- wlug - list.wlug.org.nz

“The following packages have been kept back:”
by Peter Reutemann 23 Aug '18

23 Aug '18

Every now and then, I get the message from "apt-get upgrade", that: “The following packages have been kept back:” The following answer on "ask ubuntu" explains this nicely and also several solutions to install these packages after all: https://askubuntu.com/questions/601/the-following-packages-have-been-kept-b… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel's Reworked Microcode Security Fix License No Longer Prohibits Benchmarking
by Peter Reutemann 23 Aug '18

23 Aug '18

'Intel has backtracked on the license for its latest microcode update that mitigates security vulnerabilities in its processors -- after the previous wording outlawed public benchmarking of the chips. The reason for Intel's insistence on a vow of silence is that -- even with the new microcode in place -- turning off hyper-threading is necessary to protect virtual machines from attack via Foreshadow -- and that move comes with a potential performance hit. Predictably, Intel's contractual omerta had the opposite effect and drew attention to the problem. "Performance is so bad on the latest Spectre patch that Intel had to prohibit publishing benchmarks," said Lucas Holt, MidnightBSD project lead, via Twitter. In response to the outcry, Intel subsequently said it would rewrite the licensing terms. And now the fix is in. Via Twitter, Imad Sousou, corporate VP and general manager of Intel Open Source Technology Center, on Thursday said: "We have simplified the Intel license to make it easier to distribute CPU microcode updates and posted the new version here. As an active member of the open source community, we continue to welcome all feedback and thank the community." The reworked license no longer prohibits benchmarking. Long-time Slashdot reader and open-source pioneer, Bruce Perens, first brought Intel's microcode update to our attention. In a phone interview with The Register, Perens said he approved of the change. "This is a relatively innocuous license for proprietary software and it can be distributed in the non-free section of Debian, which is where is used to be, and it should be distributable by other Linux distributions," he said. "You can't expect every lawyer to understand CPUs. Sometimes they have to have a deep conversation with their technical people."' -- source: https://it.slashdot.org/story/18/08/23/2041206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel Publishes Microcode Security Patches With No Benchmarks Or Profiling Allowed
by Peter Reutemann 23 Aug '18

23 Aug '18

'The Register reports that Debian is rejecting a new Intel microcode update because of a new license term prohibiting the use of the CPU for benchmarks and profiling. There is a new license term applied to the new microcode: "You will not, and will not allow any third party to (i) use, copy, distribute, sell or offer to sell the Software or associated documentation; (ii) modify, adapt, enhance, disassemble, decompile, reverse engineer, change or create derivative works from the Software except and only to the extent as specifically required by mandatory applicable laws or any applicable third party license terms accompanying the Software; (iii) use or make the Software available for the use or benefit of third parties; or (iv) use the Software on Your products other than those that include the Intel hardware product(s), platform(s), or software identified in the Software; or (v) publish or provide any Software benchmark or comparison test results."' -- source: https://linux.slashdot.org/story/18/08/22/2213233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ghostscript Leaks Like A Sieve
by Lawrence D'Oliveiro 23 Aug '18

23 Aug '18

Tools like ImageMagick commonly accept graphics in PostScript format, which they render through Ghostscript. Trouble is, there are holes in Ghostscript that can be exploited by malicious parties. In short, you should not be accepting PostScript data from untrusted parties. The fact that PostScript is a full programming language just makes it harder -- in terms of vulnerability exposure, it’s similar to JavaScript, except that I think a lot more effort has gone into securing the latter. <https://www.theregister.co.uk/2018/08/23/imagemagick_ghostscript/>

1 0

Mozilla to Remove Legacy Firefox Add-Ons From Add-On Portal in Early October
by Peter Reutemann 22 Aug '18

22 Aug '18

'Mozilla announced today plans to remove all Firefox legacy add-ons from the official Mozilla add-ons portal in early October. From a report: The move comes after Mozilla updated the Firefox core to use a new add-ons system based on the Chrome-compatible WebExtensions API. This new add-ons API replaced Firefox's old XUL-based add-ons API in November 2017, with the release of Firefox 57. All Firefox legacy add-ons stopped working in Firefox 57, but Mozilla continued to support them in the Firefox Extended Support Release (ESR) 52 branch. Support for Firefox ESR 52 will end on September 5, in two weeks, meaning there won't be any official Firefox version that supports legacy add-ons anymore.' -- source: https://tech.slashdot.org/story/18/08/21/196225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting on Monday
by Peter Reutemann 21 Aug '18

21 Aug '18

Hi everyone We have a meeting coming up on Monday: "Linux is Alexa's best mate" Brendon Ranum, owner of a voice driven highly automated accommodation business in Cambridge, discusses Alexa integration from a Linux User perspective. Brendon will bring along his collection of every Amazon Echo ever made (10 models), and talk about adding voice control in front of home automation, the pitfalls, and how a spare Raspberry Pi can be used to solve some of them. He will also demo creating and using Echo Skills, compare differences in features of the Echo's in different countries, and share how guests attitudes have changed over the last year using Alexa. Usually found leading large scale IT change & innovation overseas, Brendon never lost his passion for electrical and electronic engineering and love of shiny things. Come along and learn why someone would put 20 of these in a house! -- details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/246737178/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Online Exam Requires Microsoft Office 365, Laptops, No Chargers Allowed
by Lawrence D'Oliveiro 20 Aug '18

20 Aug '18

Some students are Botany Downs Secondary College are upset at their school’s requirements for them to set the NCEA Level 1 science exam <https://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=12110032>. Their problem is with the ban on chargers, because the school says they cannot provide outlets for 450 students. So laptops have to have a 5-hour battery life to make it through the exam. Which leaves out older machines with batteries in less-than-tiptop condition. Would there be a problem allowing them spare batteries? (And temporary use of an outlet while switching over, to avoid the need to power down?) Come to think of it, do they know they can buy spare batteries?

1 0

Slides Worth Viewing
by Lawrence D'Oliveiro 15 Aug '18

15 Aug '18

Followed this link <https://twitter.com/thepacketrat/status/1029728686734565382> which doesn’t seem to relate to the article that included it, but which has some gems on IoT security worth repeating: Assumptions of Technological Manifest Destiny: 1. Technology is value-neutral and thus will automatically help everyone 2. Technology should be deployed as quickly as possible 3. History is uninteresting and unhelpful The Value of Scepticism In three words: Think before deploying. In two words: Think first. In one word: Don’t. Q: Why Do Keynote Speakers Keep Suggesting That Improving Security Is Possible? A: Because Keynote Speakers Make Bad Life Decisions And Are Poor Role Models.

1 0

Standardizing The Legalities Of Reporting Security Bugs
by Lawrence D'Oliveiro 03 Aug '18

03 Aug '18

Security researchers often find themselves in for a rough ride (legally speaking) when they try to report holes that they have found. This new effort <https://arstechnica.com/information-technology/2018/08/new-open-source-effo…> tries to put together a clear framework so everybody knows exactly where they stand. Of course, the next step is to get various organizations to adopt it.

1 0

Hāwera High School Hit By Ransomware Attack
by Lawrence D'Oliveiro 02 Aug '18

02 Aug '18

Some students have lost access to their coursework <https://www.theregister.co.uk/2018/08/02/new_zealand_school_hit_by_ransomwa…>.

1 0

Reddit Breached Via Two-Factor Authentication Vulnerability
by Lawrence D'Oliveiro 02 Aug '18

02 Aug '18

Two-factor authentication, using a phone call or SMS text as the second factor, seemed like such a neat idea. But it turned out to be far too easy to hack. And here’s the proof <https://arstechnica.com/information-technology/2018/08/password-breach-teac…>: The 2FA protecting the Reddit accounts, however, relied on OTPs sent through SMS messages, despite reports over the years (such as this one <https://arstechnica.com/information-technology/2017/05/thieves-drain-2fa-pr…>) that make it amply clear they are susceptible to interception. Seems like the only reasonable option for a second authentication factor is dedicated hardware security keys.

1 0

sudo Or su?
by Lawrence D'Oliveiro 01 Aug '18

01 Aug '18

Found this piece <https://www.pclinuxos.com/forum/index.php/topic,90479.0.html> in the PCLinuxOS forums, courtesy of a reader link from <https://www.theregister.co.uk/2018/08/01/ncsc_ubuntu/>. Basically it says that “sudo”, when used “In The Manner Of the Buntus”, i.e. to be able to run arbitrary commands as root, is a bad idea. Instead, it should be carefully restricted to allow access only to functions needed by a particular user. To get blanket root access, it is better to use “su”, which means having a separate root password. Actually, it goes further than that: it decrees that anybody posting instructions on the PCLinuxOS forums involving “irresponsible” use of sudo (i.e. contrary to the philosophy above) is subject to having their posts deleted, being reprimanded, and ultimately having their account cancelled altogether. Thoughts?

3 2

UK’s National Cyber Security Centre Weighs In On Ubuntu
by Lawrence D'Oliveiro 01 Aug '18

01 Aug '18

Advice for both users and admins about Ubuntu 18.04 LTS <https://www.ncsc.gov.uk/guidance/eud-security-guidance-ubuntu-1804-lts>, from the arm of the GCHQ charged with looking after the security of the computers of ordinary mortals. Points out some gaps in software-only disk encryption, and recommends enabling Secure Boot, among a remarkable amount of other detail. Found from <https://www.theregister.co.uk/2018/08/01/ncsc_ubuntu/>.

1 0

If You Buy Something, Do You Own It?
by Lawrence D'Oliveiro 31 Jul '18

31 Jul '18

Raglan man Niall Darwin discovers that assurances by electric-car company Tesla’s own official representatives aren’t worth a darn. And so, the question needs to be asked for the hundredth or thousandth time: when you buy a consumer item with essential proprietary software at its heart, what actually do you own? <https://www.newshub.co.nz/home/new-zealand/2018/07/waikato-man-suing-tesla-…>

1 0

Now They Need To Fix The TV Sets ...
by Lawrence D'Oliveiro 31 Jul '18

31 Jul '18

YouTube has adopted a more responsive page layout to cope with videos having different aspect ratios <https://arstechnica.com/gadgets/2018/07/youtube-picks-up-dark-mode-on-andro…>. To no-one’s surprise, this has annoyed a few people who have become accustomed to the old design. When 16:9 widescreen TVs were being conceived way back in the 1990s, the aim clearly was to allow us all to view cinematic movies full-screen, making maximum use of available screen area with minimal or no black bars. Nobody foresaw the widespread popularity of smartphones with built-in cameras, and of the common use of footage captured with such devices in TV broadcasts. But while such phones commonly have 16:9 screens and their cameras capture 16:9 footage, their users often hold them vertically, so the image ends up in just about the worst shape for display on a regular widescreen TV. There seems to be a common convention nowadays of filling in the gaps with blurred portions of the actual image -- which I agree looks less jarring than black bars. Hmmm ... there have been computer monitors that can be rotated to portrait or landscape orientations, with automatic adjustment of the display to match (aka “xrandr” <https://wiki.archlinux.org/index.php/xrandr>). Wouldn’t it be useful if a TV could do the same...?

1 0

Ubuntu 18.04.01 now released for most flavours
by Ian Stewart 30 Jul '18

30 Jul '18

Hi, A few days ago Ubuntu 18.04.01 was released for most flavours (e.g. Desktop, Server, Mate, Budgie, Kylin, Xubuntu, Kubuntu) You can get your flavour, in 32 or 64 bit, from here... https://www.ubuntu.com/download/desktop <https://www.ubuntu.com/download/desktop> http://cdimage.ubuntu.com/ubuntu/releases/18.04.1/release/ <http://cdimage.ubuntu.com/ubuntu/releases/18.04.1/release/> http://cdimage.ubuntu.com/ubuntu-mate/releases/18.04.1/release/ http://cdimage.ubuntu.com/ubuntu-budgie/releases/18.04.1/release/ http://cdimage.ubuntu.com/ubuntukylin/releases/18.04.1/release/ http://cdimage.ubuntu.com/xubuntu/releases/18.04.1/release/ http://cdimage.ubuntu.com/kubuntu/releases/18.04.1/release/ My understanding is that if you are running 16.04.xx LTS and you have enabled "Notify me of a new updated version of Ubuntu", then you should now start to get pop-up's prompting you to do an on-line update to 18.04.01. I'm hopeful that it will bring some stability to Mate that seemed to be lacking in 18.04.00. cheers, Ian.

