- wlug - list.wlug.org.nz

Microsoft SQL Server For Linux?
by Lawrence D'Oliveiro 07 Mar '16

07 Mar '16

From <http://arstechnica.com/information-technology/2016/03/sql-server-for-linux-…>: The announcement implies [one of] two things. Either there is a large number of Linux-using corporations out there that are desperate for SQL Server's feature set (as opposed to open source databases such as PostgreSQL, MySQL, or MaxDB, or the proprietary ones such as IBM's DB2 and, of course, Oracle's Oracle), or there is a large number of SQL Server-using organizations out there that are keen to ditch the cost of their Windows licenses but happy to continue to pay for their SQL Server licenses. Neither seems obvious to us. Nor to me...

1 0

Raspberry Pi 3
by William Mckee 02 Mar '16

02 Mar '16

Hello, Raspberry Pi 3 was just released. The highlights of the model: Raspberry Pi 3 - Model B Technical Specification Broadcom BCM2387 chipset 1.2GHz Quad-Core ARM Cortex-A53 802.11 bgn Wireless LAN and Bluetooth 4.1 (Bluetooth Classic and LE) 1GB RAM 64 Bit CPU I think I am most excited about the 64 Bit CPU. What's also amazing is they have kept the same price as the Raspberry Pi 2 - 35 pounds. I'm happy with my Raspberry Pi 2 setup but keen to pick one of these up (still can't get a zero). Blog post: https://www.raspberrypi.org/blog/raspberry-pi-3-on-sale/ cheers, William.

3 7

LibreSSL Unaffected By DROWN
by Peter Reutemann 02 Mar '16

02 Mar '16

"The OpenBSD people forked and heavily cleaned up OpenSSL to create LibreSSL due to dissatisfaction with the maintainance of OpenSSL, culminating in the heartbleed bug. The emphasis has been on cleaning up the code and improving security, which includes removing things such as SSL2 which has fundamental security flaws. As a result, LibreSSL is not affected by the DROWN bug. LibreSSL is largely compatible with OpenSSL. The main exceptions are in the cases where programs use insecure functions removed from libreSSL, or require bug compatiblity with OpenSSL." -- source: http://it.slashdot.org/story/16/03/02/1620221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

SCO Is Undeniably, Reliably Dead
by Peter Reutemann 01 Mar '16

01 Mar '16

"On Friday, IBM and SCO filed an agreement with the US district court in Utah to accept a ruling of dismissal of the last remaining claims by SCO against IBM." -- source: http://yro.slashdot.org/story/16/03/01/154214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

A Third of All HTTPS Websites Vulnerable To DROWN Attack
by Peter Reutemann 01 Mar '16

01 Mar '16

"The OpenSSL project has released versions 1.0.2g and 1.0.1s to address a high severity security issue known as the DROWN attack (CVE-2016-0800) which allows attackers to break HTTPS and steal encrypted information. In layman terms, the attack uses an improperly patched issue (from 1998) in SSL to attack websites using the more modern TLS protocol. Servers where admins use SSL and TLS are in danger. Additionally, servers where only TLS is used, but the admins are sharing the same certificate for other servers where they have SSL, are also vulnerable, since the attack targets RSA, employed in both SSL and TLS. The entire attack is also easy to carry out, costing only $440 on Amazon EC2." -- source: http://it.slashdot.org/story/16/03/01/1743237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Pi used in FM radio transmitters in Syria
by Ian Young 01 Mar '16

01 Mar '16

Hope this is of some interest - not a Pi application I have heard about hitherto. http://www.bbc.com/news/technology-35690688

1 0

OpenShot 2.0 Beta Is Out
by Lawrence D'Oliveiro 29 Feb '16

29 Feb '16

Initial verdict on the results of the crowd-funded development: “The real winners here are Linux users who now have an editor that's on par with Apple's iMovie (even more powerful than recent versions of iMovie) and bears considerable resemblance to the industry-standard Final Cut Pro.” <http://www.theregister.co.uk/2016/02/29/openshot_2_review/>

2 1

Skype On Linux Is Broken
by Lawrence D'Oliveiro 26 Feb '16

26 Feb '16

Seems like the Linux version of Skype has lost the ability to connect with Skype on other platforms. <http://www.theregister.co.uk/2016/02/25/linux_skype_outage_outrage/>

1 0

Linux On Windows?
by Lawrence D'Oliveiro 25 Feb '16

25 Feb '16

Microsoft has abandoned its “Astoria” project to allow Android apps to run essentially unmodified on Windows. <http://arstechnica.com/information-technology/2016/02/microsoft-confirms-an…> Nevertheless, one interesting by-product of this effort remains: Tucked away inside the Windows 10 Insider Preview is a Linux-like operating system. The big question is what Microsoft is actually going to do with it.

