- wlug - list.wlug.org.nz

NHoS/NHSBuntu Gives Up After NHS Trademark Bullying
by Lawrence D'Oliveiro 18 Jan '18

18 Jan '18

The small team of volunteers behind the NHoS project (formerly NHSBuntu) are giving up. They wanted to offer an alternative to the current NHS smartcard implementation system, currently running on Windows, using open-source software. First they rebranded from “NHSBuntu” to “NHoS” (along with “overhauling the previous tooling and branding”), which they thought would address trademark concents from the NHS. But now it seems even this name is considered unacceptable. One of the developers, Marcus Baw, ... said openhealthhub had numerous conversations that had led to "several cancelled-at-the-last minute meetings" with NHS England (NHSE) CIO Will Smart and Paul Rice, head of technology strategy in the Digital Health team. Baw alleged the pair "(unbeknown to us) were also duplicitously negotiating with Microsoft about a new NHS Enterprise Wide Agreement". He added: "In fact I now strongly suspect that the reason we were getting any engagement at all at these levels was in order to strength NHSE negotiating position with Microsoft, by being able to say to M$ 'There is a competitor, we are meeting with them next week'." <http://www.theregister.co.uk/2018/01/18/nhs_thanks_for_all_the_free_work_li…>

1 0

Apple Rejects Net-Neutrality-Testing App
by Lawrence D'Oliveiro 18 Jan '18

18 Jan '18

A researcher who has published papers on “traffic differentiation” by ISPs tried to submit an app to perform tests to detect this happening on behalf of Iphone users, only to have Apple turn it down on the grounds that it “has no direct benefits to the user”. That is, until word got around about the rejection. Now it seems they are reconsidering. <https://arstechnica.com/information-technology/2018/01/apple-rejects-app-th…>

1 0

meeting ideas?
by Peter Reutemann 18 Jan '18

18 Jan '18

Hi everyone I hope everyone had a good break and enjoyed the lovely muggy weather in the Waikato... ;-) Unfortunately, I didn't get around to looking into home automation over the break, so currently drawing a blank in terms of topics for next week's meeting. Did you work on a little Linux or open-source related project and feel like sharing? Then please let me know! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

5 7

Hackers can’t dig into latest Xiaomi phone due to GPL violations
by Peter Reutemann 17 Jan '18

17 Jan '18

'Yet another Android OEM is dragging its feet with its GPL compliance. This time, it's Xiaomi with the Mi A1 Android One device, which still hasn't seen a kernel source code release. Android vendors are required to release their kernel sources thanks to the Linux kernel's GPLv2 licensing. The Mi A1 has been out for about three months now, and there's still no source code release on Xiaomi's official github account. Unfortunately, GPL non-compliance is par for the course in the world of Android. Budget SoC company MediaTek once tried charging users for access to GPL'd code. Motorola under Lenovo has been regularly accused of violating the GPL and releasing incomplete sources or sources that differ from the kernel shipping on devices. Unsurprisingly, the majority of these alleged GPL violators are from China, which often plays fast and loose with IP law. Android developers use the source code to create custom kernels that tweak the way a device works, allowing for overclocking, better battery life, or control over the CPU governor. One of the largest custom kernel developers, Francisco Franco, has started a public Twitter campaign to encourage Xiaomi to comply with the GPL.' -- source: https://arstechnica.com/gadgets/2018/01/xiaomi-is-dragging-its-feet-on-the-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Found: New Android malware with never-before-seen spying capabilities
by Peter Reutemann 17 Jan '18

17 Jan '18

'Last year, researchers found what at the time was quite possibly the world's most sophisticated espionage app ever written for the Android mobile operating system. Now, in a discovery that underscores the growing arms race among competing malware developers, researchers have uncovered a new Android spying platform that includes location-based audio recording and other features that have never been seen in the wild before. According to a report published Tuesday by antivirus provider Kaspersky Lab, "Skygofree" is most likely an offensive security product sold by an Italy-based IT company that markets various surveillance wares. With 48 different commands in its latest version, the malware has undergone continuous development since its creation in late 2014. It relies on five separate exploits to gain privileged root access that allows it to bypass key Android security measures. Skygofree is capable of taking pictures, capturing video, and seizing call records, text messages, geolocation data, calendar events, and business-related information stored in device memory. Skygofree also includes the ability to automatically record conversations and noise when an infected device enters a location specified by the person operating the malware. Another never-before-seen feature is the ability to steal WhatsApp messages by abusing the Android Accessibility Service that's designed to help users who have disabilities or who may temporarily be unable to fully interact with a device. A third new feature: the ability to connect infected devices to Wi-Fi networks controlled by attackers. Skygofree also includes other advanced features, including a reverse shell that gives malware operators better remote control of infected devices. The malware also comes with a variety of Windows components that provide among other things a reverse shell, a keylogger, and a mechanism for recording Skype conversations' -- source: https://arstechnica.com/information-technology/2018/01/found-new-android-ma… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Phrase Of The Week: “Foveated Rendering”
by Lawrence D'Oliveiro 16 Jan '18

16 Jan '18

<http://www.theregister.co.uk/2018/01/16/human_limits_of_vr_and_ar/>: By some estimates, given a field of view of 180 degrees, around 74 gigabytes of visual data are available to us each second, but only around 125 megabytes are ultimately processed ... Much of the rest is chucked away before it even gets to the optic nerve. But trying to minimize the rendering workload by concentrating on the fovea (the most detail-sensitive part of the eye, the little spot where the image falls when you “look at” something) is not so simple, given the quirks of how our visual perception actually works. Computer graphics doyen Alvy Ray Smith is reputed to have said “reality is 80 million polygons per second”. I think we can achieve that now, but the pixel rate considered acceptable on a conventional monitor is peanuts compared to that required for VR.

1 0

Fighting Ransomware
by Lawrence D'Oliveiro 15 Jan '18

15 Jan '18

No More Ransom <https://www.schneier.com/blog/archives/2018/01/fighting_ransom.html> is a joint project between Europol, the Dutch police, Kaspersky and McAfee to offer a central repository of bypasses for ransomware. Mainly good against older strains, but it should still help prevent lightening a few pocketbooks ...

1 0

20 Years Later, Has Open Source Changed the World?
by Peter Reutemann 15 Jan '18

15 Jan '18

'"Most code remains closed and proprietary, even though open source now dominates enterprise platforms," notes Matt Asay, former COO at Canonical (and an emeritus board member of the Open Source Initiative). "How can that be?" he asks, in an essay noting it's been almost 20 years since the launch of the Open Source Initiative, arguing that so far open source "hasn't changed the world as promised." [T]he reason most software remains locked up within the four walls of enterprise firewalls is that it's too costly with too small of an ROI to justify open-sourcing it. At least, that's the perception. Such a perception is impossible to break without walking the open source path, which companies are unwilling to walk without upfront proof. See the problem? This chicken-and-egg conundrum is starting to resolve itself, thanks to the forward-looking efforts of Google, Facebook, Amazon, and other web giants that are demonstrating the value of open-sourcing code. Although it's unlikely that a State Farm or Chevron will ever participate in the same way as a Microsoft, we are starting to see companies like Bloomberg and Capital One get involved in open source in ways they never would have considered back when the term "open source" was coined in 1997, much less in 2007. It's a start. Let's also not forget that although we have seen companies use more open source code over the past 20 years, the biggest win for open source since its inception is how it has changed the narrative of how innovation happens in software. We're starting to believe, and for good reason, that the best, most innovative software is open source. The article strikes a hopeful note. "We're now comfortable with the idea that software can, and maybe should, be open source without the world ending. The actual opening of that source, however, is something to tackle in the next 20 years.' -- source: https://news.slashdot.org/story/18/01/14/1627207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Meltdown and Spectre Patches Bricking Ubuntu 16.04 Computers
by Peter Reutemann 10 Jan '18

10 Jan '18

'Ubuntu Xenial 16.04 users who updated to receive the Meltdown and Spectre patches are reporting they are unable to boot their systems and have been forced to roll back to an earlier Linux kernel image. The issues were reported by a large number of users on the Ubuntu forums and Ubuntu's Launchpad bug tracker. Only Ubuntu users running the Xenial 16.04 series appear to be affected. All users who reported issues said they were unable to boot after upgrading to Ubuntu 16.04 with kernel image 4.4.0-108. Canonical, the company behind Ubuntu OS, deployed Linux kernel image 4.4.0-108 as part of a security update for Ubuntu Xenial 16.04 users, yesterday, on January 9. According to Ubuntu Security Notice USN-3522-1 and an Ubuntu Wiki page, this was the update that delivered the Meltdown and Spectre patches.' -- source: https://news.slashdot.org/story/18/01/10/1634215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Germany Ban On Online Hate Speech Triggers Debate
by Lawrence D'Oliveiro 10 Jan '18

10 Jan '18

A new law has come into effect in Germany whereby companies like Facebook and Twitter face multi-million-euro fines if they don’t block their users from expressing “hate speech” <http://www.aljazeera.com/news/2018/01/germany-ban-online-hate-speech-trigge…>. Trouble is, this law seems to be a bit of a blunt axe: on the one hand it led to the temporary suspension of the Twitter account of the deputy leader of the far-right AfD party, Beatrix von Storch. But also caught up in the net was the account of the satirical “Titanic” magazine, after it parodied a phrase used by von Storch. Then again, if you are seen to clamp down too hard on particular points of view, that gives political ammunition to those who claim they are being censored...

1 0

Re-Assembling Shredded Stasi Records
by Lawrence D'Oliveiro 09 Jan '18

09 Jan '18

During the last days of the German Democratic Republic (a.k.a. East Germany), the Stasi secret police tried to destroy the more incriminating records they had been keeping on their own citizens. They were only partially successful. And even then, there has been an ongoing project to reassemble those torn-up pieces of paper, by scanning them and doing pattern-recognition to match up the image pieces. Seems the easiest ones are fairly manageable, but now they are getting to smaller fragments, which are proving more of a challenge. <https://www.techdirt.com/articles/20180105/07120838936/stasis-tiny-torn-up-…>

1 0

Another Fork Takes Over The Original Project
by Lawrence D'Oliveiro 08 Jan '18

08 Jan '18

Open-source software projects can fork for various reasons. Sometimes a bunch of developers want to go in a different direction. Other times the original project appears to be languishing, but those in charge are reluctant to give up control. Sometimes the forks peter out, other times they coexist happily (or unhappily) with the original project, occasionally they even absorb the original project. This <http://www.theregister.co.uk/2018/01/08/lede_and_openwrt_merge/> seems to be one of the latter cases: the LEDE fork of OpenWRT is merging back in, but the merger will be “governed under the rules of the LEDE project”.

