- wlug - list.wlug.org.nz

Easy guide to secure VNC server with TLS encryption
by Peter Reutemann 05 Nov '17

05 Nov '17

'In this tutorial, we will learn to install VNC server & secure VNC server sessions with TLS encryption. This method has been tested on CentOS 6 & 7 but should work on other versions/OS as well (RHEL, Scientific Linux etc).' -- source: http://linuxtechlab.com/secure-vnc-server-tls-encryption/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

TorMoil Vulnerability Leaks Real IP Address From Tor Browser Users; Security Update Released
by Peter Reutemann 04 Nov '17

04 Nov '17

'The Tor Project has released a security update for the Tor Browser on Mac and Linux to fix a vulnerability that leaks users' real IP addresses. The vulnerability was spotted by Filippo Cavallarin, CEO of We Are Segment, an Italian company specialized in cyber-security and ethical hacking. Cavallarin privately reported the issue -- which he codenamed TorMoil -- to the Tor Project last week. Tor Project developers worked with the Firefox team (Tor Browser is based on the Firefox browser) to release a fix. Today, the Tor team released version 7.0.9 to address the vulnerability. Tor Browser 7.0.9 is only available for Mac and Linux users. Tor Browser on Windows is not affected.' -- source: https://it.slashdot.org/story/17/11/03/2127235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Lots Of Digitally-Signed Malware Out There
by Lawrence D'Oliveiro 03 Nov '17

03 Nov '17

One of the security weaknesses exploited by the “Stuxnet” worm that sabotaged Iran’s nuclear enrichment program was that it had a valid digital signature from a recognized issuer of certificates for Windows software. Of course, the issuer would never knowingly have validated a piece of malware, but the certificate had been compromised so it could be used without their permission. Turns out this sort of thing is not only quite common, there is a further problem in that anti-malware software, which is supposed to pick up revoked certificates and reject signatures that use them, frequently has bugs in their implementation of the signature-checking protocol, so they can let these bad signatures through. <https://arstechnica.com/information-technology/2017/11/evasive-code-signed-…>

1 0

The Patent That Just Wouldn’t Die
by Lawrence D'Oliveiro 03 Nov '17

03 Nov '17

A holding company called Personal Audio claims to have a patent covering the entire idea of podcasting. Over the years, it has succeeded in winning some lucrative payouts, including $8 million from Apple and $1.3 million from CBS. All without making a single item of product itself. In other words, Personal Audio is what lawyers politely refer to as a “Non-Practising Entity” (NPE), or, in more common parlance, a patent troll. However, the Electronic Frontier Foundation has succeeded, with the help of a crowdfunding campaign, in invalidating this patent, using a system introduced at the USPTO called “inter partes review” (IPR). Of course, Personal Audio has not taken this lying down. It has come up with a truly imaginative series of legal counterarguments: * IPR violates the 7th Amendment of the US Constitution (right to trial by jury in a lawsuit). * IPR encourages “collective efforts to invalidate patents” which “severely tilts the playing field in favor of the party or parties seeking invalidation”. * the EFF has been working together with defendants in their litigation. Fortunately, the Court of Appeals for the Federal Circuit (CAFC) -- the same appeals court that overruled Judge William Alsup in his verdict (in Oracle vs Google) that APIs were not copyrightable -- seems to be a bit less uncritically pro-“Intellectual Property” these days (something to do with being slapped down by the Supreme Court?), and has rejected these arguments. Imagine if all this creativity had gone into producing actual useful products, instead of legal arguments ... <https://arstechnica.com/tech-policy/2017/11/eff-destroys-the-podcasting-pat…>

1 0

Microsoft Quietly Announces End of Last Free Windows 10 Upgrade Offer
by Peter Reutemann 03 Nov '17

03 Nov '17

'If you've been waiting to claim your free Windows 10 upgrade using the "assistive technologies" exception, you need to act soon. In a quiet change to an obscure web page, Microsoft announced this week that those exceptions will end on December 31, 2017. On July 29, 2016, Microsoft officially ended the Get Windows 10 program, which offered free Windows 10 upgrades to anyone currently running a supported earlier version of Windows. But the company left a giant loophole in a separate announcement at the same time. Under the terms of that announcement, individuals who use "assistive technologies" received an automatic extension of the free upgrade offer. Sometime in the past week, Microsoft quietly edited that page, to add "The accessibility upgrade offer expires on December 31, 2017."' -- source: https://tech.slashdot.org/story/17/11/03/1737219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android Oreo Bug Sends Thousands of Phones Into Infinite Boot Loops
by Peter Reutemann 02 Nov '17

02 Nov '17

'A bug in the new "Adaptive Icons" feature introduced in Android Oreo has sent thousands of phones into infinite boot loops, forcing some users to reset their devices to factory settings, causing users to lose data along the way. The bug was discovered by Jcbsera, the developer of the Swipe for Facebook Android app (energy-efficient Facebook wrapper app), and does not affect Android Oreo (8.0) in its default state. The bug occurs only with apps that use adaptive icons -- a new feature introduced in Android Oreo that allows icons to change shape and size based on the device they're viewed on, or the type of launcher the user is using on his Android device. For example, adaptive icons will appear in square, rounded, or circle containers depending on the theme or launcher the user is using. The style of adaptive icons is defined a local XML file. The bug first manifested itself when the developer of the Swipe for Facebook Android app accidentally renamed the foreground image of his adaptive icon with the same name as this XML file (ic_launcher_main.png and ic_launcher_main.xml). This naming scheme sends Android Oreo in an infinite loop that regularly crashes the device. At one point, Android detects something is wrong and prompts the user to reset the device to factory settings. Users don't have to open an app, and the crashes still happen just by having an app with malformed adaptive icons artifacts on your phone. Google said it will fix the issue in Android Oreo 8.1.' -- source: https://tech.slashdot.org/story/17/11/01/1550256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

10 Best Lightweight Linux Distributions For Older Computers In 2017
by Peter Reutemann 31 Oct '17

31 Oct '17

Quick overview: 10. Peppermint 9. Lubuntu 8. Linux Lite 7. LXLE 6. CrunchBang++ 5. Bodhi Linux 4. antiX Linux 3. SparkyLinux 2. Puppy Linux 1. Tiny Core See here for full details: https://itsfoss.com/lightweight-linux-beginners/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Googler A Command Line Tool To Search Google
by Peter Reutemann 31 Oct '17

31 Oct '17

'Looking for information on the web has become something that we do day in and day out. Whether it is support you are looking for, looking for a product or news about a particular topic, all you have to do is search on the web. As a result, search engines have been designed so they can help us sift through or the garbage in order to get the information we seek. There are Google, Bing, and DuckDuckGo just to mention a few. But what do all these have in common, well, to use these you need a browser such as Firefox or Chromium first. Well does no problem at all; except when all you have is a terminal and no GUI and browser. Also, you may have a GUI and a browser but you wish you did not have to leave the terminal just for that quick search, and thus comes Googler. ' -- source: http://www.linuxandubuntu.com/home/googler-a-command-line-tool-to-search-go… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Appeals Court Keeps Alive The Never-Ending Linux Case, SCO v. IBM
by Lawrence D'Oliveiro 30 Oct '17

30 Oct '17

“Jarndyce v. Jarndyce” for the 21st century, anybody? <https://arstechnica.com/tech-policy/2017/10/appeals-court-keeps-alive-the-n…>

1 0

How Kodi Took Over Piracy
by Peter Reutemann 30 Oct '17

30 Oct '17

'For years, piracy persisted mainly in the realm of torrents, with sites like The Pirate Bay and Demonoid connecting internet denizens to premium content gratis. But a confluence of factors have sent torrent usage plummeting from 23 percent of all North American daily internet traffic in 2011 to under 5 percent last year. Legal crackdowns shuttered prominent torrent sites. Paid alternatives like Netflix and Hulu made it easier just to pay up. And then there were the "fully loaded" Kodi boxes -- otherwise vanilla streaming devices that come with, or make easily accessible, so-called addons that seek out unlicensed content -- that deliver pirated movies and TV shows with push-button ease. "Kodi and the plugin system and the people who made these plugins have just dumbed down the process," says Dan Deeth, spokesperson for network-equipment company Sandvine. "It's easy for anyone to use. It's kind of set it and forget it. Like the Ron Popeil turkey roaster." Kodi itself is just a media player; the majority of addons aren't piracy focused, and lots of Kodi devices without illicit software plug-ins are utterly uncontroversial. Still, that Kodi has swallowed piracy may not surprise some of you; a full six percent of North American households have a Kodi device configured to access unlicensed content, according to a recent Sandvine study. But the story of how a popular, open-source media player called XBMC became a pirate's paradise might. And with a legal crackdown looming, the Kodi ecosystem's present may matter less than its uncertain future.' -- source: https://yro.slashdot.org/story/17/10/30/1931208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Firefox To Get a Better Password Manager
by Peter Reutemann 30 Oct '17

30 Oct '17

'Mozilla engineers have started work on a project named Lockbox that they describe as "a work-in-progress extension [...] to improve upon Firefox's built-in password management." Mozilla released the new extension for employee-use only at first, but users can install it by going to this or this links. Lockbox revamps Firefox's antiquated password management utility with a new user interface (UI). A new Firefox UI button is also included, in case users want to add a shortcut in their browser's main interface to open Lockbox without going through all the menu options. Support for a master password is included, helping users secure their passwords from unauthorized access by co-workers, family members, or others.' -- source: https://news.slashdot.org/story/17/10/30/1245202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

If We Can’t Trust Kaspersky, Should We Trust Microsoft?
by Lawrence D'Oliveiro 30 Oct '17

30 Oct '17

An opinion piece at Al Jazeera <http://www.aljazeera.com/indepth/opinion/trust-kaspersky-trust-microsoft-17…> considers: A single malicious update pushed from Microsoft could cripple almost every government worldwide. ... That a small number of vendors have the capacity to remotely shut down government infrastructure, or vacuum up secret documents, is almost too scary to wrap your head around. And that's without pondering how likely they are to be pressured by their governments. In the face of future conflict, is the first step going to be disabling auto-updates for software from that country?

