something I did not order with what appears to be an invalid tracking number banner Hi John Thompson, A consignment has been dispatched from NZ LIFESTYLE CAMPING LTD, these will leave on our next courier cycle. Please click on the links below to track your parcels Shipping Information Receiver: *John Thompson* 2/22 Stokes Crescent Maeroa, 3200 Parcels Reference Label Number CQ0000465225 <http://www.fastway.co.nz/courier-services/track-your-parcel?l=CQ0000465225> *Visit our website at: www.fastway.co.nz <http://www.fastway.co.nz>* The headers appear a little dodgy to me could someone look at them and help me decide if this is bovine scatology? Return-path: <csc(a)nzlifestylecamping.com> Envelope-to: jaytee21(a)slingshot.co.nz Delivery-date: Thu, 05 Dec 2019 19:32:17 +1300 Received: from [10.253.37.139] (port=45902 helo=canit-scanner-1.slingshot.co.nz) by mda-2.slingshot.co.nz with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from <csc(a)nzlifestylecamping.com>) id 1ickgR-0004iw-Gp for jaytee21(a)slingshot.co.nz; Thu, 05 Dec 2019 19:32:15 +1300 Received: from EX-VCLUST-03.FASTWAYTECH.local (smtp.fastway.org [103.61.69.250]) by canit-scanner-1.slingshot.co.nz (8.14.4/8.14.4/Debian-8+deb8u2) with ESMTP id xB56W9xu012445 for <jaytee21(a)slingshot.co.nz>; Thu, 5 Dec 2019 19:32:10 +1300 Received: from EX-VWEB-LB-01 ([192.168.32.164]) by EX-VCLUST-03.FASTWAYTECH.local with Microsoft SMTPSVC(7.5.7600.16601); Thu, 5 Dec 2019 19:32:08 +1300 MIME-Version: 1.0 From: csc(a)nzlifestylecamping.com To: jaytee21(a)slingshot.co.nz Date: 5 Dec 2019 19:32:08 +1300 Subject: New Consignment Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: base64 Message-ID: <EX-VCLUST-03UYLqVpU001ab53e(a)EX-VCLUST-03.FASTWAYTECH.local> X-OriginalArrivalTime: 05 Dec 2019 06:32:08.0088 (UTC) FILETIME=[B7B31180:01D5AB35] X-Bayes-Prob: 0.0001 (Score 0, tokens from: jaytee21, base:default, @@RPTN) X-Spam-Score: -0.89 () [Hold at 5.00] HTML_FONT_LOW_CONTRAST:0.001,HTML_MESSAGE:0.001,MIME_HTML_ONLY:1.105,SPF(none:0),DKIM(none:0),CC(NZ:-2) X-CanIt-Geo: ip=103.61.69.250; country=NZ; latitude=-41.0000; longitude=174.0000; http://maps.google.com/maps?q=-41.0000,174.0000&z=6 X-CanItPRO-Stream: base:jaytee21 (inherits from base:default) X-Canit-Stats-ID: 031y6w9mF - 4fdbdb3d511b - 20191205 Received-SPF: none (canit-scanner-1.slingshot.co.nz: domain of csc(a)nzlifestylecamping.com does not designate permitted sender hosts) receiver=canit-scanner-1.slingshot.co.nz; client-ip=103.61.69.250; envelope-from=<csc(a)nzlifestylecamping.com>; helo=EX-VCLUST-03.FASTWAYTECH.local; identity=mailfrom X-Scanned-By: CanIt (www . roaringpenguin . com) X-Envelope-To: jaytee21(a)slingshot.co.nz PCFET0NUWVBFIGh0bWwgUFVCTElDICItLy9XM0MvL0RURCBYSFRNTCAxLjAgVHJhbnNp dGlvbmFsLy9FTiIgImh0dHA6Ly93d3cudzMub3JnL1RSL3hodG1sMS9EVEQveGh0bWwx LXRyYW5zaXRpb25hbC5kdGQiPg0KPGh0bWwgeG1sbnM9Imh0dHA6Ly93d3cudzMub3Jn LzE5OTkveGh0bWwiIHN0eWxlPSJoZWlnaHQ6IDEwMCU7IHdpZHRoOiAxMDAlIj4NCjxo ZWFkPg0KICAgIDxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0i dGV4dC9odG1sOyBjaGFyc2V0PWlzby04ODU5LTEiIC8+DQogICAgPHRpdGxlPkVtYWls IG5vdGlmaWNhdGlvbjwvdGl0bGU+DQogICAgPHN0eWxlIHR5cGU9InRleHQvY3NzIj4N CiAgICAgICAgI2VtYWlsQm9keSB7DQogICAgICAgICAgICBtYXJnaW4tbGVmdDogMHB4 Ow0KICAgICAgICAgICAgbWFyZ2luLXRvcDogMHB4Ow0KICAgICAgICAgICAgbWFyZ2lu LXJpZ2h0OiAwcHg7DQogICAgICAgICAgICBtYXJnaW4tYm90dG9tOiAwcHg7DQogICAg ICAgICAgICBiYWNrZ3JvdW5kLWNvbG9yOiAjM0QzRDNCOw0KICAgICAgICB9DQogICAg PC9zdHlsZT4NCjwvaGVhZD4NCjxib2R5IGlkPSJlbWFpbEJvZHkiPg0KICAgIDxkaXYg c3R5bGU9InZlcnRpY2FsLWFsaWduOiB0b3A7IGZvbnQtc2l6ZTogOHB0OyI+DQogICAg ICAgIDx0YWJsZSB3aWR0aD0iMTAwJSIgYm9yZGVyPSIwIiBjZWxsc3BhY2luZz0iMCIg Y2VsbHBhZGRpbmc9IjAiIGhlaWdodD0iMTAwJSI+DQogICAgICAgICAgICA8dHIgdmFs aWduPSJ0b3AiPg0KICAgICAgICAgICAgICAgIDx0ZCB3aWR0aD0iMTAwJSIgaGVpZ2h0 PSIxMDAlIiBiZ2NvbG9yPSIjM0QzRDNCIj4NCiAgICAgICAgICAgICAgICAgICAgPGRp diBhbGlnbj0iY2VudGVyIj4NCiAgICAgICAgICAgICAgICAgICAgICAgIDx0YWJsZSB3 aWR0aD0iNTMwIiBib3JkZXI9IjAiIGNlbGxwYWRkaW5nPSIwIiBjZWxsc3BhY2luZz0i MCI+DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgPHRib2R5Pg0KICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICA8dHI+DQogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICA8dGQgd2lkdGg9IjEwIj4mbmJzcDsNCiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIDwvdGQ+DQogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICA8dGQgd2lkdGg9IjUxMCIgY29sc3Bhbj0iMiIgc3R5bGU9InRl eHQtYWxpZ246Y2VudGVyOyI+DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgPGltZyBzcmM9Imh0dHA6Ly93d3cuZmFzdHdheWVucXVpcmllcy5jb20v RW1haWwvNi5qcGciIHN0eWxlPSJtYXgtd2lkdGg6IDUxMHB4OyBoZWlnaHQ6IGF1dG87 bWFyZ2luOjAgYXV0bzsiIGFsdD0iYmFubmVyIi8+DQogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICA8L3RkPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgPHRkIHdpZHRoPSIxMCI+Jm5ic3A7DQogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICA8L3RkPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICA8L3RyPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8dHI+DQog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8dGQgd2lkdGg9IjEwIj4m bmJzcDsNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvdGQ+DQog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8dGQgd2lkdGg9IjUxMCIg Ymdjb2xvcj0iI2ZmZmZmZiIgY29sc3Bhbj0iMiI+DQogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgPHRhYmxlIHdpZHRoPSIxMDAlIiBib3JkZXI9IjAi IGNlbGxzcGFjaW5nPSI4IiBjZWxscGFkZGluZz0iMCI+DQogICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIDx0Ym9keT4NCiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDx0cj4NCiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8dGQ+DQogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IDx0YWJsZSB3aWR0aD0iMTAwJSIgYm9yZGVyPSIwIiBjZWxsc3BhY2luZz0iMCIgY2Vs bHBhZGRpbmc9IjAiPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgPHRyPg0KICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDx0ZD4NCiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgPGRpdiBhbGlnbj0ibGVmdCI+DQogICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICA8IS0tPHN0cm9uZz5NZXNzYWdlIGZyb20gTlogTElGRVNUWUxFIENBTVBJTkcg