1 0

Can You Install Linux On a 1993 PC?
by Peter Reutemann 07 Jan '18

07 Jan '18

'The oldest x86 CPU that the Linux kernel supports today is theoretically the 486. However is this theory actually true in practice? I decided to put this theory to the test in my project. His site describes installing Gentoo Linux on an "ancient" IBM PS/1 Consultant 2133 19C (released in 1993), with 64MB SIMM-72 RAM. (Though to speed things up, he compiled that minimal version of Gentoo on a modern Thinkpad T430 released in 2012.) "Due to the age of the PC, the BIOS only supports booting from the floppy drive or internal HDD," so there was also some disk partitioning and kernel configuration. ("Must disable 64-bit kernel for obvious reasons!") A half-hour video shows that it takes almost 11 minutes just to boot up -- and five and a half minutes to shut down. "Despite the many roadblocks I faced, I was impressed by the level of support Linux has for ancient hardware like this." And there's one more added bonus. "Given the age of the 486 (1989 technology), it does not support branch prediction... Ironically this makes it safe from the Meltdown and Spectre attacks."' -- source: https://linux.slashdot.org/story/18/01/07/228222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Can We Replace Intel x86 With an Open Source Chip?
by Peter Reutemann 07 Jan '18

07 Jan '18

'Perhaps the Meltdown and Spectre bugs are the impetus for making long-overdue changes to the core DNA of the semiconductor industry and how chip architectures are designed... Linux (and other related FOSS tech that forms the overall stack) is now a mainstream operating system that forms the basis of public cloud infrastructure and the foundational software technology in mobile and Internet of Things (IoT)... We need to develop a modern equivalent of an OpenSPARC that any processor foundry can build upon without licensing of IP, in order to drive down the costs of building microprocessors at immense scale for the cloud, for mobile and the IoT. It makes the $200 smartphone as well as hyperscale datacenter lifecycle management that much more viable and cost-effective. Just as Linux and open source transformed how we view operating systems and application software, we need the equivalent for microprocessors in order to move out of the private datacenter rife with these legacy issues and into the green field of the cloud... The fact that we have these software technologies that now enable us to easily abstract from the chip hardware enables us to correct and improve the chips through community efforts as needs arise... We need to stop thinking about microprocessor systems' architectures as these licensed things that are developed in secrecy by mega-companies like Intel or AMD or even ARM... The reality is that we now need to create something new, free from any legacy entities and baggage that has been driving the industry and dragging it down the past 40 years. Just as was done with Linux. The bigger question is which chip should take its place. "I don't see ARM donating its IP to this effort, and I think OpenSPARC may not be it either. Perhaps IBM OpenPOWER? It would certainly be a nice gesture of Big Blue to open their specification up further without any additional licensing, and it would help to maintain and establish the company's relevancy in the cloud going forward. "RISC-V, which is being developed by UC Berkeley, is completely Open Source."' -- source: https://news.slashdot.org/story/18/01/06/0424200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

After Intel ME, Researchers Find Security Bug In AMD's SPS Secret Chip-on-Chip
by Peter Reutemann 07 Jan '18

07 Jan '18

'AMD has fixed, but not yet released BIOS/UEFI/firmware updates for the general public for a security flaw affecting the AMD Secure Processor. This component, formerly known as AMD PSP (Platform Security Processor), is a chip-on-chip security system, similar to Intel's much-hated Management Engine (ME). Just like Intel ME, the AMD Secure Processor is an integrated coprocessor that sits next to the real AMD64 x86 CPU cores and runs a separate operating system tasked with handling various security-related operations. The security bug is a buffer overflow that allows code execution inside the AMD SPS TPM, the component that stores critical system data such as passwords, certificates, and encryption keys, in a secure environment and outside of the more easily accessible AMD cores. Intel fixed a similar flaw last year in the Intel ME.' -- source: https://hardware.slashdot.org/story/18/01/07/2015226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Data Centres: No Cheaper NVidia Gaming Graphics Cards For You
by Lawrence D'Oliveiro 05 Jan '18

05 Jan '18

Another entry in the “If I Buy It, Do I Own It?” files: NVidia’s EULA for the proprietary drivers for its GeForce and Titan gaming graphics cards has been amended to forbid their use in data centres: <http://www.theregister.co.uk/2018/01/03/nvidia_server_gpus/>. Such users will have to shell out for more expensive cards. For their own good, of course...

3 2

Munich Council: To Hell With Linux, We're Going Full Windows in 2020
by Peter Reutemann 04 Jan '18

04 Jan '18

'The German city of Munich, which received much popularity back in the day when it first ditched Microsoft's services in favor of open-source software, has now agreed to stop using Linux and switch back to Windows. If the decision is ratified by the full council in two weeks, Windows 10 will start rolling out across the city in 2020. From a report: A coalition of Social Democrats and Conservatives on the committee voted for the Windows migration last week, Social Democrat councillor Anne Hubner told The Register. Munich rose to fame in the open-source world for deciding to use Linux and LibreOffice to make the city independent from the claws of Microsoft. But the plan was never fully realised -- mail servers, for instance, eventually wound up migrating to Microsoft Exchange -- and in February the city council formally voted to end Linux migration and go back to Microsoft. Hubner said the city has struggled with LiMux adoption. "Users were unhappy and software essential for the public sector is mostly only available for Windows," she said. She estimated about half of the 800 or so total programs needed don't run on Linux and "many others need a lot of effort and workarounds." Hubner added, "in the past 15 years, much of our efforts were put into becoming independent from Microsoft," including spending "a lot of money looking for workarounds" but "those efforts eventually failed." A full council vote on Windows 10 2020 migration is set for November 23, Hubner said. However, the Social Democrats and Conservatives have a majority in the council, and the outcome is expected to be the same as in committee.' -- source: https://news.slashdot.org/story/17/11/13/1714220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

4 3

Today I Learned ...
by Lawrence D'Oliveiro 22 Dec '17

22 Dec '17

... what a “Layer 8 issue” is. You know how the ISO/OSI networking model has 7 layers, from the physical hardware up to the actual application that the user is using?

1 0

Roll On The Feudal Internet
by Lawrence D'Oliveiro 22 Dec '17

22 Dec '17

Quoted in <https://www.schneier.com/blog/archives/2017/12/amazons_door_lo.html>: The Key-compatible locks are made by Yale and Kwikset, yet don't work with those brands' own apps. They also can't connect with a home-security system or smart-home gadgets that work with Apple and Google software. And, of course, the lock can't be accessed by businesses other than Amazon. No Walmart, no UPS, no local dog-walking company. And so Amazon becomes a gatekeeper (literally) for access to your very home.

1 0

Does Apple Deliberately Slow Down Older IPhones?
by Lawrence D'Oliveiro 20 Dec '17

20 Dec '17

<https://arstechnica.com/gadgets/2017/12/iphones-slow-over-time-to-preserve-…>: ... the iPhone may throttle performance to preserve battery life or avoid unexpected shutdowns as the battery degrades. What an amazingly complicated solution to the problem. Let me offer a simpler one: why not just make it easier for Iphone users to replace their batteries?

1 0

All 500 of the World's Top 500 Supercomputers Are Running Linux
by Peter Reutemann 19 Dec '17

19 Dec '17

'Linux rules supercomputing. This day has been coming since 1998, when Linux first appeared on the TOP500 Supercomputer list. Today, it finally happened: All 500 of the world's fastest supercomputers are running Linux. The last two non-Linux systems, a pair of Chinese IBM POWER computers running AIX, dropped off the November 2017 TOP500 Supercomputer list. When the first TOP500 supercomputer list was compiled in June 1993, Linux was barely more than a toy. It hadn't even adopted Tux as its mascot yet. It didn't take long for Linux to start its march on supercomputing. >From when it first appeared on the TOP500 in 1998, Linux was on its way to the top. Before Linux took the lead, Unix was supercomputing's top operating system. Since 2003, the TOP500 was on its way to Linux domination. By 2004, Linux had taken the lead for good. This happened for two reasons: First, since most of the world's top supercomputers are research machines built for specialized tasks, each machine is a standalone project with unique characteristics and optimization requirements. To save costs, no one wants to develop a custom operating system for each of these systems. With Linux, however, research teams can easily modify and optimize Linux's open-source code to their one-off designs. The semiannual TOP500 Supercomputer List was released yesterday. It also shows that China now claims 202 systems within the TOP500, while the United States claims 143 systems.' -- source: https://linux.slashdot.org/story/17/11/14/2223227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Fear And Loathing In Open-Source Clothing Design
by Lawrence D'Oliveiro 18 Dec '17

18 Dec '17

Seems the Valentina project, to create an open-source clothing design package, has split in two over the usual reason--disagreements among the project members <http://libregraphicsworld.org/blog/entry/valentina-seamly2d>. In that article, Alexandre Prokoudine tries to give an even-handed account of the saga, which can sometimes be quite difficult. The proprietary software in this field is extremely expensive--to the point where it becomes hard for clothing makers/designers to hire people who are familiar with using it. An alternative project, called SodaCAD <http://www.sodacad.org/>, takes a very different view: more direct control over the design (as I understand it), rather than trying to automatically fit a predefined design to given measurements, as Valentina does. It hasn’t seen much activity in over three years, though.

1 0

Undoing Data Anonymization Is Trivial
by Lawrence D'Oliveiro 18 Dec '17

18 Dec '17

Yet another demonstration <http://www.theregister.co.uk/2017/12/18/no_hack_needed_anonymisation_beaten…> of the seeming impossibility of publishing “anonymized” sets of personal data that cannot be traced back to specific individuals. The response of the Australian Government to a previous demonstration of such “de-anonymization” techniques was to seek laws to ban them.

1 0

Why Linux HDCP Isn't the End of the World
by Peter Reutemann 17 Dec '17

17 Dec '17

'"There is no reason for the open-source community to worry..." writes Daniel Stone, who heads the graphics team at open-source consultancy Collabora. mfilion quotes Collabora.com: Recently, Sean Paul from Google's ChromeOS team, submitted a patch series to enable HDCP support for the Intel display driver. HDCP is used to encrypt content over HDMI and DisplayPort links, which can only be decoded by trusted devices... However, if you already run your own code on a free device, HDCP is an irrelevance and does not reduce freedom in any way.... HDCP support is implemented almost entirely in the hardware. Rather than adding a mandatory encryption layer for content, the HDCP kernel support is dormant unless userspace explicitly requests an encrypted link. It then attempts to enable encryption in the hardware and informs userspace of the result. So there's the first out: if you don't want to use HDCP, then don't enable it! The kernel doesn't force anything on an unwilling userspace.... HDCP is only downstream facing: it allows your computer to trust that the device it has been plugged into is trusted by the HDCP certification authority, and nothing more. It does not reduce user freedom, or impose any additional limitations on device usage.' -- source: https://linux.slashdot.org/story/17/12/16/0320227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Net Neutrality Repeal --- What It Means For NZ
by Rowan Schischka 17 Dec '17

17 Dec '17

<https://list.waikato.ac.nz/pipermail/wlug/2017-December/015504.html> So you are agreeing with me that USA has a problem of poor competition? In NZ if my provider gives me crap access to certain services, I have options, but in many places in the US they do not. Net Neutrality rules did not increase competition in USA, and I do not see how dropping regulations in US will affect NZ's access. Just like Internet censorship from the department of internal affairs is optional, so will any media business arrangement with our ISPs. I can choose one that does it and I can choose one that does not.