1 0

Early HP Archives Destroyed
by Lawrence D'Oliveiro 30 Oct '17

30 Oct '17

Bill Hewlett and Dave Packard were the archetypal “two guys who started a business in a garage” from 1938. When the company they founded moved on to other things (computers, printers etc), the original test-equipment business they created was spun off as part of a company called Agilent, which in turn divested it as an outfit now known as Keysight. Now we hear that important historical paper archives from those early days, which were in the care of Keysight Technologies, have been lost in the recent deadly Santa Rosa wildfires. <http://www.theregister.co.uk/2017/10/29/hewlett_packard_history_lost_to_san…>

1 0

Anypaste – Share And Upload Files To Compatible Hosting Sites Automatically
by Peter Reutemann 30 Oct '17

30 Oct '17

'A while ago, we have written a guide about Transfer.sh which allows you to share files over Internet from command-line. Today, we will see yet another file sharing utility called Anypaste. It is a simple script to share and upload files to compatible hosting sites depending upon the type of the files, automatically. You don’t need to manually log in to the hosting sites and upload or share your files. Anypaste will pick the right hosting sites depends upon the type of the file you want to upload. To put this simply, photos will get uploaded to image hosting sites, videos to video sites, code to pastebins. Cool, yeah? Anypaste is completely free, open source and light-weight script and you can do everything from command line. You don’t need to depend on any heavy, memory-consuming GUI apps to upload and share files.' -- source: https://www.ostechnix.com/anypaste-share-upload-files-compatible-hosting-si… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Purism Now Offers Laptops with Intel's 'Management Engine' Disabled
by Peter Reutemann 29 Oct '17

29 Oct '17

' "San Francisco company Purism announced that they are now offering their Librem laptops with the Intel Management Engine disabled," writes Slashdot reader boudie2. Purism describes Management Engine as "a separate CPU that can run and control a computer even when powered off." HardOCP reports that Management Engine "is widely despised by security professionals and privacy advocates because it relies on signed and secret Intel code, isn't easily alterable, isn't fully documented, and has been found to be vulnerable to exploitation... In short, it's a tiny potentially hackable computer in your computer that you cannot totally control, nor opt-out of, but it can totally control your system." Purism writes: Disabling the Management Engine is no easy task, and it has taken security researchers years to find a way to properly and verifiably disable it. Purism, because it runs coreboot and maintains its own BIOS firmware update process, has been able to release and ship coreboot that disables the Management Engine from running, directly halting the ME CPU without the ability of recovery... "Disabling the Management Engine, long believed to be impossible, is now possible and available in all current Librem laptops. It is also available as a software update for previously shipped recent Librem laptops," says Todd Weaver, Founder & CEO of Purism.' -- source: https://hardware.slashdot.org/story/17/10/29/0324201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Mint Is Killing the KDE Edition
by Peter Reutemann 27 Oct '17

27 Oct '17

'While both the Cinnamon and Mate versions of Linux Mint are decent choices for computer users, there was one version that was always utterly bizarre -- the KDE Edition. Don't get me wrong, KDE is a fine environment, but Kubuntu already exists. Having a version of Mint using KDE was redundant and confusing. Thankfully, today, the Linux Mint team announces it is finally killing the KDE edition. "In continuation with what's been done in the past, Linux Mint 18.3 will feature a KDE edition, but it will be the last release to do so. I would like to thank Kubuntu for the amazing work they have done. The quality of Plasma 5 in Xenial made backports a necessity. The rapid pace of development upstream from the KDE project made this very challenging, yet they managed to provide a stable flow of updates for us and we were able to ship good KDE editions thanks to that. I don't think this would have been possible without them," says Clement Lefebvre, Linux Mint. Lefebvre further says, "KDE is a fantastic environment but it's also a different world, one which evolves away from us and away from everything we focus on. Their apps, their ecosystem and the QT toolkit which is central there have very little in common with what we're working on. We're not just shipping releases and distributing upstream software. We're a product distribution and we see ourselves as a complete desktop operating system. We like to integrate solutions, develop whatâ(TM)s missing, adapt what's not fitting perfectly, and we do a great deal of that not only around our own Cinnamon desktop environment but also thanks to cross-DE frameworks we put in place to support similar environments, such as MATE and Xfce."' -- source: https://linux.slashdot.org/story/17/10/26/0325221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

How to Install Mycroft AI Assistant On Raspberry Pi
by Peter Reutemann 27 Oct '17

27 Oct '17

'Personal assistants like Alexa and Google Home are extremely popular right now, and interest is only growing. It’s not too hard to envision a near future where just about every home has its own AI assistant. What if you don’t want a huge corporation having a direct line into your home? Maybe you want to build your own to understand how they work? Mycroft is the solution. Mycroft is an open-source AI assistant that aims to compete with the likes of Alexa and Google. No, Mycroft isn’t entirely there yet, but the project is still in active development. Mycroft is based on the hugely popular Raspberry Pi, so you can actually set up your own with a Pi and test it out.' -- source: https://www.maketecheasier.com/install-mycroft-on-raspberry-pi/ Apparently, you can use it without creating an account: https://github.com/MycroftAI/mycroft-core#using-mycroft-without-home Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Who's building Linux in 2017?
by Peter Reutemann 27 Oct '17

27 Oct '17

'It's 2017 and Linux rules the computing world. Don't believe me? The Linux Foundation reports that Linux runs 90 percent of the public cloud workload, 82 percent of the world's smartphones, 62 percent of the embedded market, oh and a mere 99 percent of the supercomputer market. All that rests on the Linux kernel. In its 2017 Linux Kernel Development Report, Jonathan Corbet, Linux kernel developer and editor of LWN.net, and Greg Kroah-Hartman, stable Linux kernel maintainer, report on Linux's recent evolution. This report was released at the invitation-only Linux Kernel Summit in Prague, Czech Republic. Since 2005 and adoption of Git version control system, 15,637 developers from over 1,400 companies have contributed to the Linux kernel. Since last year, over 4,300 developers from more than 500 companies have contributed to the kernel. Of these, 1,670 contributed for the first time, or about a third of contributors' -- source: http://www.zdnet.com/article/whos-building-linux-in-2017/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Are “Enterprise-Quality” Hard Drives Worth It?
by Lawrence D'Oliveiro 26 Oct '17

26 Oct '17

Another quarter, another report from backups outfit Backblaze on hard disk reliability <https://arstechnica.com/gadgets/2017/10/big-hard-disks-may-be-breaking-the-…>: In aggregate, the company has now accumulated 3.7 million drive days for the consumer disks and 1.4 million for the enterprise ones. Over this usage, the annualized failure rates are 1.1 percent for the consumer disks and 1.2 percent for the enterprise ones. At least for now, then, the enterprise disks aren't doing anything to justify their longer warranty; their reliability is virtually identical.

1 0

How To Protect A Small Organization Against Electronic Adversaries
by Lawrence D'Oliveiro 25 Oct '17

25 Oct '17

About to have a look at the document posted here <https://freedom-to-tinker.com/2017/10/25/howto-protect-your-small-organizat…>. Unfortunately, for a document that’s about security, wget tells me the link is (currently) not secure: WARNING: The certificate of ‘www.cs.rice.edu’ is not trusted. WARNING: The certificate of ‘www.cs.rice.edu’ hasn't got a known issuer. WARNING: The certificate of ‘www.cs.rice.edu’ was signed using an insecure algorithm.

1 0

Why Computing Devices Slow Down Over Time
by rowan schischka 25 Oct '17

25 Oct '17

> So trying to speed things up can make things slower?? Its a repost from another outlet. This is just filler article in the tech section. Stuff has one today about mobile battery advice that contradicts last months article about mobile batteries.

1 0

When You Have To Have An Entire Conference On Software Licensing...
by Lawrence D'Oliveiro 24 Oct '17

24 Oct '17

Choice quotes from <http://www.theregister.co.uk/2017/10/24/oracle_users_meets_behind_closed_do…>: The emphasis on anonymity comes from firms’ fear that vendors are always poised to launch an audit or bump up fees. Sessions will offer advice on ... why customers shouldn’t be too reliant on licensing tools.

1 0

Why Did Ubuntu Drop Unity? Mark Shuttleworth Explains
by Peter Reutemann 24 Oct '17

24 Oct '17

Since we talked about Canonical ditching Mir/Unity on Monday night, here's some more insight from Shuttleworth himself: 'Ubuntu's decision to ditch Unity took many of us by surprise earlier this year. Now Ubuntu founder Mark Shuttleworth shares more details about why Ubuntu chose to drop Unity. From a report: Shuttleworth says he, along with the other 'leads' at Canonical, came to a consensual view that they should put the company on the path to becoming a public company. And to appear attractive to potential investors the company has to focus on its areas of profitability -- something Unity, Ubuntu phone, Unity 8 and convergence were not part of: "[The decision] meant that we couldn't have on our books (effectively) very substantial projects which clearly have no commercial angle to them at all. It doesn't mean that we would consider changing the terms of Ubuntu for example, because it's foundational to everything we do. And we don't have to, effectively," he said. Money may have meant Unity's demise but the wider Ubuntu project is in rude health. as Shuttleworth explains: "One of the things I'm most proud of is in the last 7 years is that Ubuntu itself became completely sustainable. I could get hit by a bus tomorrow and Ubuntu could continue. It's kind of magical, right? Here's a platform that is a world class enterprise platform, that's completely freely available, and yet it is sustainable. Jane Silber is largely to thank for that." While it's all-too-easy for desktop users to focus on, well, the desktop, there is far more to Canonical (the company) than the 6-monthly releases we look forward to. Losing Unity may have been a big blow for desktop users but it helped to balance other parts of the company: "There are huge possibilities for us in the enterprise beyond that, in terms of really defining how cloud infrastructure is built, how cloud applications are operated, and so on. And, in IoT, looking at that next wave of possibility, innovators creating stuff on IoT. And all of that is ample for us to essentially put ourselves on course to IPO around that." Dropping Unity wasn't easy for Mark, though: "We had this big chunk of work, which was Unity, which I really loved. I think the engineering of Unity 8 was pretty spectacularly good, and the deep ideas of how you bring these different form factors together was pretty beautiful.' -- source: https://news.slashdot.org/story/17/10/24/1854254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Install Let's Encrypt and Secure Nginx with SSL/TLS in Debian 9
by Peter Reutemann 24 Oct '17

24 Oct '17

'This tutorial will show you how to install and secure a Nginx web server on Debian 9 with a TLS certificate issued for free by the Let’s Encrypt Certificate Authority. Furthermore, we will configure automatic renewal of Lets’ Encrypt TLS certificates using a cron job before the certificates expire.' -- source: https://www.howtoforge.com/tutorial/install-letsencrypt-and-secure-nginx-in… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Librem 5 Privacy-Focused Linux Phone Crowdfunding Campaign Ends with $2 Million
by Peter Reutemann 24 Oct '17