1 0

Distrowatch review of Ubuntu MATE and Budgie 18.04
by Ian Young 30 Jul '18

30 Jul '18

This week's Distrowatch features Ubuntu MATE and Budgie for review. Not the usual reviewer and somewhat longer than most of the weekly distro reviews. Some faults found with the MATE version and to a lesser extent with Budgie. The laptop in use for testing only had 2GiB of RAM however which might account for some of the problems encountered. 4 GiB seems to be a bare minimum these days.

2 1

Intel Moving Away From Hyperthreading?
by Lawrence D'Oliveiro 27 Jul '18

27 Jul '18

Looks like Intel’s next-generation i7 product family will abandon hyperthreading in favour of increasing the core count. So while you will still be able to run 8 concurrent threads, each one gets its own core now. Also, it looks like Intel’s current fab technology is running out of steam, while the new one is a bit behind schedule. <https://arstechnica.com/gadgets/2018/07/leaked-benchmarks-show-intel-is-dro…>

1 0

Space Supercomputer Comes Up To First Birthday
by Lawrence D'Oliveiro 26 Jul '18

26 Jul '18

340 days ago, an HPE machine made up of two Apollo Intel x86 servers running RHEL was installed on the ISS, without any radiation hardening or any other special hardware adaptation measures, apart from a “water-cool enclosure”. So far it has suffered only two complete outages, both triggered by loss of external power, not the failure of the machine itself. Though the software has apparently been picking up transient memory errors (not too surprising, really). <https://www.theregister.co.uk/2018/07/26/hpe_iss_supercomputer/>

1 0

Fwd: [NZLUG] Linux.conf.au Call for Papers.
by Peter Reutemann 25 Jul '18

25 Jul '18

Apologies for cross-posting. Cheers, Peter ---------- Forwarded message ---------- From: Michael Field <michael.field(a)concepts.co.nz> Date: Thu, Jul 26, 2018 at 9:58 AM Subject: [NZLUG] Linux.conf.au Call for Papers. To: "nzlug(a)lists.nzoss.org.nz" <nzlug(a)lists.nzoss.org.nz> I don’t know if anybody has posted that the Call for Proposals is open for Linux Conference Australia (in Chch this year) – they close on 30th July. See https://linux.conf.au/ if you want to submit Presentation / Tutorial / Miniconf. If accepted, you get free registration, speakers dinner ticket and so on. Mike *Michael Field* | *Senior Systems Engineer* *COMPUTER CONCEPTS LIMITED* <http://concepts.co.nz/> *P:* 03 348 2500 | *W:* concepts.co.nz 21 Durham Street South, Sydenham, Christchurch, New Zealand 8023 This email and any attachments are confidential. They may contain privileged information or copyright material. If you are not an intended recipient, you should not read, copy, use or disclose the contents without authorisation and we request you contact us at once by return email. Please then delete the email and any attachments from your system. We do not accept liability in connection with computer viruses, data corruption, delay, interruption, unauthorised access or unauthorised amendment. Any views expressed in this email and any attachments do not necessarily reflect the views of the company. _______________________________________________ NZLUG mailing list NZLUG(a)lists.nzoss.org.nz http://lists.nzoss.org.nz/mailman/listinfo/nzlug -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bluetooth Security Flaw Could Let Nearby Attacker Grab Your Private Data
by Peter Reutemann 24 Jul '18

24 Jul '18

'A recently discovered bug in many Bluetooth firmware and OS drivers could allow an attacker within about 30 meters to capture and decrypt data shared between Bluetooth-paired devices. Researchers at the Israel Institute of Technology discovered the flaw, which was flagged today by Carnegie Mellon University CERT. It affects Bluetooth's Secure Simple Pairing and Low Energy Secure Connections. ZDNet reports: As the CERT notification explains, the vulnerability is caused by some vendors' Bluetooth implementations not properly validating the cryptographic key exchange when Bluetooth devices are pairing. The flaw slipped into the Bluetooth key exchange implementation which uses the elliptic-curve Diffie-Hellman (ECDH) key exchange to establish a secure connection over an insecure channel. This may allow a nearby but remote attacker to inject a a bogus public key to determine the session key during the public-private key exchange. They could then conduct a man-in-the-middle attack and "passively intercept and decrypt all device messages, and/or forge and inject malicious messages." Thankfully, patches are on the way. "Intel recommended users upgrade to the latest support driver and to check with vendors if they have provided one in their respective updates," reports ZDNet. "Dell has released a new driver for the Qualcomm driver it uses while Lenovo's update is for the flaw in Intel software. LG and Huawei have referenced fixes for CVE-2018-5383 in their respective July updates for mobile devices." It is not yet known if Android, Google, or the Linux kernel are affected. Apple has released a patch for the flaw earlier this month.' -- source: https://it.slashdot.org/story/18/07/24/2121215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ReactOS 0.4.9 Is Entirely Self-Hosting, Fixes FastFAT Crashes
by Peter Reutemann 24 Jul '18

24 Jul '18

'ReactOS, the "free Windows clone" operating system, has pushed out ReactOS 0.4.9 just recently, which brings a whole slew of improvements. With this latest 0.4.9 version, ReactOS has become entirely self-hosting without any issues, which means ReactOS can fully build itself from within itself, it does not require any third-party operating system to compile ReactOS. Self-hosting was built into older ReactOS versions, but it came with a myriad of issues -- the system would become too stressed under memory usage and storage I/O loads. This was due to a flawed NT-compliant kernel. Additional improvements in ReactOS 0.4.9 include overall stability and performance enhancements. The hardware abstraction layer and the FastFAT drivers received significant attention, and FastFAT should no longer eat through the cache so fast it causes system crashes due to resource leakage. FastFAT has also been rewritten to trigger a "chkdsk" repair on dirty / corrupt volumes during boot detections. Some other quality improvements are the addition of a built-in zipfldr extension -- ReactOS can now natively unpackage zipped archives, without the need of a third-party tool like WinZip.' -- source: https://news.slashdot.org/story/18/07/24/0139247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

In Encryption Push, Chrome Flags HTTP Sites as 'Not Secure'
by Peter Reutemann 24 Jul '18

24 Jul '18

'On Tuesday, Chrome started marking sites that don't use HTTPS as "not secure." From a report: First announced two years ago, Google said it would flag any site that still uses unencrypted HTTP to deliver its content in the latest version of Chrome, out Tuesday. It's part of the company's years-long effort effort to gradually nudge more webmasters and site owners into adopting HTTPS, a secure encryption standard for data in transit. Any site that doesn't load with green padlock or a "secure" message in the browser's address bar will be flagged -- and shamed -- as insecure. [...] According to nightly data compiled by security experts Troy Hunt and Scott Helme, roughly 100 of the top 500 websites are still serving their pages over unencrypted HTTP -- all of which will today be flagged as "insecure." Many of those sites -- like Baidu, JD.com, and Google.cn -- are Chinese language sites, but many popular Western sites -- including BBC.com, DailyMail.co.uk, and Fedex.com -- are HTTP. Of the top million sites, a little over half do not redirect to HTTPS. Chrome 68 also brings with it Page Lifecycle API, and the Payment Handler API. From a report: The Payment Handler API builds on the Payment Request API, which helped users check out online. The new API enables web-based payment apps to facilitate payments directly within the Payment Request experience, as seen above. As with every version, Chrome 68 includes an update to the V8 JavaScript engine: version 6.8. It reduces memory consumption as well as includes improvements to array destructuring, Object.assign, and TypedArray.prototype.sort. Check out the full list of changes for more information.' -- source: https://tech.slashdot.org/story/18/07/24/177207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Blocks Autoplaying Web Audio
by Peter Reutemann 24 Jul '18

24 Jul '18

'Mozilla's latest Nightly builds for Firefox now include an option to mute autoplaying audio. The feature was recently added to the Chrome browser, but Mozilla's update offers a few more options. According to Engadget, "You can turn the feature off entirely, force it to ask for permission, and make exceptions for specific sites." Keep in mind that these are nightly releases, so you will most likely run into some bugs. The "polished version" is likely weeks away.' -- source: https://news.slashdot.org/story/18/07/24/2055217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Researchers Detail New CPU Side-Channel Attack Named SpectreRSB
by Peter Reutemann 24 Jul '18

24 Jul '18

'"Scientists from the University of California, Riverside (UCR) have published details last week about a new Spectre-class attack that they call SpectreRSB," reports Bleeping Computer. "Just like all 'Spectre-class' attacks, SpectreRSB takes advantage of the process of speculative execution -- a feature found in all modern CPUs that has the role of improving performance by computing operations in advance and later discarding unneeded data. The difference from previous Spectre-like attacks is that SpectreRSB recovers data from the speculative execution process by attacking a different CPU component involved in this 'speculation' routine, namely the Return Stack Buffer (RSB)." In a research paper, academics say they've used SpectreRSB attacks to recover data belonging to other processes, and have even tricked the RSB into spilling SGX secrets. The attack works on Intel, AMD, and ARM processors, known to use RSB. The attack can also bypass all the mitigations put in place for the original Spectre/Meltdown flaws.' -- source: https://it.slashdot.org/story/18/07/23/2143259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

None of Google's 85, 000 Employees Have Been Phished in More Than a Year After Company Required Them to Use Physical Security Keys For 2FA
by Peter Reutemann 24 Jul '18

24 Jul '18

'Google has not had any of its 85,000+ employees successfully phished on their work-related accounts since early 2017, when it began requiring all employees to use physical Security Keys in place of passwords and one-time codes, the company told KrebsOnSecurity. From the report: Security Keys are inexpensive USB-based devices that offer an alternative approach to two-factor authentication (2FA), which requires the user to log in to a Web site using something they know (the password) and something they have (e.g., a mobile device). A Google spokesperson said Security Keys now form the basis of all account access at Google. "We have had no reported or confirmed account takeovers since implementing security keys at Google," the spokesperson said. "Users might be asked to authenticate using their security key for many different apps/reasons. It all depends on the sensitivity of the app and the risk of the user at that point in time." The basic idea behind two-factor authentication is that even if thieves manage to phish or steal your password, they still cannot log in to your account unless they also hack or possess that second factor.' -- source: https://tech.slashdot.org/story/18/07/23/1944236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Academics Publish New Software-Level Protections Against Spectre and Rowhammer Attacks
by Peter Reutemann 23 Jul '18

23 Jul '18

'Academics from multiple universities have announced fixes for two severe security flaws known as Spectre and Rowhammer. Both these fixes are at the software level, meaning they don't require CPU or RAM vendors to alter products, and could, in theory, be applied as basic software patches. The first of these new mitigation mechanisms was announced on Thursday, last week. A research team from Dartmouth College in New Hampshire says it created a fix for Spectre Variant 1 (CVE-2017-5753), a vulnerability discovered at the start of the year affecting modern CPUs. Their fix uses ELFbac, an in-house-developed Linux kernel patch that brings access control policies to runtime virtual memory accesses of Linux processes, at the level of ELF binary executables. [...] The second fix for a major flaw announced last week came on Saturday from the Systems and Network Security Group at VU Amsterdam. Researchers announced a new technique called ZebRAM that they said is a comprehensive software protection against Rowhammer attacks.' -- source: https://it.slashdot.org/story/18/07/23/1613217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