TFREPC9zdHJvbmc+LS0+DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvZGl2Pg0KICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIDwvdGQ+DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICA8L3RyPg0KICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPHRyPg0KICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIDx0ZCBhbGlnbj0ibGVmdCIgc3R5bGU9ImhlaWdodDoyNXB4OyI+DQogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIDwhLS08aW1nIGhlaWdodD0iMiIgc3JjPSIyLmdpZiIgd2lkdGg9IjQ3 NSIgYWx0PSIiIC8+LS0+DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC90ZD4NCiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvdHI+ DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIDwvdGFibGU+DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgPC90ZD4NCiAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIDwvdHI+DQoNCiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIDx0cj4NCiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8dGQ+DQoNCiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGRp dj4NCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIEhpIEpvaG4gVGhvbXBzb24sPGJyIC8+PGJyIC8+QSBjb25zaWdu bWVudCBoYXMgYmVlbiBkaXNwYXRjaGVkIGZyb20gTlogTElGRVNUWUxFIENBTVBJTkcg TFRELCB0aGVzZSB3aWxsIGxlYXZlIG9uIG91ciBuZXh0IGNvdXJpZXIgY3ljbGUuPGJy IC8+PGJyIC8+UGxlYXNlIGNsaWNrIG9uIHRoZSBsaW5rcyBiZWxvdyB0byB0cmFjayB5 b3VyIHBhcmNlbHM8YnIgLz48YnIgLz48c3R5bGUgdHlwZT0ndGV4dC9jc3MnPg0KICAg ICAgICAuYm9yZGVyDQogICAgICAgIHsNCiAgICAgICAgICAgIGJvcmRlci1ib3R0b206 IDFweCBzb2xpZCBibGFjazsNCiAgICAgICAgfQ0KDQogICAgICAgIC50aXRsZQ0KICAg ICAgICB7DQogICAgICAgICAgICBmb250LXNpemU6IDEycHQ7DQogICAgICAgIH0NCg0K ICAgICAgICBib2R5DQogICAgICAgIHsNCiAgICAgICAgICAgIGNvbG9yOiAjMDAzMzk5 Ow0KICAgICAgICAgICAgZm9udC1mYW1pbHk6IEdlbmV2YSxBcmlhbCxIZWx2ZXRpY2Es c2Fucy1zZXJpZjsNCiAgICAgICAgICAgIGZvbnQtc2l6ZTogNzAlOw0KICAgICAgICB9 DQogICAgPC9zdHlsZT4NCjxwPsKgPC9wPg0KICAgIDx0YWJsZSB3aWR0aD0nMTAwJScg Y2VsbHNwYWNpbmc9JzAnPg0KICAgICAgICA8dHI+DQogICAgICAgICAgICA8dGQgY29s c3Bhbj0nMycgY2xhc3M9J2JvcmRlciB0aXRsZSc+DQogICAgICAgICAgICAgICAgU2hp cHBpbmcgSW5mb3JtYXRpb24NCiAgICAgICAgICAgIDwvdGQ+DQogICAgICAgIDwvdHI+ PHRyPg0KICAgICAgICAgICAgPHRkIGNvbHNwYW49JzMnPg0KICAgICAgICAgICAgICAg IDx0YWJsZSB3aWR0aD0nMTAwJSc+DQogICAgICAgICAgICAgICAgICAgIDx0ciB2YWxp Z249J3RvcCc+DQogICAgICAgICAgICAgICAgICAgICAgICA8dGQgd2lkdGg9JzYwcHgn IHN0eWxlPSdmb250LXNpemU6MTBwdCc+DQogICAgICAgICAgICAgICAgICAgICAgICAg ICAgUmVjZWl2ZXI6DQogICAgICAgICAgICAgICAgICAgICAgICA8L3RkPg0KICAgICAg ICAgICAgICAgICAgICAgICAgPHRkPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAg IDxzdHJvbmc+Sm9obiBUaG9tcHNvbjwvc3Ryb25nPjxiciAvPjIvMjIgU3Rva2VzIENy ZXNjZW50PGJyIC8+TWFlcm9hLCAzMjAwDQogICAgICAgICAgICAgICAgICAgICAgICA8 L3RkPg0KICAgICAgICAgICAgICAgICAgICAgICAgPHRkIHdpZHRoPScyMHB4Jz7CoDwv dGQ+ICAgICAgICAgICAgICAgICAgICAgICAgIA0KICAgICAgICAgICAgICAgICAgICA8 L3RyPg0KICAgICAgICAgICAgICAgIDwvdGFibGU+DQogICAgICAgICAgICA8L3RkPg0K ICAgICAgICA8L3RyPiA8dHI+DQogICAgICAgICAgICA8dGQgY29sc3Bhbj0nMyc+DQog ICAgICAgICAgICAgICDCoA0KICAgICAgICAgICAgPC90ZD4NCiAgICAgICAgPC90cj4N CiAgICAgICAgICA8dHI+DQogICAgICAgICAgICA8dGQgY29sc3Bhbj0nMycgY2xhc3M9 J2JvcmRlciB0aXRsZSc+DQogICAgICAgICAgICAgICBQYXJjZWxzDQogICAgICAgICAg ICA8L3RkPg0KICAgICAgICA8L3RyPg0KICAgICAgICA8dHI+DQogICAgICAgIDx0ZD5S ZWZlcmVuY2U8L3RkPg0KDQogICAgICAgIDx0ZCBjb2xzcGFuPScyJz5MYWJlbCBOdW1i ZXI8L3RkPg0KICAgICAgICA8L3RyPjx0cj48dGQ+PC90ZD4NCiAgICAgICAgPHRkIGNv bHNwYW49JzInPjxhIGhyZWY9J2h0dHA6Ly93d3cuZmFzdHdheS5jby5uei9jb3VyaWVy LXNlcnZpY2VzL3RyYWNrLXlvdXItcGFyY2VsP2w9Q1EwMDAwNDY1MjI1Jz5DUTAwMDA0 NjUyMjU8L2E+PC90ZD4NCiAgICAgICAgPC90cj48L3RhYmxlPg0KICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Rpdj4N CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICA8L3RkPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgPC90cj4NCg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgPHRyPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIDx0ZCBoZWlnaHQ9IjI1IiBiZ2NvbG9yPSIjMTc2NmEz Ij4NCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgPGRpdiBhbGlnbj0iY2VudGVyIiBzdHlsZT0iY29sb3I6IFdoaXRlOyI+ DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICA8c3Ryb25nPlZpc2l0IG91ciB3ZWJzaXRlIGF0OiA8YSBzdHlsZT0i dGV4dC1kZWNvcmF0aW9uOiBub25lOyBjb2xvcjogI2ZmZmZmZjsiDQogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgaHJlZj0iaHR0cDovL3d3dy5mYXN0d2F5LmNvLm56Ij53d3cuZmFzdHdheS5jby5u ejwvYT48L3N0cm9uZz4NCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgPC9kaXY+DQogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC90ZD4NCiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvdHI+DQogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvdGJvZHk+DQogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC90YWJsZT4NCiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvdGQ+DQogICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICA8dGQgd2lkdGg9IjEwIj4mbmJzcDsNCiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvdGQ+DQogICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIDwvdHI+DQogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIDx0cj4NCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDx0ZCBj b2xzcGFuPSI0IiB3aWR0aD0iNTMwIj4mbmJzcDsNCiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIDwvdGQ+DQogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIDwvdHI+DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgPC90Ym9keT4NCiAg ICAgICAgICAgICAgICAgICAgICAgIDwvdGFibGU+DQogICAgICAgICAgICAgICAgICAg IDwvZGl2Pg0KDQogICAgICAgICAgICAgICAgICAgIDxkaXYgYWxpZ249ImNlbnRlciI+ DQogICAgICAgICAgICAgICAgICAgICAgICAmbmJzcDsNCiAgICAgICAgICAgICAgICAg ICAgPC9kaXY+DQogICAgICAgICAgICAgICAgPC90ZD4NCiAgICAgICAgICAgIDwvdHI+ DQogICAgICAgIDwvdGFibGU+DQogICAgPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= Hi John Thompson, A consignment has been dispatched from NZ LIFESTYLE CAMPING LTD, these will leave on our next courier cycle. Please click on the links below to track your parcels Label Number CQ0000465225 <http://www.fastway.co.nz/courier-services/track-your-parcel?l=CQ0000465225> *Visit our website at: www.fastway.co.nz <http://www.fastway.co.nz>*