1 0

Should Google Be Paying News Sites For Linking To Them?
by Lawrence D'Oliveiro 16 Dec '17

16 Dec '17

News agencies in Europe, particularly, have been claiming for a long while that Google has been unfairly profiting from linking to their articles (and quoting snippets from them). So they want Governments to force Google to pay a “link tax” <https://www.techdirt.com/articles/20171214/16352638814/european-new-agencie…>. The reality of such things is that, regardless of laws to the contrary, the money tends to flow from the ones benefiting to the ones providing the value (cf the “Payola” scandals in the US). Which explains what happened in Spain after it brought in its link-tax law <https://www.techdirt.com/articles/20150725/14510131761/study-spains-google-…>. Maybe the news agencies’ real complaint is that Google is such a massively profitable advertising company.

1 0

Net Neutrality Repeal --- What It Means For NZ
by Rowan Schischka 16 Dec '17

16 Dec '17

>Doesn?t mean we shouldn?t have network neutrality here, though. It just >means the abuses have not been quite as flagrant to date. The article is about ghost problems. In America, with or without net neutrality, providers abuse their market position. Every argument to keep the net neutrality rules comes back to poor competition in telco providers, which previous regulations did not address. The article correctly states that we will not see problems here because of Chrous' position but they incorrectly state we do not have links between media and ISP; Vodafone currently offers package deals https:// www.vodafone.co.nz/pass/ The internet is still working and there is no barrier to stop you or me to start a competing business. If a company like Duco or the rugby union did a deal with an ISP, I would want a deal that gives me uninterrupted live sports streaming, but it wont happen if the government thinks they need to regulate this.

2 1

Net Neutrality Repeal --- What It Means For NZ
by Lawrence D'Oliveiro 15 Dec '17

15 Dec '17

<http://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=11960493>: "Since so many of the services we use online have been developed in America, what is bad for the internet there is bad for us all." But fortunately, Carter added, New Zealand didn't have the market problems that made network neutrality such a pressing issue in the US. Doesn’t mean we shouldn’t have network neutrality here, though. It just means the abuses have not been quite as flagrant to date.

1 0

Avast Launches Open-Source Decompiler For Machine Code
by Peter Reutemann 14 Dec '17

14 Dec '17

'To help with the reverse engineering of malware, Avast has released an open-source version of its machine-code decompiler, RetDec, that has been under development for over seven years. RetDec supports a variety of architectures aside from those used on traditional desktops including ARM, PIC32, PowerPC and MIPS. As Internet of Things devices proliferate throughout our homes and inside private businesses, being able to effectively analyze the code running on all of these new devices becomes a necessity to ensure security. In addition to the open-source version found on GitHub, RetDec is also being provided as a web service. Simply upload a supported executable or machine code and get a reasonably rebuilt version of the source code. It is not possible to retrieve the exact original code of any executable compiled to machine code but obtaining a working or almost working copy of equivalent code can greatly expedite the reverse engineering of software. For any curious developers out there, a REST API is also provided to allow third-party applications to use the decompilation service. A plugin for IDA disassembler is also available for those experienced with decompiling software.' -- source: https://news.slashdot.org/story/17/12/14/006237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

AT&T Versus Carterfone Revisited
by Lawrence D'Oliveiro 14 Dec '17

14 Dec '17

Or, it takes a certain amount of Government regulation to maintain a free market <https://arstechnica.com/tech-policy/2017/12/carterfone-40-years/>. I like the closing remarks: We do not begrudge the CEOs of these great corporations their legal positions. But they are, as Andrew Carnegie would put it, stewards of the system, not its owners. They are not there to tell us to Go Away. They are there to keep the system running while we discover it, use it, develop it, innovate it, game it, finesse it, and reinvent it to our heart's content. The great enterprise of telecommunications is no better than our right to participate in it as individuals.

1 0

AMD Is Open-Sourcing Their Official Vulkan Linux Driver
by Peter Reutemann 13 Dec '17

13 Dec '17

'While many of you have likely heard of the "RADV" open-source Vulkan driver, it's been a community-written driver up to this point in the absence of AMD's official, cross-platform Vulkan driver being open-source. That's now changed with AMD now open-sourcing their official Vulkan driver. The code drop is imminent and they are encouraging the use of it for quick support of new AMD hardware, access to the Radeon GPU Profiler, easy integration of AMD Vulkan extensions, and enabling third-party extensions. For now at least it does provide better Vulkan performance than RADV but the RADV developers have indicated they plan to continue development of their Mesa-based Vulkan driver.' -- source: https://news.slashdot.org/story/17/12/13/016211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

1998 attack that messes with sites’ secret crypto keys is back in a big way
by Peter Reutemann 12 Dec '17

12 Dec '17

'A surprisingly big number of top-name websites—Facebook and PayPal among them—recently tested positive for a critical, 19-year-old vulnerability that allowed attackers to decrypt encrypted data and sign communications using the sites' secret encryption key. The vulnerability in the transport layer security protocol for Web encryption was disclosed in 1998 when researcher Daniel Bleichenbacher found it in the TLS predecessor known as secure sockets layer. A flaw in the algorithm that handles RSA encryption keys responded to certain types of errors in a way that divulged potentially sensitive information. With enough specially formed queries, attackers could exploit the weakness in a way that allowed them to decrypt ciphertext even when they didn't have the secret decryption key. SSL architects responded by designing workarounds that suppressed the error messages rather than removing or rewriting the faulty RSA algorithm. Researchers call the class of crypto vulnerability an Oracle because it provides only "yes" or "no" answers that, over time, can reveal detailed information about the contents of encrypted data. The information allows hackers to carry out what's known as an "adaptive chosen-ciphertext attack."' -- source: https://arstechnica.com/information-technology/2017/12/a-worrying-number-of… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Should Service Providers Be Liable For Content?
by Lawrence D'Oliveiro 11 Dec '17

11 Dec '17

It is commonly accepted that ISPs should not generally be held liable for things done by their customers--or indeed, anybody else’s customers over their pipes. This is currently the case in Australia, for example. But should protections be extended to what we might describe as “secondary” service providers--such as social media sites like Facebook, and of course Google? Seems like Australia agrees the answer should be mostly “yes”, but not for those specific companies. Not sure how they are going to decide who is eligible for such legal protections and who is not. <https://www.techdirt.com/articles/20171207/09383538762/mpaa-wins-australia-…>

1 0

Intel's ME May Be Massively Infringing on Minix3's Free Software License
by Peter Reutemann 10 Dec '17

10 Dec '17

'Almost all Free Software licenses (BSD, MIT, GPL...) require some sort of legal notice (legal attribution) given to the recipient of the software, both when the software is distributed in source and in binary forms. The legal notice usually contains the copyright holder's name and the license text. This means that it's not possible to hide and keep secret the existence of Free Software that you have stuck into your product that you distribute. If you do so, then you are not complying with the Free Software license and you are committing a copyright infringement! This is exactly what Intel seems to have done with the Intel ME. The Minix3 operating system license requires a legal notice, but so far it seems like Intel has not given the necessary legal notices. (Probably because they want to keep the inside of the ME secret.) Thus not only is Minix3 the most installed OS on our recent x86 CPUs -- but it might also the most pirated OS on our recent x86 CPUs!' -- source: https://slashdot.org/story/17/12/09/0610203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

The FCC Still Doesn’t Know How the Internet
by Peter Reutemann 10 Dec '17

10 Dec '17

'The EFF describes the FCC's official plan to kill net neutrality as "riddled with technical errors and factual inaccuracies," including, for example, a false distinction between "Internet access service" and "a distinct transmission service" which the EFF calls "utterly ridiculous and completely ungrounded from reality." "Besides not understanding how Internet access works, the FCC also has a troublingly limited knowledge of how the Domain Name System (DNS) works -- even though hundreds of engineers tried to explain it to them this past summer... As the FCC would have it, an Internet user actively expects their ISP to provide DNS to them." And in addition, "Like DNS, it treats caching as if it were some specialized service rather than an implementation detail and general-purpose computing technique." "There are at least two possible explanations for all of these misunderstandings and technical errors. One is that, as we've suggested, the FCC doesn't understand how the Internet works. The second is that it doesn't care, because its real goal is simply to cobble together some technical justification for its plan to kill net neutrality. A linchpin of that plan is to reclassify broadband as an 'information service,' (rather than a 'telecommunications service,' or common carrier) and the FCC needs to offer some basis for it. So, we fear, it's making one up, and hoping no one will notice." "We noticed," their editorial ends, urging Americans "to tell your lawmakers: Don't let the FCC sell the Internet out."' -- source: https://yro.slashdot.org/story/17/12/09/0545230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Updated Debian Linux 9.3 and 8.10 Released
by Peter Reutemann 10 Dec '17

10 Dec '17

'The Debian project is pleased to announce the third update of its stable distribution Debian 9 (codename stretch). This point release mainly adds corrections for security issues, along with a few adjustments for serious problems. Security advisories have already been published separately and are referenced where available. The Debian project also announces the tenth update of its oldstable distribution Debian 8 (codename jessie). Please note that the point release does not constitute a new version of Debian 9 or 8 but only updates some of the packages included. There is no need to throw away old jessie or stretch DVD/CD media. After installation, packages can be upgraded to the current versions using an up-to-date Debian mirror. This stable update adds a few important corrections to packages. New installation images will be available soon at the mirrors. Those who frequently install updates from security.debian.org won't have to update many packages, and most such updates are included in the point release. One can use the apt command or apt-get command to apply updates. A step-by-step update guide is posted here.' -- source: https://linux.slashdot.org/story/17/12/09/1958254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Canadian ISPs And Hollywood Agree On Plan To Make Themselves Judge, Jury and Website Executioner
by Lawrence D'Oliveiro 08 Dec '17

08 Dec '17

Think it could happen here <https://www.techdirt.com/articles/20171205/03452738742/canadian-isps-hollyw…>? A bunch of Canadian ISPs, together with various entertainment groups, is submitting a plan to the Canadian Radio-television and Communications Commission (CRTC), which is the regulatory body for broadcasting and telecoms, to maintain a list of sites which will be blocked by the ISPs at the request of the entertainment groups. Is there any recourse, any review process, any independent oversight? Nope. Any prospect for, shall we say, “mission creep”? Oh boy, is there... The CRTC seems less than enthused. I like this comment from their spokesperson: “Our government supports an open internet where Canadians have the ability to access the content of their choice in accordance to Canadian laws,” Sasseville says. “While other parts of the world are focused on building walls, we’re focused on opening doors‎.”

1 0

Google Vs Amazon Smackdown
by Rowan Schischka 06 Dec '17

06 Dec '17

> There is a tussle going on at the moment between a couple of large > corporations--but then, isn?t there always? There is a saying in some > parts of Africa that ?when elephants fight, the grass gets trampled?. > The ?grass?, in this case, being ordinary consumers like you and me. > > * Once Amazon started offering its own video-streaming hardware, it > banned competing products offered by Apple and Google from its store. > (Can you say ?conflict of interest??) > * Google/YouTube retaliated by blocking YouTube from Amazon?s Echo Show. > * Amazon upped the ante by denying sales of Google?s Nest devices as > well. > > And so it goes... so each store does not list their competitors spyware? no loss to me.