NetBSD 8.0 Released
by Peter Reutemann 22 Jul '18

22 Jul '18

'The NetBSD Project is pleased to announce NetBSD 8.0, the sixteenth major release of the NetBSD operating system. This release brings stability improvements, hundreds of bug fixes, and many new features. Some highlights of the NetBSD 8.0 release are: — USB stack rework, USB3 support added. — In-kernel audio mixer (audio_system(9)). — Reproducible builds — PaX MPROTECT (W^X) memory protection enforced by default — PaX ASLR enabled by default — Position independent executables by default [...] NetBSD is free. All of the code is under non-restrictive licenses, and may be used without paying royalties to anyone.' -- source: https://linux.slashdot.org/story/18/07/21/2341255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Fifth Undocumented Cisco Backdoor Has Been Discovered
by Peter Reutemann 21 Jul '18

21 Jul '18

'Cisco released 25 security updates Wednesday, including a critical patch removing an undocumented password for "root" accounts of Cisco Policy Suite (sold to ISPs and large corporate clients). "The vulnerability received a rare severity score of 9.8 out of a maximum of 10 on the CVSSv3 scale," reports Bleeping Computer. An anonymous reader quotes Tom's Hardware: Over the past few months, not one, not two, but five different backdoors joined the list of security flaws in Cisco routers.... In March, a hardcoded account with the username "cisco" was revealed. The backdoor would have allowed attackers to access over 8.5 million Cisco routers and switches remotely. That same month, another hardcoded password was found for Cisco's Prime Collaboration Provisioning software, which is used for remote installation of Cisco's video and voice products. Later this May, Cisco found another undocumented backdoor account in Cisco's Digital Network Architecture Center, used by enterprises for the provisioning of devices across a network. In June, yet another backdoor account was found in Cisco's Wide Area Application Services, a software tool for Wide Area Network traffic optimization... Whether or not the backdoor accounts were created in error, Cisco will need to put an end to them before this lack of care for security starts to affect its business.' -- source: https://tech.slashdot.org/story/18/07/21/2133202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday
by Peter Reutemann 20 Jul '18

20 Jul '18

Hi everyone We have a meeting next Monday: "Tom Butz will bring his RaspberryPi to this meetup. After introducing RISCOS and how the Pi was born, he will give a short demo of RISCOS. He will also use Debian/Raspbian on the Pi and, among other things, demo web-browsing, email-checking, database handling with COBOL, playing games and videos. Instead of using an external display via HDMI, he will also show the use of a pop-on LCD screen." -- details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/246737169/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Is Making the Windows Command Line a Lot Better
by Peter Reutemann 19 Jul '18

19 Jul '18

'Over the last few years, Microsoft has been working to improve the Windows console. Console windows now maximize properly, for example. In the olden days, hitting maximize would make the window taller but not wider. Today, the action will fill the whole screen, just like any other window. Especially motivated by the Windows subsystem for Linux, the console in Windows 10 supports 16 million colors and VT escape sequences, enabling much richer console output than has traditionally been possible on Windows. Microsoft is working to build a better console for Windows, one that we hope will open the door to the same flexibility and capabilities that Unix users have enjoyed for more than 40 years. The APIs seem to be in the latest Windows 10 Insider builds, though documentation is a little scarce for now. The command-line team is publishing a series of blog posts describing the history of the Windows command-line, and how the operating system's console works. The big reveal of the new API is coming soon, and with this, Windows should finally be able to have reliable, effective tabbed consoles, with emoji support, rich Unicode, and all the other things that the Windows console doesn't do... yet.' -- source: https://tech.slashdot.org/story/18/07/17/2028206 It's probably gonna get announced as "revolutionary"... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

PC Sales Grow For A Change
by Lawrence D'Oliveiro 13 Jul '18

13 Jul '18

The first year-on-year growth in quarterly PC shipments has happened in 6 years <https://arstechnica.com/gadgets/2018/07/pc-market-appears-to-have-grown-for…>. Interesting to compare the basis behind the two different figures quoted: excluding Chromebooks, but including tablets (whether running Windows or not), gives a figure of 1.4% increase (Gartner), while the converse gives 2.7% (IDC). In other words, Chromebooks are accounting for something like half that growth, possibly even more.

1 0

Python Creator Steps Down
by Lawrence D'Oliveiro 13 Jul '18

13 Jul '18

Guido van Rossum, creator of Python and (up to now) “Benevolent Dictator For Life” over the Python project, has decided to relinquish that role <https://www.theregister.co.uk/2018/07/13/python_creator_guido_van_rossum_qu…>. The reason may have been building for a while, but the last straw seems to have been the controversy over this <https://www.python.org/dev/peps/pep-0572/> proposed new feature for Python, “assignment expressions”, using a new “:=” operator. Interestingly enough, back in the day, “:=” was the operator used for assignments in what they called “ALGOL-like” languages (which included Pascal). The use of “=” for assignment was a peculiarity of FORTRAN, and also adopted by C, from which it has spread (unfortunately, in my view) to be adopted in most newer, higher-level languages, like Perl and Python. In the “ALGOL-like” languages, “=” kept close to its mathematical meaning, namely a test for equality. But if “:=” becomes valid, how long before these “assignment expressions” become acceptable stand-alone, as assignment statements? Pity that “=” can never become the equality-test operator ... unless Python 4 provides some way to guard against writing expressions as statements that simply discard their value ...

1 0

AV1 is Well On Its Way To Becoming a Viable Alternative To Patented Video Codecs, Mozilla Says
by Peter Reutemann 12 Jul '18

12 Jul '18

'Here's a surprising fact: It costs money to watch video online, even on free sites like YouTube. That's because about 4 in 5 videos on the web today rely on a patented technology called the H.264 video codec. >From a report: It took years for companies to put this complex, global set of legal and business agreements in place, so H.264 web video works everywhere. Now, as the industry shifts to using more efficient video codecs, those businesses are picking and choosing which next-generation technologies they will support. The fragmentation in the market is raising concerns about whether our favorite web past-time, watching videos, will continue to be accessible and affordable to all. Over the last decade, several companies started building viable alternatives to patented video codecs. Mozilla worked on the Daala Project, Google released VP9, and Cisco created Thor for low-complexity videoconferencing. All these efforts had the same goal: to create a next-generation video compression technology that would make sharing high-quality video over the internet faster, more reliable, and less expensive. In 2015, Mozilla, Google, Cisco, and others joined with Amazon and Netflix and hardware vendors AMD, ARM, Intel, and NVIDIA to form AOMedia. As AOMedia grew, efforts to create an open video format coalesced around a new codec: AV1. AV1 is based largely on Google's VP9 code and incorporates tools and technologies from Daala, Thor, and VP10. Mozilla loves AV1 for two reasons: AV1 is royalty-free, so anyone can use it free of charge. Software companies can use it to build video streaming into their applications. Web developers can build their own video players for their sites. The second reason we love AV1 is that it delivers better compression technology than even high-efficiency codecs -- about 30% better, according to a Moscow State University study.' -- source: https://news.slashdot.org/story/18/07/11/2246221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Typeform Data Breach Hits A Little Close To Home
by Lawrence D'Oliveiro 12 Jul '18

12 Jul '18

A few days ago, Typeform, a company which specializes in online survey forms, reported <https://www.theregister.co.uk/2018/07/02/typeform_breach/> that someone had gained unauthorized access to one of its backups. This turned out to impact a remarkable variety of institutions using its services <https://www.theregister.co.uk/2018/07/03/hotel_chain_and_uk_political_party…> <https://www.theregister.co.uk/2018/07/04/typeform_breach_continued/>, though the listed ones all seem to be in the UK and Australia. Now, I read today in the Hamilton Press (issue of 11th July, i.e. today), on page 6, that the affected customers include the Hamilton City Council, Waikato District Council, and Waipā District Council. “About 2800 Waikato people” may have used the Typeform service to express views to these local bodies. Information that could have been leaked was “names, email addresses, and in some cases, phone numbers”. Hamilton City used the service to run 10 surveys between November 2014 and February 2018, and a total of 1941 people “may have been affected”; it has contacted them about the breach, and it doesn’t use Typeform any more. Waipā District has similarly contacted 125 participants in its surveys. (No mention of what action Waikato District is taking...)

1 0

Year-old router bug exploited to steal sensitive DOD drone, tank documents
by Peter Reutemann 11 Jul '18

11 Jul '18

'In May, a hacker perusing vulnerable systems with the Shodan search engine found a Netgear router with a known vulnerability—and came away with the contents of a US Air Force captain's computer. The purloined files from the captain—the officer in charge (OIC) of the 432d Aircraft Maintenance Squadron's MQ-9 Reaper Aircraft Maintenance Unit (AMU)at Creech Air Force Base, Nevada—included export-controlled information regarding Reaper drone maintenance. The hacker took the documents to a Dark Web marketplace, where he planned on selling them for a few hundred dollars. And it's there that analysts from Recorded Future, an information security threat intelligence company, discovered them. The vulnerability, which makes it possible for an attacker to remotely execute commands and gain access to the root directory of the router via FTP, was disclosed by Netgear over a year ago. Discoverable by searching Shodan for devices with Internet Protocol port 21 open and response text including "214-ADMIN_LOGIN," the vulnerability allowed attackers to compromise routers and then gain access to the local network. They could then either grab files passing over the network or gain access to devices on it.' -- source: https://arstechnica.com/information-technology/2018/07/year-old-router-bug-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Malware Found in Arch Linux AUR Package Repository
by Peter Reutemann 11 Jul '18

11 Jul '18

'Malware has been discovered in at least three Arch Linux packages available on AUR (Arch User Repository), the official Arch Linux repository of user-submitted packages. The malicious code has been removed thanks to the quick intervention of the AUR team. The incident happened because AUR allows anyone to take over "orphaned" repositories that have been abandoned by their original authors. On Saturday, a user going by the pseudonym of "xeactor" took over one such orphaned package named "acroread" that allows Arch Linux users to view PDF files. According to a Git commit to the packag's source code, xeactor added malicious code that would download a file named "~x" from ptpb [dot] pw, a lightweight site mimicking Pastebin that allows users to share small pieces of texts.' -- source: https://it.slashdot.org/story/18/07/10/2136251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Stolen certificates from D-Link used to sign password-stealing malware
by Peter Reutemann 10 Jul '18

10 Jul '18

'Criminals recently stole code-signing certificates from router and camera maker D-Link and another Taiwanese company and used them to pass off malware that steals passwords and backdoors PCs, a researcher said Monday. The certificates were used to cryptographically verify that legitimate software was issued by D-Link and Changing Information Technology. Microsoft Windows, Apple’s macOS, and most other operating systems rely on the cryptographic signatures produced by such certificates to help users ensure that executable files attached to emails or downloaded on websites were developed by trusted companies rather than malicious actors masquerading as those trusted companies. Somehow, members of an advanced persistent-threat hacking group known as BlackTech obtained the certificates belonging to D-Link and Changing Information Technology, the researcher with antivirus provider Eset said in a blog post. The attackers then used the certificates to sign two pieces of malware, one a remotely controlled backdoor and the other a related password stealer. Both pieces of malware are referred to as Plead and are used in espionage campaigns against targets located in East Asia. The Japan Computer Emergency Response team recently documented the Plead malware here. AV provider Trend Micro recently wrote about BlackTech here. “The ability to compromise several Taiwan-based technology companies and reuse their code-signing certificates in future attacks shows that this group is highly skilled and focused on that region,” Eset researcher Anton Cherepanov wrote in Monday’s post.' -- source: https://arstechnica.com/information-technology/2018/07/stolen-certificates-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Spectre-like attack uses speculative execution to overflow buffers
by Peter Reutemann 10 Jul '18

10 Jul '18

'When the Spectre and Meltdown attacks were disclosed earlier this year, the expectation was that these attacks would be the first of many, as researchers took a closer look at the way that the speculative execution in modern processors could be used to leak sensitive information and undermine the security of software running on those processors. In May, we saw the speculative store bypass, and today we have a new variant on this theme: speculative buffer overflows, discovered by Vladimir Kiriansky at MIT and independent researcher Carl Waldspurger.' -- source: https://arstechnica.com/gadgets/2018/07/new-spectre-like-attack-uses-specul… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