24 Oct '17

Since we talked about this phone last night... 'Librem 5 was successfully crowdfunded about two weeks ago when it surpassed its goal of $1.5 million, but the campaign continued to run, and now it appears to have gathered half million dollars more, ending with $2 million, which we believe is more than enough to build world's first truly free mobile device. Powered by PureOS, Purism's own GNU/Linux distribution based on the popular Debian GNU/Linux operating system, but focused on offering users a privacy-focused and more secure desktop solution, Librem 5 will be using KDE's Plasma Mobile and GNOME's GNOME Shell user interfaces, along with powerful open source software. During its crowdfunding campaign, Librem 5 saw an amazing feedback from the Open Source community as Purism partnered not only with big names like KDE and GNOME, but also with Nextcloud, which will bring its end-to-end encrypted file sync, sharing and cloud-based storage solution by default to the Linux smartphone.' -- source: http://news.softpedia.com/news/librem-5-privacy-focused-linux-phone-crowdfu… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

3 Simple, Excellent Linux Network Monitors
by Peter Reutemann 24 Oct '17

24 Oct '17

'You can learn an amazing amount of information about your network connections with these three glorious Linux networking commands. iftop tracks network connections by process number, Nethogs quickly reveals what is hogging your bandwidth, and vnstat runs as a nice lightweight daemon to record your usage over time.' -- source: https://www.linux.com/learn/intro-to-linux/2017/10/3-simple-excellent-linux… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

4 Reasons Building A Gaming PC Sucks Right Now
by Lawrence D'Oliveiro 23 Oct '17

23 Oct '17

Just saw this video on the current high prices of GPUs, RAM and variable-refresh monitors <https://www.youtube.com/watch?v=Vh8tZ_qkY1o>. What’s surprising to me is the reason why GPU prices are currently high: because they are being snapped up for cryptocurrency mining.

1 0

Why Computing Devices Slow Down Over Time
by Lawrence D'Oliveiro 23 Oct '17

23 Oct '17

Entertaining opinion piece <http://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=11935838>: To make their apps run faster, some designers make them store copies of things in RAM ... Known as cacheing, this makes things work much faster - until your system starts to run out of memory. For cacheing to be effective, the amount of space devoted to it must be carefully managed by the application and the device's operating system. Some app developers don't put the effort that they should into doing this well, and their applications not only slow down over time, but can drag the rest of the system down with them too. So trying to speed things up can make things slower??

1 0

Android getting “DNS over TLS” support to stop ISPs from knowing what websites you visit
by Peter Reutemann 23 Oct '17

23 Oct '17

'DNS (Domain Name Server) is what translates a website address from a URL that you enter to an IP address which your computer actually connects to. For example, when you type “www.xda-developers.com” into your browser, your computer queries a DNS which looks up and returns the IP address “209.58.128.90” to the client. This process is hidden from the user, but every website you visit (so long as it has a human-readable URL) will go through this same process. The problem for those security conscious out there is that these requests are done in plain text through UDP or TCP protocols which are readable by anyone that can see your connection, including your ISP. This is where DNS over TLS comes in.' -- source: https://www.xda-developers.com/android-dns-over-tls-website-privacy/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

Microsoft Chastises Google Over Chrome Security
by Peter Reutemann 22 Oct '17

22 Oct '17

'In a Wednesday blog post, Redmond examined Google's browser security and took the opportunity to throw some shade at Chrome's security philosophy, while also touting the benefits of its own Edge browser. The post, written by Microsoft security team member Jordan Rabet, noted that Google's Chrome browser uses "sandboxing" and isolation techniques designed to contain any malicious code. Nevertheless, Microsoft still managed to find a security hole in Chrome that could be used to execute malicious code on the browser. The bug involved a Javascript engine in Chrome. Microsoft notified Google about the problem, which was patched last month. The company even received a $7,500 reward for finding the flaw. However, Microsoft made sure to point out that its own Edge browser was protected from the same kind of security threat. It also criticized Google for the way it handled the patching process. Prior to the patch's official rollout, the source code for the fix was made public on GitHub, a software collaboration site that hosts computer code. That meant attentive hackers could have learned about the vulnerability before the patch was pushed out to customers, Microsoft claimed. "In this specific case, the stable channel of Chrome remained vulnerable for nearly a month," the blog post said. "That is more than enough time for an attacker to exploit it." In the past Google has also disclosed vulnerabilities found in Microsoft products -- including Edge.' -- source: https://it.slashdot.org/story/17/10/22/010235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Security Upgraded For NetBSD-amd64 with Kernel ASLR Support
by Peter Reutemann 22 Oct '17

22 Oct '17

'24 years after its release, NetBSD is getting a security upgrade -- specifically, Address Space Layout Randomization (ASLR). An anonymous reader writes: Support for Kernel ASLR was added on NetBSD-amd64 a few weeks ago. KASLR basically randomizes the address of the kernel, and makes it harder to exploit several classes of vulnerabilities [including privilege escalations and remote code execution]. It is still a work-in-progress, but it's already fully functional, and can be used following the instructions on this post from the NetBSD blog. It will be available starting from NetBSD 9, but may be backported to NetBSD 8 once it is stabilized. NetBSD says they're the first BSD system to support ASLR.' -- source: https://bsd.slashdot.org/story/17/10/21/0118226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bloody Stupid Linux
by Lawrence D'Oliveiro 21 Oct '17

21 Oct '17

That’s the name of the distro <http://bloodystupid.clockwatching.org/>: Why go to all this trouble? The BSL kernel is basically a life support system for ram and network cards, since it wget's support for everything else on the machine the kernel is very small. The initial aim was to fit it on a single floppy, then PXE booting became attractive, and really, since the kernel doesn't need to support whatever it just booted from in order to have its root filesystem, its very flexible. Yeah, I know an initrd can do the same thing, but its more fun this way. As it stands, BSL makes for an excellent repair system, the framework for a bulk installer, a neat toy, and an alright thin client ( as long as you've got a gob of RAM handy.) OK, so it hasn’t been updated in over a decade. But the mascot image is cute. ;)

1 0

The Ultimate In Terminal Emulators?
by Lawrence D'Oliveiro 20 Oct '17

20 Oct '17

Brian Lunduke continues his Command-Line Week with a look at a couple of quite amazing terminal emulators: <https://www.youtube.com/watch?v=-vm7B6bLbLg>. So you think “command line” and “eye candy” can’t go together?

1 0

Yet another distro - Q4OS - meeting topic
by Ian Young 20 Oct '17

20 Oct '17

Some may be surprised to learn that a few diehards are still running a fork of KDE 3.5 on a Debian Base. The Trinity desktop. Could give it a quick run through on Monday night if there is time. May be of interest to those who wonder sometimes why KDE 3 was dropped once it actually became usable.

3 2

Meet CudaText: A Cross-Platform Open Source Code Editor
by Peter Reutemann 20 Oct '17

20 Oct '17

'CudaText is a cross-platform open source code editor based on Lazarus. It has extensive support for most of the popular programming languages. I cannot call it one of the best open source code editors because it is too early for that. I cannot even call it Notepad++ alternative for Linux because it’s more like a lightweight IDE like Geany. Though the default interface reminds me of Eclipse IDE.' -- source: https://itsfoss.com/cudatext-code-editor/ Great to see that Object Pascal is still thriving, though I haven't programmed in Pascal for years. Lazarus is an IDE for Object Pascal, a free alternative to (originally Borland's) Delphi. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Desktop Recorder App Green Recorder 3.0 Released
by Peter Reutemann 19 Oct '17

19 Oct '17

'Green Recorder is a simple desktop recorder for Linux distributions. You can use it to record audio and video on almost every Linux interface. Released under GPL 3, it now also supports Wayland. Green Recorder 3.0 supports avi, mkv, mp4 nut and gif. Wayland’s GNOME session supports only WebM. The user can choose the audio input source from a list as well as can set default values from the preference window.' -- source: https://itsfoss.com/green-recorder-3/ Just tried it and it works! Previously, I had used recordMyDesktop (GTK UI), which only supported Ogg Video. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Canada's 'Super Secret Spy Agency' Is Releasing a Malware-Fighting Tool To the Public
by Peter Reutemann 19 Oct '17

19 Oct '17

'Canada's electronic spy agency says it is taking the "unprecedented step" of releasing one of its own cyber defence tools to the public, in a bid to help companies and organizations better defend their computers and networks against malicious threats. The Communications Security Establishment (CSE) rarely goes into detail about its activities -- both offensive and defensive -- and much of what is known about the agency's activities have come from leaked documents obtained by U.S. National Security Agency whistleblower Edward Snowden and published in recent years. But as of late, CSE has acknowledged it needs to do a better job of explaining to Canadians exactly what it does. Today, it is pulling back the curtain on an open-source malware analysis tool called Assemblyline that CSE says is used to protect the Canadian government's sprawling infrastructure each day. "It's a tool that helps our analysts know what to look at, because it's overwhelming for the number of people we have to be able to protect things," Scott Jones, who heads the agency's IT security efforts, said in an interview with CBC News. On the one hand, open sourcing Assemblyline's code is a savvy act of public relations, and Jones readily admits the agency is trying to shed its "super secret spy agency" reputation in the interest of greater transparency.' -- source: https://news.slashdot.org/story/17/10/19/1837236 Let's see, whether anybody finds bits in the code that report home to the agency... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

AGM next month
by Peter Reutemann 19 Oct '17

19 Oct '17

Hi everyone The Annual General Meeting (AGM) of the Waikato Linux Users Group Society will be held on November 27th this year. Agenda (preliminary) - President's Report - Treasurer's Report - Election of 2017 Committee - General business - Consumption of pizza https://www.meetup.com/WaikatoLinuxUsersGroup/events/237234897/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu 17.10 Artful Aardvark Released
by Peter Reutemann 19 Oct '17

19 Oct '17

'Canonical has made available the download links for Ubuntu 17.10 "Artful Aardvark". It comes with a range of new features, changes, and improvements including GNOME as the default desktop, Wayland display server by default, Optional X.org server session, Mesa 17.2 or Mesa 17.3, Linux kernel 4.13 or kernel 4.14, new Subiquity server installer, improved hardware support, new Ubuntu Server installer, switch to libinput, an always visible dock using Dash to Dock GNOME Shell extension, and Bluetooth improvements with a new BlueZ among others. ' -- source: https://news.slashdot.org/story/17/10/19/0943200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Samsung To Let Proper Linux Distros Run on Galaxy Smartphones
by Peter Reutemann 19 Oct '17