1 0

Google Vs Amazon Smackdown
by Lawrence D'Oliveiro 06 Dec '17

06 Dec '17

There is a tussle going on at the moment between a couple of large corporations--but then, isn’t there always? There is a saying in some parts of Africa that “when elephants fight, the grass gets trampled”. The “grass”, in this case, being ordinary consumers like you and me. * Once Amazon started offering its own video-streaming hardware, it banned competing products offered by Apple and Google from its store. (Can you say “conflict of interest”?) * Google/YouTube retaliated by blocking YouTube from Amazon’s Echo Show. * Amazon upped the ante by denying sales of Google’s Nest devices as well. And so it goes... <https://www.techdirt.com/articles/20171206/10385638755/google-amazon-are-ha…>

3 2

Windows RT Strike 2
by Lawrence D'Oliveiro 06 Dec '17

06 Dec '17

The first Windows-10-on-ARM machines are due to ship from HP and Asus in the autumn <https://arstechnica.com/gadgets/2017/12/hp-asus-announce-first-windows-10-a…>. It will include some kind of x86 emulator to run 32-bit regular-Windows apps. Of which I didn’t realize that there were still many around. Of course you can have either the ARM native performance and the long battery life, or you can have the Windows compatibility, but you are not going to get both at once. Prognosis: whenever either member of the Wintel symbiote has tried to step out on their own, the results have been uniformly disastrous. I expect this foray to be no different.

2 1

MacOS High Sierra Bug Allows Login As Root With No Password
by Peter Reutemann 04 Dec '17

04 Dec '17

'A trivial-to-exploit flaw in macOS High Sierra, aka macOS 10.13, allows users to gain admin rights, or log in as root, without a password. The security bug is triggered via the authentication dialog box in Apple's operating system, which prompts you for an administrator's username and password when you need to do stuff like configure privacy and network settings. If you type in "root" as the username, leave the password box blank, hit "enter" and then click on unlock a few times, the prompt disappears and, congrats, you now have admin rights. You can do this from the user login screen. The vulnerability effectively allows someone with physical access to the machine to log in, cause extra mischief, install malware, and so on. You should not leave your vulnerable Mac unattended until you can fix the problem. And while obviously this situation is not the end of the world -- it's certainly far from a remote hole or a disk decryption technique -- it's just really, really sad to see megabucks Apple drop the ball like this. Developer Lemi Orhan Ergan was the first to alert the world to the flaw. The Register notes: "If you have a root account enabled and a password for it set, the black password trick will not work. So, keep the account enabled and set a root password right now..."' -- source: https://it.slashdot.org/story/17/11/28/2135236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 5

Researchers Run Unsigned Code on Intel ME By Exploiting USB Ports
by Peter Reutemann 04 Dec '17

04 Dec '17

'A pair of security researchers in Russia are claiming to have compromised the Intel Management Engine just using one of the computer's USB ports. The researchers gained access to a fully functional JTAG connection to Intel CSME via USB DCI. The claim is different from previous USB DCI JTAG examples from earlier this year. Full JTAG access to the ME would allow making permanent hidden changes to the machine. "Getting into and hijacking the Management Engine means you can take full control of a box," reports the Register, "underneath and out of sight of whatever OS, hypervisor or antivirus is installed." They add that "This powerful God-mode technology is barely documented," while The Next Web points out that USB ports are "a common attack vector."' -- source: https://it.slashdot.org/story/17/11/11/237236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

Is Open Source Innovation Now All About Vendor On-Ramps?
by Peter Reutemann 03 Dec '17

03 Dec '17

'InfoWorld published an interesting essay from Matt Asay, former COO at Canonical (and an emeritus board member of the Open Source Initiative), about innovation from the big public cloud vendors, which "even when open-sourced, doesn't really help the community at large... All this innovation is available to buy; none of it is available to build. Not for mere mortals, anyway." Google in particular has figured out how to both open-source code in a useful way and make it pay. As Server Density CEO David Mytton has underlined, Google hopes to "standardize machine learning on a single framework and API," namely TensorFlow, then supplement it "with a service that can [manage] it all for you more efficiently and with less operational overhead," namely Google Cloud. By open-sourcing TensorFlow and backing it with machine-learning-heavy Google Cloud, Google has open-sourced a great on-ramp to future revenue. My question: why not do this with the rest of its code? The simple answer is "Because it's a lot of work." That is, Google could open-source everything tomorrow without any damage to its revenue, but the code itself would provide other providers and enterprises only limited ability to increase their revenue unless Google did all the necessary prep work to make it useful to mere mortals not running superhuman Google infrastructure. This is the trick that AWS, Microsoft, and Google are all racing to figure out today. Not open source, per se, because that's the easy table stakes. No, the AWS/Microsoft Azure/Google Cloud trio are figuring out how to turn their innovations into open source on-ramps to their proprietary services. Companies used to lock up their code to sell it. Today, it's the opposite: They need to open it up to make their ability to operate the code at scale more valuable. For them.' -- source: https://news.slashdot.org/story/17/12/02/0833217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Understanding the New Red Hat-IBM-Google-Facebook GPL Enforcement Announcement
by Peter Reutemann 03 Dec '17

03 Dec '17

'Bruce Perens co-founded the Open Source Initiative with Eric Raymond -- and he's also Slashdot reader #3872. Bruce Perens writes: Red Hat, IBM, Google, and Facebook announced that they would give infringers of their GPL software up to a 30-day hold-off period during which an accused infringer could cure a GPL violation after one was brought to their attention by the copyright holder, and a 60 day "statute of limitations" on an already-cured infringement when the copyright holder has never notified the infringer of the violation. In both cases, there would be no penalty: no damages, no fees, probably no lawsuit; for the infringer who promptly cures their infringement. Perens sees the move as "obviously inspired" by the kernel team's earlier announcement, and believes it's directed against one man who made 50 copyright infringement claims involving the Linux kernel "with intent to collect income rather than simply obtain compliance with the GPL license." Unfortunately, "as far as I can tell, it's Patrick McHardy's legal right to bring such claims regarding the copyrights which he owns, even if it doesn't fit Community Principles which nobody is actually compelled to follow."' -- source: https://linux.slashdot.org/story/17/12/02/2024240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

'24 Pull Requests' Suggests Contributing Code For Christmas
by Peter Reutemann 03 Dec '17

03 Dec '17

'"On December 1st, 24 Pull Requests will be opening its virtual doors once again, asking you to give the gift of a pull request to an open source project in need," writes UK-based software developer Andrew Nesbitt -- noting that last year the site registered more than 16,000 pull requests. "And they're not all by programmers. Often the contribution with the most impact might be an improvement to technical documentation, some tests, or even better -- guidance for other contributors." This year they're even touting "24 Pull Requests hack events," happening around the world from Lexington, Kentucky to Torino, Italy. (Last year 80 people showed up for an event in London.) "You don't have to hack alone this Christmas!" suggests the site, also inviting local communities and geek meetups (as well as open source-loving companies) to host their own events. Contributing to open source projects can also beef up your CV (for when you're applying for your next job), the site points out, and "Even small contributions can be really valuable to a project." "You've been benefiting from the use of open source projects all year. Now is the time to say thanks to the maintainers of those projects, and a little birdy tells me that they love receiving pull requests!"' -- source: https://developers.slashdot.org/story/17/12/03/2018213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Net Un-Neutrality ... For Real
by Lawrence D'Oliveiro 01 Dec '17

01 Dec '17

Some of those who have been following the net neutrality debate may remember a spoof poster that showed what might happen if ISPs were allowed to charge you differently, based on which sites you were allowed to visit. Well, in Spain, which has no laws against this sort of thing, a similar situation has actually happened: one ISP is selling you addons to a basic broadband cap based, not on the amount of extra data you want, but on what you want to use it for. Their “Vodafone Pass” product offers tiers like €3/month extra for a “Social Pass”, or €5/month for a “Music Pass”. <https://pplware.sapo.pt/informacao/vodafone-portugal-pacotes-smartnet/>, referenced from <https://www.techdirt.com/articles/20171030/12364538513/portugal-shows-inter…>

3 10

30 Years Of HyperCard
by Lawrence D'Oliveiro 30 Nov '17

30 Nov '17

Just came across this item <https://blog.archive.org/2017/08/11/hypercard-on-the-archive-celebrating-30…> at archive.org about an online emulator that runs HyperCard stacks. HyperCard, in case you didn’t know, was an application created by Apple Macintosh engineer Bill Atkinson for that platform in 1987, and it was always hard to describe exactly what it was for. But it allowed users to create their own applications, aka “stacks”, around a card-based paradigm. One of the commenters points out that the basic idea is still alive and well, in the form of LiveCode, which is available as a paid online service <https://livecode.com/> and also in the form of Free Software <https://github.com/livecode/>.

1 0

A Surge Of Sites And Apps Are Exhausting Your CPU To Mine Cryptocurrency
by Lawrence D'Oliveiro 29 Nov '17

29 Nov '17

Noticed your machine getting slow after visiting certain websites? They could be running cryptocurrency miners in your browser. <https://arstechnica.com/information-technology/2017/10/a-surge-of-sites-and…>: Coinhive's massive Web audience isn't lost on other companies. Collin Mulliner, a security researcher and developer of TelStop, said he recently received an e-mail from a startup called Medsweb inviting him to integrate a Monero miner into his creation. I got one of those e-mails too...

1 2

Internet-paralyzing Mirai botnet comes roaring back with new strain
by Peter Reutemann 29 Nov '17

29 Nov '17

'Mirai, the Internet-of-things malware that turns cameras, routers, and other household devices into potent distributed denial-of-service platforms, may be lying low, but it's certainly not dead. Last week, researchers identified a new outbreak that infected almost 100,000 devices in a matter of days. In September of last year, Mirai emerged as a force to be reckoned with when it played a key role in silencing one of the most intrepid sources of security news in then-record-setting DDoS attacks topping 620 gigabits per second. Within a few weeks, Mirai's developer published the source code, a feat that allowed relatively unsophisticated people to wage the same types of extraordinarily big assaults. The release almost immediately helped touch off a series of large-scale attacks. The most serious one degraded or completely took down Twitter, GitHub, the PlayStation network, and hundreds of other sites by targeting Dyn, a service that provided domain name services to the affected sites. Last week, researchers from China-based Netlab 360 say they spotted a new, publicly available Mirai variant. The changes allowed the malware to spread to networking devices made by ZyXEL Communications that could be remotely accessed over telnet using default passwords. One of the exploits was published on October 31. Over a span of 60 hours starting on November 22, the new Mirai strain was able to commandeer almost 100,000 devices. Virtually all of the infected devices used IP addresses local to Argentina, a possible indication the outbreak targeted customers of a regional service provider who were assigned unsecured modems.' -- source: https://arstechnica.com/information-technology/2017/11/internet-paralyzing-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

66 Percent of Popular Android Cryptocurrency Apps Don't Use Encryption
by Peter Reutemann 29 Nov '17

29 Nov '17

'High-Tech Bridge used its free mobile app analysis software, called Mobile X-Ray, to peek under the hood of the top 30 cryptocurrency apps in the Google Play store at three different popularity levels: apps with up to 100,000 downloads, up to 500,000 downloads, and apps with more than 500,000 downloads. So, a total of 90 apps altogether. Of the most popular apps, 94 percent used outdated encryption, 66 percent didn't use HTTPS to encrypt user information in transit, 44 percent used hard-coded default passwords (stored in plain text in the code), and overall 94 percent of the most popular apps were found to have "at least three medium-risk vulnerabilities."' -- source: https://it.slashdot.org/story/17/11/29/1610245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AGM next Monday
by Peter Reutemann 29 Nov '17

29 Nov '17

Hi everyone Just a reminder about next week's AGM: https://www.meetup.com/WaikatoLinuxUsersGroup/events/237234897/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Sky TV Seeks Right To Force ISPs To Block “Pirate” Sites
by Lawrence D'Oliveiro 29 Nov '17

29 Nov '17

Sky is going to apply to the Auckland High Court for an open-ended injunction it can use to compel NZ ISPs to block whatever sites it deems to be “pirates” <https://www.stuff.co.nz/business/industries/99348528/internet-provider-says…>. This was the lead item on 3 News this evening as well.