2 1

Brother of Drug Lord Pablo Escobar Launches 'Unbreakable' Foldable Smartphone
by Peter Reutemann 05 Dec '19

05 Dec '19

'Roberto Escobar, brother of the late drug lord Pablo Escobar, has announced a foldable smartphone that is "very difficult to break" thanks to the screen's "special type of plastic." The Escobar Fold 1, as it is called, significantly undercuts Samsung's Galaxy Fold and Huawei Mate X with a price of only $349. Neowin reports: While all the foldable phones announced so far have a price tag of at least $1,500+, the Escobar Fold 1 will be available from only $349 which includes free shipping and a case as well. It will be sold unlocked and work on all compatible networks worldwide. This makes it cheaper than other non-foldable flagship smartphones available in the market right now. The drug lord's brother has been able to price the phone so low by cutting out the middlemen like networks and retailers. He is also preparing to file a $30 billion class-action lawsuit against Apple for scamming people and wants the company to "give some of their illegal profits back to the people." Like the Huawei Mate X, the Escobar Fold can be unfolded to turn it into a tablet with a screen size of 7.8-inches. The expanded AMOLED display has a 4:3 aspect ratio and an FHD+ resolution. The design language is different from the Samsung Galaxy Fold which features two separate displays, one of which folds. ' -- source: https://mobile.slashdot.org/story/19/12/03/2325235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

The Rise and Fall of the PlayStation Supercomputers
by Peter Reutemann 04 Dec '19

04 Dec '19

'"On the 25th anniversary of the original Sony PlayStation, The Verge shares the story of the PlayStation supercomputers," writes Slashdot reader jimminy_cricket. From the report: Dozens of PlayStation 3s sit in a refrigerated shipping container on the University of Massachusetts Dartmouth's campus, sucking up energy and investigating astrophysics. It's a popular stop for tours trying to sell the school to prospective first-year students and their parents, and it's one of the few living legacies of a weird science chapter in PlayStation's history. Those squat boxes, hulking on entertainment systems or dust-covered in the back of a closet, were once coveted by researchers who used the consoles to build supercomputers. With the racks of machines, the scientists were suddenly capable of contemplating the physics of black holes, processing drone footage, or winning cryptography contests. It only lasted a few years before tech moved on, becoming smaller and more efficient. But for that short moment, some of the most powerful computers in the world could be hacked together with code, wire, and gaming consoles. "The game consoles entered the supercomputing scene in 2002 when Sony released a kit called Linux for the PlayStation 2," reports The Verge. Craig Steffen, senior research scientist at the National Center for Supercomputing Applications, and his group hooked up between 60 and 70 PlayStation 2s, wrote some code, and built out a library. "The PS3 entered the scene in late 2006 with powerful hardware and an easier way to load Linux onto the devices," the report adds. "Researchers would still need to link the systems together, but suddenly, it was possible for them to imagine linking together all of those devices into something that was a game-changer instead of just a proof-of-concept prototype."' -- source: https://hardware.slashdot.org/story/19/12/03/2214249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 71 Arrives With Better Lockwise and Tracker Blocking, Picture-in-Picture on Windows
by Peter Reutemann 04 Dec '19

04 Dec '19

'Mozilla today released Firefox 71 for Windows, Mac, Linux, Android, and iOS. Firefox 71 includes Lockwise password manager improvements, Enhanced Tracking Protection tweaks, and Picture-in-Picture video on Windows.' -- source: https://news.slashdot.org/story/19/12/03/1428206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

elementary OS 5.1 'Hera' Linux Distro is Here
by Peter Reutemann 04 Dec '19

04 Dec '19

'elementary OS has long been viewed by many as the future of Linux on the PC thanks to its beautiful desktop environment and overall polished experience. Development of the Ubuntu-based operating system has been frustratingly slow, however. This shouldn't be surprising, really, as the team of developers is rather small, and its resources are likely much less than those of larger distributions such as the IBM-backed Fedora or Canonical's Ubuntu. And that is what makes elementary OS so remarkable -- its developers can make magic on a smaller budget. Today, the latest version of the operating system is released. Code-named "Hera," elementary OS 5.1 is now available for download. Support for Flatpak is now baked in -- this is significant, as the developers explain it is "the first non-deb packaging format we've supported out of the box." The Linux kernel now sits at a very modern 5.0. One of the most important aspects of elementary OS, the AppCenter, is now an insane 10 times faster than its predecessor.' -- source: https://tech.slashdot.org/story/19/12/03/1538207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Removes Avast and AVG Extensions From Add-on Portal Over Snooping Claims
by Peter Reutemann 04 Dec '19

04 Dec '19

'Mozilla today removed four Firefox extensions made by Avast and its subsidiary AVG after receiving credible reports that the extensions were harvesting user data and browsing histories. From a report: The four extensions are Avast Online Security, AVG Online Security, Avast SafePrice, and AVG SafePrice. The first two are extensions that show warnings when navigating to known malicious or suspicious sites, while the last two are extensions for online shoppers, showing price comparisons, deals, and available coupons. Mozilla removed the four extensions from its add-ons portal after receiving a report from Wladimir Palant, the creator of the AdBlock Plus ad-blocking extension. Palant analyzed the Avast Online Security and AVG Online Security extensions in late October and found that the two were collecting much more data than they needed to work -- including detailed user browsing history, a practice prohibited by both Mozilla and Google.' -- source: https://yro.slashdot.org/story/19/12/03/1559248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Vulnerability In Fully Patched Android Phones Under Active Attack By Bank Thieves
by Peter Reutemann 03 Dec '19