19 Oct '17

'Samsung has announced it will soon become possible to run actual proper Linux on its Note8, Galaxy S8 and S8+ smartphones -- and even Linux desktops. Yeah, yeah, we know Android is built on Linux, but you know what we mean. Samsung said it's working on an app called "Linux on Galaxy" that will let users "run their preferred Linux distribution on their smartphones utilizing the same Linux kernel that powers the Android OS." "Whenever they need to use a function that is not available on the smartphone OS, users can simply switch to the app and run any program they need to in a Linux OS environment," Samsung says. The app also allows multiple OSes to run on a device. Linux desktops will become available if users plug their phones into the DeX Station, the device that lets a Galaxy 8 run a Samsung-created desktop-like environment when connected to the DeX and an external monitor.' -- source: https://linux.slashdot.org/story/17/10/19/0524234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

EU: No Encryption Backdoors But, Let's Help Each Other Crack That Crypto
by Peter Reutemann 19 Oct '17

19 Oct '17

'The European Commission has proposed that member states help each other break into encrypted devices by sharing expertise around the bloc. From a report: In an attempt to tackle the rise of citizens using encryption and its effects on solving crimes, the commission decided to sidestep the well-worn, and well-ridiculed, path of demanding decryption backdoors in the stuff we all use. Instead, the plans set out in its antiterrorism measures on Wednesday take a more collegiate approach -- by offering member states more support when they actually get their hands on an encrypted device. "The commission's position is very clear -- we are not in favour of so-called backdoors, the utilisation of systemic vulnerabilities, because it weakens the overall security of our cyberspace, which we rely upon," security commissioner Julian King told a press briefing. "We're trying to move beyond a sometimes sterile debate between backdoors or no backdoors, and address some of the concrete law enforcement challenges. For instance, when [a member state] gets a device, how do they get information that might be encrypted on the device." [...] Share the wealth. "Some member states are more equipped technically to do that [extract information from a seized device] than others," King said. "We want to make sure no member state is at a disadvantage, by sharing the tech expertise among the member states and reinforcing the support that Europol can offer."' -- source: https://yro.slashdot.org/story/17/10/19/1440200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Engineers Explore Ways To Stop In-Browser Cryptocurrency Miners in Chrome
by Peter Reutemann 19 Oct '17

19 Oct '17

'Google Chrome engineers are considering adding a special browser permission that will thwart the rising trend of in-browser cryptocurrency miners. Discussions on the topic of in-browser miners have been going on the Chromium project's bug tracker since mid-September when Coinhive, the first such service, launched. "Here's my current thinking," Ojan Vafai, a Chrome engineering working on the Chromium project, wrote in one of the recent bug reports. "If a site is using more than XX% CPU for more than YY seconds, then we put the page into 'battery saver mode' where we aggressively throttle tasks and show a toast [notification popup] allowing the user to opt-out of battery saver mode. When a battery saver mode tab is backgrounded, we stop running tasks entirely. I think we'll want measurement to figure out what values to use for XX and YY, but we can start with really egregious things like 100% and 60 seconds. I'm effectively suggesting we add a permission here, but it would have unusual triggering conditions [...]. It only triggers when the page is doing a likely bad thing." An earlier suggestion had Google create a blacklist and block the mining code at the browser level. That suggestion was shut down as being too impractical and something better left to extensions.' -- source: https://tech.slashdot.org/story/17/10/19/1618222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Targeted Fuzzing Is Improving Linux Security, Linus Torvalds Says
by Peter Reutemann 19 Oct '17

19 Oct '17

'On the sidelines of announcing the fifth release candidate for the Linux kernel version 4.14, Linus Torvalds said fuzzing, which involves stress testing a system by generating random code to induce errors, is helping the community find and fix a range of security vulnerabilities. He wrote: The other thing perhaps worth mentioning is how much random fuzzing people are doing, and it's finding things. We've always done fuzzing (who remembers the old "crashme" program that just generated random code and jumped to it? We used to do that quite actively very early on), but people have been doing some nice targeted fuzzing of driver subsystems etc, and there's been various fixes (not just this last week either) coming out of those efforts. Very nice to see.' -- source: https://linux.slashdot.org/story/17/10/19/171206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

IoT Cybersecurity: What’s Plan B?
by Lawrence D'Oliveiro 19 Oct '17

19 Oct '17

Whither the Internet Of Things? Markets, as we've repeatedly learned over the past century, are terrible mechanisms for improving the safety of products and services. It was true for automobile, food, restaurant, airplane, fire, and financial-instrument safety. The reasons are complicated, but basically, sellers don't compete on safety features because buyers can't efficiently differentiate products based on safety considerations. The race-to-the-bottom mechanism that markets use to minimize prices also minimizes quality. Without government intervention, the IoT remains dangerously insecure. The US government has no appetite for intervention, so we won't see serious safety and security regulations, a new federal agency, or better liability laws. We might have a better chance in the EU. Depending on how the General Data Protection Regulation on data privacy pans out, the EU might pass a similar security law in 5 years. No other country has a large enough market share to make a difference. <https://www.schneier.com/blog/archives/2017/10/iot_cybersecuri.html>

1 0

GPL Abuse In The Linux Kernel
by Lawrence D'Oliveiro 18 Oct '17

18 Oct '17

The questionable legal activities of a former Linux kernel developer <http://www.theregister.co.uk/2017/10/18/linux_kernel_community_enforcement_…> have driven a bunch of senior kernel figures to issue a “Community Enforcement Statement” to try to put a stop to this sort of thing in the future. What’s interesting about this is their admission that the GPL 2.0 has “ambiguities … that no one in our community has ever considered part of compliance”. And to fix it, their Statement “adopts the same termination provisions we are all familiar with from GPL-3.0 as an Additional Permission giving companies confidence that they will have time to come into compliance if a failure is identified”. Do you remember back when GPL 3.0 came out, and Linus Torvalds and other senior kernel figures issued a statement claiming that they were quite happy with GPL 2.0, they had no intention of moving to GPL 3.0, which he quite publicly loathed? Seems like now they are slowly coming to a realization of the reasons why GPL 3.0 was created in the first place...

1 0

Ah, The Joys Of Debian Unstable ...
by Lawrence D'Oliveiro 17 Oct '17

17 Oct '17

Did my (roughly) monthly system upgrades over the last couple of days. Debian has changed the default Python version for the “python3” command to 3.6. (And Blender now requires that version for building as well.) Didn’t notice anything broken until today, when I tried to print something on my HP inkjet. Turns out the various HP/CUPS-related packages with version number 3.17 want the system default Python to be 3.5, not 3.6. In situations like these, the first thing I have learned to try is to manually download older versions of packages from <http://ftp.debian.org/debian/> and install them with “dpkg -i”. For reference, these are the packages I downgraded: dpkg -i hplip-data_3.16.11+repack0-3_all.deb dpkg -i libhpmud0_3.16.11+repack0-3_amd64.deb dpkg -i libsane-hpaio_3.16.11+repack0-3_amd64.deb dpkg -i printer-driver-hpcups_3.16.11+repack0-3_amd64.deb dpkg -i hplip_3.16.11+repack0-3_amd64.deb And it worked. My printer now prints again. Presumably this will be sorted out in time for my next upgrade ...

1 3

Unlikely Things Running Linux
by Lawrence D'Oliveiro 16 Oct '17

16 Oct '17

>From the International Space Station and Large Hadron Collider, through self-driving cars, an electric motorbike and a solar-powered surfboard, down to a milking machine, Computer Engineer Barbie and a crockpot, Brian Lunduke presents a quick tour of just some of the unlikely places you will find a computer running Linux <https://www.youtube.com/watch?v=xPbAXKMCDkY>. Complete with a sting in the tail for those who uncritically subscribe to the old “do one thing and do it well” misconception...

1 0

meeting suggestions?
by Peter Reutemann 16 Oct '17

16 Oct '17

Hi everyone Since we had no volunteers for demoing "Sogo Groupware Server" (Roger?), does anybody else have a topic for next Monday's meeting? Ubuntu 17.10 should be out then... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

qTox – An Open Source P2P Instant Messaging and VoIP App
by Peter Reutemann 16 Oct '17

16 Oct '17

'As you probably already know, GNU/Linux has no shortage of VoIP apps. We’ve written on Wire and Discord. And we even compiled a list of The 10 Best Instant Messaging Apps for Linux. Today, we’ve got a new app to add to our list of instant messaging apps and it goes by the name of qTox. qTox is a free and open source p2p instant messaging, audio and video calls app and is (apparently) the most feature-rich Tox client. As a powerful Tox client, it follows Tox’s design guidelines while maintaining a uniform UI/UX across all the major platforms. It is built with privacy as its paramount goal and the team has even made a public statement that user safety is their priority and nothing in the world can change that.' -- source: https://www.fossmint.com/qtox-an-open-source-p2p-instant-messaging-and-voip… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Windows Subsystem for Linux graduates in Windows 10 Fall Creators Update
by Peter Reutemann 16 Oct '17

16 Oct '17

'Interested in running Linux on Windows 10 with Windows Subsystem for Linux (WSL), but nervous about it being both a beta and only available in Windows 10 developer mode? Your worries are over. In the Windows 10 Fall Creators Update (WinFCU) WSL has graduated to being a Windows 10 feature that can be run by any user. Tested for over a year, WSL on WinFCU is bringing many new features to this combination of the Linux Bash shell and Windows. Besides WSL no longer being a beta or requiring users to be in developer mode, the new features include: Install Linux distros via the Windows Store - WSL now runs multiple Linux distros - WSL comes to Windows Server & Microsoft Azure VMs - WSL now supports USB/serial comms - Miscellaneous fixes and improvements Besides Ubuntu, the new WSL-supported Linux distros are SUSE's community openSUSE and its corporate SUSE Linux Enterprise Server (SLES). Fedora and other distros will arrive in the store shortly.' -- source: http://www.zdnet.com/article/windows-subsystem-for-linux-graduates-in-windo… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Munich Plans New Vote on Dumping Linux For Windows 10
by Peter Reutemann 16 Oct '17