1 0

Software Freedom Conservancy: Distributing Linux With ZFS Is Illegal
by Peter Reutemann 25 Feb '16

25 Feb '16

'Phoronix reports that Bradley M. Kuhn and Karen M. Sandler at the Software Freedom Conservancy (SFS) have posted a blog post today arguing that Canonical's plan to distribute Ubuntu 16.04 LTS "Xenial Xerus" with support for the ZFS file system violates the Linux kernel's GPLv2 license. On February 18, Dustin Kirkland at Canonical wrote on his blog: "We at Canonical have conducted a legal review, including discussion with the industry's leading software freedom legal counsel, of the licenses that apply to the Linux kernel and to ZFS. And in doing so, we have concluded that we are acting within the rights granted and in compliance with their terms of both of those licenses...The CDDL cannot apply to the Linux kernel because zfs.ko is a self-contained file system module — the kernel itself is quite obviously not a derivative work of this new file system. And zfs.ko, as a self-contained file system module, is clearly not a derivative work of the Linux kernel but rather quite obviously a derivative work of OpenZFS and OpenSolaris. Equivalent exceptions have existed for many years, for various other stand alone, self-contained, non-GPL kernel modules. Our conclusion is good for Ubuntu users, good for Linux, and good for all of free and open source software." The SFS's blog post of today states: "We are sympathetic to Canonical's frustration in this desire to easily support more features for their users. However, as set out below, we have concluded that their distribution of zfs.ko violates the GPL."' -- source: http://linux.slashdot.org/story/16/02/25/1846230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Carnegie Mellon University Attacked Tor, Was Subpoenaed By Feds
by Peter Reutemann 25 Feb '16

25 Feb '16

'Back in November 2015 it was speculated that Carnegie Mellon University (CMU) helped the FBI attack the TOR network. Now, both the name of the university and the existence of a subpoena have been confirmed in a recent filing in one of the affected criminal cases: "The record demonstrates that the defendant's IP address was identified by the Software Engineering Institute ("SEI") of Carnegie Mellon University (CMU") [sic] when SEI was conducting research on the Tor network which was funded by the Department of Defense ("DOD")," an order filed on Tuesday in the case of Brian Farrell reads. Between January and July 2014, a large number of malicious nodes operated on the Tor network, with the purpose, according to the Tor Project, of deanonymising dark web sites and their users. The attack relied on a set of vulnerabilities in the Tor software—which have since been patched—and according to one source, the technique could unmask new hidden services within two weeks.' -- source: http://yro.slashdot.org/story/16/02/25/172245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Mint Hack Is an Indicator of a Larger Problem
by Peter Reutemann 25 Feb '16

25 Feb '16

"On February 20th, a hacker working under the handle 'Peace' took control of the website of Linux Mint, a popular Linux distribution derived from Ubuntu (and Debian) targeted toward non-technical users and power users unhappy with modern desktop environments. While these attacks are regrettable, and part of an infrastructure problem rather than a problem with the distribution itself, it increasingly appears that the Linux Mint team is spread too thin when it comes to security. The distribution itself blacklists updates that work perfectly in Ubuntu and Debian, and the graphical utilities don't update the kernel. Because the value added by Linux Mint is in Cinnamon, why do the developers need to distribute a broken version of Ubuntu when the Cinnamon DE could be distributed as an Ubuntu spin?" -- source: http://linux.slashdot.org/story/16/02/24/1924229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Virtual Ethernet Bug Delivers Corrupt TCP/IP Data
by Peter Reutemann 22 Feb '16

22 Feb '16

"Vijay Pandurangan from Twitter warns about a Linux kernel bug that causes containers using Virtual Ethernet devices for network routing to not check TCP checksums. Examples of software stacks that use Virtual Ethernet devices are Docker on IPv6, Kubernetes, Google Container Engine and Mesos. The kernel flaw results in applications incorrectly receiving corrupt data in a number of situations, such as with bad networking hardware. The bug dates back at least 3 years or more – it is present in kernels as far back as the Twitter engineering team has tested. Their patch has been reviewed and accepted into the kernel, and is currently being backported to -stable releases back to 3.14 in various distributions. If you use containers in your setup, Pandurangan recommends that you deploy a kernel with this patch." -- source: http://linux.slashdot.org/story/16/02/22/1715202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Knoppix image
by Ian Young 21 Feb '16

21 Feb '16

Hi Peter, Yes, I have the image thanks. ~ Ian Y

2 1

Timeline Of Events: Linux Mint Website Hack That Distributed Malicious ISOs
by Peter Reutemann 21 Feb '16

21 Feb '16

"The Linux Mint website was hacked last night and was pointing to malicious ISOs that contained an IRC bot known as TSUNAMI, used as part of an IRC DDoSing botnet. While the Linux Mint team says they were hacked via their WordPress site, security experts have discovered that their phpBB forum database was put up for sale on the Dark Web at around the same time of the hack. Also, it seems that after the Linux Mint team cleaned their website, the hackers reinfected it, which caused the developers to take it down altogether." -- source: http://linux.slashdot.org/story/16/02/21/1548228 Ouch... Maybe time to switch to a Nikola generated site... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

knoppix live install
by Ian Young 21 Feb '16

21 Feb '16

If there is some free time at Monday's meeting perhaps we could try an install of what i think is the latest Knoppix iso to USB, live as it happens. ~ Ian Y

2 1

World’s cheapest Android smartphone goes on sale for just $3.67
by Peter Reutemann 20 Feb '16