03 Dec '19

'A vulnerability in millions of fully patched Android phones is being actively exploited by malware that's designed to drain the bank accounts of infected users, researchers said on Monday. The vulnerability allows malicious apps to masquerade as legitimate apps that targets have already installed and come to trust, researchers from security firm Promon reported in a post. Running under the guise of trusted apps already installed, the malicious apps can then request permissions to carry out sensitive tasks, such as recording audio or video, taking photos, reading text messages or phishing login credentials. Targets who click yes to the request are then compromised. Researchers with Lookout, a mobile security provider and a Promon partner, reported last week that they found 36 apps exploiting the spoofing vulnerability. The malicious apps included variants of the BankBot banking trojan. BankBot has been active since 2017, and apps from the malware family have been caught repeatedly infiltrating the Google Play Market. The vulnerability is most serious in versions 6 through 10, which account for about 80% of Android phones worldwide. Attacks against those versions allow malicious apps to ask for permissions while posing as legitimate apps. There's no limit to the permissions these malicious apps can seek. Access to text messages, photos, the microphone, camera, and GPS are some of the permissions that are possible. A user's only defense is to click "no" to the requests. "The vulnerability is found in a function known as TaskAffinity, a multitasking feature that allows apps to assume the identity of other apps or tasks running in the multitasking environment," reports Ars Technica. While Google has removed the [unnamed] malicious apps from its Play Store, according to Promon, the vulnerability is still unfixed in all versions of Android. "Promon is calling the vulnerability 'StrandHogg,' an old Norse term for the Viking tactic of raiding coastal areas to plunder and hold people for ransom," the report adds. "Promon researchers said they identified StrandHogg after learning from an unnamed Eastern European security company for financial institutions that several banks in the Czech Republic reported money disappearing from customer accounts."' -- source: https://it.slashdot.org/story/19/12/02/230254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Huawei Is Now Making Smartphones Without American Chips
by Peter Reutemann 03 Dec '19

03 Dec '19

'"American tech companies are getting the go-ahead to resume business with Chinese smartphone giant Huawei Technologies Co., but it may be too late," reports the Wall Street Journal. Huawei is just building its smartphones without U.S. chips. Huawei's latest phone, which it unveiled in September -- the Mate 30 with a curved display, telephone and wide-angle cameras that competes with Apple Inc.'s iPhone 11 -- contained no U.S. parts, according to an analysis by UBS and Fomalhaut Techno Solutions, a Japanese technology lab that took the device apart to inspect its insides... While Huawei hasn't stopped using American chips entirely, it has reduced its reliance on U.S. suppliers or eliminated U.S. chips in phones launched since May, including the company's Y9 Prime and Mate smartphones, according to Fomalhaut's teardown analysis. Similar inspections by iFixit and Tech Insights Inc., two other firms that take apart phones to inspect components, have come to similar conclusions.' -- source: https://mobile.slashdot.org/story/19/12/02/0146208 Looks like actual competition now... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Rust-Based Redox OS Is Nearly Self-Hosting After Four Years
by Peter Reutemann 02 Dec '19

02 Dec '19

'Redox OS, written in Rust and currently under development, is only "a few months of work away" from self-hosting, meaning that the Rustc compiler would run on Redox itself, according to its creator Jeremy Soller... Redox has a POSIX-compliant C library written in Rust, called relibc. It is Linux-compatible both at the syscall API level and at the syscall ABI (Application binary interface) level, subject to the same architecture. The article notes that the OS's latest release was version 0.5 last March, arguing that it's "best described as experimental..." "Still, if Rust continues to grow in popularity, its characteristics of safety and unimpeded performance seem ideal for creating a new operating system, so perhaps Redox will become more prominent."' -- source: https://linux.slashdot.org/story/19/11/30/2011231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Kali Linux Adds 'Undercover' Mode to Impersonate Windows 10
by Peter Reutemann 02 Dec '19

02 Dec '19

'"Kali Linux 2019.4 was released last week and with it comes an 'Undercover' mode that can be used to quickly make the Kali desktop look like Windows 10," reports Bleeping Computer: Kali is a Linux distribution created for ethical hacking and penetration testing and is commonly used by researchers and red teamers to perform security tests against an organization. As most people are used to seeing Windows and macOS devices being used, it may look suspicious to see a user running Kali Linux with it's distinctive dragon logo and a Linux environment in an office lobby or other public setting. With this in mind, in Kali Linux 2019.4 the developers created a new 'Undercover' mode that will make the desktop look similar to Windows 10 in order to draw less suspicion. The script even hides Kali's dragon logo, explains a post on the Kali blog, so "you can work a bit more incognito. After you are done and in a more private place, run the script again and you switch back to your Kali theme. Like magic...!" "Thanks to Robert, who leads our penetration testing team, for suggesting a Kali theme that looks like Windows to the casual view..."' -- source: https://linux.slashdot.org/story/19/12/01/1825215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The File /var/lib/dbus/machine-id Matters For Your Privacy (and Devuan Fixed It)
by Peter Reutemann 01 Dec '19

01 Dec '19

'A few days ago Devuan ASCII 2.1 was announced and one update has been overlooked by most media outlets: our dbus patch to re-generate machine-id at every boot. This patch matters for everyone's privacy and I hope more distributions will follow our example, let alone Debian. We are dealing with important privacy implications: non-consensual user tracking is illegal in many countries and is not even mentioned in the machine-id documentation so far. "In theory, the machine-id should be a persistent identifier of the current host," explains the README documentation. "In practice, this causes some privacy concerns...' -- source: https://linux.slashdot.org/story/19/11/30/0538211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu 19.10: It’s fast, like “make old hardware feel new” fast
by Peter Reutemann 28 Nov '19

28 Nov '19

'Leaves are turning. Temperatures have dipped. These are sure signs—if you live in the Northern Hemisphere, at least—that Canonical's Autumn release is upon us. Things are a bit different in 2019, however. Not only is Ubuntu 19.10 nicknamed Eoan Ermine (no, I don't know how you pronounce it either), but it's the best non-LTS Ubuntu release Canonical has ever put out. I should qualify that statement somewhat, because really, as the newest version, it had damn well better be the best Ubuntu ever. But there's more than recency bias behind the sentiment. I've been reviewing Ubuntu for 10 years now, and I was using and interacting with this distro in some form or another for another three or four years before that. After spending recent weeks with Ubuntu 19.10, I can say confidently it is quite simply the best Ubuntu Canonical has ever released. The first reason I like 19.10 so much is that it feels insanely fast. Everyday tasks like opening applications, dragging windows, activating the search interface, and even just moving the cursor around are all noticeably faster than in 19.04. The speed boost is immediately noticeable from the minute you pop in the live CD, and it's even faster once you have 19.10 installed. I happened to be testing a top-of-the-line MacBook around the time I first installed the 19.10 beta on my aging Lenovo x240, and it instantly made the Mac feel like a sloth. Ubuntu 19.10 ran circles around the Mac even on much, much less powerful hardware, and nothing says success during testing like software that makes old hardware feel newer. Even if that were all you got out of Ubuntu 19.10, I'd call it a win.' -- source: https://arstechnica.com/gadgets/2019/11/ubuntu-19-10-quite-simply-the-best-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

tagging arbitrary files (not just mp3s) under Linux
by Peter Reutemann 26 Nov '19