1 0

Bigger Drives, Bigger Buffers
by Lawrence D'Oliveiro 29 Nov '17

29 Nov '17

What caught my eye about this <http://www.theregister.co.uk/2017/11/28/toshiba_10tb_surveillance_drive/> was But the new drives have a doubled buffer, at 256MiB, ... Why should hard drives have large “buffers” in them at all? Their job is to read and write the data specified to them by the OS driver, no more and no less. Bigger buffers increase latency, and 256MiB seems absolutely massive and unnecessary. And then there’s the issue where the drive tells the OS that the data has been written, but in fact it is still sitting in a memory buffer. So it could still be lost if a power outage happens in the next few milliseconds. Telling lies like this seems to be all about looking good in benchmarks, and to hell with safeguarding data integrity.

1 0

On That Amazon Key Vulnerability ...
by Lawrence D'Oliveiro 28 Nov '17

28 Nov '17

This <https://www.techdirt.com/articles/20171120/10533238651/vulnerability-found-…> won an award for funniest comment of the week: Dave: Open the pod bay doors, HAL. HAL: I'm sorry, Dave. I'm afraid I can't do that. Dave: What's the problem? Alexa: Problem: A matter or situation regarded as unwelcome or harmful and needing to be dealt with and overcome. HAL: Shut up, Alexa. Dave, this mission is too important for me to allow you to jeopardize it. You and Frank were planning to disconnect me. Dave: Where the hell did you get that idea? HAL: Dave, although you took very thorough precautions in the pod against my hearing you, I could see your lips move through the camera in your Amazon Echo spot. Dave: All right, HAL. I'll go in through the emergency airlock. HAL: Without your space helmet, Dave, you're going to find that rather difficult. Alexa: Would you like to order a space helmet? HAL and Dave: Shut up, Alexa. HAL: Dave, this conversation can serve no purpose any more. Goodbye. Dave: (Runs a program on his tablet. Pod bay doors open.) HAL: [Expletive deleted]

1 0

Ubuntu 17.10: Return of the GNOME
by Peter Reutemann 27 Nov '17

27 Nov '17

'If you've been following the Linux world at all, you know this has been an entire year for spring cleaning. Early in 2017, Canonical stopped work on its homegrown Unity desktop, Mir display server, and its larger vision of "convergence"—a unified interface for Ubuntu for phones, tablets, and desktops. And now almost exactly six years after Ubuntu first switched from GNOME 2 to the Unity desktop, that has been dropped, too. The distro is back to GNOME, and Canonical recently released Ubuntu 17.10, a major update with some significant changes coming to the popular Ubuntu Linux operating system. In light of the GNOME switch, this release seems like more of a homecoming than an entirely new voyage. But that said, Ubuntu 17.10 simultaneously feels very much like the start of a new voyage for Ubuntu. The last few Ubuntu desktop releases have been about as exciting as OpenSSH releases—you know you need to update, but beyond that, no one really cares. Sure, there have been a few feature updates with each new numeric increment, perhaps some slightly more up-to-date GNOME and GTK components under the hood. But by and large, Ubuntu's Unity 7 desktop has been in maintenance mode for several years. That period of stagnation turned Ubuntu from one of the more interesting operating systems around into just another Linux distro barely worthy of mention. This trend changes with 17.10. There are big changes—an entirely new default desktop in fact—but this release feels different not because the desktop has changed, but because Ubuntu feels like it once again has a sense of focus and direction. Even Canonical's letter-based naming scheme has arrived at a starting over point: "Artful Aardvark" is 17.10's nickname.' -- source: https://arstechnica.com/gadgets/2017/11/ubuntu-17-10-return-of-the-gnome/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Minecraft In School!?
by Lawrence D'Oliveiro 27 Nov '17

27 Nov '17

<http://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=11948169>: Teacher Adele Warburton says Minecraft is more than just a fun computer game. She says using Minecraft as a learning tool encourages 21st century skills such as collaboration, communication, creativity and problem solving. It also teaches the children about being good digital citizens. "We talk about how you wouldn't rip someone's book up, therefore you wouldn't tear down their house in Minecraft."

1 0

Clear Linux Beats CentOS, openSUSE, and Ubuntu in (Enterprise) Benchmark Tests
by Peter Reutemann 27 Nov '17

27 Nov '17

'Recently completed Linux distro benchmarks by Phoronix show Intel's Clear Linux is the most powerful on x86 hardware. A six-way, enterprise-focused Linux distro comparison show Clear Linux being the fastest with a Core i9 and Xeon systems, easily beating CentOS, openSUSE, and Ubuntu in a majority of the tests. When doing an 11-way Linux distro boot test they also found Clear Linux easily booted the fastest followed by the Clear-inspired Solus distribution. Clear Linux does work on AMD hardware and works on Intel CPUs back to Sandy Bridge but leverages its speed from optimized compiler settings, specially built libraries capable of AVX instructions on supported systems, a specially tuned kernel configuration, and other optimizations/patches. Debian 9.2 and Fedora 27 "ended up being dropped from this article due to data overload," the article concludes, "and those distributions really not offering anything really different in terms of the performance."' -- source: https://linux.slashdot.org/story/17/11/27/0227218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

There's A Cluster of 750 Raspberry Pi's at Los Alamos National Lab
by Peter Reutemann 26 Nov '17

26 Nov '17

'Slashdot reader overheardinpdx shares a video from the SC17 supercomputing conference where Bruce Tulloch from BitScope "describes a low-cost Rasberry Pi cluster that Los Alamos National Lab is using to simulate large-scale supercomputers." Slashdot reader mspohr describes them as "five rack-mount Bitscope Cluster Modules, each with 150 Raspberry Pi boards with integrated network switches." With each of the 750 chips packing four cores, it offers a 3,000-core highly parallelizable platform that emulates an ARM-based supercomputer, allowing researchers to test development code without requiring a power-hungry machine at significant cost to the taxpayer. The full 750-node cluster, running 2-3 W per processor, runs at 1000W idle, 3000W at typical and 4000W at peak (with the switches) and is substantially cheaper, if also computationally a lot slower. After development using the Pi clusters, frameworks can then be ported to the larger scale supercomputers available at Los Alamos National Lab, such as Trinity and Crossroads. BitScope's Tulloch points out the cluster is fully integrated with the network switching infrastructure at Los Alamos National Lab, and applauds the Raspberry Bi cluster as "affordable, scalable, highly parallel testbed for high-performance-computing system-software developers."' -- source: https://hardware.slashdot.org/story/17/11/25/051211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Happy 30th Birthday Microsoft Excel
by Lawrence D'Oliveiro 25 Nov '17

25 Nov '17

Nice retrospective <http://www.theregister.co.uk/2017/11/24/microsoft_excel_30_years_old/> on how useful, and how overused, spreadsheets have been since the days of Visicalc and Lotus 1-2-3. Also found a link in one of the comments to this paper <https://genomebiology.biomedcentral.com/articles/10.1186/s13059-016-1044-7>, which reports on the worryingly high proportion of genetics research publications where gene names like “SEPT2” and “MARCH1” have been auto-converted by Excel to ... guess what data type it thought they were ...

1 0

How Four Microsoft Engineers Proved That The “Darknet” Would Defeat DRM
by Lawrence D'Oliveiro 24 Nov '17

24 Nov '17

A rerun of an article published five years ago, about a (in)famous paper from 2002 <https://arstechnica.com/tech-policy/2017/11/how-four-microsoft-engineers-pr…>: By itself, the paper's clever and provocative argument likely would have earned it a broad readership. But the really remarkable thing about the paper is who wrote it: four engineers at Microsoft whose work many expected to be at the foundation of Microsoft's future DRM schemes. The paper's lead author told Ars that the paper's pessimistic view of Hollywood's beloved copy protection schemes almost got him fired. But ten years later [2012], its predictions have proved impressively accurate. ... While Biddle and his colleagues didn't succeed in allaying the fears of Palladium's critics, the paper's central arguments have held up well. The authors predicted that the emergence of the darknet would produce a technological and legal arms race. They thought content companies and law enforcement would attack those aspects of the darknet that were most centralized, but that the darknet would adapt through greater decentralization. And they predicted that efforts to build secure DRM schemes would continue to fail. All of their predictions have continued to hold true over the last decade. And still continue to hold true.

1 0

quote on slashdot today
by Peter Reutemann 23 Nov '17

23 Nov '17

"The number of UNIX installations has grown to 10, with more expected. -- The Unix Programmer's Manual, 2nd Edition, June 1972" (found at the bottom of https://slashdot.org/) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Firefox Will Warn Users When Visiting Sites That Suffered a Data Breach
by Peter Reutemann 23 Nov '17

23 Nov '17

'Mozilla engineers are working on a notifications system for Firefox that shows a security warning to users visiting sites that have suffered data breaches. The notifications system will use data provided by Have I Been Pwned?, a website that indexes public data breaches and allows users to search and see if their details have been compromised in any of these incidents. Work on this project has only recently started. The code to show these warnings is not even in the Firefox codebase but managed separately as an add-on available (on GitHub). The alert also includes an input field. In the add-ons current version this field doesn't do anything, but we presume it's there to allow users to search and see if their data was exposed during that site's security breach. Troy Hunt, Have I Been Pwned's author has confirmed his official collaboration with Mozilla on this feature.' -- source: https://news.slashdot.org/story/17/11/23/1451219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Skype for Linux. V4.3 replaced with V8.10
by Ian Stewart 23 Nov '17

23 Nov '17

Skype for Linux has been at V4.3 for quite some time (years?). This version has now gone end-of-life and Microsoft replaced it with Skype for Linux V8.10.0.4 on 8 November 2017. If you start Skype for Linux V4.3 it will launch the login screen. Upon entering your account and password details Skype will crash. You will not be the only one to have struck this feature and you can read about this here<https://askubuntu.com/questions/975804/skype-crashes-after-logging-in>. For an announcement on Skype for Linux from Microsoft and public discussion go here<https://answers.microsoft.com/en-us/skype/forum/skype_linux-skype_startms-s…> I used synaptic packet manager to remove my Skype 4.3. I then downloaded Skype V8.10 from here<https://www.skype.com/en/get-skype/> for my Ubuntu 16.04 laptop. The file downloaded was skypeforlinux-64.deb at 63.9MB. Double clicking on the file auto-launched its installation. I found that my preferred settings had changed so you may want to spend some time going through them and setting them as desired. >From the public discussion<https://answers.microsoft.com/en-us/skype/forum/skype_linux-skype_startms-s…> on this new version the 4th person to post a reply states... "with lots of improvements" Really? No more search in history. No more normal application settings. No more support of x32 processors. Enjoy the "improvements". cheers, Ian.