With So Many Eyeballs, Is Open Source Security Better?
by Peter Reutemann 10 Jul '18

10 Jul '18

'Back in 1999, Eric Raymond coined the term "Linus' Law," which stipulates that given enough eyeballs, all bugs are shallow. Linus' Law, named in honor of Linux creator Linus Torvalds, has for nearly two decades been used by some as a doctrine to explain why open source software should have better security. In recent years, open source projects and code have experienced multiple security issues, but does that mean Linus' Law isn't valid? According to Dirk Hohndel, VP and Chief Open Source Officer at VMware, Linus' Law still works, but there are larger software development issues that impact both open source as well as closed source code that are of equal or greater importance. "I think that in every development model, security is always a challenge," Hohndel said. Hohndel said developers are typically motivated by innovation and figuring out how to make something work, and security isn't always the priority that it should be. "I think security is not something we should think of as an open source versus closed source concept, but as an industry," Hohndel said.' -- source: https://it.slashdot.org/story/18/07/10/1642226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hacker Breaches Chrome Extension of Popular VPN Service Hola, Directs Users To Compromised Cryptocurrency Website
by Peter Reutemann 10 Jul '18

10 Jul '18

'A hacker has breached a Hola VPN developer account and has replaced the official Chrome extension with one that redirected users of the MyEtherWallet.com website to a phishing page controlled by the attacker. The compromise took place yesterday and only lasted for five hours the MyEtherWallet (MEW) team said in a tweet. The Hola VPN team admitted to the hack. "The attack was programmed to inject a JavaScript tag in to the MEW site to 'phish' information about MEW accounts that are logging in without being in 'incognito mode', by re-directing the MEW users to the hacker's website," the Hola VPN team said.' -- source: https://yro.slashdot.org/story/18/07/10/1720243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ARM’s Anti-RISC-V FUD
by Lawrence D'Oliveiro 10 Jul '18

10 Jul '18

ARM put up a site attacking the open-source RISC-V processor architecture a few days ago, then had to take it down as a result of objections from its own staff <https://www.theregister.co.uk/2018/07/10/arm_riscv_website/>. Seems ARM is feeling the heat from the increasing traction that RISC-V is getting. Even though the original site is gone, it is still accessible via the Wayback Machine. And also one of the commenters points out that this graphic <https://www.arm.com/-/media/global/company/arm-risc-v-infographic.png> is still on ARM’s own site.

1 0

Firefox and Chrome Pull Popular Browser Extension Stylish From Their Stores After Report Claimed It Logs and Shares Browsing History, Credentials
by Peter Reutemann 05 Jul '18

05 Jul '18

'Stylish, a popular extension available for Chrome and Firefox which allows for easy customization of any website, now phones home and shares its users' browser history with its corporate parent, according to blogger Robert Heaton. This prompted Firefox to ban the extension from its addons site and prompt all users to disable it. The discussion can be seen in the relevant bug report. In Heaton's words: Stylish is no longer a well-meaning product with your best interests at heart. If you use and like Stylish, please uninstall it and switch to an alternative like Stylus, an offshoot from the good old version of Stylish that works in much the same way, minus the spyware. Google too has pulled the extension from its extension store. This is not the first time Stylish is at the centre of a privacy debacle' -- source: https://yro.slashdot.org/story/18/07/04/218234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Download Bomb Trick Returns in Chrome -- Also Affects Firefox, Opera, Vivaldi and Brave
by Peter Reutemann 03 Jul '18

03 Jul '18

'The release of Google Chrome 67 has reopened a "download bomb" bug that was exploited by tech support scammers last winter, and which had been fixed with the release of Chrome 65 in March 2018. Furthermore, the issue also appears to affect other browsers as well, such as Firefox, Vilvadi, Opera, and Brave, according to tests carried out by Bleeping Computer. The "download bomb" trick is a technique that involves initiating hundreds or thousands of downloads to freeze a browser on a specific page. Across the years, there have been multiple variations of download bombs, and they have often been used by tech support scammers to trap users on shady sites that tried to lure victims into calling a tech support number to have their browser unlocked. Over the winter, security researchers from Malwarebytes noticed a tech support scam campaign that employed a new "download bomb" technique to trap users on its shady sites.' -- source: https://news.slashdot.org/story/18/07/03/1416208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Study Finds That a Large Number of Popular Android Apps Secretly Cast the Screen To Third Parties, But They Don't Listen To Conversations
by Peter Reutemann 03 Jul '18

03 Jul '18

'It's the smartphone conspiracy theory that just won't go away: Many, many people are convinced that their phones are listening to their conversations to target them with ads. [...] Some computer science academics at Northeastern University had heard enough people talking about this technological myth that they decided to do a rigorous study to tackle it. For the last year, Elleen Pan, Jingjing Ren, Martina Lindorfer, Christo Wilson, and David Choffnes ran an experiment involving more than 17,000 of the most popular apps on Android to find out whether any of them were secretly using the phone's mic to capture audio. The apps included those belonging to Facebook, as well as over 8,000 apps that send information to Facebook. Sorry, conspiracy theorists: They found no evidence of an app unexpectedly activating the microphone or sending audio out when not prompted to do so. Like good scientists, they refuse to say that their study definitively proves that your phone isn't secretly listening to you, but they didn't find a single instance of it happening. Instead, they discovered a different disturbing practice: apps recording a phone's screen and sending that information out to third parties.' -- source: https://yro.slashdot.org/story/18/07/03/1822250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Allows Outside App Developers To Read People's Gmails, Says Report
by Peter Reutemann 03 Jul '18

03 Jul '18

'According to The Wall Street Journal, hundreds of app developers have access to millions of inboxes belonging to Gmail users (Warning: source paywalled; alternative source). The developers reportedly receive access to messages from Gmail users who signed up for things like price-comparison services or automated travel-itinerary planners. Some of these companies train software to scan the email, while others enable their workers to pore over private messages. INSIDER reports: It's not news that Google and many top email providers enable outside developers to access users' inboxes. In most cases, the people who signed up for the price-comparison deals or other programs agreed to provide access to their inboxes as part of the opt-in process. In Google's case, outside developers must pass a vetting process, and as part of that, Google ensures they have an acceptable privacy agreement, The Journal reported, citing a Google representative. What is unclear is how closely these outside developers adhere to their agreements and whether Google does anything to ensure they do, as well as whether Gmail users are fully aware that individual employees may be reading their emails, as opposed to an automated system, the report says. It's interesting to note that, judging from The Journal's story, very little indicates that Google is doing anything different from Microsoft or other top email providers. According to the newspaper, nothing in Microsoft or Yahoo's policy agreements explicitly allows people to read others' emails. ' -- source: https://yro.slashdot.org/story/18/07/02/2057256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Micro Focus Sells SUSE
by Lawrence D'Oliveiro 02 Jul '18

02 Jul '18

<https://www.theregister.co.uk/2018/07/02/linux_makes_suse_sold_for_a_cool_2…>: Micro Focus CEO Chris Hsu subsequently decided that spending time with his family seemed more fun than piloting a juggernaut made of more offcuts than a cut-and-shut Ford Fiesta from Honest Bob's Motors. ... However, SUSE was a bright spot in the gloom, showing revenues of $164.4m and a solid, if unexciting, growth rate of 13.1 per cent in the six months to October 2017. ... For its part, SUSE is pretty happy with the deal. It will retain its CEO, Nils Brauckman, who seemed pleased to be free of Micro Focus ...

1 0

Metric-Compatible Fonts
by Lawrence D'Oliveiro 02 Jul '18

02 Jul '18

I was idly doing some web searches the other day (as you do), and stumbled across this page <https://wiki.archlinux.org/index.php/Metric-compatible_fonts> at the ever-dependable Arch Wiki. My specific question was, what had happened to the “URW Palladio” font? Up until recently, this was the one that Fontconfig would offer up when I used the old “Palatino” name from Adobe PostScript days. (I used to like the way the curve of the “P” didn’t quite join up with the stem, but left a little gap with a pointy bit on the end. Ahem...) Turns out it’s still there, just under another name; it’s now called “P052” for some unfathomable reason. Anyway, that page gives a bunch of handy alternatives if you are looking for Free alternatives to proprietary fonts that preserve the metrics (widths, spacing etc), so substituting them won’t stuff up the formatting of a document.

1 0

'Why You Should Not Use Google Cloud'
by Peter Reutemann 02 Jul '18

02 Jul '18

'A user on Medium named "Punch a Server" says you should not use Google Cloud due to the "'no-warnings-given, abrupt way' they pull the plug on your entire system if they (or the machines) believe something is wrong." The user has a project running in production on Google Cloud (GCP) that is used to monitor hundreds of wind turbines and scores of solar plants scattered across 8 countries. When their project goes down, money is lost. An anonymous Slashdot reader shares the report: Early today morning (June 28, 2018) I receive an alert from Uptime Robot telling me my entire site is down. I receive a barrage of emails from Google saying there is some "potential suspicious activity" and all my systems have been turned off. EVERYTHING IS OFF. THE MACHINE HAS PULLED THE PLUG WITH NO WARNING. The site is down, app engine, databases are unreachable, multiple Firebases say I've been downgraded and therefore exceeded limits. Customer service chat is off. There's no phone to call. I have an email asking me to fill in a form and upload a picture of the credit card and a government issued photo id of the card holder. Great, let's wake up the CFO who happens to be the card holder. What if the card holder is on leave and is unreachable for three days? We would have lost everything -- years of work -- millions of dollars in lost revenue. I fill in the form with the details and thankfully within 20 minutes all the services started coming alive. The first time this happened, we were down for a few hours. In all we lost everything for about an hour. An automated email arrives apologizing for "inconvenience" caused. Unfortunately The Machine has no understanding of the "quantum of inconvenience" caused.' -- source: https://news.slashdot.org/story/18/07/01/0354200 The cloud is convenient, as you don't have to look after your own hardware and it allows you to add more processing power as needed. But this is a good example of why your own hardware might not be a bad idea... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

PB Tech Used Trade Me Data For Spam
by Lawrence D'Oliveiro 02 Jul '18

02 Jul '18

From <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=120816…>: PB Tech has signed an enforceable undertaking with the [Department of Internal Affairs] after it was found to have collected Trade Me customer details during trades and then sent them unsolicited messages. This was in breach of the Unsolicited Electronic Messages Act.