16 Oct '17

'The city of Munich has suggested it will cost too much to carry on using Linux alongside Windows, despite having spent millions of euros switching PCs to open-source software... "Today, with a Linux client-centric environment, we are often confronted with major difficulties and additional costs when it comes to acquiring and operating professional application software," the city council told the German Federation of Taxpayers. Running Linux will ultimately prove unsustainable, suggests the council, due to the need to also keep a minority of Windows machines to run line-of-business software incompatible with Linux. "In the long term, this situation means that the operation of the non-uniform client landscape can no longer be made cost-efficient"... Since completing the multi-year move to LiMux, a custom-version of the Linux-based OS Ubuntu, the city always kept a smaller number of Windows machines to run incompatible software. As of last year it had about 4,163 Windows-based PCs, compared to about 20,000 Linux-based PCs. The assessment is at odds with a wide-ranging review of the city's IT systems by Accenture last year, which found that most of the problems stem not from the use of open-source software, but from inefficiencies in how Munich co-ordinates the efforts of IT teams scattered throughout different departments. Dr. Florian Roth, leader of the Green Party at Munich City Council, said the review had also not recommended a wholesale shift to Windows. "The Accenture report suggested to run both systems because the complete 'rollback' to Windows and MS Office would mean a waste of experience, technology, work and money," he said... The city's administration is investigating how long it would take and how much it would cost to build a Windows 10 client for use by the city's employees. Once this work is complete, the council will vote again in November on whether this Windows client should replace LiMux across the authority from 2021. A taxpayer's federation post urged "Penguin, adieu!" -- while also admitting that returning to Windows "will devour further tax money in the millions," according to TechRepublic. "The federation's post also makes no mention of the licensing and other savings achieved by switching to LiMux, estimated to stand at about €10m."' -- source: https://linux.slashdot.org/story/17/10/15/2344244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Has Already Fixed the Wi-Fi Attack Vulnerability; Android Will Be Patched Within Weeks
by Peter Reutemann 16 Oct '17

16 Oct '17

'Microsoft says it has already fixed the problem for customers running supported versions of Windows. From a report: "We have released a security update to address this issue," says a Microsoft spokesperson in a statement to The Verge. "Customers who apply the update, or have automatic updates enabled, will be protected. We continue to encourage customers to turn on automatic updates to help ensure they are protected." Microsoft is planning to publish details of the update later today. While it looks like Android and Linux devices are affected by the worst part of the vulnerabilities, allowing attackers to manipulate websites, Google has promised a fix for affected devices "in the coming weeks." Google's own Pixel devices will be the first to receive fixes with security patch level of November 6, 2017, but most other handsets are still well behind even the latest updates. Security researchers claim 41 percent of Android devices are vulnerable to an "exceptionally devastating" variant of the Wi-Fi attack that involves manipulating traffic, and it will take time to patch older devices.' -- source: https://mobile.slashdot.org/story/17/10/16/166220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Millions of High-Security Crypto Keys Crippled by Newly Discovered Flaw
by Peter Reutemann 16 Oct '17

16 Oct '17

'Slovak and Czech researchers have found a vulnerability that leaves government and corporate encryption cards vulnerable to hackers to impersonate key owners, inject malicious code into digitally signed software, and decrypt sensitive data, reports ArsTechnica. From the report: The weakness allows attackers to calculate the private portion of any vulnerable key using nothing more than the corresponding public portion. Hackers can then use the private key to impersonate key owners, decrypt sensitive data, sneak malicious code into digitally signed software, and bypass protections that prevent accessing or tampering with stolen PCs. The five-year-old flaw is also troubling because it's located in code that complies with two internationally recognized security certification standards that are binding on many governments, contractors, and companies around the world. The code library was developed by German chipmaker Infineon and has been generating weak keys since 2012 at the latest. The flaw is the one Estonia's government obliquely referred to last month when it warned that 750,000 digital IDs issued since 2014 were vulnerable to attack. Estonian officials said they were closing the ID card public key database to prevent abuse. On Monday, officials posted this update. Last week, Microsoft, Google, and Infineon all warned how the weakness can impair the protections built into TPM products that ironically enough are designed to give an additional measure of security to high-targeted individuals and organizations.' -- source: https://it.slashdot.org/story/17/10/16/1736252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Nobel Prize Winner Argues Tech Companies Should Be Changing The World
by Peter Reutemann 16 Oct '17

16 Oct '17

'Tech companies are competing to serve the wealthy, argues the winner of the 2006 Nobel Peace Prize, complaining there's no "global vision," with big innovations instead "designed and dedicated mostly for commercial successes... while trillions of dollars are invested in developing robotics and artificial intelligence for military and commercial purposes, there is little interest in applying technology to overcome the massive human problems of the world." A genius in the tech industry "can dedicate his work to creating a medical breakthrough that will save thousands of lives -- or he can develop an app that will let people amuse themselves." As an exception, he cites the low-cost Endless computer, which runs Linux and has 50,000 Wikipedia articles pre-installed to enable offline research -- plus more than 100 applications -- for a price of just $79. "One part of Endless's business is operated like a conventional, profit-seeking company, while the other part is a social business that provides underserved populations with educational, health, and creative services they were once denied. Endless is already being shipped around the globe by four of the five largest computer manufacturers. It has become the leading PC platform in Indonesia and much of Southeast Asia. It has also been selected as the standard operating system for the Brazilian Ministry of Education, and in coming months it will be adopted as the primary platform by a number of other Latin American countries." The article is by Muhammad Yunus, who pioneered the concepts of microcredit and microfinance, and is taken from his new book, A World of Three Zeros: The New Economics of Zero Poverty, Zero Unemployment, and Zero Net Carbon Emission' -- source: https://news.slashdot.org/story/17/10/15/1739212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Olimex ships $284 open source Linux laptop kit
by Peter Reutemann 15 Oct '17

15 Oct '17

'Olimex is shipping its open source, Alwinner A64 based Teres-A64 laptop kit, with an 11.6-in LCD, 2GB RAM, 16GB eMMC, 9500mAh battery, and an Ubuntu Mate OS. Back in February, Bulgaria-based Olimex, which is known for its open spec OLinuXino SBCs like the Allwinner A64 based A64-OLinuXino, announced an open source laptop kit based on the same quad-core, Cortex-A53 SoC called the Teres-1. The Ubuntu Mate-supported laptop kit took longer than expected, but it’s finally here as the Teres-A64, selling for 240 Euros ($284) instead of 225 Euros.' -- source: http://linuxgizmos.com/olimex-ships-open-source-linux-laptop-and-tips-new-c… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Ubuntu 17.10 (Artful Aardvark) Is Now in Final Freeze, Launches October 19
by Peter Reutemann 15 Oct '17

15 Oct '17

'Work on Ubuntu 17.10 begun six months ago, on April 20, when the toolchain was uploaded to the repository, with the main goal of replacing our beloved Unity user interface with the latest GNOME 3 desktop environment. Two Alpha and Beta milestones later, Ubuntu 17.10 is now officially in Final Freeze stage. "As of now, artful has entered the Final Freeze period in preparation for the final release of Ubuntu 17.10 next week," said Adam Conrad, Software Engineer at Canonical, in a mailing list announcement. "The current uploads in the queue will be reviewed and either accepted or rejected as appropriate by pre-freeze standards." Of course, this means that developers won't be able to update any of the packages they maintain, except for those that fix critical bugs affecting the ISO images or the installer. Patches for 0-day security vulnerabilities are also welcome during the Final Freeze stage, which will last until next week, on October 19, 2017.' -- source: http://news.softpedia.com/news/ubuntu-17-10-artful-aardvark-is-now-in-final… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How to Switch to Xorg from Wayland in Ubuntu 17.10 [Quick Tip]
by Peter Reutemann 15 Oct '17

15 Oct '17

"One of the main new features in Ubuntu 17.10 is the addition of Wayland as the default display server. As more and more Linux distributions are moving away from the legacy X.Org server and Wayland seems to be the top alternative. While Wayland maybe the future, it really is in future. At least for Ubuntu 17.10. The issue here is that a number of Linux desktop applications still depend on X.Org. They don’t support Wayland very well." -- source: https://itsfoss.com/switch-xorg-wayland/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Android ransomware "DoubleLocker"
by Eric Light 15 Oct '17

15 Oct '17

Anyone out there still trust Adobe Flash Player? "DoubleLocker can change the device’s PIN, preventing victims from accessing their devices, and also encrypts the data it finds in them – a combination that has not been seen previously in the Android ecosystem. [...] It is distributed mostly as a fake Adobe Flash Player through compromised websites. First, it changes the device’s PIN, effectively blocking the victim from using it. The new PIN is set to a random value which the attackes neither store nor send anywhere, so it’s impossible for the user or a security expert to recover it. After the ransom is paid, the attacker can remotely reset the PIN and unlock the device. Second, DoubleLocker encrypts all files from the device’s primary storage directory. It utilizes the AES encryption algorithm, appending the extension “.cryeye”. “The encryption is implemented properly, which means that, unfortunately, there is no way to recover the files without receiving the encryption key from the attackers,” says Štefanko. https://www.welivesecurity.com/2017/10/13/doublelocker-innovative-android-m… -------------------------------------------- Q: Why is this email five sentences or less? A: http://five.sentenc.es

1 0

SUSE Shares Linux-Themed Music Video Parodies
by Peter Reutemann 15 Oct '17

15 Oct '17

'German Linux company SUSE Linux is well-known for its Linux and other open source solutions. It is also known for producing videos for geeks and debuting them at its annual SUSECon conference. This year, in Prague, was no different. The company, which marked its 25th year on 2 September, came up with two videos, one to mark the occasion and the other all about Linux and open source. Both videos are parodies of well-known songs: the video Linus Said is based on "Momma Said", while 25 Years is a parody of "7 Years". Some of the lyrics in both SUSE videos would be meaningless to the average person -- but every word will ring a bell, sometimes a very poignant one, with geeks. And that's the primary audience it targets. The article embeds both videos -- and also links to the music videos they're parodying. And it includes links to SUSE's two previous annual music video parodies -- Uptime Funk (based on Bruno Mars' blockbuster hit "Uptown Funk"), and Can't Stop the SUSE, a parody of Justin Timberlake's "Can't Stop the Feeling".' -- source: https://linux.slashdot.org/story/17/10/15/0137205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Unpatched Exploit Lets You Clone Key Fobs and Open Subaru Cars
by Peter Reutemann 15 Oct '17

15 Oct '17

'Tom Wimmenhove, a Dutch electronics designer, has discovered a flaw in the key fob system used by several Subaru models, a vulnerability the vendor has not patched and could be abused to hijack cars. The issue is that key fobs for some Subaru cars use sequential codes for locking and unlocking the vehicle, and other operations. These codes -- called rolling codes or hopping code -- should be random, in order to avoid situations when an attacker discovers their sequence and uses the flaw to hijack cars. This is exactly what Wimmenhove did. He created a device that sniffs the code, computes the next rolling code and uses it to unlock cars... The researcher said he reached out to Subaru about his findings. "I did [reach out]. I told them about the vulnerability and shared my code with them," Wimmenhove told BleepingComputer. "They referred me to their 'partnership' page and asked me to fill in a questionnaire. It didn't seem like they really cared and I haven't heard back from them." His Subaru-cracking feat -- documented in a video -- was accomplished using a $25 Raspberry Pi B+ and two dongles, one for wifi ($2) and one for a TV ($8), plus a $1 antenna and a $1 MCX-to-SMA convertor.' -- source: https://tech.slashdot.org/story/17/10/14/230254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Everybody Has To Be A Software Company Now
by Lawrence D'Oliveiro 14 Oct '17

14 Oct '17

Wireless speakers made by Pure no longer work with Apple’s newest phone OS, because it has dropped the ability to run 32-bit apps--everything must now be 64-bit-only <http://www.theregister.co.uk/2017/10/12/ios_11_knackers_neglected_pure_conn…>: Part of the problem, it seems, is Pure's inability to maintain and update its own apps, and it is most likely not alone in this respect: companies that have outsourced their mobile app programming are finding themselves locked out of iOS 11 because they can't get the code or the tools or the people to rebuild their contract-developed software. The iOS App Store shows that the last update to Pure Connect was on June 25, 2015, more than two years ago, so Pure has been without a mobile developer for a while, it seems. More and more consumer products need ongoing software updates now. But the companies selling those products are having trouble getting to grips with that fact.