26 Nov '19

Hi everyone After last night's AGM, I had a conversation with Rod regarding any Linux applications that allow tagging of arbitrary files (not just mp3s) to improve organizing them, similar to what Gmail introduced all those years ago. In the following reddit discussion: https://www.reddit.com/r/linux/comments/3mjwn5/do_any_popular_linux_file_sy… I came across the "TagSpaces" application (open source, AGPL), which seems to fit that bill: https://www.tagspaces.org/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

The strange tale of OneCoin
by Ian Young 26 Nov '19

26 Nov '19

Sorry if this is too wildly off topic but I was taken back by a story on the BBC from a day or two ago. https://www.bbc.com/news/stories-50435014

2 1

Passive-Cooling A Raspberry π 4
by Lawrence D'Oliveiro 26 Nov '19

26 Nov '19

Just came across this video <https://www.youtube.com/watch?v=VJC6OpGpq0Y>, latest in a series on cooling solutions for a Raspberry π 4. This instalment looks at a couple of purely passive, fanless products that use the case as a heat sink (or vice versa). But on top of that, a recent firmware update from Broadcom has made a massive difference to the running temperature in all the configurations. Summary: passive cooling worked quite well before the update, and now works even better.

1 0

The Librem 5 has been “shipping” for a month—but not to backers
by Peter Reutemann 26 Nov '19

26 Nov '19

'Purism announced that shipping of its Librem 5 open source smartphone began in late September. Two months later, nobody outside the company has a Librem 5, and people are getting restless. The Librem 5 is a crowdfunded project—and an ambitious one—so it wasn't much surprise or cause for concern when it missed its original January 2019 delivery target—or the April 2019 target set after January slipped. Both date changes were announced well ahead of time, and the company continued to post progress reports, commit code upstream, and assure backers of its commitment to transparency. (Full disclosure: I am a Librem 5 backer myself and am scheduled to receive a phone in the Evergreen batch.) The new delays are more troubling. On September 5, CEO Todd Weaver announced that the Librem 5 would ship in six iterative batches, codenamed Aspen, Birch, Chestnut, Dogwood, Evergreen, and Fir. The first three batches would effectively be usable prototypes of decreasing roughness; Evergreen would be the first entirely finished hardware production run, and Fir would be a relatively unspecified next-generation design.' -- source: https://arstechnica.com/gadgets/2019/11/the-librem-5-has-been-shipping-for-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla's Annual Buyer's Guide Rates Amazon and Google Security Cameras 'Very Creepy'
by Peter Reutemann 26 Nov '19

26 Nov '19

'"Be Smart. Shop Safe," warns Mozilla's annual buyer's guide for secure connected products. Based on their conversations with developers and dozens of privacy experts, they've awarded smiley faces with different expressions to rate products from "Not Creepy" up to "Super Creepy". "While the variety of smart devices on offer is rapidly increasing, so are the number of products that pay no heed to even basic security measures..." notes the editor of Mozilla's Internet Health Report. "Now that more and more companies collect personal data about you, including audio and video of your family, and sensitive biometric and health information, like your heart rate and sleeping habits, it's worrying that more are not upfront about the privacy and security of their products." Or, as The Next Web writes, "god bless Mozilla for having our lazy backs." And, well, if you're a user of any Ring camerasâ¦ we're sorry. Basically, there are five things that every product must do: - Have automatic security updates, so they're protected against the newest threats - Use encryption, meaning bad actors can't just snoop on your data - Include a vulnerability management pathway, which makes reporting bugs easy and, well, possible - Require users to change the default password (if applicable), because that makes devices far harder to access - Privacy policies -- ones that relate to the product specifically, and aren't just generic Doesn't seem too much to ask right...? Well, of the 76 devices Mozilla selected, 60 of them passed this test... And what devices didn't meet the criteria? There were nine of them overall (including the Artie 3000 Coding Robot and the Wemo Wifi Smart Dimmer), but the real loser in this test is the Amazon-owned Ring. Three of the company's products (which is effectively all of their major devices) didn't meet Mozilla's criteria. Yes, that's right, the Ring Video Doorbell, Ring Indoor Cam, and Ring Security Cam all didn't meet minimum standards for security.... The main reasons for not meeting this criteria is due Ring's history with poor encryption policies, and vulnerability management. To be fair, Nest Cam's Indoor and Outdoor Security Cameras and Google Home also fell into the "Very Creepy" category -- and so did Amazon's Echo smart speakers. (The Amazon Echo Show even made it into Mozilla's highest "Super Creepy" category, where the only other product was Facebook Portal.) But at least the Nest Hello Video doorbell only appears in Mozilla's "Somewhat Creepy" category. "Just because something on your wishlist this year connects to the internet, doesn't mean you have to compromise on privacy and security..." warns the editor of Mozilla's Internet Health Report. And in addition, "Fitness trackers designed for kids as young as 4 years old, raise questions about what we are teaching our children about how much digital surveillance in their lives is normal." Going forward, they suggest that we push for better privacy regulations -- and that whenever we rate products on performance and price, we should also rate them on their privacy and security. But in the meantime, as Mozilla explained on Twitter, "Friends don't let friends buy creepy gifts."' -- source: https://yro.slashdot.org/story/19/11/25/0415202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Web Creator Tim Berners-Lee Launches Plan To 'Fix' the Internet
by Peter Reutemann 26 Nov '19

26 Nov '19

'Tim Berners-Lee, the creator of the World Wide Web, is officially launching his plan to "fix" the internet. From a report: The World Wide Web Foundation, a non-profit campaign group set up by Berners-Lee, has secured the backing of tech giants Facebook, Google and Microsoft for the scheme, dubbed the "contract for the web." The British computer scientist first outlined his vision to overhaul organizations' approach to the internet at the Web Summit event last year. At the time, he said the web was "at a tipping point." The contract calls on companies to respect consumers' data privacy and urges governments to ensure everyone has access to the internet. "Never before has the web's power for good been more under threat," Adrian Lovett, CEO of the World Wide Web Foundation, told CNBC in an interview Friday. He added that the rise of hateful content and fake news being propagated online meant something had to change. "We're launching the contract for the web for the world's first-ever global action plan to protect the web as a force for good, bringing together companies, governments and citizens from around the world to say these are the things that need to be done to put things back on the right track." Other organizations backing the contract include DuckDuckGo, Reddit, GitHub and Reporters Without Borders. One major component of the pledge is the requirement that the web remains an accessible tool for all users. Lovett said that, "despite the progress we've seen in getting the world connected, half the world doesn't have access." He said the contract comes with nine core principles, while underneath them is a total of 76 clauses. "Not every organization has to abide by all of them," he insisted. "A good number of those 76 will be relevant." Berners-Lee will deliver a speech in Berlin, Germany, on Monday where he is due to say the contract will serve as a blueprint for governments, companies and citizens to safeguard the web as a force for good. The World Wide Web Foundation says it is working with partners to develop tools that can measure progress on the contract's various clauses' -- source: https://yro.slashdot.org/story/19/11/25/1347233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Zorin OS 15 Lite Linux Distro Can Rejuvenate Your Aging Windows PC
by Peter Reutemann 26 Nov '19