20 Feb '16

"An Android-based smartphone costing about the same as a cup of coffee has been launched today in India by the local company Ringing Bells. The Freedom 251 costs 251 rupees (about £2.50 or $4), comes with a one-year guarantee, and has surprisingly decent specifications, on paper at least. The phone's price is not subsidised by a carrier contract: it really costs £2.50." -- source: http://arstechnica.com/gadgets/2016/02/worlds-cheapest-android-smartphone-g… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

TP-Link Begins Lockdown of Firmware In Response To FCC
by Peter Reutemann 18 Feb '16

18 Feb '16

'In response to an FCC rule that requires manufacturers to lock down computing devices (routers, PCs, phones) to prevent modification if they have a "modular wireless radio," TP-Link has begun locking down its routers to prevent firmware not signed by TP-Link from being installed. This essentially prevents open source OSs (OpenWRT, for example) from being used on routers.' -- source: http://yro.slashdot.org/story/16/02/18/1423216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Stealing Keys From a Laptop In Another Room — and Offline
by Peter Reutemann 18 Feb '16

18 Feb '16

'Motherboard carries a report that with equipment valued at about $3,000, a group of Israeli researchers have been able to extract cryptographic keys from a laptop that is not only separated by a physical wall, but protected by an air gap. This, they say, "is the first time such an approach has been used specifically against elliptic curve cryptography running on a PC." From the article: The method is a so-called side-channel attack: an attack that doesn't tackle an encryption implementation head on, such as through brute force or by exploiting a weakness in the underlying algorithm, but through some other means. In this case, the attack relies on the electromagnetic outputs of the laptop that are emitted during the decryption process, which can then be used to work out the target's key. Specifically, the researchers obtained the private key from a laptop running GnuPG, a popular implementation of OpenPGP. (The developers of GnuPG have since released countermeasures to the method. Tromer said that the changes make GnuPG âoemore resistant to side-channel attack since the sequence of high-level arithmetic operations does not depend on the secret key.â)' -- source: http://it.slashdot.org/story/16/02/18/1626205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Meet Linux's Little Brother Zephyr, a Tiny Open Source IoT RTOS
by Peter Reutemann 18 Feb '16

18 Feb '16

"The Linux Foundation has launched the Zephyr Project, to foster an open source, small footprint, modular, scalable, connected, real-time OS for IoT devices. The Zephyr Project's RTOS implements both a small footpoint microkernel and an even tinier nanokernel, and is the result of Wind River contributing its Rocket RTOS kernel to the Zephyr Project. (Wind's Rocket RTOS will now become a downstream commercial distribution based on Zephyr sources.) To get a sense of Zephyr's benefit, its nanokernel is said to be able to run in as little as 10KB of RAM on 32-bit microcontrollers, whereas a minimalistic Linux implementation like uClinux needs upwards of 200KB. The Linux Foundation hopes to see cross-project collaboration between the Zephyr and Linux communities. Technical details are at the Zephyr site." -- source: http://linux.slashdot.org/story/16/02/18/1522219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Magnitude of glibc Vulnerability Coming To Light
by Peter Reutemann 18 Feb '16

18 Feb '16

"The glibc vulnerability disclosed this week has some experts on edge because of how DNS can leveraged in exploits. Dan Kaminsky said that while man-in-the-middle attacks are one vector, it would appear that it's also possible to exploit the bug and attack most Linux servers via DNS caching-only servers. 'This would be substantially worse if it went through the caching ecosystem; 99 percent of attack vectors go through that system,' Kaminsky said. Glibc, or the GNU C library, is used by most flavors of Linux and also a number of popular web services and frameworks, giving attacks potentially massive horizontal scale. The major Linux distros have patched and pushed updates to servers; source code is also available for homegrown Linux builds." -- source: http://linux.slashdot.org/story/16/02/18/157239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fwd: [NZLUG] Fwd: [SECURITY] [DSA 3481-1] glibc security update
by Peter Reutemann 18 Feb '16