3 2

Impersonating Password Prompts
by Lawrence D'Oliveiro 13 Oct '17

13 Oct '17

An old problem which never seems to be quite solved: how do you distinguish pieces of software on a platform that have a legitimate need to request a password from you, from those which don’t? <https://www.schneier.com/blog/archives/2017/10/impersonating_i.html>

1 0

XikiHub: The Social Command Line
by Peter Reutemann 13 Oct '17

13 Oct '17

'In 2014, Craig Muth developed an open source alternative shell called Xiki (executable wiki) which combined shell and GUI concepts and tried making the shell console more friendly and powerful. The selection was easier with arrow keys or with mouse clicks and there was the option to create menus to access other tools with ease. And, all of this was made possible for beginners with little to no knowledge about the command line. ' [see archive link here: https://list.waikato.ac.nz/pipermail/wlug/2014-June/012983.html] 'Now, Xiki is going a step further with XikiHub by adding a social element to commands. XikiHub aims to be a social repository where you can discover thousands of examples and interfaces contributed from users all over the world. You can pick up the one you like, create your own and contribute it to the social repository. The idea behind XikiHub is to create a social platform where any Xiki user can share a command he/she created that can be picked up and used by any other user. It will include a quick install step that will provide the option to review before installing a command.' -- source: https://itsfoss.com/xikihub-social-command-line/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Endless OS Is First Linux Distro to Support Flatpak Apps from Flathub by Default
by Peter Reutemann 13 Oct '17

13 Oct '17

'Flatpak has been around for some time now, and it's gaining more and more popularity among GNU/Linux distributions. Endless OS is the latest to announce that it brings support for Flatpak apps, though it's the first to offer support for this universal binary format directly from the Flathub repository, by default. Last month, the Flatpak developers over at Red Hat announced that their Flathub software repository received a modern, web-based frontend, which allows users to easily browse all available Flatpak apps at a glance, and developers to add their own Flatpaks to the list of more than 100 apps.' -- source: http://news.softpedia.com/news/endless-os-is-first-linux-distro-to-enable-s… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Purism Linux smartphone makes its $1.5 million crowdfunding goal
by Peter Reutemann 12 Oct '17

12 Oct '17

'Hundreds of millions are happy with Android smartphones and iPhones. But there are some users who want the maximum possible control over their smartphones. For those people, Purism now has the funding it needs for its free-software smartphone without a trace of proprietary code or firmware: The Purism Librem 5 smartphone. At first, it appeared Purism wouldn't make its $1.5-million goal. The Librem 5 crowdfunding campaign staggered forward at first. Them, when KDE and then GNOME threw their support behind the project, the project picked up steam.' -- source: http://www.zdnet.com/article/purism-linux-smartphone-makes-its-1-5-million-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

How to test internet speed in Linux terminal
by Peter Reutemann 12 Oct '17

12 Oct '17

'Most of us check the internet bandwidth speed whenever we connect to new network or wifi. So why not our servers! Here is a tutorial which will walk you through to test internet speed in Linux terminal. Everyone of us generally uses Speedtest by Ookla to check internet speed. Its pretty simple process for a desktop. Goto their website and just click GO button. It will scans your location and speed test with nearest server. If you are on mobile, they have their app for you. But if you are on terminal with command line interface things are little different. Lets see how to check internet speed from Linux terminal.' -- source: https://kerneltalks.com/tips-tricks/how-to-test-internet-speed-in-linux-ter… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Europe pledges support for open source government solutions
by Peter Reutemann 12 Oct '17

12 Oct '17

'Estonia has long been the digital envy of many European Union member states. An effective and open policy approach to digital government has yielded extraordinary results—from 90%+ uptake of electronic identification (E-ID) solutions to an open source e-government platform (X-Road) to meet the ever-growing expectations of IT-savvy citizens as well as other countries wanting to pool IT across borders. It was thus fitting that Estonia, the current EU presidency, brought together Ministers from 32 countries (under the umbrellas of the EU and European Free Trade Association) to adopt the Tallinn Declaration on E-Government, creating a renewed political dynamism coupled with legal tools to accelerate the implementation of a range of existing EU policy instruments (e.g., the e-Government Action Plan and ISA² program). Perhaps the most significant development for open source supporters is the explicit recognition of open source software (OSS) as a key driver towards achieving ambitious governmental digitisation goals by 2020.' -- source: https://opensource.com/article/17/10/eu-open-source Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How to Enable Fractional Scaling in Gnome
by Peter Reutemann 12 Oct '17

12 Oct '17

'Fractional scaling is practically necessary if you’re running a HiDPI display, and you want your desktop to scale uniformly to match your display. It’s always been an issue on Linux, but the latest version of the GNOME desktop has implemented a true fractional scaling feature to keep your desktop looking good. Even though GNOME 3.26 does have fractional scaling support, it wasn’t mature enough to make the release. As a result, it’s still a testing feature that you need to enable yourself.' -- source: https://www.maketecheasier.com/enable-fractional-scaling-gnome/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Sonos Speakers: Refuse Updates, They Stop Working
by Lawrence D'Oliveiro 12 Oct '17

12 Oct '17

In August, when wireless speaker maker Sonos decided to update its privacy policy to allow it to gather more data on its customers from their devices, it characterized the consequences of refusing to accept the change as being left out of future feature upgrades. ... "If you choose not to provide the functional data, you won't be able to receive software updates," a Sonos spokesperson explained at the time. "It's not like if you don't accept it, we'd be shutting down your device or intentionally bricking it." ... However, the [spokesperson] acknowledged that a few people who have updated their apps, manually or through automatic updates, have ended up with software on their handsets that isn't compatible with their firmware – which did not update because they would not accept the privacy policy change. <http://www.theregister.co.uk/2017/10/11/sonos_privacy_speakers/>

1 0

Adventures In E-Mail
by Lawrence D'Oliveiro 11 Oct '17

11 Oct '17

I am currently messing about with a virtual private server at Rimu Hosting, with a view to have it take over my e-mail serving after Vodafone turns off its provision of that service. Eventually I will have an MX record for my domain pointing at that server, so it will receive all e-mail addressed to me. Next part is, I want to periodically suck all that mail back to my main office machine. Currently I have a cron task that periodically connects to Vodafone’s POP server, fetches all the mail, and delivers it locally. When I try to do the same thing with the VPS, my local Postfix bounces the attempt at local delivery, saying something like <user(a)domain> (expanded from <user>): mail forwarding loop for user(a)domain A bit of hunting around online found this <http://postfix.1071664.n5.nabble.com/What-is-causing-this-mail-forwarding-l…> likely discussion, where the problem seems to be that the incoming message already has a “Delivered-To:” header pointing at my e-mail address, so Postfix concludes that the message is stuck in a forwarding loop, and refuses to pass it on. The exchange ends with this response from Wietse Venema, “Mr Postfix” himself: You can use header_checks to remove the problem header, but I will not help with implementing such iodiocy. Hmm, looking at the local(8) man page, it says In order to stop mail forwarding loops early, the software adds an optional Delivered-To: header with the final envelope recipient address. If mail arrives for a recipient that is already listed in a Delivered-To: header, the message is bounced. The key being that word “optional”. So it looks like I simply have to disable the addition of “Delivered-To:” on the VPS. Stay tuned.

2 3

OpenBSD 6.2 Released
by Peter Reutemann 10 Oct '17

10 Oct '17

'OpenBSD 6.2 has now been released. Some of the new features and systems include improved hardware support, vmm(4)/ vmd(8) improvements, IEEE 802.11 wireless stack improvements, generic network stack improvements, installer improvements, routing daemons and other userland network improvements, security improvements and more.' -- source: https://linux.slashdot.org/story/17/10/09/2029219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Now Has its First Open Source RISC-V Processor
by Peter Reutemann 09 Oct '17

09 Oct '17

'"SiFive has declared that 2018 will be the year of RISC V Linux processors," writes Design News. An anonymous reader quotes their report: When it released its first open-source system on a chip, the Freeform Everywhere 310, last year, Silicon Valley startup SiFive was aiming to push the RISC-V architecture to transform the hardware industry in the way that Linux transformed the software industry. Now the company has delivered further on that promise with the release of the U54-MC Coreplex, the first RISC-V-based chip that supports Linux, Unix, and FreeBSD... This latest development has RISC-V enthusiasts particularly excited because now it opens up a whole new world of use cases for the architecture and paves the way for RISC-V processors to compete with ARM cores and similar offerings in the enterprise and consumer space... "The U54 Coreplexes are great for companies looking to build SoC's around RISC-V," Andrew Waterman co-founder and chief engineer at SiFive, as well as the one of the co-creators of RISC-V, told Design News. "The forthcoming silicon is going to enable much better software development for RISC-V." Waterman said that, while SiFive had developed low-level software such as compilers for RISC-V the company really hopes that the open-source community will be taking a much broader role going forward and really pushing the technology forward. "No matter how big of a role we would want to have we can't make a dent," Waterman said. "But what we can do is make sure the army of engineers out there are empowered." ' -- source: https://hardware.slashdot.org/story/17/10/09/0019212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Review by many eyes does not always prevent buggy code
by Peter Reutemann 09 Oct '17

09 Oct '17

'There is a view that because open source software is subject to review by many eyes, all the bugs will be ironed out of it. This is a myth.' -- source: https://opensource.com/article/17/10/many-eyes Even if a project has many contributors, you will get a lot of contributors in areas that are easy to contribute in (eg spelling, expanding documentation, simple additions) and hardly anyone in the difficult areas. The less contributors in an area, the less likely they will overlap and therefore the less code review will happen. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 8