1 0

Massive New 'Salesforce Tower' Light Sculpture: AI, Ubuntu, Fog, and a MacBook
by Peter Reutemann 30 Jun '18

30 Jun '18

'The new tallest building on the San Francisco skyline -- and the tallest building in America west of the Mississippi -- includes a nine-story electronic sculpture that's been called the tallest piece of public art on Earth. It uses 11,000 LED bulbs reflected off the tower-topping aluminum panels -- each pixel created by a set of red, green, blue and white lights controlled by 8-bit PIC microcontrollers. "On a clear night, the show is visible for 30 miles," reports IEEE Spectrum. Slashdot reader Tekla Perry shares their article about "the technology involved in the light show at the top of Salesforce Tower. Electrical engineer and artist Jim Campbell explains it all -- and how the window-washer problem stumped him for nearly a year." "[O]n the 62nd floor, a central PC-based computer runs Ubuntu Linux, sending instructions to a communications control system that splits the data and sends it at 11 Mbit to the 32 enclosures using a custom communications protocol... We will capture images throughout the day, sending them to Amazon's cloud, and run some algorithms designed to identify visual interesting-ness. For example, at its simplest, when we look at the sky, if it's all blue, it's boring, if it's all white, it's boring, if it has white and blue it is likely to be interesting. We'll chose the best half hour of the day at each camera, based on movement and color, to display...." And finally, when the main display shuts down late at night, another system designed by Campbell will kick in. In this static display, a set of 36 white LEDs will create a three-dimensional constellation of lights that will look like stars. "It's quieter, it has a random aspect to it," he says. "Since construction started, the tower has emerged as an icon of the new San Francisco -- techie, ambitious, perhaps a little grandiose," writes the New Yorker, capturing the moment when Campbell finally unveiled his four-year project -- while fighting stomach flu and a chest cold, on a night which turned out to be prohibitively foggy. The executive vice-president of Boston Properties told him cheerily, "Jim! Look on the brighter side. We've got every night for the rest of our lives." "There was a long silence from the people on the terrace. The fog was thick. At last, someone exclaimed, 'Woo-hoo!,' and a volley of cheers followed." Although the colors they were seeing came from the celebratory fireworks and not from Jim's light sculpture. Are there any San Francisco-area Slashdotters who want to weigh in on the Salesforce Tower?' -- source: https://tech.slashdot.org/story/18/06/30/2031224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

It’s Not A Bug, It’s A Feature!
by Lawrence D'Oliveiro 30 Jun '18

30 Jun '18

The IndexByDate.txt files available on the various Bitsavers directories (e.g. <http://bitsavers.trailing-edge.com/pdf/>) list the various items available in order of date. But if you want them ordered by name, so items in the same directory come together, the logical thing to do is use the sort(1) <https://linux.die.net/man/1/sort> command on this file. You specify the sort key by a “field definition”. The man page says that, by default, each field starts at a non-whitespace character after whitespace. The file has a very regular format: splitting by whitespace, you get the date, the time, and then the pathname. So a command like sort -k3 IndexByDate.txt should work. Except I was seeing a sequence like this: 2006-08-17 22:17:12 ge/MarkI_Timesharing/IPC-202646_FORTRAN_Aug66.pdf 2012-08-29 02:26:21 generalAutomation/18_30/88A00026A-A_GA1830_Industrial_Supervisory_System_Reference_Manual_May69.pdf ... 2018-05-16 00:33:35 georgiaTech/GTL_Programmers_Reference_Manual_for_the_Burroughs_B_5500_Aug1974.pdf 2006-08-27 11:36:57 ge/PAC-4000/GET-3201B_PAC-4000_SysMan_Mar66.pdf As you can see, the “ge” section is interrupted by “generalAutomation” and others, and then resumes after them. What was going on? It took me a while to realize that the sorting is done by locale, and the locale setting is set to ignore the slashes. Thus, the above sequence is effectively “gem” followed by “gen”, then “geo” and “gep”. What I wanted was a straight ASCII sort on the full pathname, without regard to any locale settings. But there is no hint in the man page as to how to specify this. Then I realized: the locale is controlled by environment variables. If you want the “non-localized” locale, then specify the locale called “C”, thus: LC_ALL=C sort -k3 IndexByDate.txt and this gives the order I want.

1 0

Linux Mint 19 'Tara' Released
by Peter Reutemann 30 Jun '18

30 Jun '18

'Linux Mint, the maker of popular Linux distro, announced on Friday the general availability of a new version of their operating system. Called Linux Mint 19 "Tara", the new version offers a range of new features, improvements, and a promise that it would stick around for a while. Writing for BetaNews, Brian Fagioli: The most significant aspect of Linux Mint 19 is the new Ubuntu 18.04 LTS base. Tara will receive updates until 2023 -- very impressive. The kernel is at 4.15, and all three desktop environments are being updated too. Mate is now at version 1.2, Cinnamon gets bumped up to 3.8, and Xfce is updated to 4.12. In Linux Mint 19, the star of the show is Timeshift, said, Clement Lefebvre, Linux Mint Project Leader. Although it was introduced in Linux Mint 18.3 and backported to all Linux Mint releases, it is now at the center of Linux Mint's update strategy and communication, he added. Thanks to Timeshift you can go back in time and restore your computer to the last functional system snapshot. If anything breaks, you can go back to the previous snapshot and it's as if the problem never happened.' -- source: https://linux.slashdot.org/story/18/06/29/2041255 Cheers, Petre -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Google Invests $22 Million In Feature Phone Operating System KaiOS
by Peter Reutemann 30 Jun '18

30 Jun '18

'Google is turning startup investor to further its goal of putting Google services like search, maps, and its voice assistant front and center for the next billion internet users in emerging markets. It has invested $22 million into KaiOS, the company that has built an eponymous operating system for feature phones that packs a range of native apps and other smartphone-like services. As part of the investment, KaiOS will be working on integrating Google services like search, maps, YouTube and its voice assistant into more KaiOS devices, after initially announcing Google apps for KaiOS-powered Nokia phones earlier this year. KaiOS is a U.S.-based project that started in 2017, built on the ashes of Mozilla's failed Firefox OS experiment, as a fork of the Linux codebase. Firefox OS was intended to be the basis of a new wave of HTML-5, low-cost smartphones. And while those devices and the wider ecosystem never really took off, KaiOS has fared significantly better. KaiOS powers phones made by OEMs including Nokia (HMD), Micromax and Alcatel, and it works with carriers including Sprint and AT&T -- it counts offices in North America, Europe and Asia. But its most significant deployment to date has been with India's Reliance Jio, the challenger telco that disrupted the Indian market with affordable 4G data packages. "This funding will help us fast-track development and global deployment of KaiOS-enabled smart feature phones, allowing us to connect the vast population that still cannot access the internet, especially in emerging markets," said KaiOS CEO Sebastien Codeville in a statement.' -- source: https://mobile.slashdot.org/story/18/06/29/2118251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Facebook, Google, and Microsoft Use Design To Trick You Into Handing Over Your Data, Report Warns
by Peter Reutemann 29 Jun '18

29 Jun '18

'A study from the Norwegian Consumer Council dug into the underhanded tactics used by Microsoft, Facebook, and Google to collect user data. "The findings include privacy intrusive default settings, misleading wording, giving users an illusion of control, hiding away privacy-friendly choices, take-it-or-leave-it choices, and choice architectures where choosing the privacy friendly option requires more effort for the users," states the report, which includes images and examples of confusing design choices and strangely worded statements involving the collection and use of personal data. Google makes opting out of personalized ads more of a chore than it needs to be and uses multiple pages of text, unclear design language, and, as described by the report, "hidden defaults" to push users toward the company's desired action. "If the user tried to turn the setting off, a popup window appeared explaining what happens if Ads Personalization is turned off, and asked users to reaffirm their choice," the report explained. "There was no explanation about the possible benefits of turning off Ads Personalization, or negative sides of leaving it turned on." Those who wish to completely avoid personalized ads must traverse multiple menus, making that "I agree" option seem like the lesser of two evils. In Windows 10, if a user wants to opt out of "tailored experiences with diagnostic data," they have to click a dimmed lightbulb, while the symbol for opting in is a brightly shining bulb, says the report. Another example has to do with Facebook. The social media site makes the "Agree and continue" option much more appealing and less intimidating than the grey "Manage Data Settings" option. The report says the company-suggested option is the easiest to use. "This 'easy road' consisted of four clicks to get through the process, which entailed accepting personalized ads from third parties and the use of face recognition. In contrast, users who wanted to limit data collection and use had to go through 13 clicks."' -- source: https://tech.slashdot.org/story/18/06/27/2233234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

GitHub Gentoo Organization Hacked
by Peter Reutemann 29 Jun '18

29 Jun '18

'June 28 at approximately 20:20 UTC unknown individuals have gained control of the Github Gentoo organization, and modified the content of repositories as well as pages there. We are still working to determine the exact extent and to regain control of the organization and its repositories. All Gentoo code hosted on GitHub should for the moment be considered compromised. This does NOT affect any code hosted on the Gentoo infrastructure. Since the master Gentoo ebuild repository is hosted on our own infrastructure and since Github is only a mirror for it, you are fine as long as you are using rsync or webrsync from gentoo.org. Details are sparse, but we will update this story once we learn more.' -- source: https://it.slashdot.org/story/18/06/28/2240254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

What's Up With ProtonMail Outages?
by Peter Reutemann 28 Jun '18

28 Jun '18

Since we talked about ProtonMail in the past... 'ProtonMail, a secure email service provider used by more than two million users and references of which has been made in shows like Mr. Robot, has been facing outages for the last two days as it fights numerous DDoS attacks. "The attacks went on for several hours, although the outages were far more brief, usually several minutes at a time with the longest outage on the order of 10 minutes," a ProtonMail spokesperson told BleepingComputer, adding that it has tracked the attack to a group that claims to have ties to Russia. But things are more complicated than that, and it appears ProtonMail users, who are already annoyed at the frequent outages over the last few days, are up for more such downtimes in the coming days. BleepingComputer: But in reality, the DDoS attacks have no ties to Russia, weren't even planned to in the first place, and the group behind the attacks denounced being Russian, to begin with. Responsible for the attacks is a hacker group named Apophis Squad. In a private conversation with Bleeping Computer today, one of the group's members detailed yesterday's chain of events. The Apophis member says they targeted ProtonMail at random while testing a beta version of a DDoS booter service the group is developing and preparing to launch. The group didn't cite any reason outside "testing" for the initial and uncalled for attack on ProtonMail, which they later revealed to have been a 200 Gbps SSDP flood, according to one of their tweets. "After we sent the first attack, we downed it for 60 seconds," an Apophis Squad member told us. He said the group didn't intend to harass ProtonMail all day yesterday or today but decided to do so after ProtonMail's CTO, Bart Butler, responded to one of their tweets calling the group "clowns." This was a questionable response on the part of the ProtonMail CTO, as it set the hackers against his company even more. "So we then downed them for a few hours," the Apophis Squad said. Subsequent attacks included a whopping TCP-SYN flood estimated at 500 Gbps, as claimed by the group.' -- source: https://it.slashdot.org/story/18/06/28/159252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Every Android Device Launched Since 2012 Impacted By RAMpage Vulnerability
by Peter Reutemann 28 Jun '18

28 Jun '18

'Almost all Android devices released since 2012 are vulnerable to RAMpage bug, an international team of academics has revealed today. >From a report: The vulnerability, tracked as CVE-2018-9442, is a variation of the Rowhammer attack. Rowhammer is a hardware bug in modern memory cards. A few years back researchers discovered that when someone would send repeated write/read requests to the same row of memory cells, the write/read operations would create an electrical field that would alter data stored on nearby memory. In the following years, researchers discovered that Rowhammer-like attacks affected personal computers, virtual machines, and Android devices. Through further researcher, they also found they could execute Rowhammer attacks via JavaScript code, GPU cards, and network packets.' -- source: https://it.slashdot.org/story/18/06/28/160220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Doubles Down on Linux and Open Source
by Peter Reutemann 28 Jun '18

28 Jun '18

'Google couldn't exist without Linux and open-source software. While you may not think of Google as a Linux company in the same way as you do Canonical, Red Hat, or SUSE, it wouldn't be the search and advertising giant it is today without Linux. So, it makes sense that Google is moving up from its Silver membership in The Linux Foundation, to the Platinum level. With this jump in status, Google gets a seat on the Foundation's board of directors. This position will be filled by Sarah Novotny, the head of open source strategy for Google Cloud Platform. Earlier this week, Chinese tech giant Tencent joined the Linux Foundation as a platinum member.' -- source: https://news.slashdot.org/story/18/06/27/1926211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

BBC Releases Computer History Archive
by Peter Reutemann 28 Jun '18

28 Jun '18

'A slice of computing history has been made public, giving people the opportunity to delve into an archive that inspired a generation of coders. The Computer Literacy Project led to the introduction of the BBC Micro alongside programs which introduced viewers to the principles of computing. It included interviews with innovators such as Bill Gates and Steve Wozniak. The BBC hopes the 1980s archive will encourage today's youngsters to become involved in computing. With the release of the archive, viewers can now search and browse all of the programmes from the project. The archive includes 267 programs, and 166 BBC Micro programs that were used on-screen.' -- source: https://news.slashdot.org/story/18/06/27/2037216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Finally, It's the Year of the Linux... Supercomputer
by Peter Reutemann 27 Jun '18

27 Jun '18

'From ZDNet: "The latest TOP500 Supercomputer list is out. What's not surprising is that Linux runs on every last one of the world's fastest supercomputers. Linux has dominated supercomputing for years. But, Linux only took over supercomputing lock, stock, and barrel in November 2017. That was the first time all of the TOP500 machines were running Linux. Before that IBM AIX, a Unix variant, was hanging on for dear life low on the list." An interesting architectural note: "GPUs, not CPUs, now power most of supercomputers' speed."' -- source: https://linux.slashdot.org/story/18/06/27/152216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Anonymizing Printed Documents
by Lawrence D'Oliveiro 27 Jun '18

27 Jun '18

It’s been known for a while that many printer vendors add extra hard-to-detect dots to their printouts to make a pattern that can be used to identify the source of the document later. Now a research group <http://www.theregister.co.uk/2018/06/27/german_researchers_defeat_printer_t…> has found a way to stymie this process by adding extra dots that fit the patterns, but confuse the identification system. They even have source code on GitHub.