26 Nov '19

'Called "Zorin OS 15 Lite," it is not only lightweight, but thanks to the Xfce desktop environment and integrated Flatpak support, it should be quite familiar to those switching from Windows. In fact, the developers are intentionally targeting existing Windows 7 users, as Microsoft's operating system will be unsupported beginning January 2020. Zorin OS 15 Lite, in comparison, is based on Ubuntu 18.04 LTS and supported until 2023! It even comes with the very modern Linux kernel 5.0. "With Zorin OS 15 Lite, weâ(TM)ve condensed the full Zorin OS experience into a streamlined operating system, designed to run fast on computers as old as 15 years. With version 15, we've gone the extra mile to make the XFCE 4.14-based desktop feel familiar and user-friendly to new users, especially those moving away from Windows 7 leading up to the end of its support in January 2020. By pairing the most advanced and efficient software with a user-friendly experience, we've made it possible for anyone to extend the lifespan of their computers for years to come," explains the Zorin OS developers.' -- source: https://linux.slashdot.org/story/19/11/25/179256 Maybe worth a demo next year? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The RIPE NCC Has Run Out of IPv4 Addresses
by Peter Reutemann 26 Nov '19

26 Nov '19

'The RIPE NCC, the regional internet registry for Europe, West Asia, and the former USSR, has allocated the final /22 remaining in their address pool, and has stated that they have now run out of IPv4 addresses. RIPE will continue to recover IPv4 addresses from organisations that go out of business, close, or that return them due to lack of need, but expects these small amounts of recovered IPv4 addresses to fall well short of demand: RIPE will now only assign IPv4 addresses to entities that have never received any IPv4 allocation in the past, and even then will assign no more than a /24. RIPE puts out a call to action for IPv6 migration: This event is another step on the path towards global exhaustion of the remaining IPv4 addressing space. In recent years, we have seen the emergence of an IPv4 transfer market and greater use of Carrier Grade Network Address Translation (CGNAT) in our region. There are costs and trade-offs with both approaches and neither one solves the underlying problem, which is that there are not enough IPv4 addresses for everyone. Without wide-scale IPv6 deployment, we risk heading into a future where the growth of our Internet is unnecessarily limited — not by a lack of skilled network engineers, technical equipment or investment -- but by a shortage of unique network identifiers. There is still a long way to go, and we call on all stakeholders to play their role in supporting the IPv6 roll-out.' -- source: https://tech.slashdot.org/story/19/11/25/1841256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 5.4 Released
by Peter Reutemann 26 Nov '19

26 Nov '19

'Linux 5.4 has been released, featuring the new kernel lockdown mode, intended to strengthen the boundary between UID 0 and the kernel; virtio-fs, a high-performance virtio driver which allows a virtualized guest to mount a directory that has been exported on the host; fs-verity, for detecting file tampering, like dm-verity, but works on files rather than block devices; dm-clone, which allows live cloning of dm targets; two new madvise() flags for improved app memory management on Android, support for new Intel/AMD GPUs, support for the exfat file system and removing the experimental status of the erofs file system; a new haltpoll cpuidle driver and governor that greatly improves performance for virtualized guests wanting to do guest-side polling in the idle loop; and blk-iocost, a new cgroup controller that attempts to calculate more accurately the cost of IO. As always, many other new drivers and improvements can be found in the changelog.' -- source: https://tech.slashdot.org/story/19/11/25/1836212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

NextCloud Linux Servers Targetted by NextCry Ransomware
by Peter Reutemann 25 Nov '19

25 Nov '19

'A new and particularly troublesome ransomware variant has been identified in the wild. Dubbed NextCry, this nasty strain of ransomware encrypts data on NextCloud Linux servers and has managed to evade the detection of public scanning platforms and antivirus engines. To make matters worse, there is currently no free decryption tool available for victims. Ransomware hunter and creator of ID Ransomware Michael Gillespie notes that the NextCry ransomware, which is a Python script compiled in a Linux ELF binary using pyInstaller, oddly uses Base64 to encode file names as well as the content of files which have already been encrypted. Gillespie has also confirmed that NextCry encrypts data using the AES algorithm with a 256-bit key. The ransom note that NextCry victims receive reads "READ_FOR_DECRYPT", and demands 0.025 BTC for a victim's files to be unlocked.' -- source: https://linux.slashdot.org/story/19/11/24/1845253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Tracking Prevention in Microsoft's Edge Will Hit Google the Hardest
by Peter Reutemann 25 Nov '19

25 Nov '19

'Microsoft's Edge browser is built on the same open source code as Google Chrome. But Ed Bott, writing for ZDNet, noticed something interesting: On January 15, 2020, Microsoft is scheduled to roll out a completely revamped Edge browser to the general public. That browser, which is available for beta testing now on all supported versions of Windows and MacOS, includes a feature called Tracking Prevention. If that name sounds familiar, you're not imagining things. Microsoft added a Tracking Protection feature to Internet Explorer 9, back in 2011; it used simple text files called Tracking Protection Lists (TPLs) to allow or block third-party requests from specific domains. That's the same general principle behind Tracking Prevention in the new Edge, but the implementation is more usable and more sophisticated, with multiple Trust Protection Lists taking the place of a single TPL. I've spent the past week looking closely at this feature... [A]lthough it's aimed at the online advertising and tracking industries in general, my tests suggest that its effects are likely to be felt most directly by one company: Google. Using the default Balanced setting, Tracking Prevention blocked a total of 2,318 trackers, or an average of 35 on each page. Of that total, 552 were from Google domains. That's a mind-boggling 23.8% of the total. To put that into perspective, the second entry on the list of blocked trackers was Facebook, which represented 3.8% of the total. Rather than an anti-Google conspiracy, the article suggests this is instead just a reflection of both Google's ubiquity and its business model. "Google Analytics and Google AdSense are embedded on a staggering number of web pages."' -- source: https://tech.slashdot.org/story/19/11/24/2055219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AGM tomorrow
by Peter Reutemann 24 Nov '19

24 Nov '19

Hi everyone Just a friendly reminder that our AGM is on tomorrow: https://www.meetup.com/WaikatoLinuxUsersGroup/events/257884356/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Mint 19.2
by tom butz 23 Nov '19

23 Nov '19

Re: Linux Mint 19.2 The latest update ('new' package-manager) seems to disable Bluetooth. That also happened to me when I updated from 19.1 to 19.2 WITHOUT a complete reinstall. There are two workarounds: EITHER: back-up the whole system every night, and restore it if Bluetooth disappears again (=no icon in the panel after an update) - skipping updates. OR: use another system such as SparkyLinux, e.g. on a bootable sdcard for Bluetooth-transfers and stick with Mint 19.2 for anything else. I use this 'veteran' Linux because it features OpenShot 1.4 - my (favourite) moviemaker. My Toshiba laptop has 128 GB of RAM-HD, so copying/restoring to/from an image-file doesn't take all that long. Tom Butz

2 1

Server Management Recommendations
by Stu Meads 22 Nov '19

22 Nov '19

Hi all, I'm setting up a new Ubuntu 19.04LTS LAMP server in the next few months, I normally do it all myself, manage all the security myself etc, but I'm finding I don't have time and am looking for a reputable person or company to help me with initial setup, making sure everything is really secure, and be available for upgrades, security audits etc. My preference is a New Zealand based company in the hope that I will get a better quality service, easier communication etc, but will go for whatever's best for my employer Any recommendations either privately or via this list welcome

3 3

The Ad Tracker Arms Race Continues
by Lawrence D'Oliveiro 22 Nov '19

22 Nov '19

Web advertisers are resorting to a new technique <https://www.theregister.co.uk/2019/11/21/ublock_origin_firefox_unblockable_…> to bypass restrictions on third-party cookies for tracking users’ browsing behaviour: use first-party cookies instead. A detailed example can be found in this GitHub issue <https://github.com/uBlockOrigin/uBlock-issues/issues/780>: the site www.liberation.fr includes links to f7ds.liberation.fr, which is notionally under the same domain. However, that is actually a CNAME (alias) for the third-party tracker site liberation.eulerian.net. So cookies that are supposed to be restricted to *.liberation.fr are passed to that site as well. Just to be clear, this is not a browser “bug” by any means; it’s just part of how the DNS is supposed to work. The good news is, Firefox offers an API that adblocker addons can use to detect this sort of thing going on and stop it.