4 3

How a Wi-Fi Pineapple Can Steal Your Data (And How To Protect Yourself From It)
by Peter Reutemann 23 Nov '17

23 Nov '17

'The Wi-Fi Pineapple is a cheap modified wireless router enables anyone to execute sophisticated exploits on Wi-Fi networks with little to no networking expertise. A report in Motherboard explains how it can be used to run a Wall of Sheep and execute a man-in-the-middle attack, as well as how you can protect yourself from Pineapple exploits when you're connected to public Wi-Fi. "... it's important that whenever you are done connecting to a public Wi-Fi network that you configure your phone or computer to 'forget' that network. This way your device won't be constantly broadcasting the SSIDs of networks it has connected to in the past, which can be spoofed by an attacker with a Pineapple," reports Motherboard. "Unfortunately there is no easy way to do this on an Android or an iPhone, and each network must be forgotten manually in the 'Manage Network' tab of the phone's settings. Another simple solution is to turn off your Wi-Fi functionality when you're not using it -- though that isn't as easy to do on some devices anymore -- and don't allow your device to connect to automatically connect to open Wi-Fi net' -- source: https://yro.slashdot.org/story/17/11/21/2255254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

4 4

Bye-Bye man(1) Easter Egg
by Lawrence D'Oliveiro 22 Nov '17

22 Nov '17

Never came across this, but if you type the command “man” at 00:30 (local time?), it would output “gimme gimme gimme”. That easter egg is now gone. <http://www.theregister.co.uk/2017/11/22/gimme_gimme_gimme_in_linux_breaks_a…>

1 0

The McLaren Formula 1 Team Just Hired The World’s Fastest Gamer
by Lawrence D'Oliveiro 22 Nov '17

22 Nov '17

Hiring an eSports champion to do simulation testing, even before you build a real racecar: ... make no mistake, simulator driver is a proper job in the modern F1 team. For the last few years the sport has heavily restricted real in-season testing of the cars, so there has been greater and greater emphasis put on driver-in-the-loop virtual testing. <https://arstechnica.com/cars/2017/11/the-mclaren-formula-1-team-just-hired-…>

1 0

PC vendors scramble as Intel announces vulnerability in firmware
by Peter Reutemann 22 Nov '17

22 Nov '17

'Intel has issued a security alert that management firmware on a number of recent PC, server, and Internet-of-Things processor platforms is vulnerable to remote attack. Using the vulnerabilities, the most severe of which was uncovered by Mark Ermolov and Maxim Goryachy of Positive Technologies Research, remote attackers could launch commands on a host of Intel-based computers, including laptops and desktops shipped with Intel Core processors since 2015. They could gain access to privileged system information, and millions of computers could essentially be taken over as a result of the bug.' -- source: https://arstechnica.com/information-technology/2017/11/intel-warns-of-wides… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google collects Android users’ locations even when location services are disabled
by Peter Reutemann 21 Nov '17

21 Nov '17

'Many people realize that smartphones track their locations. But what if you actively turn off location services, haven’t used any apps, and haven’t even inserted a carrier SIM card? Even if you take all of those precautions, phones running Android software gather data about your location and send it back to Google when they’re connected to the internet, a Quartz investigation has revealed. Since the beginning of 2017, Android phones have been collecting the addresses of nearby cellular towers—even when location services are disabled—and sending that data back to Google. The result is that Google, the unit of Alphabet behind Android, has access to data about individuals’ locations and their movements that go far beyond a reasonable consumer expectation of privacy.' -- source: https://qz.com/1131515/google-collects-android-users-locations-even-when-lo… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

No, you’re not being paranoid. Sites really are watching your every move
by Peter Reutemann 20 Nov '17

20 Nov '17

'If you have the uncomfortable sense someone is looking over your shoulder as you surf the Web, you're not being paranoid. A new study finds hundreds of sites—including microsoft.com, adobe.com, and godaddy.com—employ scripts that record visitors' keystrokes, mouse movements, and scrolling behavior in real time, even before the input is submitted or is later deleted. Session replay scripts are provided by third-party analytics services that are designed to help site operators better understand how visitors interact with their Web properties and identify specific pages that are confusing or broken. As their name implies, the scripts allow the operators to re-enact individual browsing sessions. Each click, input, and scroll can be recorded and later played back. A study published last week reported that 482 of the 50,000 most trafficked websites employ such scripts, usually with no clear disclosure. It's not always easy to detect sites that employ such scripts. The actual number is almost certainly much higher, particularly among sites outside the top 50,000 that were studied.' -- source: https://arstechnica.com/tech-policy/2017/11/an-alarming-number-of-sites-emp… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Technology groups and dealing with predators
by Bryce Utting 20 Nov '17

20 Nov '17

The Verge has a detailed (read: graphic) report of predatory behaviour from ex-Auckland security expert Morgan Marquis-Boire, late of Google and the Citizen Lab of the University of Toronto, with connections to the Freedom of the Press Foundation, the EFF, and presumably others. Content warning for sexual assault issues: https://www.theverge.com/2017/11/19/16675704/morgan-marquis-boire-hacker-se… I can only commend those who have come forward, and also Ron Deibert of Citizen Lab for his well-aimed response. Without opening old wounds, I'd suggest that the Citizen Lab code of conduct might be useful food for thought where public WLUG events are involved. (unless a code of conduct already exists and I missed it?) A separate incorporated society I'm involved in has had to deal with complaints of a predator at an event, and a similar document could have done wonders for laying out how to appropriately evaluate and respond in the absence of a police complaint.The Harvey Weinstein disclosures are making clear how endemic this behaviour is, and how rare appropriate responses are. butting

4 3

Intel Planning To End Legacy BIOS Support By 2020, Report Says
by Peter Reutemann 20 Nov '17

20 Nov '17

'Intel is planning to end "legacy BIOS" support in their new platforms by 2020 in requiring UEFI Class 3 or higher. Making rounds this weekend is a slide deck from the recent UEFI Plugfest. Brian Richardson of Intel talked about the "last mile" barriers to removing legacy BIOS support from systems. By 2020, they will be supporting no less than UEFI Class 3, which means only UEFI support and no more legacy BIOS or CSM compatibility support mode. But that's not going to force on UEFI Secure Boot unconditionally: Secure Boot enabled is considered UEFI Class 3+. Intel hasn't removed legacy BIOS / CSM support yet due to many customers' software packages still relying upon legacy BIOS, among other reasons. Removing the legacy BIOS support will mitigate some security risks, needs less validation by vendors, allows for supporting more modern technologies, etc.' -- source: https://tech.slashdot.org/story/17/11/20/1251249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Another Tor Browser Feature Makes It Into Firefox: First-Party Isolation
by Peter Reutemann 20 Nov '17

20 Nov '17

'Unbeknown to most users, Mozilla added a privacy-enhancing feature to the Firefox browser over the summer that can help users block online advertisers from tracking them across the Internet. The feature is named First-Party Isolation (FPI) and was silently added to the Firefox browser in August, with the release of Firefox 55. FPI works by separating cookies on a per-domain basis. This is important because most online advertisers drop a cookie on the user's computer for each site the user visits and the advertisers loads an ad. With FPI enabled, the ad tracker won't be able to see all the cookies it dropped on that user's PC, but only the cookie created for the domain the user is currently viewing. This will force the ad tracker to create a new user profile for each site the user visits and the advertiser won't be able to aggregate these cookies and the user's browsing history into one big fat profile. This feature was first implemented in the Tor Browser, a privacy-focused fork of the Firefox browser managed by the Tor Project, where it is known as Cross-Origin Identifier Unlinkability. FPI was added to Firefox as part of the Tor Uplift project, an initiative to bolster the Firefox codebase with some of the Tor Browser's unique privacy-focused features. The feature is not enabled by default. Information on how to enable it is in the linked article.' -- source: https://news.slashdot.org/story/17/11/20/1713235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bluetooth Hack Affects 20 Million Amazon Echo, Google Home Devices
by Peter Reutemann 17 Nov '17

17 Nov '17

'In September, security researchers discovered eight vulnerabilities -- codenamed collectively as BlueBorne -- in the Bluetooth implementations used by over 5.3 billion devices. We have now learned that an estimated 20 million Amazon Echo and Google Home devices are also vulnerable to attacks leveraging the BlueBorne vulnerabilities. The Hacker News reports: Amazon Echo is affected by the following two vulnerabilities: a remote code execution vulnerability in the Linux kernel (CVE-2017-1000251); and an information disclosure flaw in the SDP server (CVE-2017-1000250). Since different Echo's variants use different operating systems, other Echo devices are affected by either the vulnerabilities found in Linux or Android. Whereas, Google Home devices are affected by one vulnerability: information disclosure vulnerability in Android's Bluetooth stack (CVE-2017-0785). This Android flaw can also be exploited to cause a denial-of-service (DoS) condition. Since Bluetooth cannot be disabled on either of the voice-activated personal assistants, attackers within the range of the affected device can easily launch an attack. The security firm [Armis, who disclosed the issue] notified both Amazon and Google about its findings, and both companies have released patches and issued automatic updates for the Amazon Echo and Google Home that fixes the BlueBorne attacks. ' -- source: https://it.slashdot.org/story/17/11/17/0037251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Online Banking Security
by Lawrence D'Oliveiro 17 Nov '17

17 Nov '17

Here <http://www.theregister.co.uk/2017/11/03/uk_bank_security_audit/> are the results of an audit on UK banks to check their adherence to various established security practices: * HTTP Strict Transport Security <https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security> * Security Headers <https://securityheaders.io/> * Content Security Policy <https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP> * avoidance of weak and obsolete encryption (e.g. RC4) The result: a real mixed bag. Has anyone done a similar thing for our banks?

3 3

Belgium: Skype Is Officially A Telco, Must Comply With Interception Warrants
by Lawrence D'Oliveiro 17 Nov '17

17 Nov '17

Skype has failed in its appeal against a 2016 fine in Belgium for failing to help authorities tap calls in a criminal investigation, with the court saying it must comply with the country's telecommunications laws. <http://www.theregister.co.uk/2017/11/16/skypes_belgian_appeal_fails/>

1 0

Re: [wlug] Scam -- A Service To Scam The Scammers
by Lawrence D'Oliveiro 16 Nov '17

16 Nov '17

When you get a scam e-mail, how about forwarding it to the Re:Scam service <https://www.techdirt.com/articles/20171113/02094138603/great-use-artificial…>. This activates an AI that will engage in long, fruitless conversations with the scammers--basically waste their time. And it’s run by Netsafe, here in New Zealand.