1 0

OpenBSD Chief De Raadt Says No Easy Fix For New Intel CPU Bug 'TLBleed'
by Peter Reutemann 26 Jun '18

26 Jun '18

'Recompiling is unlikely to be a catch-all solution for a recently unveiled Intel CPU vulnerability known as TLBleed, the details of which were leaked on Friday, the head of the OpenBSD project Theo de Raadt says. iTWire reports: The details of TLBleed, which gets its name from the fact that the flaw targets the translation lookaside buffer, a CPU cache, were leaked to the British tech site, The Register; the side-channel vulnerability can be theoretically exploited to extract encryption keys and private information from programs. Former NSA hacker Jake Williams said on Twitter that a fix would probably need changes to the core operating system and were likely to involve "a ton of work to mitigate (mostly app recompile)." But de Raadt was not so sanguine. "There are people saying you can change the kernel's process scheduler," he told iTWire on Monday. "(It's) not so easy." He said that Williams was lacking all the details and not thinking it through. "They actually have sufficient detail to think it through: the article says the TLB is shared between hyperthreading CPUs, and it is unsafe to share between two different contexts. Basically you can measure evictions against your own mappings, which indicates the other process is touching memory (you can determine the aliasing factors)." De Raadt said he was still not prepared to say more, saying: "Please wait for the paper [which is due in August]."' -- source: https://it.slashdot.org/story/18/06/25/2219217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Likely NSA Data-Collection Facilities
by Lawrence D'Oliveiro 26 Jun '18

26 Jun '18

Further to the mention last night of secret facilities operated by AT&T in the US where the NSA has access, this article <https://arstechnica.com/tech-policy/2018/06/meet-the-8-spooky-att-buildings…> reports on a list of eight likely places as detailed by The Intercept <https://theintercept.com/2018/06/25/att-internet-nsa-spy-hubs/>. While the NSA is not technically allowed to spy on wholly “domestic” communications, there seem to be no limits on any “incidental collection” as a result of targetting some foreign communication. That means they can grab the contents of entire mailboxes just for the sake of one message. Then keep the lot for whatever use they like.

1 0

How Should Open Source Development Be Subsidized?
by Peter Reutemann 24 Jun '18

24 Jun '18

'"Open source maintainers are exhausted and rarely paid," writes TechCrunch's editorial manager. "A new generation wants to change the economics." An anonymous reader quotes their report: [Patreon] is increasingly being used by notable open source contributors as a way to connect with fans and sustain their work... For those who hit it big, the revenues can be outsized. Evan You, who created the popular JavaScript frontend library Vue.js, has reached $15,206 in monthly earnings ($182,472 a year) from 231 patrons... While Patreon is one direct approach for generating revenues from users, another one is to offer dual licenses, one free and one commercial... Companies care about proper licensing, and that becomes the leverage to gain revenue while still maintaining the openness and spirit of open source software... Tidelift is designed to offer assurances "around areas like security, licensing, and maintenance of software," CEO Donald Fischer explained... In addition, Tidelift handles the mundane tasks of setting up open source for commercialization such as handling licensing issues... Open Collective wants to open source the monetization of open source itself. Open Collective is a non-profit platform that provides tools to "collectives" to receive money while also offering mechanisms to allow the members of those collectives to spend their money in a democratic and transparent way. TechCrunch warns that "It's not just that people are free riding, it's often that they don't even realize it. Software engineers can easily forget just how much craftsmanship has gone into the open source code that powers the most basic of applications... "If you work at a for-profit company, take the lead in finding a way to support the code that allows you to do your job so efficiently. The decentralization and volunteer spirit of the open source community needs exactly the same kind of decentralized spirit in every financial contributor. Sustainability is each of our jobs, every day."' -- source: https://news.slashdot.org/story/18/06/23/2113222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Birth Of PDF
by Lawrence D'Oliveiro 21 Jun '18

21 Jun '18

<http://www.theregister.co.uk/2018/06/21/how_a_tax_form_kludge_gave_us_25_ye…>: [In 1985] ... both Apple and Adobe wanted to show off the LaserWriter's abilities with some sample files. Warnock thought it would be great to have the printer producing something complex but familiar so he personally hand-programmed an IRS tax form in PostScript. ... all those boxes and form fields required Warnock to code in lots of subroutines and utilities. The page took 2 minutes 45 seconds to print. Jobs was horrified at how slow that was. ... His new version of the IRS tax form printed on the LaserWriter in 22 seconds. In other words, by abandoning all the programming-language constructs (subroutines, conditionals, looping etc) in PostScript and just writing out a straight sequence of imaging commands, the code ran a lot faster, even if it was bigger. The article mentions the release of PDF 2.0, which is now being managed by ISO. Unfortunately, unlike Adobe, ISO do not make their specs available for free.

1 0

OpenBSD Disables Intel CPU Hyper-Threading Due To Security Concerns
by Peter Reutemann 21 Jun '18

21 Jun '18

'The OpenBSD project announced today plans to disable support for Intel CPU hyper-threading due to security concerns regarding the theoretical threat of more "Spectre-class bugs." Bleeping Computer reports: Hyper-threading (HT) is Intel's proprietary implementation of Simultaneous Multithreading (SMT), a technology that allows processors to run parallel operations on different cores of the same multi-core CPU. The feature has been added to all Intel CPUs released since 2002 and has come enabled by default, with Intel citing its performance boost as the main reason for its inclusion. But today, Mark Kettenis of the OpenBSD project, said the OpenBSD team was removing support for Intel HT because, by design, this technology just opens the door for more timing attacks. Timing attacks are a class of cryptographic attacks through which a third-party observer can deduce the content of encrypted data by recording and analyzing the time taken to execute cryptographic algorithms. The OpenBSD team is now stepping in to provide a new setting to disable HT support because "many modern machines no longer provide the ability to disable hyper-threading in the BIOS setup." ' -- source: https://bsd.slashdot.org/story/18/06/19/2327212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Widely used D-Link modem/router under mass attack by potent IoT botnet
by Peter Reutemann 21 Jun '18

21 Jun '18

'Malicious hackers are mass exploiting a critical vulnerability in D-Link DSL routers in an attempt to make them part of Satori, the potent Internet-of-things botnet that is used to take down websites and mine digital coins, researchers said. Since making its debut late last year, Satori has proven to be a particularly versatile and sophisticated botnet. It made a name for itself in December when it infected more than 100,000 Internet-connected devices in just 12 hours by exploiting remote code-execution vulnerabilities in Huawei and RealTek routers. A month later, Satori operators released a new version that infected devices used to mine digital coins, proving that the IoT botnet could also take control of more traditional computing devices. In February, Satori resurfaced when it infected tens of thousands of routers manufactured by Dasan Networks.' -- source: https://arstechnica.com/information-technology/2018/06/widely-used-d-link-m… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

TPP Versus Free-Software Licensing
by Lawrence D'Oliveiro 20 Jun '18

20 Jun '18

Seems like the “CPTPP” aka “TPP-11” (TPP minus the USA) may not be entirely free of objectionable provisions. A submission to the Australian ratification process <https://www.techdirt.com/articles/20180615/09090440050/open-source-industry…> has pointed out the following problematic clause: No Party shall require the transfer of, or access to, source code of software owned by a person of another Party, as a condition for the import, distribution, sale or use of such software, or of products containing such software, in its territory. As you may know, such an access requirement is an integral part of copyleft licences like the GPL. What this clause seems to be saying is that such a requirement is unenforceable under the TPP.

2 4

meeting next Monday?
by Peter Reutemann 19 Jun '18

19 Jun '18

Hi everyone Any suggestions for next week's meeting? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

macOS Breaks Your OpSec by Caching Data From Encrypted Hard Drives
by Peter Reutemann 18 Jun '18

18 Jun '18

'Apple's macOS surreptitiously creates and caches thumbnails for images and other file types stored on password-protected / encrypted containers (hard drives, partitions), according to macOS security experts Wojciech Regula and Patrick Wardle. From a report: The problem is that these cached thumbnails are stored on non-encrypted hard drives, in a known location and can be easily retrieved by malware or forensics tools, revealing some of the content stored on encrypted containers. On macOS, these thumbnails are created by Finder and QuickLook. Finder is the default macOS file explorer app, similar to Windows Explorer. Whenever a user navigates to a new folder, Finder automatically loads icons for the files located in those folders. For images, these icons are gradually replaced by thumbnails that show a preview of the image at a small scale.' -- source: https://apple.slashdot.org/story/18/06/18/1336248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 4.18 Preparing Many New Features While Dropping 100k+ Lines of Code
by Peter Reutemann 18 Jun '18

18 Jun '18

'Linux 4.18 development is going strong with recent 4.18-rc1 release. This kernel cycle has dropped 107,210 lines of code so far but Linux 4.18 is adding many new features. The kernel is coming in lighter as a result of the LustreFS code being removed and other code cleanups. On the feature front, Phoronix reports, "ew AMDGPU support improvements, mainlining of the V3D DRM driver, initial open-source work on NVIDIA Volta GV100 hardware, merging of the Valve Steam Controller kernel driver, merging of the BPFILTER framework, ARM Spectre mitigation work, Speck file-system encryption support, removal of the Lustre file-system, the exciting restartable sequences system call was merged, the new DM writecache target, and much more."' -- source: https://linux.slashdot.org/story/18/06/18/1334205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Another Reason To Move To GPLv3?
by Lawrence D'Oliveiro 18 Jun '18

18 Jun '18

Red Hat has decided <http://www.theregister.co.uk/2018/06/18/red_hat_gpl_violation/> that it prefers the more lenient remediation provisions in GPLv3 for licence violators. So as a matter of policy, it is going to adhere to them even for products it has licensed GPL/LGPLv2.x. [Licensing export Paul] Berg said the GPL and LGPL version 3 have more lenient termination clauses for good reason: Most people have no idea they've violated the terms and would comply if made aware of the problem. The article mentions the case of a Linux kernel developer who has been exploiting--some say abusing--his contributions to extract money from various firms. This has been a great annoyance to the kernel community--the same community that made it clear some years ago that they were against moving to GPLv3.