18 Feb '16

Apologies for cross-posting... Cheers, Peter ---------- Forwarded message ---------- From: Mark Foster <blakjak(a)blakjak.net> Date: Thu, Feb 18, 2016 at 1:50 PM Subject: Re: [NZLUG] Fwd: [SECURITY] [DSA 3481-1] glibc security update To: NZ Linux Users Group <nzlug(a)lists.nzoss.org.nz> And just to illustrate that, CERT is compiling a list of vendor's position statements etc, it's quite a list already: https://www.kb.cert.org/vuls/id/457759 On 18/02/2016 1:49 p.m., Mark Foster wrote: This is a widespread risk to pretty much every linux based system out there. I hope you're all aware of this one and taking action to patch or protect your systems. -------- Forwarded Message -------- Subject: [SECURITY] [DSA 3481-1] glibc security update Resent-Date: Tue, 16 Feb 2016 14:18:54 +0000 (UTC) Resent-From: debian-security-announce(a)lists.debian.org Date: Tue, 16 Feb 2016 14:18:27 +0000 From: Salvatore Bonaccorso <carnil(a)debian.org> Reply-To: debian-security(a)lists.debian.org To: debian-security-announce(a)lists.debian.org -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3481-1 security(a)debian.org https://www.debian.org/security/ Florian Weimer February 16, 2016 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : glibc CVE ID : CVE-2015-7547 CVE-2015-8776 CVE-2015-8778 CVE-2015-8779 Debian Bug : 812441 812445 812455 Several vulnerabilities have been fixed in the GNU C Library, glibc. The first vulnerability listed below is considered to have critical impact. CVE-2015-7547 The Google Security Team and Red Hat discovered that the glibc host name resolver function, getaddrinfo, when processing AF_UNSPEC queries (for dual A/AAAA lookups), could mismanage its internal buffers, leading to a stack-based buffer overflow and arbitrary code execution. This vulnerability affects most applications which perform host name resolution using getaddrinfo, including system services. CVE-2015-8776 Adam Nielsen discovered that if an invalid separated time value is passed to strftime, the strftime function could crash or leak information. Applications normally pass only valid time information to strftime; no affected applications are known. CVE-2015-8778 Szabolcs Nagy reported that the rarely-used hcreate and hcreate_r functions did not check the size argument properly, leading to a crash (denial of service) for certain arguments. No impacted applications are known at this time. CVE-2015-8779 The catopen function contains several unbound stack allocations (stack overflows), causing it the crash the process (denial of service). No applications where this issue has a security impact are currently known. While it is only necessary to ensure that all processes are not using the old glibc anymore, it is recommended to reboot the machines after applying the security upgrade. For the stable distribution (jessie), these problems have been fixed in version 2.19-18+deb8u3. For the unstable distribution (sid), these problems will be fixed in version 2.21-8. We recommend that you upgrade your glibc packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce(a)lists.debian.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJWwy2KAAoJEAVMuPMTQ89EIIIP/1Sa7Mlc0xJ0b4v5QFf1UL1N zLPxw/JXbExR1sX9RUt8mCzdOoz5rcwaR8yyvGZS0A+NwtSgLr3sNKweMrrf3yaH Ul7vziRfgcNjnWdN5+aeHp+lIUEIgCbT6JJVqt/lfXO8/vo23V2EZKVTtnNt7oR6 FmhSW73+jt8v9qxdHVDhE0ivXhs7Neeo7oLfolAX9n+ZFjRhT68ERRTyPaq3dnfS PdDLdnn5V+g+3y9zjurGNvmSp7OcOq7aKclEFtQBoEF6ZFmqhUYkuOmAkhlQlMMX nJGqZYrY2pgz1pHZZXJGY31WIYDaYR0cSIoe/c49ejT+Kug9IMLBMruvwAglX+gd IAFflJ8Iar9StiPwMz3HloLbNT1vVCvlvdbEJiMrgpTMRUyacG6GfHVid2tso+n7 ZpWnxI2B62lwJU/Jq2yxRkIVtGs9go7lvGEmUs/T4Pl87otULBAfGD0xXtt2vY+A hrEbjCgNMrbrjiCdm/w2MW+hLwiXgRn617Q7w9e5gWnSjIEpybrrwKAR1QsDxxNM zwjgwQdTEivJ5dtXQdwkHg+2ba1/gqKqMU9b0rlBf/YF0e73I/FTaDu1nEgOX4En kq6ZwrPBlptv0kCR0EtyX6xmt4Q3j8tF1IwPyEwfiyPKcN0cxuk7LLILc7ewPnGU pPKkk9EqhPWAP7+Ufo9p =lzjt -----END PGP SIGNATURE----- _______________________________________________ NZLUG mailing list NZLUG(a)lists.nzoss.org.nz http://lists.nzoss.org.nz/mailman/listinfo/nzlug _______________________________________________ NZLUG mailing list NZLUG(a)lists.nzoss.org.nz http://lists.nzoss.org.nz/mailman/listinfo/nzlug -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome OS distro for regular PCs can now dual-boot with Windows
by Peter Reutemann 18 Feb '16

18 Feb '16

"Today, Neverware announced a new version of CloudReady aimed at schools and individuals who want to try the software on their PCs without losing the capability to run Windows. CloudReady version 45.3 can be installed on any system with an existing UEFI-mode installation of Windows 7, 8, or 10 and 32GB of free disk space. You can find detailed installation directions on Neverware's site." -- source: http://arstechnica.com/gadgets/2016/02/chrome-os-distro-for-regular-pcs-can… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apple Being Ordered To Help Break Into San Bernardino Shooter’s Phone
by Lawrence D'Oliveiro 17 Feb '16

17 Feb '16

It is being widely reported in the news that a judge has told Apple to give investigators access to encrypted data on an Iphone belonging to one of the perpetrators in the San Bernardino shooting case. Current versions of IOS do not allow Apple to break this encryption. However, it seems Apple is actually being asked to help bypass the feature that autowipes the phone after 10 failed attempts to enter the decryption key, thereby allowing the key to be broken by brute force. This feature is supposed to be under the control of the owner of the phone, not Apple. But what Apple can give, it can take away. It may be possible that Apple could load a software update (perhaps a temporary one) into the phone to override control of this feature. <https://www.techdirt.com/articles/20160216/17393733617/no-judge-did-not-jus… backdoor.shtml>

2 2

Backblaze Report On Hard Drive Failures In 2015
by Lawrence D'Oliveiro 17 Feb '16

17 Feb '16

Backblaze has posted another report on the reliability of their hard drives <https://www.backblaze.com/blog/hard-drive-reliability-q4-2015/>. As pointed out in the Ars Technica analysis <http://arstechnica.com/information-technology/2016/02/hgst-hard-disks-still…>, HGST is owned by WD, so WD is simultaneously responsible for the most and least reliable brands of drives in the report. An overall statistic of 6% failure rate per year seems a reasonable conclusion. Also it seems like 3-4TB is still the sweet spot.