1 0

System76 Will Start Designing and Building Its Own Linux Laptops Beginning January 2020
by Peter Reutemann 21 Nov '19

21 Nov '19

'Denver-based PC manufacturer and Pop!_OS Linux developer System76 plans to follow-up its custom Thelio desktop PC with an in-house laptop beginning next year, according to founder and CEO Carl Richell. During a recent interview, Richell was quick to emphasize that the entire process of designing, prototyping and iterating the final product could take two to three years. But the company is eager to break into this market and put the same signature "stamp" on its laptop hardware that graces its custom-built Thelio desktop. System76 sells an extensive lineup of laptops, but the machines are designed by the likes of Sager and Clevo. The company doesn't merely buy a chassis and slap Pop!_OS on it, but Richell tells me he's confident that with the experience gained from developing Thelio -- and the recent investment into a factory at the company's Denver headquarters -- System76 is capable of building a laptop from the ground up that meets market needs and carries a unique value proposition. Richell says the company's first priority is locking down the aesthetic of the laptop and how various materials look and feel. It will simultaneously begin working on the supply chain aspects and speaking with various display and component manufacturers. System76 will design and build a U-class laptop first (basically an Ultrabook form factor like the existing Darter and Galago) and then evaluate what it might do with higher-end gaming and workstation notebooks with dedicated graphics.' -- source: https://hardware.slashdot.org/story/19/11/20/2241223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

“Where the Wi-Fi sucks” is where a new wireless protocol does its magic
by Peter Reutemann 21 Nov '19

21 Nov '19

'Researchers at Brigham Young University have created a new RF protocol that runs on top of existing consumer Wi-Fi at significantly greater range. But before you get too excited, the protocol's bandwidth is extremely low—so much so that it makes LoRa look like an OC-24. The protocol, called ONPC—short for On-Off Noise Power Communication—currently only specifies a single bit per second. Although ONPC only conveys one bit per second of data, its range is 60m or more beyond Wi-Fi—and it runs in software alone, on unmodified Wi-Fi hardware. An ONPC device can connect to standard Wi-Fi when range permits, fall back to ONPC mode if the connection drops, and then re-connect to the Wi-Fi when it becomes available again.' -- source: https://arstechnica.com/gadgets/2019/11/where-the-wi-fi-sucks-is-where-a-ne… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google outlines plans for mainline Linux kernel support in Android
by Peter Reutemann 20 Nov '19

20 Nov '19

'It seems like Google is working hard to update and upstream the Linux kernel that sits at the heart of every Android phone. The company was a big participant in this year's Linux Plumbers Conference, a yearly meeting of the top Linux developers, and Google spent a lot of time talking about getting Android to work with a generic Linux kernel instead of the highly-customized version it uses now. It even showed an Android phone running a mainline Linux kernel. But first, some background on Android's current kernel mess.Currently, three major forks happen in between the "mainline" Linux kernel and a shipping Android device (note that "mainline" here has no relation to Google's own "Project Mainline"). First, Google takes the an LTS (Long Term Support) Linux kernel and turns it into the "Android Common kernel"—the Linux kernel with all the Android OS-specific patches applied. Android Common is shipped to the SoC vendor (usually Qualcomm) where it gets its first round of hardware-specific additions, first focusing on a particular model of SoC. This "SoC Kernel" then gets sent to a device manufacturer for even more hardware-specific code that supports every other piece of hardware, like the display, camera, speakers, usb ports, and any extra hardware. This is the "Device Kernel," and it's what actually ships on a device.' -- source: https://arstechnica.com/gadgets/2019/11/google-outlines-plans-for-mainline-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google and Samsung Fix Android Spying Flaw. Other Makers May Still Be Vulnerable
by Peter Reutemann 20 Nov '19

20 Nov '19

'Until recently, weaknesses in Android camera apps from Google and Samsung made it possible for rogue apps to record video and audio and take images and then upload them to an attacker-controlled server -- without any permissions to do so. Camera apps from other manufacturers may still be susceptible. From a report: The weakness, which was discovered by researchers from security firm Checkmarx, represented a potential privacy risk to high-value targets, such as those preyed upon by nation-sponsored spies. Google carefully designed its Android operating system to bar apps from accessing cameras and microphones without explicit permission from end users. An investigation published Tuesday showed it was trivial to bypass those restrictions. The investigation found that an app needed no permissions at all to cause the camera to shoot pictures and record video and audio. To upload the images and video -- or any other image and video stored on the phone -- to an attacker-controlled server, an app needed only permission to access storage, which is among one of the most commonly given usage rights. The weakness, which is tracked as CVE-2019-2234, also allowed would-be attackers to track the physical location of the device, assuming GPS data was embedded into images or videos. Google closed the eavesdropping hole in its Pixel line of devices with a camera update that became available in July. Checkmarx said Samsung has also fixed the vulnerability, although it wasn't clear when that happened. Checkmarx said Google has indicated that Android phones from other manufacturers may also be vulnerable. The specific makers and models haven't been disclosed.' -- source: https://tech.slashdot.org/story/19/11/19/1737219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The World's Fastest Supercomputers Hit Higher Speeds Than Ever With Linux
by Peter Reutemann 19 Nov '19

19 Nov '19

'In the latest Top 500 supercomputer ratings, the average speed of these Linux-powered racers is now an astonishing 1.14 petaflops. The fastest of the fast machines haven't changed since the June 2019 Top 500 supercomputer list. Leading the way is Oak Ridge National Laboratory's Summit system, which holds top honors with an HPL result of 148.6 petaflops. This is an IBM-built supercomputer using Power9 CPUs and NVIDIA Tesla V100 GPUs. In a rather distant second place is another IBM machine: Lawrence Livermore National Laboratory's Sierra system. It uses the same chips, but it "only" hit a speed of 94.6 petaflops. Close behind at No. 3 is the Sunway TaihuLight supercomputer, with an HPL mark of 93.0 petaflops. TaihuLight was developed by China's National Research Center of Parallel Computer Engineering and Technology (NRCPC) and is installed at the National Supercomputing Center in Wuxi. It is powered exclusively by Sunway's SW26010 processors. Sunway's followed by the Tianhe-2A (Milky Way-2A). This is a system developed by China's National University of Defense Technology (NUDT). It's deployed at the National Supercomputer Center in China. Powered by Intel Xeon CPUs and Matrix-2000 accelerators, it has a top speed of 61.4 petaflops. Coming at No. 5, the Dell-built, Frontera, a Dell C6420 system is powered by Intel Xeon Platinum processors. It speeds along at 23.5 petaflops. It lives at the Texas Advanced Computing Center of the University of Texas. The most powerful new supercomputer on the list is Rensselaer Polytechnic Institute Center for Computational Innovations (CCI)'s AiMOS. It made the list in the 25th position with 8.0 petaflops. The IBM-built system, like Summit and Sierra, is powered by Power9 CPUs and NVIDIA V100 GPUs. In closing, ZDNet's Steven J. Vaughan-Nichols writes: "Regardless of the hardware, all 500 of the world's fastest supercomputers have one thing in common: They all run Linux."' -- source: https://linux.slashdot.org/story/19/11/18/2128212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel To Remove Old Drivers and BIOS Updates From Its Site
by Peter Reutemann 19 Nov '19