4 Best Modern Open Source Code Editors For Linux
by Peter Reutemann 09 Oct '17

09 Oct '17

According to the author of the article referenced below, these are: - Brackets - Atom - Light Table - Visual Studio Code -- source: https://itsfoss.com/best-modern-open-source-code-editors-for-linux/ No, not trying to start another flame war here. However, it doesn't hurt pointing out alternatives. After all, it is all about choice. ;-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How to Install Multiple Linux Distributions on One USB
by Peter Reutemann 09 Oct '17

09 Oct '17

'MultiBootUSB is a free and open source cross-platform application which allows you to create a USB drive with multiple Linux distributions. It also supports uninstalling any distribution at any point in time, so you can reclaim space on your drive for another one.' -- source: https://itsfoss.com/multiple-linux-one-usb/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Licensing Pirate Sites
by Lawrence D'Oliveiro 07 Oct '17

07 Oct '17

Fun fact: pirating US-made movies is not a crime in Iran ... provided you have a licence from the Government. So *licensed* pirate sites get to dob in *unlicensed* pirate sites for breaking the law. Got that? <https://www.techdirt.com/articles/20171003/09314138334/iran-cracks-down-mov…>

1 0

How to install Sogo Groupware Server on Debian
by Peter Reutemann 06 Oct '17

06 Oct '17

'Today we talk about Sogo. SOGo is a fully supported and trusted groupware server with a focus on scalability and open standards, is released under the GNU GPL/LGPL v2 and above. SOGo provides a rich AJAX-based Web interface and supports multiple native clients through the use of standard protocols such as CalDAV, CardDAV, and GroupDAV, as well as Microsoft ActiveSync. In this tutorial we'll install on Debian 8, a new version will be available soon.' -- source: https://www.howtoforge.com/tutorial/how-to-install-sogo-on-debian-8/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

4 6

OpenVPN And systemd Service Templates
by Lawrence D'Oliveiro 06 Oct '17

06 Oct '17

The OpenVPN package on Debian comes with some systemd .service files to make VPN connections easier to manage. These (all located in /lib/systemd/system/) are named openvpn-client(a).service openvpn-server(a).service openvpn.service openvpn(a).service Note the @-signs in the names of three of them: these indicate “template” services, each of which can be “instantiated” any number of times, to create multiple service “instances”. There seem to be two alternative ways of defining your OpenVPN services here: the first two .service files let you define and manage client-end and server-end connections individually, and require you to start and stop them separately, while the latter two don’t bother distinguishing between client-end and server-end (this is purely up to the respective OpenVPN configurations), they are all defined by instantiating “openvpn(a).service”. The non-template file, “openvpn.service”, can then be used to start and stop all these instances at once. (It could be that the first two represent an older way of managing connections, while the latter two are a newer, unified, more flexible way. But hey...) To illustrate how template instantiations work, I have been setting up a VPN link between a virtual private server at Rimu Hosting and the Internet router machine in my office. The VPS (with the fixed IP address) is the server end, while my office end is the client. On the server, I create a config file named /etc/openvpn/server/office.conf that appropriately defines the server end of the connection. The name “office” now automatically becomes the name of the instance: to start this, I just type systemctl start openvpn-server(a)office and systemd automatically fills in the name “office” in place of the “%i” placeholder in the contents of the openvpn-server(a).service template file, and executes the appropriate openvpn command. (One of the occurrences of %i is in the name of the config file.) At the client end, I create a config file named /etc/openvpn/client/vps.conf that appropriately defines the client end of the connection. Here the instance name is “vps”, so the systemd command to launch openvpn at the client end is systemctl start openvpn-client(a)vps and as before, instances of “%i” in the template are replaced with the instance name, “vps”. (As before, %i is also used to produce the name of the config file.) Of course, manually starting and stopping OpenVPN instances may be fine for testing, but for production use you want this to happen automatically at boot time. Just change the systemctl “start” commands to “enable”, and it’s done.

1 0

Intel Versus AMD
by Lawrence D'Oliveiro 06 Oct '17

06 Oct '17

Comparing current high-end CPU offerings from the two x86 vendors <https://arstechnica.co.uk/gadgets/2017/09/intel-core-i9-7960x-review/>, it’s clear AMD has bounced back from many years in the “also-ran” back row with its “Ryzen” and “Threadripper” offerings: The difference is that AMD bet on a massively multicore future for consumers and prosumers, designing an architecture with dramatic scaling in mind, when Intel was still umming and ahhing whether to bring six-core chips to the mainstream. So if you make heavy use of multithreaded software, for example 3D rendering, video encoding, or large software builds, then AMD currently has a significant price/performance edge. Interesting that one of the benchmarks is “Blenchmark”, which involves using Blender to render a 3D BMW car model, while another builds Google’s Chromium browser from source.

1 0

How Bulletproof Hosting Works
by Lawrence D'Oliveiro 06 Oct '17

06 Oct '17

“Bulletproof” hosting providers tout their ability to stay online in spite of the efforts of law enforcement to shut them down. Here is a report <http://www.theregister.co.uk/2017/10/05/bulletproof_hosting/> into some research detailing how they manage to keep operating: One service cited by the work is a cloud proxy network that abuses the services of legitimate providers including AWS and TenCent. The product ... typically costs $250/month/domain and maintains operations by cycling through an enormous number of providers – 230 in just nine days, according to the researchers. ... Another provider ...is still in business despite being raided three times ... Operating out of political hotspots gives some BPH operations another shield against takedown attempts.

1 0

How Do Sysadmins Manage Patches?
by Lawrence D'Oliveiro 06 Oct '17

06 Oct '17

The infamous Equifax breach (which has compromised the personal information belonging to 140 million Americans) was down to a vulnerability in an application library which had already been discovered and a patch issued months before, but the patch was never applied at the company. Why does this sort of thing keep happening? Here is a research survey <https://freedom-to-tinker.com/2017/10/04/avoid-an-equifax-like-breach-help-…> being undertaken to try to better understand the real-world constraints under which companies operate, with a view to making the software update process more effective (i.e. more likely to be followed).

1 0

HP Shared ArcSight Source Code With Russians
by Lawrence D'Oliveiro 06 Oct '17

06 Oct '17

Bruce Schneier repeats a point that should be well-known about security and Open Source, but which some still have trouble grasping: This is one of the areas where open-source software has a security edge. If everyone has access to the source code -- and security doesn't depend on its secrecy -- then there's no advantage in getting a copy. As long as companies rely on obscurity for their security, these sorts of attacks are possible and profitable. <https://www.schneier.com/blog/archives/2017/10/hp_shared_arcsi.html>

1 0

Return Of The Algorithm Monster: YouTube Auto-Promoted Conspiracy Theory Videos
by Lawrence D'Oliveiro 06 Oct '17

06 Oct '17

During the [Wall Street Journal]'s Tuesday test, searches for hot-topic terms like "Las Vegas shooting" and "NFL anthem protest," along with the term "9/11," each brought up top-five video posts, specifically listed in the site's "Top News" box, whose titles and content were loaded with debunked and misleading content. The fifth result for "Las Vegas shooting" was titled "Proof Las Vegas Shooting Was a FALSE FLAG attack—Shooter on 4th Floor" and claimed that multiple shooters had been involved, in spite of Vegas officials stating otherwise. <https://arstechnica.com/gaming/2017/10/return-of-the-algorithm-monster-yout…>

1 0

“Your Account eStatement For February”
by Lawrence D'Oliveiro 05 Oct '17

05 Oct '17

It took me a few seconds to parse this one. Dear Customer Attached is your provisional statement with the new charges. For your security it has been encrypted. This means that you will need a decoder to view your statement. Before you can view your statement, you must Download the attachment and install the decoder. Read that far, and initially thought “for crying out loud, another bloody piece of Windows-only software”. Then a few seconds later, it dawned on me that, while it claimed to come from the right bank, the from-address <JOhnEdwarD011(a)gaea.ocn.ne.jp> couldn’t be that of any bank. It wasn’t until after I’d filed it as a scam that I noticed the most glaring thing: “February”??

1 0

World’s First 14TB Drive
by Lawrence D'Oliveiro 04 Oct '17

04 Oct '17

Western Digital has announced a drive using shingled media recording to push the capacity up to 14TB <http://www.theregister.co.uk/2017/10/03/wdc_14tb_disk_drive_hs14/>. Unfortunately, this recording technique complicates (and slows down) writing, so it is meant for applications where data is read a lot, and updated less frequently.

1 0

Timeshift A System Restore Utility Tool Review
by Peter Reutemann 03 Oct '17

03 Oct '17

'TimeShift is a system restore tool for Linux. It provides functionality that is quite similar to the System Restore feature in Windows or the Time Machine tool in MacOS. TimeShift protects your system by making incremental snapshots of the file system manually or at regular automated intervals. These snapshots can then be restored at a later point to undo all changes to the system and restore it to the previous state. Snapshots are made using rsync and hard-links and the tool shares common files amongst snapshots in order to save disk space' -- source: http://www.linuxandubuntu.com/home/timeshift-a-system-restore-utility-tool-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

Quote Of The Week From UK Home Sec Amber Rudd
by Lawrence D'Oliveiro 03 Oct '17

03 Oct '17

"I don't need to understand how encryption works to understand how it's helping – end-to-end encryption – the criminals. I will engage with the security services to find the best way to combat that." <http://www.theregister.co.uk/2017/10/03/amber_rudd_still_does_not_understan…>

1 0

Asciinema – Record Terminal Sessions And Share Them On The Web
by Peter Reutemann 03 Oct '17

03 Oct '17

'I already know about recording the Terminal activities using “script” command in Unix-like systems. Today, I found out yet another similar utility called “asciinema” that can used to record Terminal sessions. Forget about the heavy screen-recording tools and/or apps. Asciinema is a fast, light-weight and open source Terminal recording tool. Unlike “script” command, Asciinema not just records our Terminal activities, but also helps us to share them on the web if necessary. You can share the recordings by copying its URL and sending it to a friend or posting it on a social network. It supports Linux, Mac OS X and *BSD.' -- source: https://www.ostechnix.com/asciinema-record-terminal-sessions-share-web/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android users rejoice! Linux kernel LTS releases are now good for 6 years
by Peter Reutemann 02 Oct '17