1 0

Another Day, Another Intel CPU Security Hole: Lazy State
by Peter Reutemann 15 Jun '18

15 Jun '18

'The latest Intel revelation, Lazy FP state restore, can theoretically pull data from your programs, including encryption software, from your computer regardless of your operating system. Like its forebears, this is a speculative execution vulnerability. In an interview, Red Hat Computer Architect Jon Masters explained: "It affects Intel designs similar to variant 3-a of the previous stuff, but it's NOT Meltdown." Still, "it allows the floating point registers to be leaked from another process, but alas that means the same registers as used for crypto, etc." Lazy State does not affect AMD processors. This vulnerability exists because modern CPUs include many registers (internal memory) that represent the state of each running application. Saving and restoring this state when switching from one application to another takes time. As a performance optimization, this may be done "lazily" (i.e., when needed) and that is where the problem hides. This vulnerability exploits "lazy state restore" by allowing an attacker to obtain information about the activity of other applications, including encryption operations' -- source: https://it.slashdot.org/story/18/06/14/1553255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Decades-old PGP bug allowed hackers to spoof just about anyone’s signature
by Peter Reutemann 15 Jun '18

15 Jun '18

'For their entire existence, some of the world's most widely used email encryption tools have been vulnerable to hacks that allowed attackers to spoof the digital signature of just about any person with a public key, a researcher said Wednesday. GnuPG, Enigmail, GPGTools, and python-gnupg have all been updated to patch the critical vulnerability. Enigmail and the Simple Password Store have also received patches for two related spoofing bugs. Digital signatures are used to prove the source of an encrypted message, data backup, or software update. Typically, the source must use a private encryption key to cause an application to show that a message or file is signed. But a series of vulnerabilities dubbed SigSpoof makes it possible in certain cases for attackers to fake signatures with nothing more than someone’s public key or key ID, both of which are often published online. The spoofed email shown at the top of this post can't be detected as malicious without doing forensic analysis that's beyond the ability of many users.' -- source: https://arstechnica.com/information-technology/2018/06/decades-old-pgp-bug-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Russian Censorship Of Telegram
by Lawrence D'Oliveiro 14 Jun '18

14 Jun '18

Bruce Schneier <https://www.schneier.com/blog/archives/2018/06/russian_censors.html>: Iran attempts to block Telegram have been more successful than Russia's, less because Iran's censorship technology is more sophisticated but because Telegram is not willing to go as far to defend Iranian users. The reasons are not rooted in business decisions. Simply put, Telegram is a Russian product and the designers are more motivated to poke Russia in the eye. ... In 1993, John Gilmore famously said that "The Internet interprets censorship as damage and routes around it." That was technically true when he said it but only because the routing structure of the Internet was so distributed. As centralization increases, the Internet loses that robustness, and censorship by governments and companies becomes easier.

1 0

KDE Plasma 5.13 Released
by Peter Reutemann 13 Jun '18

13 Jun '18

'KDE unveils the final release of Plasma 5.13, the free and open-source desktop environment. Members of the Plasma team have focused on optimizing startup and minimizing memory usage. Plasma Browser Integration is a suite of new features which make Firefox, Chrome and Chromium-based browsers work with your desktop. For example, downloads are now displayed in the Plasma notification popup, and the Media Controls Plasmoid can mute and skip videos and music playing from within the browser. Browser tabs can be opened directly using KRunner via the Alt-Space keyboard shortcut. System Settings design has been improved further. Window manager gained much-improved effects for blur and desktop switching. Wayland work continued, with the return of window rules, and initial support for screencasts and desktop sharing.' -- source: https://tech.slashdot.org/story/18/06/12/206253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome Google Disables Inline Installation For Chrome Extensions
by Peter Reutemann 12 Jun '18

12 Jun '18

'Google today announced that Chrome will no longer support inline installation of extensions. New extensions lose inline installation starting today, existing extensions will lose the ability in three months, and in early December the inline install API will be removed from the browser with the release of Chrome 71. Critics have pointed out such moves make the Chrome Web Store a walled garden, while Google insists pushing users to the store ultimately protects them.' -- source: https://tech.slashdot.org/story/18/06/12/1820217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

KDE Slimbook 2 Review
by Peter Reutemann 08 Jun '18

08 Jun '18

'The kind folks at Slimbook recently sent me the latest generation of their ultrabook-style laptop line for review, the KDE Slimbook 2. You can hear my thoughts on the latest episode of the Ubuntu Podcast, released on June 7th 2018. Slimbook are a small laptop vendor based in Spain. All the laptops ship with KDE Neon as the default operating system. In addition to their hardware, they also contribute to and facilitate local Free Software events in their area. I was sent the laptop only for review purposes. There's no other incentive provided, and Slimbook didn't see this blog post before I published it. Being a small vendor, they don't have the same buying power with OEM vendors as other big name laptop suppliers. This is reflected in the price you pay. You're supporting a company who are themselves supporting Free Software developers and communities. If you're after the cheapest possible laptop, and don't care about its origin or the people behind the device, then maybe this laptop isn't for you. However, if you like to vote with your wallet, then the KDE Slimbook should absolutely be on your list to seriously consider.' -- source: https://popey.com/blog/posts/kde-slimbook-2-review.html Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Stymied by browsers, attackers embed Flash 0-day inside MS Office document
by Peter Reutemann 08 Jun '18

08 Jun '18

'As browser makers make it increasingly hard to exploit vulnerabilities in Adobe Flash and other plugins, hackers targeting diplomats in the Middle East tried a new approach this month: using Microsoft Office to remotely load Flash content that used a potent zero-day flaw to take control of computers.' -- source: https://arstechnica.com/information-technology/2018/06/stymied-by-browsers-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How Much Physical Memory Do I Have?
by Lawrence D'Oliveiro 07 Jun '18

07 Jun '18

The free(1) <https://linux.die.net/man/1/free> command shows you system memory usage. E.g. on my laptop a few seconds ago: ldo(a)theodora:~> free total used free shared buff/cache available Mem: 7922644 1210968 3137520 135964 3574156 6265612 Swap: 8388604 24912 8363692 But there’s something not quite right about that “total” number. The machine has 8GiB of RAM, which should show as 8388608KiB. What happened to the remaining 465964KiB? That is taken up by the kernel. But where can you find a figure for this amount? Where can you make up a total that adds up to 8388608KiB? Seems there is no such place, at least not one accessible to non-privileged software. free(1) gets its info from /proc/meminfo, which is where the kernel reports it. But there is no place in this file (or anywhere else that I know of) that the kernel calculates its own memory usage. However, there is a privileged tool, dmidecode(8) <https://linux.die.net/man/8/dmidecode>, which can get information direct from the “DMI” (aka “SMBIOS”) table. In particular, the command dmidecode -t 17 on the laptop reports two “Memory Device” entries (slots for RAM DIMMs?), one of which says “Size: No Module Installed” while the other has “Size: 8192 MB” (which obviously means 8192MiB). So you have to take the total from here as your actual physical RAM, and subtract the amount shown by free(1) (or read from /proc/meminfo) to get the kernel RAM usage.

1 0

Microsoft Addresses Pressure From Developer Community, Promises To Rename GVFS
by Peter Reutemann 07 Jun '18

07 Jun '18

'Earlier this week an article ran about how Microsoft's multi-year refusal to rename its terabyte-scale Git extension "GVFS" (Git Virtual File System) had drawn the ire and dismay of the GNOME GVfs project (Gnome Virtual File System) which predates the Microsoft project by years. Thanks to Slashdot coverage and community pressure, Microsoft has now officially promised to rename GVFS to something else, and is asking the community for suggestions for a new name. Is this an official sign that MIcrosoft is finally listening to developers (albeit with a Slashdot-level of negative attention), or are they simply trying to appease the crowd while they are still in the news due to their acquisition of GitHub?' -- source: https://developers.slashdot.org/story/18/06/06/132215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Microsoft Adds Post-Quantum Cryptography To an OpenVPN Fork
by Peter Reutemann 07 Jun '18

07 Jun '18

'Microsoft recently published an interesting open source project called "PQCrypto-VPN" that implements post-quantum cryptography (PQC) within OpenVPN. Being developed by the Microsoft Research Security and Cryptography group, as part of their research into post-quantum cryptography, this fork is being used to test PQC algorithms and their performance and functionality when used with VPNs. Microsoft's PQCrypto-VPN is published on Github and allows anyone to build an OpenVPN implementation that can encrypt communications using three different post-quantum cryptography protocols, with more coming as they are developed. These protocols are: (1) Frodo: a key exchange protocol based on the learning with errors problem (2) SIKE: a key exchange protocol based on Supersingular Isogeny Diffie-Hellman and (3) Picnic: a signature algorithm using symmetric-key primitives and non-interactive zero-knowledge proofs.' -- source: https://tech.slashdot.org/story/18/06/06/138258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

VPNFilter malware infecting 500, 000 devices is worse than we thought
by Peter Reutemann 07 Jun '18

07 Jun '18

'Two weeks ago, officials in the private and public sectors warned that hackers working for the Russian government infected more than 500,000 consumer-grade routers in 54 countries with malware that could be used for a range of nefarious purposes. Now, researchers from Cisco’s Talos security team say additional analysis shows that the malware is more powerful than originally thought and runs on a much broader base of models, many from previously unaffected manufacturers.' -- source: https://arstechnica.com/information-technology/2018/06/vpnfilter-malware-in… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

UN Plan To Move The World To IPv6
by Lawrence D'Oliveiro 06 Jun '18

06 Jun '18

The UN has a plan to try to increase IPv6 adoption <http://www.theregister.co.uk/2018/05/30/internet_engineers_united_nations_i…>. However, it does it by essentially saddling IPv6 with all the limitations of IPv4 that IPv6 was specifically created to overcome. The UN has been trying for a while to take over governance of the Internet and its standards. This has been fought off by a US-led effort in favour of the IETF, ICANN etc -- all the bodies we know and love. However, the UN can claim some moral high ground in its advocacy for greater adoption among the developing world -- places where such bodies tend to be under-represented.

1 1

Web Radio
by Lawrence D'Oliveiro 06 Jun '18

06 Jun '18

Just came across this WebSDR website <http://websdr.ewi.utwente.nl:8901/> which lets people listen to short-wave stations remotely. I haven’t actually tried fiddling with it -- it was linked from this article <https://warontherocks.com/2018/05/explaining-the-mystery-of-numbers-station…> on those mysterious “numbers stations” for broadcasting messages to spies.

1 0

Microsoft Acquires GitHub For $7.5B
by Peter Reutemann 04 Jun '18

04 Jun '18

'As rumored, Microsoft said Monday that it has acquired code repository website GitHub for a whopping sum of $7.5B in Microsoft stock. Microsoft Corporate Vice President Nat Friedman, founder of Xamarin and an open source veteran, will assume the role of GitHub CEO. GitHub's current CEO, Chris Wanstrath, will become a Microsoft technical fellow, reporting to Executive Vice President Scott Guthrie, to work on strategic software initiatives. From the blog post: "Microsoft is a developer-first company, and by joining forces with GitHub we strengthen our commitment to developer freedom, openness and innovation," said Satya Nadella, CEO, Microsoft. "We recognize the community responsibility we take on with this agreement and will do our best work to empower every developer to build, innovate and solve the world's most pressing challenges." Under the terms of the agreement, Microsoft will acquire GitHub for $7.5 billion in Microsoft stock. Subject to customary closing conditions and completion of regulatory review, the acquisition is expected to close by the end of the calendar year. GitHub will retain its developer-first ethos and will operate independently to provide an open platform for all developers in all industries. Developers will continue to be able to use the programming languages, tools and operating systems of their choice for their projects -- and will still be able to deploy their code to any operating system, any cloud and any device. The two companies, together, will "empower developers to achieve more at every stage of the development lifecycle, accelerate enterprise use of GitHub, and bring Microsoft's developer tools and services to new audiences," Microsoft said. A portion of the developer community has opposed the move, with some already leaving the platform for alternative services. Update: In a conference call with reporters, Mr. Nadella said today the company is "all in with open source," and requested people to judge the company's commitment to the open source community with its actions in the recent past, today, and in the coming future. GitHub will remain open and independent, Mr. Nadella said.' -- source: https://developers.slashdot.org/story/18/06/04/1314247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 4.17 Released
by Peter Reutemann 04 Jun '18