1 0

WLUG meeting next Monday
by Peter Reutemann 17 Feb '16

17 Feb '16

Hi everyone We have a meeting coming up next Monday: "Peter Reutemann will demo Alpine Linux, a security-oriented, lightweight Linux distribution based on musl libc and busybox. Discussion of March meeting: potential introduction to git version control, in conjunction with CS^3 student society from Computer Science. Discussion of meetup.com's new pricing strategy: going up from USD 12 per 6 months to USD 29.94 per 6 months. Feel like demoing another distro? Or some other great open-source tool (doesn't necessarily have to be Linux)? Then let me know." http://www.meetup.com/WaikatoLinuxUsersGroup/events/228718557/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 4

New Warnings In GCC 6
by Lawrence D'Oliveiro 16 Feb '16

16 Feb '16

Couple of interesting blog posts <https://gnu.wildebeest.org/blog/mjw/2016/02/15/looking-forward-to-gcc6-many…>, <https://gnu.wildebeest.org/blog/mjw/2016/01/09/looking-forward-to-gcc6-nice…> about new dubious-looking constructs that the GCC 6 C and C++ compilers can pick up. I particularly like the latter, which warns against a situation like the following: if (cond) statement_guarded_by_cond; statement_not_guarded_by_cond; /* though it may look like it is */ Of course, this only works in a language that allows the redundancy of having both bracketing symbols and indentation. This is why trying to get rid of one, and having the other do duty for both--is such a bad idea.

2 2

UEFI aka Ooof!!y links - more than a lifetime to know
by Ian Young 13 Feb '16

13 Feb '16

Following a recent refererence to the dread Oofy at a LUG meeting and after looking at a couple of Intel PC type machines using this boot method I am pretty well totally baffled. The people of Arch however know it all. Or as much as can be known. https://wiki.archlinux.org/index.php/Unified_Extensible_Firmware_Interface#… I seem to have a vague recollection that Sun once used Ooofy. And Apple of course was an early adopter. Or am I thinking of Open Firmware? Somewhat related. Hmmm. https://en.wikipedia.org/wiki/Unified_Extensible_Firmware_Interface https://en.wikipedia.org/wiki/Open_Firmware

1 0

The Truth Behind “true”
by Lawrence D'Oliveiro 11 Feb '16

11 Feb '16

Among the many useful commands you will find as standard on any POSIX system is “true”. This command does absolutely nothing, but returns a successful exit status. (There is also “false”, which also does nothing, but always returns a failure status. If anyone is curious as to how you would make use of these in shell scripts, just ask.) This page <http://trillian.mit.edu/~jc/humor/ATT_Copyright_true.html> gives the history of the “true” command from the original AT&T Unix--it was essentially a shell script that did absolutely nothing at all. Yet AT&T claimed copyright on it. This article <http://www.theregister.co.uk/2016/02/10/line_break_ep2/> includes, among its examples of supposedly bad code, the full source of the GNU “true” program (which actually also shares its source with the “false” program), which runs to 80 lines, as compared to the version from OpenBSD, which is just four lines (including a blank line and comments). But as pointed out in the previous link, the GNU version uses less memory and runs faster.

2 1

San Francisco To Open-Source Its Voting Software
by Lawrence D'Oliveiro 11 Feb '16

11 Feb '16

The San Francisco Elections Commission has resolved to “support the development and certification of an open source voting system running on commercial off-the-shelf hardware; and to request that the Mayor and Board of Supervisors initiate and fund a project to develop and certify such a system for use in San Francisco”. <http://www.theregister.co.uk/2016/02/10/san_francisco_to_open_source_voting…> Contrast this with ongoing unsuccessful attempts to get access to the software used for Australian federal elections under its Freedom Of Information Act <http://www.theregister.co.uk/2015/12/13/aec_easycount_foi_decision/>: [Hobart lawyer Michael] Cordover sought the source code because Australia's 2013 election produced some irregularities. What software do we use in NZ?