02 Oct '17

'A major change in the maintenance lifecycle of Linux kernels is coming. During a Linaro Connect 2017 presentation on Android's Project Treble, Googler Iliyan Malchev announced that Linux LTS (Long Term Support) kernels were switching from a two-year lifecycle to a whopping six years of support. The free and open source Linux kernel powers most of the devices around us. It's not only present in computers and servers, it also powers most of the ARM devices on earth, so it's present in Android devices, the Internet of things, and almost anything else you can call "smart." Major new versions of the Linux kernel arrive about every 70 days. Not everyone wants to upend their existing system every 70 days to upgrade to the new kernel, though, so to help with this, the Linux kernel has traditionally had a "Long Term Support (LTS)" kernel, which is supported for two years. Rather than do a major kernel bump, devices can keep running an LTS kernel and regularly get bug and security fixes, which aren't as disruptive as full releases.' -- source: https://arstechnica.com/gadgets/2017/09/android-users-rejoice-linux-kernel-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

An Ordinary User’s Adventures In Linux
by Lawrence D'Oliveiro 30 Sep '17

30 Sep '17

I helped an elderly friend set up his new PC yesterday. His previous machine, over a decade old, was running Windows XP. I had set up an Ubuntu dual-boot a few years back, and he liked playing the games. But then the Linux boot stopped working--there was a message to the effect “hd0 out of disk”, which sounded like a GRUB problem (“hd0” being a GRUB disk name, not a Linux disk name). I booted up SystemRescueCD, and found that disk space was ample. I did an fsck on the Linux volume, and found no filesystem problems. I ran a badblocks scan, and it reported several bad sectors, though oddly they only seemed to be in the Windows partition (if I interpreted the numbers correctly). Naturally I searched online, but the hits I found for that error message didn’t seem very helpful. Reinstalling GRUB didn’t help, so I concluded there were likely other hardware problems, so time for a new machine. He got an entry-level dual-core AMD box from PBTech--their own house build, in a CoolerMaster case--for well under a grand. Nothing fancy, but good enough for his needs--mainly Web browsing, e-mail, a little bit of word processing, and those games. The PBTech box came without an OS. He could have got Windows 10 for it, but considering he would be facing a learning curve coming from XP regardless, I suggested going 100% Linux for all his daily needs, to see if that would work. He could always spend the $160-odd extra on Windows later if need be. So I set it up with Linux Mint, since that seems to be everybody’s favourite :). He was already using Firefox on Windows, so moving all his Web bookmarks across was easy. The Mint install put an icon for Thunderbird on the desktop by default, so I decided to try that for e-mail. Getting his address book across from Outlook Express was fairly straightforward, once I figured out how to map the exported CSV field names correctly. The mail messages were slightly more fiddly, but I found this extension <https://addons.mozilla.org/en-US/thunderbird/addon/importexporttools/> which directly loads Microsoft’s .dbx files, and that seemed to work OK. Then he wanted to play CDs. When we put in an audio CD, it came up with options to run Banshee (media player) or Brasero (disc burner). The Banshee media player wouldn’t play the CD directly, it insisted on ripping it to the hard drive first. This was not really what he wanted. I had a look round, and found KsCD, which will indeed play audio CDs without trying to rip them to audio files first. As far as I know, this is the only GUI Linux app that can do so. So, day 1 ended on a reasonably successful note. He was already noticing how much faster the new machine was. So we’ll see how it goes from here...

5 13

Well, That’s One Way For A Site To Make Money ...
by Lawrence D'Oliveiro 30 Sep '17

30 Sep '17

Would you let a website run a Bitcoin miner in your browser? <https://www.techdirt.com/articles/20170928/11262538304/showtime-wont-explai…>

1 0

Java Security Plagued By Crappy Docs, Complex APIs, Bad Advice
by rowan schischka 29 Sep '17

29 Sep '17

>Does a system of assigning point scores to people make things better ... or worse? Gamifying an internet forum/social media; My experience with stackoverflow is it really rewards people who have a lot of spare time. The problem of measuring work is, the work will be moulded by your method of measurement. Any point/scoring/KPI system results in cheating & corner cutting in some way.

1 0

Java Security Plagued By Crappy Docs, Complex APIs, Bad Advice
by Lawrence D'Oliveiro 29 Sep '17

29 Sep '17

... researchers from Virginia Tech contend more care needs to be taken when copying code from accepted Stack Overflow answers, at least in the context of Java. ... they found that many of the answers endorsed by the Stack Overflow community led to insecure code. For example, accepted answers often recommended the use of MD5 and SHA-1 crypto algorithms – despite the fact that they're insecure and should not be used. ... They also observed that in some instances, the higher social reputation of Stack Overflow respondents led to incorrect answers being accepted over more correct fixes offered by individuals with lesser reputation scores. <http://www.theregister.co.uk/2017/09/29/java_security_plagued_stack_overflo…>

2 2

Internet Explorer Bug Leaks Whatever You Type In the Address Bar
by Peter Reutemann 28 Sep '17

28 Sep '17

'The latest version of Internet Explorer has a bug that leaks the addresses, search terms, or any other text typed into the address bar. The flaw was disclosed Tuesday by security researcher Manual Caballero. Ars Technica reports: The bug allows any currently visited website to view any text entered into the address bar as soon as the user hits enter. The technique can expose sensitive information a user didn't intend to be viewed by remote websites, including the Web address the user is about to visit. The hack can also expose search queries, since IE allows them to be typed into the address bar and then retrieved from Bing or other search services. The proof-of-concept makes it transparent that the attacking website is viewing the entered text. The hack, however can easily be modified to make the information theft completely stealthy. A proof-of-concept site shows the exploit in action.' -- source: https://tech.slashdot.org/story/17/09/28/0245228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

System76 Pop!_OS Beta Ubuntu-based Linux Distribution Now Available To Download
by Peter Reutemann 28 Sep '17

28 Sep '17

'Next month, a new era of Ubuntu begins. Unity is dead, and GNOME 3 takes over as the default desktop environment. While this change was for the best, it was still shocking for many. For a company like System76, for instance, that sells computers pre-loaded with Ubuntu, this was problematic. Why? Well, the company essentially lost control of the overall user experience by relying on vanilla Ubuntu. It was being forced to follow Canonical's path. To solve this, and regain some control, System76 has been developing its own operating system called 'Pop!_OS.' No, it is not reinventing the wheel here -- it will still use Ubuntu as a base, and GNOME will be the desktop environment. The company is customizing the operating system, however, with things like fonts, themes, and icons, to create something truly unique. This could lead to an improved user experience. Today, the first official beta of the operating system becomes available for download.' -- source: https://linux.slashdot.org/story/17/09/28/190247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The World's First Blockchain Smartphone Is In Development
by Peter Reutemann 28 Sep '17

28 Sep '17

'A company called Sirin Labs is developing an open-source smartphone that runs on a fee-less blockchain. "The Finney -- named in honor of bitcoin pioneer Hal Finney -- will be the only smartphone in the world that's fully secure and safe enough to hold cryptographic coins," reports Engadget. The company is launching a crowdsale event this October (date to be confirmed) to support the phone's development. >From the report: According to Sirin, all Finney devices (there's an all-in-one PC coming, too) will form an independent blockchain network powered by IOTA's Tangle technology. The network will operate without centralized backbones or mining centers cluttering up the transaction process, using the SRN token as its default currency (only SRN token holders will be able to purchase the device). And it'll all run on a Sirin operating system specially designed to support blockchain applications such as crypto wallets and secure exchange access. The phone comes with all the bells and whistles you'd expect from a device with a $1,000 price tag, including a 256GB internal memory and 16MP camera, plus a hefty suite of security measures. ' -- source: https://mobile.slashdot.org/story/17/09/27/0749240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla's 'Firefox Quantum' Browser Challenges Chrome In Speed
by Peter Reutemann 28 Sep '17

28 Sep '17

'The next version of Firefox, aptly named Firefox Quantum, is getting a big speed boost. "The idea, of course, is that the upcoming version 57 is a quantum leap over predecessors -- or, in the words of Mozilla CEO Chris Beard, a 'big bang,'" reports CNET. While Mozilla stopped short of declaring victory over Chrome, Nick Nguyen, vice president of Firefox product, said Firefox Quantum's page-load speed "is often perceivably faster" while using 30 percent less memory. From the report: The new Firefox revamp includes lots of under-the-covers improvements, like Quantum Flow, which stamps out dozens of performance bugs, and Quantum CSS, aka Stylo, which speeds up website formatting. More obvious from the outside is a new interface called Photon that wipes out Firefox's rounded tabs and adds a "page action" menu into the address bar. It also builds in the Pocket bookmarking service Mozilla acquired and uses it to recommend sites you might be interested in. A screenshot tool generates a website link so you can easily share what you see by email or Twitter. Mozilla even simplified the Firefox logo, a fox wrapping itself around the globe. More improvements are in the pipeline for later Firefox versions, too, including Quantum Render, which should speed up Firefox's ability to paint web pages onto your screen. ' -- source: https://news.slashdot.org/story/17/09/27/0727226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Distrowatch opinion piece about DRM in browsers
by Ian Young 27 Sep '17

27 Sep '17

Some may not have seen an opinion piece in this week's Distrowatch Weekly. Link on front page to article by one Jesse Smith who does most of the reviews on DW. The W3C, encrypted media and software freedom ~ Ian Y

3 2

Manjaro Linux Discontinues 32-bit Support
by Peter Reutemann 26 Sep '17

26 Sep '17

'Recently, Philip, the lead developer of Manjaro Linux, announced that the project would be dropping support for the 32-bit architecture. He said that the reason for the move was “due to the decreasing popularity of i686 among the developers and the community”. While Manjaro 17.0.3 is the last release to have a 32-bit ISO, current 32-bit installs will receive a short window of continued support. During September and October, 32-bit package will continue to be updated. However, starting in November, packages will be limited to 64-bit. After that period, 32-bit installs of Manjaro will essentially be unsupported.' -- source: https://itsfoss.com/manjaro-drops-32-bit-support/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Krita 3.3 Digital Painting App Promises Better HiDPI Support on Linux & Windows
by Peter Reutemann 26 Sep '17

26 Sep '17

'In the release announcement, Krita devs reveal the fact that they were forced to bump the version number from 3.2.x to 3.3.x because the upcoming Krita 3.3 release will be introducing some important changes for Windows platforms, such as support for the Windows 8 event API, thus supporting the n-trig pen in Surface laptops. "Alvin Wong has implemented support for the Windows 8 event API, which means that Krita now supports the n-trig pen in the Surface line of laptops (and similar laptops from Dell, HP and Acer) natively. This is still very new, so you have to enable this in the tablet settings," said the devs.' -- source: http://news.softpedia.com/news/krita-3-3-digital-painting-app-promises-bett… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0