04 Jun '18

'In his weekly message to the Linux community on Sunday, Linus Torvalds announced the release of Linux 4.17. The release comes a couple of months after the first release candidate, and in his message Torvalds also talks about version 5.0 of the Linux kernel. Having previously said that Linux kernel v5.0 "should be meaningless," he said that this next major numerical milestone will come around "in the not too distance future." For now, though, it's version 4.17 -- or Merciless Moray, if you prefer -- that's of interest. Linux kernel 4.17 is not a major release, and Torvalds announced it without much fanfare. "So this last week was pretty calm, even if the pattern of most of the stuff coming in on a Friday made it feel less so as the weekend approached. And while I would have liked even less changes, I really didn't get the feeling that another week would help the release in any way, so here we are, with 4.17 released."' -- source: https://linux.slashdot.org/story/18/06/04/0913249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Is Said to Have Agreed to Acquire Coding Site GitHub
by Peter Reutemann 04 Jun '18

04 Jun '18

'Microsoft Corp. has agreed to acquire GitHub Inc., the code repository company popular with many software developers, and could announce the deal as soon as Monday, according to people familiar with the matter. GitHub preferred selling the company to going public and chose Microsoft partially because it was impressed by Chief Executive Officer Satya Nadella, said one of the people, who asked not to be identified discussing private information. Terms of the agreement weren't known on Sunday. GitHub was last valued at $2 billion in 2015. GitHub is an essential tool for coders. Many corporations, including Microsoft and Alphabet Inc.'s Google, use GitHub to store their corporate code and to collaborate. It's also a social network of sorts for developers. While GitHub's losses have been significant -- it lost $66 million over three quarters in 2016 -- it had revenue of $98 million in nine months of that year. On Friday, it was reported that Microsoft was in talks with GitHub about an acquisition. Now it seems like it's actually happening. Update: Our sister site, SourceForge, has weighed in. Here is a tool that will import your GitHub project to SourceForge. Update #2: Already, we are seeing plenty of backlash over this news. One user has started a petition to stop Microsoft from buying GitHub.' -- source: https://developers.slashdot.org/story/18/06/03/2042255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Emacs 26.1 Released With New Features
by Peter Reutemann 03 Jun '18

03 Jun '18

'There's a new version of the 42-year-old libre text editor with over 2,000 built-in commands, reports LWN.net: Highlights include a built-in Lisp threading mechanism that provides some concurrency, double buffering when running under X, a redesigned flymake mode, 24-bit color support in text mode, and a systemd [user] unit file. The Free Software Foundation has released a 10,653-word description of all the new features in Emacs 26.1. Here's a couple more: * The Emacs server now has socket-launching support. This allows socket based activation, where an external process like systemd can invoke the Emacs server process upon a socket connection event and hand the socket over to Emacs... This new functionality can be disabled with the configure option '--disable-libsystemd'. * The new function 'call-shell-region' executes a command in an inferior shell with the buffer region as input. * Intercepting hotkeys on Windows 7 and later now works better. * The new user variable 'electric-quote-chars' provides a list of curved quotes for 'electric-quote-mode', allowing user to choose the types of quotes to be used.' -- source: https://news.slashdot.org/story/18/06/01/202205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Atari Launches Linux Gaming Box Starting at $199
by Peter Reutemann 03 Jun '18

03 Jun '18

'Attempts to establish Linux as a gaming platform have failed time and time again, with Valve's SteamOS being the latest high-profile casualty. Yet, Linux has emerged as a significant platform in the much smaller niche of retro gaming, especially on the Raspberry Pi. Atari has now re-emerged from the fog of gaming history with an Ubuntu-based Atari VCS gaming and media streaming console aimed at retro gamers. In addition to games, the Atari VCS will also offer Internet access and optional voice control. With a Bluetooth keyboard and mouse, the system can be used as a standard Linux computer. The catch is that the already delayed systems won't ship until July 2019... By the launch date, Atari plans to have "new and exclusive" games for download or streaming, including "reimagined classic titles from Atari and other top developers," as well as multi-player games. The Atari VCS Store will also offer video, music and other content... The hardware is not open source, and the games will be protected with HDCP. However, the Ubuntu Linux stack based on Linux kernel 4.10 is open source, and includes a "customizable Linux UX." A Linux "sandbox" will be available for developing or porting games and apps. Developers can build games using any Linux compatible gaming engine, including Unity, Unreal Engine, and Gamemaker. Atari also says that "Linux-based games from Steam and other platforms that meet Atari VCS hardware specifications should work." Atari boasts this will be their first device offering online multi-player experiences, and the device will also come pre-loaded with over 100 classic Atari games. An Indiegogo campaign this week seeking $100,000 in pre-orders has already raised over $2.2 million from 8808 backers.' -- source: https://games.slashdot.org/story/18/06/01/2057206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

CSS Is Now So Overpowered It Can Deanonymize Facebook Users
by Peter Reutemann 03 Jun '18

03 Jun '18

'Some of the recent additions to the Cascading Style Sheets (CSS) web standard are so powerful that a security researcher has abused them to deanonymize visitors to a demo site and reveal their Facebook usernames, avatars, and if they liked a particular web page of Facebook. Information leaked via this attack could aid some advertisers linking IP addresses or advertising profiles to real-life persons, posing a serious threat to a user's online privacy. The leak isn't specific to Facebook but affects all sites which allow their content to be embedded on other web pages via iframes. The actual vulnerability resides in the browser implementation of a CSS feature named "mix-blend-mode," added in 2016 in the CSS3 web standard. Security researchers have proven that by overlaying multiple layers of 1x1px-sized DIV layers on top of iframes, each layer with a different blend mode, they could determine what's displayed inside it and recover the data, to which parent websites cannot regularly access. This attack works in Chrome and Firefox, but has been fixed in recent versions.' -- source: https://tech.slashdot.org/story/18/06/02/0531202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Amscay Essagemay
by Lawrence D'Oliveiro 02 Jun '18

02 Jun '18

Received this message a few days ago: Hello, Tphe3rer was a6n e7rdrmor in ymourq bi3llicng infoormaptniido0n: C6re7dit cfard ntu9mbejt:94*****c we c5obuldnt co8nfiidrem3 you8r5 deta4ilsf with youri b9an5k u C1ovn1tdenatl Providerl: iTyunes2 Store,App Store,xiCloud,ipTunesy Ma5tc7h... Dkaltex of expmir2at6ion: 30/0h5/18 Reason of expiratikon7: Acecountk n7egver been1 updqated Accuouynt stagteusz: On hmold1,Waitincg2 for ryeinae7wablme Your ac9cmount is ond hold, Warit2ingy fboyrq r0e3nejwald,8 you have 4g8 hours or wi3ll0 be closed.h Pxlmeaaseb renbew yeouqr suzbstcnroi2ptsison witih u5s tor convtinnue uvse acll s0eqrvices In otr9dern to3 ensiur9ed yo1urp Accoiunlt achtsi8ve,a yyou mcustf nsow c4lickz the fopldl6owjing lin8k andp fyollowx thce instar5uctilovnsd providie3d: (etc, etc) I realize there must be an upper IQ limit to those who are likely to respond to such an invitation. But surely there must be a lower limit as well, to being able to even understand the message in the first place. Is the interval between them nonempty?

1 0

Inkscape: By The Way ...
by Lawrence D'Oliveiro 01 Jun '18

01 Jun '18

That previous Libre Graphics World article linked to an item on Tavmjong Bah’s blog <http://tavmjong.free.fr/blog/>. “Mr Inkscape” himself has posts on the ins and outs of SVG and CSS, and tutorials on advanced features of Inkscape itself.

1 0

SVG 2.0 Chicken-And-Egg Dilemma
by Lawrence D'Oliveiro 01 Jun '18

01 Jun '18

From <http://libregraphicsworld.org/blog/entry/gradient-meshes-and-hatching-to-be…>: Essentially, we have arrived to the point where development of a major vector graphics file format for the Web is shaped by inactivity of Mozilla and Google, while Microsoft and W3C do the real work, a developer of one design tool [Inkscape] contributes a lot, but has no say in what goes into the standard, and a vendor [Adobe] of another design tool is taking a wait-and-see stance. By the way, it appears Alexandre Prokoudine has given up the battle with spammers, and has turned off all posting of new comments on his blog.

1 0

Chrome and Firefox leaks let sites steal visitors’ Facebook names, profile pics
by Peter Reutemann 01 Jun '18

01 Jun '18

'For more than a year, Mozilla Firefox and Google Chrome may have leaked users’ Facebook usernames, profile pictures, and likes if the users’ browsers visited malicious websites that employed a cutting-edge hack, researchers said Thursday. The data could be extracted through what’s known as a side-channel vulnerability in the browsers’ implementation of new standards for cascading style sheets introduced in 2016. One of the new features known as the “mix-blend-mode” leaked visual content hosted on Facebook to websites that included an iframe linking to it and some clever code to capture the data. Normally, a security concept known as the same-origin policy forbids content hosted on one domain to be available to a different domain. The vulnerability was significant because it allowed hackers to bypass this bedrock principle for two of the Internet’s most widely used browsers. The leak was independently discovered by two different research teams, and it was fixed late last year in version 63 of Chrome and two weeks ago in Firefox 60. While the updated browsers no longer pose a threat to user privacy, one of the researchers who discovered the vulnerability said the increasingly powerful graphics capabilities being added in the HTML5 and CSS standards are likely to make similar hacks possible in the future.' -- source: https://arstechnica.com/information-technology/2018/05/chrome-and-firefox-l… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

1834: The World’s First Cyberattack
by Lawrence D'Oliveiro 31 May '18

31 May '18

How a pair of bond-trader brothers were able to covertly get information on prices days ahead of the competition, using the French Government-only telegraph network <https://www.schneier.com/blog/archives/2018/05/1834_the_first_.html>.

1 0

ProtonMail Launches Free ProtonVPN Service For Macs
by Peter Reutemann 31 May '18

31 May '18

'The creators of popular encrypted email service ProtonMail have released a free version of their ProtonVPN software for macOS. From a report: Even though the free version does not contain the full features that you would come to expect from a paid VPN service it is more than capable of obfuscating IP addresses and your location. While ProtonVPN has already released Windows and Android versions, according to Dr. Andy Yen, CEO of ProtonMail, their reason for releasing the free macOS version "is to make the world a safer place by ensuring that citizens around the world have access to an Internet free of spying and censorship. Releasing a free VPN service for macOS is another important step in that direction."' -- source: https://apple.slashdot.org/story/18/05/31/1327232 Here's the pricing/features overview: https://protonvpn.com/pricing Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Chrome 67 Released for Windows, Mac, and Linux
by Peter Reutemann 31 May '18

31 May '18

'Google released earlier today Chrome 67, the latest stable release of its web browser. According to changelogs released with Chrome 67, this version adds support for a Generic Sensors API, improves AR and VR experiences, and deprecates the HTTP-Based Public Key Pinning (HPKP) security feature. Probably the biggest change in Chrome 67 is the addition of the Generic Sensors API. As the name implies, this is an API that exposes data from device sensors to public websites. The new API is based on the Generic Sensor W3C standard. This API is meant primarily for mobile use, and in its current version, websites can use Chrome's Generic Sensors API to access data from a device's accelerometer, gyroscope, orientation and motion sensors. Another API that shipped with Chrome is the WebXR Device API. Developers can use this API to build virtual and augmented reality experiences on Chrome for mobile-based VR headsets like Google Daydream View and Samsung Gear VR, as well as desktop-hosted headsets like Oculus Rift, HTC Vive, and Windows Mixed Reality Headsets.' -- source: https://tech.slashdot.org/story/18/05/30/1440256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

pop linux reviewed on distrowatch
by Ian Young 30 May '18

30 May '18

https://distrowatch.com/weekly.php?issue=20180528 By a strange coincidence the Sys 76 Linux version gets a look over this week on Distrowatch about the same time as our last meeting. A range of interesting comments amidst the dross. ~ Ian Y

3 3