2 1

Docker Images To Be Based On Alpine Linux
by Peter Reutemann 07 Feb '16

07 Feb '16

"Docker container sizes continue a race to the bottom with a couple of environments weighing in at less than 10MB. Following on the heels of this week's story regarding small images based on Alpine Linux, it appears that the official Docker images will be moving from Debian/Ubuntu to Alpine Linux in the near future. How low will they go?" -- source: http://linux.slashdot.org/story/16/02/06/0433228 Alpine Linux is rather small, coming in at 82MB as ISO download: http://www.alpinelinux.org/ Anybody feel like giving a demo at the next meeting? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Open Source Pioneer Michael Tiemann On the Myth of the Average
by Peter Reutemann 03 Feb '16

03 Feb '16

'In a recent article, Michael Tiemann, one of the world's first open source entrepreneurs and VP of Open Source Affairs at Red Hat, highlights an example from the 1950s US Air Force where the "myth of the average resulted in a generation of planes that almost no pilots could reliably fly, and which killed as many as 17 pilots in a single day." He uses this example to argue that IT leaders who think that playing it safe means being as average as possible in order to avoid risks (i.e. "Buy what others are buying. Deploy what others are deploying. Manage what others are managing.") may be making IT procurement and strategy decisions based on flawed data. Instead, Tiemann says that IT leaders should understand elements of differentiation that are most valuable, and then adopt the standards that exploit them. "Don't aim for average: it may not exist. Aim for optimal, and use the power of open source to achieve what uniquely benefits your organization."' -- source: http://it.slashdot.org/story/16/02/03/177233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

New Hack Shrinks Docker Containers
by Peter Reutemann 03 Feb '16

03 Feb '16

'Promising "uber tiny Docker images for all the things," Iron.io has released a new library of base images for every major language optimized to be as small as possible by using only the required OS libraries and language dependencies. "By streamlining the cruft that is attached to the node images and installing only the essentials, they reduced the image from 644 MB to 29MB,"explains one technology reporter, noting this makes it quicker to download and distribute the image, and also more secure. "Less code/less programs in the container means less attack surface..." writes Travis Reeder, the co-founder of Iron.io, in a post on the company's blog. "Most people who start using Docker will use Docker's official repositories for their language of choice, but unfortunately if you use them, you'll end up with images the size of the Empire State Building..."' -- source: http://developers.slashdot.org/story/16/02/03/221231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chromodo Browser Disables Key Web Security
by Peter Reutemann 03 Feb '16

03 Feb '16

"A Google Security Research update has claimed that Comodo's internet browser Chromodo, based on the open-source project Chromium, contains significant security failings and puts its users at risk. This week's Google alert suggested that the Chromodo browser – available as a standalone download, as well as part of the company's Security package – is less secure than it promises. According to analysis, the browser is disabling the Same Origin policy, hijacking DNS settings, and replacing shortcuts with Chromodo links, among other security violations." -- source: http://it.slashdot.org/story/16/02/03/1416236 NB: I know that the browser is for Windows, but you might know someone who's using it, blindly trusting the marketing of Comodo. Chromium builds are available here: https://www.chromium.org/getting-involved/dev-channel Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Crypto flaw was so glaring it may be intentional eavesdropping backdoor
by Peter Reutemann 03 Feb '16

03 Feb '16

"Socat is a more feature-rich variant of the once widely used Netcat networking service for fixing bugs in network applications and for finding and exploiting security vulnerabilities. One of its features allows data to be transmitted through an encrypted channel to prevent it from being intercepted by people monitoring the traffic. Amazingly, when using the Diffie-Hellman method to establish a cryptographic key, Socat used a non-prime parameter to negotiate the key, an omission that violates one of the most basic cryptographic principles." -- source: http://arstechnica.com/security/2016/02/crypto-flaw-was-so-glaring-it-may-b… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Fwd: [NZOSS OpenChat] TPPA appears to compromise NZ data sovereignty
by Peter Reutemann 02 Feb '16

02 Feb '16

Apologies for cross-posting. Cheers, Peter ---------- Forwarded message ---------- From: Dave Lane <president(a)nzoss.org.nz> Date: Wed, Feb 3, 2016 at 10:22 AM Subject: [NZOSS OpenChat] TPPA appears to compromise NZ data sovereignty To: NZOSS Open Chat List <openchat(a)groups.nzoss.org.nz> Hi all, Thanks to Grant Paton-Simpson for bringing clause 14.13.2 of the Trans-Pacific Partnership Agreement to my attention... I've just written a quick post to explain the potential implications of it, as I see it: https://nzoss.org.nz/content/tppa-compromises-nz-data-sovereignty Any comments or corrections (or alternative interpretations) to the article would be appreciated. If you think it is a cause for concern, I encourage you to promote it, particularly among those who will understand the implications. The TPPA is slated for signing tomorrow. We need to make a BIG stink about this very unfortunate turn of events. Cheers, Dave -- Dave Lane, President, New Zealand Open Source Society e: president(a)nzoss.org.nz m: 021 229 8147 w: http://nzoss.org.nz ―― View topic http://groups.nzoss.org.nz/r/topic/7bw4I2juaLBbCQycHlZriA Leave group mailto:openchat(a)groups.nzoss.org.nz?subject=Unsubscribe Start groups https://OnlineGroups.net -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The State Of Blender: “The Art Of Open Source”
by Lawrence D'Oliveiro 02 Feb '16

02 Feb '16

An article <https://www.blender.org/media-exposure/the-art-of-open-source/> written for the November 2015 issue of “Linux Format” magazine covers the origins and increasing popularity of Blender. But more than popularity, it seems it is now (somewhat grudgingly) winning actual respect among 3D artists. Pixar even lists Blender as one of the packages it officially supports in the latest release of RenderMan. My main beef with the article is the writer keeps saying “commercial” when he means “proprietary”, seemingly reserving the use of “proprietary” for when he means “in-house”. If you don’t think Blender can be “commercial”, just look at some of its users mentioned in the article. A quote from one of those users: “In 10 years of using proprietary 3D software, we never received usable support from either software vendor or reseller – except on problems with registering our licences.”