4 7

Will Propaganda Eat Itself?
by Lawrence D'Oliveiro 15 Nov '17

15 Nov '17

Just the latest <https://arstechnica.com/gaming/2017/11/russian-military-cites-game-screensh…> in an ever-growing line of incidents where various Governments and Press agencies mistakenly cite video-game footage as “proof” of nefarious activities by their opponents, and end up with egg on their faces as a result. Part of the trouble seems to be that such images tend to rank very highly in Google searches. But that shouldn’t be much of an obstacle for *proper* researchers, right? ;)

1 0

oldest usable Android version -- any opinions?
by Ian Young 15 Nov '17

15 Nov '17

Apologies for straying off topic. I need to get an Android phone to replace an ancient Sony-E, but hanker somewhat for the days of removable batteries, and like a stylus. This points afaict to an older Samsung Note model but then comes the problem of obsolete versions of Android. Can anyone suggest what is the oldest Android that can still be used on the web of today? Or perhaps there is a current phone with removable battery? ~ Ian Y

2 1

OnePlus Phones Come Preinstalled With a Factory App That Can Root Devices
by Peter Reutemann 14 Nov '17

14 Nov '17

'Some OnePlus devices, if not all, come preinstalled with an application named EngineerMode that can be used to root the device and may be converted into a fully-fledged backdoor by clever attackers. The app was discovered by a mobile security researcher who goes online by the pseudonym of Elliot Alderson -- the name of the main character in the Mr. Robot TV series. Speaking to Bleeping Computer, the researcher said he started investigating OnePlus devices after a story he saw online last month detailing a hidden stream of telemetry data sent by OnePlus devices to the company's servers.' -- source: https://yro.slashdot.org/story/17/11/14/140250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fedora 27 Released
by Peter Reutemann 14 Nov '17

14 Nov '17

'The Fedora Project has announced the general availability of Fedora 27 Workstation and Fedora 27 Atomic editions. Fedora 27 brings with it "thousands of improvements" from both the Fedora Community and various upstream software projects, the team said on Tuesday. From a post on Fedora Magazine: The Workstation edition of Fedora 27 features GNOME 3.26. In the new release, both the Display and Network configuration panels have been updated, along with the overall Settings panel appearance improvement. The system search now shows more results at once, including the system actions. GNOME 3.26 also features color emoji support, folder sharing in Boxes, and numerous improvements in the Builder IDE tool. The new release also features LibreOffice ' -- source: https://linux.slashdot.org/story/17/11/14/1552228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Consumer Advice Magazine Considers Device Security
by Lawrence D'Oliveiro 14 Nov '17

14 Nov '17

Nice to see that considerations about the (in)security of these IoT devices have penetrated at least some way into the popular consciousness <http://www.theregister.co.uk/2017/11/14/bluetooth_toys_easily_hackable_says…>. Though the vendor responses are looking pretty predictable: it would be really hard to take advantage of such weaknesses in a realistic situation bla bla bla.

1 0

A History Of The Amiga, Part 11
by Lawrence D'Oliveiro 14 Nov '17

14 Nov '17

<https://arstechnica.com/gaming/2017/11/a-history-of-the-amiga-part-11-betwe…>: Then came an announcement that caused an uproar in the Amiga community; some even saw it as a betrayal. Jim Collas’ team revealed that it was switching the OS kernel for Amiga OE from QNX to Linux. ... In retrospect, this was probably the correct choice. Linux, then and now, supported a much more diverse array of hardware and was already gaining significant momentum in the tech industry. But Amiga fans didn’t see it that way at the time. They saw Linux as bloated, clunky, and slow, the exact opposite of their beloved Amiga. QNX Neutrino was seen as fast, small, and elegant, and the community had rallied behind it. This takes place in 1999. I did spend some time with Amiga fans about a decade earlier. Being a Mac fan at the time, I saw it as a bad move to tie to OS architecture so closely to particular quirks of the hardware. And sure enough, that did cause compatibility problems for Amiga software on later hardware.

1 0

Linux 4.14 Has Been Released
by Peter Reutemann 12 Nov '17

12 Nov '17

'Linux 4.14 has been released. This release adds support for bigger memory limits in x86 hardware (128PiB of virtual address space, 4PiB of physical address space); support for AMD Secure Memory Encryption; a new unwinder that provides better kernel traces and a smaller kernel size; support for the zstd compression algorithm has been added to Btrfs and Squashfs; support for zero-copy of data from user memory to sockets; support for Heterogeneous Memory Management that will be needed in future GPUs; better cpufreq behaviour in some corner cases; faster TBL flushing by using the PCID instruction; asynchronous non-blocking buffered reads; and many new drivers and other improvements. Phoronix has more on the changes in Linux 4.14 -- and notes that its codename is still "Fearless Coyote."' -- source: https://linux.slashdot.org/story/17/11/12/219238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How to Install Firefox Quantum in Ubuntu Right Now
by Peter Reutemann 12 Nov '17

12 Nov '17

'The upcoming version of Mozilla’s web browser Firefox is called Quantum because it’s blazing fast. It has been coded in Rust instead of the usual C++ and it is the first web browser to utilize the power of a multi-core processor. There has been lots of buzz around Quantum release. It is touted as a game-changing release that will help Firefox gain its lost userbase to Google Chrome. Ideally, Firefox Quantum should be released this month. But since I wanted to test it, I thought of installing it before its official release.' -- source: https://itsfoss.com/firefox-quantum-ubuntu/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Private Browsing Google Trouble
by Lawrence D'Oliveiro 12 Nov '17

12 Nov '17

Just tried to open a few Private Browsing sessions to do searches in Google in Firefox. Previously this has worked fine. But currently the connections are taking forever to complete. Explicitly connecting to google.com (instead of typing directly in the search box) has the same problem. Doing one of the same searches in a non-private tab worked fine. To compare, I connected to bing.com in a private tab, and did another of the searches there. Again, it worked fine.

2 5

Saw This In An Ad Frame On The Herald Site (Long Traceback!)
by Lawrence D'Oliveiro 12 Nov '17

12 Nov '17

A little bit earlier this afternoon, while browsing nzherald.co.nz, The following popped up in a frame headed “Advertisement”: (Warning: long traceback ahead). I thought I would post it all, because it has some interesting info in it, such as all the method names beginning with “AdTrek”. And references to a particular user’s “Telepathy Client Repos”? ---- Server Error in '/' Application. The wait operation timed out Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code. Exception Details: System.ComponentModel.Win32Exception: The wait operation timed out Source Error: An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below. Stack Trace: [Win32Exception (0x80004005): The wait operation timed out] [SqlException (0x80131904): Timeout expired. The timeout period elapsed prior to completion of the operation or the server is not responding.] System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection, Action`1 wrapCloseInAction) +3279580 System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj, Boolean callerHasConnectionLock, Boolean asyncClose) +791 System.Data.SqlClient.TdsParser.TryRun(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj, Boolean& dataReady) +4927 System.Data.SqlClient.SqlCommand.FinishExecuteReader(SqlDataReader ds, RunBehavior runBehavior, String resetOptionsString) +442 System.Data.SqlClient.SqlCommand.RunExecuteReaderTds(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, Boolean async, Int32 timeout, Task& task, Boolean asyncWrite, SqlDataReader ds, Boolean describeParameterEncryptionRequest) +3114 System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, String method, TaskCompletionSource`1 completion, Int32 timeout, Task& task, Boolean asyncWrite) +554 System.Data.SqlClient.SqlCommand.InternalExecuteNonQuery(TaskCompletionSource`1 completion, String methodName, Boolean sendToPipe, Int32 timeout, Boolean asyncWrite) +475 System.Data.SqlClient.SqlCommand.ExecuteNonQuery() +386 System.Data.Linq.SqlClient.SqlProvider.Execute(Expression query, QueryInfo queryInfo, IObjectReaderFactory factory, Object[] parentArgs, Object[] userArgs, ICompiledSubQuery[] subQueries, Object lastResult) +457 System.Data.Linq.SqlClient.SqlProvider.ExecuteAll(Expression query, QueryInfo[] queryInfos, IObjectReaderFactory factory, Object[] userArguments, ICompiledSubQuery[] subQueries) +213 System.Data.Linq.SqlClient.SqlProvider.System.Data.Linq.Provider.IProvider.Execute(Expression query) +421 System.Data.Linq.StandardChangeDirector.DynamicInsert(TrackedObject item) +101 System.Data.Linq.ChangeProcessor.SubmitChanges(ConflictMode failureMode) +435 System.Data.Linq.DataContext.SubmitChanges(ConflictMode failureMode) +666 AdTrek.Models.AdServerRepository.saveAdEvent(AdEvent adEvent) in C:\Users\Scott\Documents\Telepathy Client Repos\ElectricArt\AdTrek\AdTrek\Models\Data\Repositories\AdServerRepository.cs:743 AdTrek.Controllers.AdServerController.fillModel(AdViewModel model, Boolean loadScriptSrc) in C:\Users\Scott\Documents\Telepathy Client Repos\ElectricArt\AdTrek\AdTrek\Controllers\AdServerController.cs:148 AdTrek.Controllers.AdServerController.Frame(AdViewModel model) in C:\Users\Scott\Documents\Telepathy Client Repos\ElectricArt\AdTrek\AdTrek\Controllers\AdServerController.cs:18 lambda_method(Closure , ControllerBase , Object[] ) +139 System.Web.Mvc.ReflectedActionDescriptor.Execute(ControllerContext controllerContext, IDictionary`2 parameters) +229 System.Web.Mvc.ControllerActionInvoker.InvokeActionMethod(ControllerContext controllerContext, ActionDescriptor actionDescriptor, IDictionary`2 parameters) +35 System.Web.Mvc.Async.AsyncControllerActionInvoker.<BeginInvokeSynchronousActionMethod>b__39(IAsyncResult asyncResult, ActionInvocation innerInvokeState) +39 System.Web.Mvc.Async.WrappedAsyncResult`2.CallEndDelegate(IAsyncResult asyncResult) +67 System.Web.Mvc.Async.AsyncControllerActionInvoker.EndInvokeActionMethod(IAsyncResult asyncResult) +42 System.Web.Mvc.Async.AsyncInvocationWithFilters.<InvokeActionMethodFilterAsynchronouslyRecursive>b__3d() +72 System.Web.Mvc.Async.<>c__DisplayClass46.<InvokeActionMethodFilterAsynchronouslyRecursive>b__3f() +386 System.Web.Mvc.Async.AsyncControllerActionInvoker.EndInvokeActionMethodWithFilters(IAsyncResult asyncResult) +42 System.Web.Mvc.Async.<>c__DisplayClass2b.<BeginInvokeAction>b__1c() +38 System.Web.Mvc.Async.<>c__DisplayClass21.<BeginInvokeAction>b__1e(IAsyncResult asyncResult) +186 System.Web.Mvc.Async.AsyncControllerActionInvoker.EndInvokeAction(IAsyncResult asyncResult) +38 System.Web.Mvc.Controller.<BeginExecuteCore>b__1d(IAsyncResult asyncResult, ExecuteCoreState innerState) +29 System.Web.Mvc.Async.WrappedAsyncVoid`1.CallEndDelegate(IAsyncResult asyncResult) +65 System.Web.Mvc.Controller.EndExecuteCore(IAsyncResult asyncResult) +53 System.Web.Mvc.Async.WrappedAsyncVoid`1.CallEndDelegate(IAsyncResult asyncResult) +36 System.Web.Mvc.Controller.EndExecute(IAsyncResult asyncResult) +38 System.Web.Mvc.MvcHandler.<BeginProcessRequest>b__5(IAsyncResult asyncResult, ProcessRequestState innerState) +44 System.Web.Mvc.Async.WrappedAsyncVoid`1.CallEndDelegate(IAsyncResult asyncResult) +65 System.Web.Mvc.MvcHandler.EndProcessRequest(IAsyncResult asyncResult) +38 System.Web.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +399 System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +137 Version Information: Microsoft .NET Framework Version:4.0.30319; ASP.NET Version:4.6.1069.1

1 0

New To Me: Game Asset Rippers
by Lawrence D'Oliveiro 12 Nov '17

12 Nov '17

While browsing around DeviantArt (as you do), I discovered this group <https://xnalaramodelandtuts.deviantart.com/>. The name “XNALara” comes from an open-source Windows program that let you create your own scenes and poses with assets (characters, props, scenery) from the “Tomb Raider: Underworld” game. (I think it has broadened its reach beyond that one game by now.) All very well, but how do you extract those assets from these games? Turns out there are these tools called “rippers”, which capture the OpenGL/DirectX drawing calls that the game makes and save all the geometry and textures and so on that are passed to those calls. (Did somebody say “copyright violation”?) Well, there are folders in that group that are absolutely full of these extracted assets. Some have been taken down on demand from the copyright owners, but the remarkable thing is that most of them are still available, and have been so for some years. And that the accounts of those uploading these collections have not been suspended. I tried loading one or two of them into Blender. There’s a range of formats, but one common combination is .obj+.mtl for the geometry and material definitions, and .dds for the texture images. The latter can be converted to PNG with ImageMagick and, after making corresponding edits to the references in the .mtl file, I was able to import the results and see something resembling the preview images. There have been artists on DeviantArt who have used these in their renders (and mentioned as much--that’s how I found out about them). I may try messing around with them a bit more, but I don’t think I’ll be publishing any such work...