19 Nov '19

'By Friday this week, Intel plans to remove old drivers and BIOS updates from its official website. From a report: "This download, BIOS Update [BLH6710H.86A] 0163, will no longer be available after November 22, 2019 and will not be supported with any additional functional, security, or other updates," reads a message posted to the download page of one of the impacted components. "Intel recommends that users of BIOS Update [BLH6710H.86A] 0163 uninstall and/or discontinue use as soon as possible," the message continues. The downloads are drivers and BIOS updates for Intel desktop components and motherboards the company released in the 90s and early-to-mid 2000s. Downloads for hundreds of components are believed to have been impacted, from motherboards to NIC cards and graphics cards. Most of the drivers are for Windows versions like 98, ME, XP, and older Windows Server editions -- old Windows OS versions that have themselves reached end-of-life (EOL) All components and motherboards reached (EOL) years ago, and Intel stopped delivering firmware updates as a result. Its website was merely hosting the older files for convenience.' -- source: https://it.slashdot.org/story/19/11/18/1646210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Announces Plan To Support DoH In Windows
by Peter Reutemann 19 Nov '19

19 Nov '19

'Microsoft's Core Network team just announced they plan on supporting DoH in the Windows resolver. In the blog post, the company writes: Providing encrypted DNS support without breaking existing Windows device admin configuration won't be easy. However, at Microsoft we believe that "we have to treat privacy as a human right. We have to have end-to-end cybersecurity built into technology." We also believe Windows adoption of encrypted DNS will help make the overall Internet ecosystem healthier. There is an assumption by many that DNS encryption requires DNS centralization. This is only true if encrypted DNS adoption isn't universal. To keep the DNS decentralized, it will be important for client operating systems (such as Windows) and Internet service providers alike to widely adopt encrypted DNS. With the decision made to build support for encrypted DNS, the next step is to figure out what kind of DNS encryption Windows will support and how it will be configured. Here are our team's guiding principles on making those decisions: Windows DNS needs to be as private and functional as possible by default without the need for user or admin configuration because Windows DNS traffic represents a snapshot of the user's browsing history. To Windows users, this means their experience will be made as private as possible by Windows out of the box. For Microsoft, this means we will look for opportunities to encrypt Windows DNS traffic without changing the configured DNS resolvers set by users and system administrators. Privacy-minded Windows users and administrators need to be guided to DNS settings even if they don't know what DNS is yet. Many users are interested in controlling their privacy and go looking for privacy-centric settings such as app permissions to camera and location but may not be aware of or know about DNS settings or understand why they matter and may not look for them in the device settings. Windows users and administrators need to be able to improve their DNS configuration with as few simple actions as possible. We must ensure we don't require specialized knowledge or effort on the part of Windows users to benefit from encrypted DNS. Enterprise policies and UI actions alike should be something you only have to do once rather than need to maintain. Windows users and administrators need to explicitly allow fallback from encrypted DNS once configured. Once Windows has been configured to use encrypted DNS, if it gets no other instructions from Windows users or administrators, it should assume falling back to unencrypted DNS is forbidden.' -- source: https://yro.slashdot.org/story/19/11/18/1929229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

WLUG AGM next week
by Peter Reutemann 18 Nov '19

18 Nov '19

Hi everyone Just a friendly reminder that our AGM is on next week on Monday, with the current agenda: - President's Report - Treasurer's Report - Election of 2020 Committee - Move AGM to January (after financial year ends) to have a complete treasurer's report for AGM - Alternatives to meetup.com due to payment changes - General business - Consumption of pizza Details (location etc): https://www.meetup.com/WaikatoLinuxUsersGroup/events/257884356/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Why Firefox Fights for the Future of the Web
by Peter Reutemann 18 Nov '19

18 Nov '19

'"Mozilla is no longer fighting for market share of its browser: it is fighting for the future of the web," writes the Guardian, citing Mozilla Project co-founder Mitchell Baker: Baker's pitch is that only Mozilla is motivated, first and foremost, to make using the web a pleasurable experience. Google's main priority is to funnel user data into the enormous advertising engine that accounts for most of its revenue. Apple's motivation is to ensure that customers continue to buy a new iPhone every couple of years and don't switch to Android...." Firefox now runs sites such as Facebook in "containers", effectively hiving the social network off into its own little sandboxed world, where it can't see what's happening on other sites. Baker says: "It reduces Facebook's ability to follow you around the web and track you when you're not on Facebook and just living your life...." Mozilla has launched Monitor, a data-breach reporting service; Lockwise, a password manager; and Send, a privacy-focused alternative to services such as WeSendit. It's also beta-testing a VPN (virtual private network) service, which it hopes to market to privacy-conscious users... Apple's iOS (mobile operating system) is an acknowledged disaster for Mozilla. Safari is the default and, while users can install other browsers, they come doubly hindered: they can never be set as the default, meaning any link clicked in other applications will open in Safari; and they must use Safari's "rendering engine", a technical limitation that means that even the browsers that Firefox does have on the platform are technically just fancy wrappers for Apple's own browser, rather than full versions of the service that Mozilla has built over the decades... "Even if you do download a replacement, iOS drops you back into the default. I don't know why that's acceptable. Every link you open on a phone is the choice of the phone maker, even if you, as a user, want something else." Summarizing Baker's concerns, the Guardian writes that "It is perfectly possible to build a browser that prevents advertising companies from aggregating user data. But it is unlikely that any browser made by an advertising company would offer such a feature..." And an activist for the Small Technology Foundation tells them that Google "wants the web to go through Google. It already mostly does: with eyes on 70% to 80% of the web."' -- source: https://news.slashdot.org/story/19/11/17/1614222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Wikipedia's Co-Founder Takes On Facebook With Ad-Free Social Network
by Peter Reutemann 15 Nov '19

15 Nov '19

'Wikipedia co-founder Jimmy Wales has launched a social network called WT:Social. It has no financial association with Wikipedia and operates on donations, not advertising. The Next Web reports: WT:Social went live last month and is currently nearing 50,000 users. The company is rolling out access slowly; when I signed up, I was approximately number 28,000 on the waitlist. Alternatively, you can pay 13 bucks a month or 100 a year to get access right away. In comments to the Financial Times, Wales said "The business model of social media companies, of pure advertising, is problematic. It turns out the huge winner is low-quality content." You don't say. WT:Social's interface is rather sparse at the moment, featuring a simple feed comprised of news stories and comments below them. News is a big part of the network; it's a spinoff of Wales' previous project, WikiTribune, which sought to be a global news site comprised of professional journalists and citizen contributors. Both WikiTribune and WT:Social emphasize combatting fake news, highlighting evidence-based coverage over the focus on "engagement" seen on other networks. Each story posted to the network makes prominent where the article comes from, as well as sources and references. You can also join various "SubWikis" that are essentially like Facebook groups or subreddits, which filter content to stories of a given topic. You can also add hashtags to a post or follow hashtags for more specific interests that might span more than one SubWiki. Posts are currently sorted chronologically, but the site plans to add an upvote system for users to promote quality stories.' -- source: https://news.slashdot.org/story/19/11/14/223256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0