1 0

Classic Linux Joke Even Less Funny Than Previously Thought
by Lawrence D'Oliveiro 02 Feb '16

02 Feb '16

On some UEFI-based systems, the old “rm -rf /” trick for destroying your system may do more than annihilate your software installation, it may also brick your machine. This is because it is possible to mount a virtual kernel filesystem that gives access to persistent UEFI configuration data read/write, and deleting this data makes it impossible for your machine to boot. <http://www.theregister.co.uk/2016/02/02/delete_efivars_linux/>

1 0

Towards A Ten-Million-Core Supercomputer
by Lawrence D'Oliveiro 02 Feb '16

02 Feb '16

Europe’s ExaNeSt project is putting together a small prototype of what will eventually be a supercomputer with 10 million ARM cores. Why ARM? Because the performance bottleneck in a super is not the CPUs, but the interconnect between them. So it makes sense to use more power-efficient cores to keep the overall cost down. The main cost of running a super, or indeed any massively-multiprocessor installation (data centre, cloud service, render farm etc) is the electricity bill. <http://www.theregister.co.uk/2016/02/02/buddy_can_you_spare_ten_meeelion_ar…>

1 0

Using IPv6 with Linux? You’ve likely been visited by Shodan and other scanners
by Peter Reutemann 02 Feb '16

02 Feb '16

"One of the benefits of the next-generation Internet protocol known as IPv6 is the enhanced privacy it offers over its IPv4 predecessor. With a staggering 2128 (or about 3.4×1038) theoretical addresses available, its IP pool is immune to the types of systematic scans that criminal hackers and researchers routinely perform to locate vulnerable devices and networks with IPv4 addresses. What's more, IPv6 addresses can contain regularly changing, partially randomized extensions. Together, the IPv6 features cloak devices in a quasi anonymity that's not possible with IPv4. Now, network administrators have discovered a clever way that scanners are piercing the IPv6 cloak of obscurity. By setting up an IPv6-based network time protocol service most Internet-connected devices rely on to keep their internal clocks accurate, the operators can harvest huge numbers of IPv6 addresses that would otherwise remain unknown. The server operators can then scan hundreds or thousands of ports attached to each address to identify publicly available surveillance cameras, unpatched servers, and similar vulnerabilities." -- source: http://arstechnica.com/security/2016/02/using-ipv6-with-linux-youve-likely-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Bloat: How and Why UNIX Grew Up (and Out)
by Lawrence D'Oliveiro 31 Jan '16

31 Jan '16

The original versions of common utilities like “cat”, “grep” and “ls” on V6 Unix from 1976 could measure their disk and RAM usage in bytes in just five figures. A few decades later, and the corresponding programs on a modern Linux distro are orders of magnitude larger. Why? Here is a detailed (and technical) analysis from the 2012 Linux.conf.au <https://www.youtube.com/watch?v=Nbv9L-WIu0s> which takes you step by step through all the contributions to the difference. They isolated most of these by modifying the code, selectively taking out features, and building it in different ways. Conclusion: you may call it “bloat”, but if you want a modern system, it’s pretty much unavoidable.

1 0

High-severity bug in OpenSSL allows attackers to decrypt HTTPS traffic
by Peter Reutemann 28 Jan '16

28 Jan '16

"Maintainers of the OpenSSL cryptographic code library have fixed a high-severity vulnerability that made it possible for attackers to obtain the key that decrypts communications secured in HTTPS and other transport layer security channels. While the potential impact is high, the vulnerability can be exploited only when a variety of conditions are met. First, it's present only in OpenSSL version 1.0.2. Applications that rely on it must use groups based on the digital signature algorithm to generate ephemeral keys based on the Diffie Hellman key exchange. By default, servers that do this will reuse the same private Diffie-Hellman exponent for the life of the server process, and that makes them vulnerable to the key-recovery attack. DSA-based Diffie-Hellman configurations that rely on a static Diffie-Hellman ciphersuite are also susceptible." -- source: http://arstechnica.com/security/2016/01/high-severity-bug-in-openssl-allows… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

What’s The Cheapest Wi-Fi Access Point?
by Lawrence D'Oliveiro 27 Jan '16

27 Jan '16

Someone has hacked a cheapie wireless SD card reader to turn it into a wi-fi access point running OpenWRT: <http://phoronix.com/scan.php?page=news_item&px=Zsun-WiFI-With-OpenWRT>. The most obvious thing it lacks is any kind of wired network port...