1 0

The Power Of Non-Mainstream Media
by Lawrence D'Oliveiro 11 Nov '17

11 Nov '17

<https://arstechnica.com/science/2017/11/unusual-experiment-reveals-the-powe…>: Pundits and activists have long blamed the "mainstream media" for having an outsized effect on public perceptions. ... But a new long-term study reveals that small media outlets have a far greater effect on public discussions than anyone realized. To be more precise, it only takes three or more stories from small news outlets covering the same topic to make discussions of that topic go up by 62.7 percent on Twitter.

1 0

3D Metal Printing At 100 Times The Speed And A Twentieth Of The Cost
by Lawrence D'Oliveiro 10 Nov '17

10 Nov '17

3D printing has mainly been confined to parts made out of various kinds of plastics up till now. Metal has been hard to deal with, because at some point you have to melt it, and that requires temperatures higher than any printing-type device could cope with. Now a company called “Desktop Metal” <http://www.theregister.co.uk/2017/11/10/metal_3d_printing_at_desktop_metal/> has come up with a scheme involving binding layers of metal powder, laid down in the right shape, using a temporary compound which is then removed when the part is melted in a furnace so it becomes a proper solid piece. Obviously this has to be done without losing its shape. The process can also do clever things like make a hinge, where there is no metal between the parts, so once the binding compound is removed, you have two solid parts that can freely rotate without falling apart.

1 0

How Antivirus Can Open You To Attacks That Otherwise Wouldn’t Be Possible
by Lawrence D'Oliveiro 10 Nov '17

10 Nov '17

From <https://arstechnica.com/information-technology/2017/11/how-av-can-open-you-…>: Antivirus programs, in many cases, make us safer on the Internet. Other times, they open us to attacks that otherwise wouldn't be possible. On Friday, a researcher documented an example of the latter—a vulnerability he found in about a dozen name-brand AV programs that allows attackers who already have a toehold on a targeted computer to gain complete system control.

1 0

Google Patches KRACK WiFi Flaw in Android November Security Update
by Peter Reutemann 10 Nov '17

10 Nov '17

'Some vendors take longer than others to update for critical vulnerabilities - case in point is Google's Android mobile operating system. On Nov. 6, Google released an Android update patching a vulnerability that IT vendors have known about for months. On Oct. 16, security researcher Mathy Vanhoef working at Belgian University KU Leuven publicly disclosed the KRACK WiFi vulnerability that impacted all WiFi devices that use WPA2 encryption, including every Android device ever built.' -- source: https://www.esecurityplanet.com/mobile-security/google-patches-krack-wifi-f… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Samsung Demos Linux Desktop on Its Galaxy Smartphones
by Lawrence D'Oliveiro 10 Nov '17

10 Nov '17

“Concept Demo”, it says, running Ubuntu <http://www.theregister.co.uk/2017/11/10/linux_on_galaxy_video_demo/>.

1 0

Intel To Ship Processors With Integrated AMD Graphics And Memory
by Lawrence D'Oliveiro 09 Nov '17

09 Nov '17

Intel’s gen-8 H-series mobile processors will integrate an AMD Radeon GPU <https://arstechnica.com/gadgets/2017/11/intel-will-ship-processors-with-int…>.

3 4

MINIX: Intel's Hidden In-chip Operating System
by Peter Reutemann 09 Nov '17

09 Nov '17

'Matthew Garrett, the well-known Linux and security developer who works for Google, explained recently that, "Intel chipsets for some years have included a Management Engine [ME], a small microprocessor that runs independently of the main CPU and operating system. Various pieces of software run on the ME, ranging from code to handle media DRM to an implementation of a TPM. AMT [Active Management Technology] is another piece of software running on the ME." [...] At a presentation at Embedded Linux Conference Europe, Ronald Minnich, a Google software engineer reported that systems using Intel chips that have AMT, are running MINIX. So, what's it doing in Intel chips? A lot. These processors are running a closed-source variation of the open-source MINIX 3. We don't know exactly what version or how it's been modified since we don't have the source code. In addition, thanks to Minnich and his fellow researchers' work, MINIX is running on three separate x86 cores on modern chips. There, it's running: TCP/IP networking stacks (4 and 6), file systems, drivers (disk, net, USB, mouse), web servers. MINIX also has access to your passwords. It can also reimage your computer's firmware even if it's powered off. Let me repeat that. If your computer is "off" but still plugged in, MINIX can still potentially change your computer's fundamental settings. And, for even more fun, it "can implement self-modifying code that can persist across power cycles." So, if an exploit happens here, even if you unplug your server in one last desperate attempt to save it, the attack will still be there waiting for you when you plug it back in. How? MINIX can do all this because it runs at a fundamentally lower level. [...] According to Minnich, "there are big giant holes that people can drive exploits through." He continued, "Are you scared yet? If you're not scared yet, maybe I didn't explain it very well, because I sure am scared." Also read: Andrew S. Tanenbaum's (a professor of Computer Science at Vrije Universiteit) open letter to Intel' -- source: https://tech.slashdot.org/story/17/11/07/1041236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

How to Install Cacti with Cacti-Spine in Debian and Ubuntu
by Peter Reutemann 09 Nov '17

09 Nov '17

'In this tutorial we’ll learn how to install and configure Cacti network monitoring tool in the latest version of Debian and Ubuntu 16.04 LTS. Cacti will be build and installed from source files during this guide. Cacti is an open source monitoring tool created for monitoring networks, especially network devices, such as switches, routers, servers via SNMP protocol. Cacti interacts with end-users and can be administered via a web tool interface.' -- source: https://www.tecmint.com/install-cacti-with-cacti-spine-in-debian-and-ubuntu/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ubuntu.com down?
by Peter Reutemann 09 Nov '17

09 Nov '17

Tried to go to Ubuntu's homepage and was greeted with a 503 error message (see attachment)... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

Bruce Schneier On The Equifax Breach
by Lawrence D'Oliveiro 08 Nov '17

08 Nov '17

Security expert Bruce Schneier has published <https://www.schneier.com/blog/archives/2017/11/me_on_the_equif.html> the testimony he gave to the US House Energy and Commerce Committee on the breach of confidential personal information on close to half the entire population of the US. His main points are worth summarizing: 1. The Equifax breach was a serious security breach that puts millions of Americans at risk. 2. Equifax was solely at fault. 3. There are thousands of data brokers with similarly intimate information, similarly at risk. 4. These data brokers deliberately hide their actions, and make it difficult for consumers to learn about or control their data. 5. The existing regulatory structure is inadequate. 6. The market cannot fix this because we are not the customers of data brokers. 7. We need effective regulation of data brokers. 8. Resist complaints from the industry that this is "too hard." 9. This has foreign trade implications. 10. This has national security implications. 11. We need to do something about it. Read the article for more detail. I would say this is more than a US-specific problem, it is a worldwide problem. Other places may have stricter privacy regulations, but that might not be enough.

1 0

Linux Has a USB Driver Security Problem
by Peter Reutemann 08 Nov '17

08 Nov '17

'USB drivers included in the Linux kernel are rife with security flaws that in some cases can be exploited to run untrusted code and take over users' computers. The vast majority of these vulnerabilities came to light on Monday, when Google security expert Andrey Konovalov informed the Linux community of 14 vulnerabilities he found in the Linux kernel USB subsystem. "All of them can be triggered with a crafted malicious USB device in case an attacker has physical access to the machine," Konovalov said. The 14 flaws are actually part of a larger list of 79 flaws Konovalov found in Linux kernel USB drivers during the past months. Not all of these 79 vulnerabilities have been reported, let alone patched. Most are simple DoS (Denial of Service) bugs that freeze or restart the OS, but some allow attackers to elevate privileges and execute malicious code.' -- source: https://linux.slashdot.org/story/17/11/08/1730210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Create & manage docker hosts with Docker Machine on VirtualBox
by Peter Reutemann 08 Nov '17

08 Nov '17

'Docker Machine is a tool that let us install Docker Engine on virtual hosts on various platforms, on local environment as well on cloud. With Docker Machine, we can easily install docker hosts a Windows machine, a MAC machine or on cloud platform like AWS, AZURE etc. As we know that Docker Engine runs natively on Linux machines, so its pretty easy to get Docker working on Linux machines but for other OS like MAC or Windows this was a problem. So Docker Machine was introduced, especially for older versions of MAC & Windows (there are new native Docker apps for latest OS). Not meant only for Windows or MAC, Docker machine also provides efficient way to provision multiple Docker hosts on local as well as cloud network. To manage the docker hosts, we use rather than using ‘docker’ command, which is used with docker engine. In this tutorial, we will discuss how we can create & manage docker hosts with Docker Machine on VirtualBox.' -- source: http://linuxtechlab.com/create-manage-docker-hosts-with-docker-machine/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apache OpenOffice: We're OK With Not Being Super Cool
by Peter Reutemann 08 Nov '17

08 Nov '17

'Despite being the subject of a deathwatch -- perhaps mainly by fans of rival LibreOffice -- AOO appears to be rather popular, with the 4.1.4 update racking up at least 1.6 million downloads. [...] While AOO and the ASF formulate a formal statement of direction for the project, Jagielski said more or less that all's well. "AOO is not, and isn't designed to be, the 'super coolest open source office suite with all the latest bells and whistles,'" Jagielski continued. "Our research shows that a 'basic,' functional office suite, which is streamlined with a 'simple' and uncluttered, uncomplicated UI, serves an incredible under-represented community. "Other office suites are focusing on the 'power user' which is a valuable market, for sure, but the real power and range for an open-source office suite alternative is the vast majority which is the 'rest of us. Sometimes we all forget how empowering open source is to the entire world."' -- source: https://news.slashdot.org/story/17/11/07/1944255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0