1 0

Material for Monday's meeting
by Peter Reutemann 26 Jan '16

26 Jan '16

Hi everyone The material from Monday's meeting is now available from our github account: https://github.com/WLUG/meetings/tree/master/2016/2016-01-25 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 4.5 Adds Raspberry Pi 2 Support, AMD GPU Re-Clocking, Intel Kaby Lake
by Peter Reutemann 24 Jan '16

24 Jan '16

"Linux 4.5 is set to bring many new features across the kernel's 20 million line code-base. Among the new/improved features are Raspberry Pi 2 support, open-source Raspberry Pi 3D support, NVIDIA Tegra X1 / Jetson TX1 support, an open-source Vivante graphics driver, AMDGPU PowerPlay/re-clocking support, Intel Kaby Lake enablement, a Logitech racing wheel driver, improvements for handling suspended USB devices, new F2FS file-system features, and better Xbox One controller handling." -- source: http://linux.slashdot.org/story/16/01/24/1329206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Atom-Based JaguarBoard To Take On Raspberry Pi
by Peter Reutemann 24 Jan '16

24 Jan '16

"The tiny single-board PC movement that's leading the Internet of Things (IoT) market is largely dominated by ARM-based processors, and for good reason — they're cheap, low power and capable. However, what if you prefer to work with the x86 architecture? JaguarBoard looks strikingly similar to Raspberry Pi, which is arguably the most popular single-board mini PC. But unlike Raspberry Pi, JaguarBoard allows users to develop for x86, courtesy of its Intel Atom Z3735G (Bay Trail) foundation. The chip is a quad-core part clocked at 1.33GHz to 1.83GHz with 2MB of L2 cache, offering a fair amount of horsepower for IoT applications. In addition to an Atom processor, JaguarBoard also boasts 1GB of DDR3L memory, 16GB of eMMC storage, three USB 2.0 ports, 10/100M LAN port, HDMI 1.4 output, SDIO 3.0 socket, two COM ports, four GPIO pins, and audio ports. It's an interesting device that you could use strictly as a mini PC for general purpose computing, as an embedded system, a learning or research tool, or for whatever DIY projects you can conjure up." -- source: http://hardware.slashdot.org/story/16/01/24/1729241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Searching For Vulnerable Webcams
by Lawrence D'Oliveiro 23 Jan '16

23 Jan '16

Customers don’t understand and don’t care about the security of the devices they put online. And vendors are in no hurry to enlighten them, if it adds to costs and cuts profits. If anybody is in a position to intervene, it has to be a Government authority. <http://arstechnica.com/security/2016/01/how-to-search-the-internet-of-thing…>

1 0

Linux Filesystems On Windows
by Lawrence D'Oliveiro 22 Jan '16

22 Jan '16

Came across this <http://www.phoronix.com/forums/forum/phoronix/latest-phoronix-articles/8468…> rather informative posting about different filesystems for cross-platform use. One interesting possibility is UDF (“Universal Disk Format”), which is how DVDs are usually formatted. It turns out it is useful not just for read-only media but read/write as well. There is widespread built-in support for it on Linux, OS X and Windows, albeit with some limitations in the proprietary OSes (as usual). It can even work on flash drives, though there may be some issues with the hardware layout being optimized for FAT32 or other antiquated filesystems. Alternatively, the article mentions a number of choices for accessing Linux filesystems on Windows: <http://www.fs-driver.org/> <http://uranus.chrysocome.net/linux/ext2ifs.htm> <http://www.diskinternals.com/linux-reader/> <http://www.chrysocome.net/virtualvolumes> Disclaimer: I haven’t tried any of these.

1 0

Command-Line Options For CUPS
by Lawrence D'Oliveiro 20 Jan '16

20 Jan '16

I was looking for some options to tweak scaling and positioning of images printed with the CUPS “lp” command. This page <http://www.cups.org/documentation.php/doc-1.5/options.html> lists various keywords that can be used with the “-o” option, in particular “natural-scaling”, “ppi” and “position”. You’ll notice that section has a large banner at the top saying “Not Supported on Mac OS X”. Which is slightly ironic, given that CUPS is owned by Apple. Anyway, the description of those options has disappeared from versions of that page for CUPS 1.6 and later, e.g. <http://www.cups.org/documentation.php/doc-1.6/options.html>, <http://www.cups.org/documentation.php/doc-2.1/options.html>. This even though I have CUPS 2.1.2 on my system, and the “position” option, for example, does seem to do something.

1 0

Tracking Protection In Wi-Fi Networks Coming Soon To Linux
by Peter Reutemann 19 Jan '16

19 Jan '16

'Fedora contributor and NetworkManager developer Lubomir Rintel explains how your devices are being identified on a network by a unique number that most of us know by the name of MAC address. Same goes for mobile networking, as your laptop's or mobile phone's MAC address is, in most cases, broadcasted everywhere you go before you even attempt a connection to a wireless network. And that's a problem for your privacy. The solution? Randomization of the MAC address while scanning for Wi-Fi networks. Apple is already using this method on iOS 8 and later mobile operating systems, and so is Microsoft in Windows 10, so Linux users will ["likely"] get it in the upcoming NetworkManager 1.2 release.' -- source: http://tech.slashdot.org/story/16/01/19/1345210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Building Your Own Internet Router
by Lawrence D'Oliveiro 19 Jan '16

19 Jan '16

<http://arstechnica.com/gadgets/2016/01/numbers-dont-lie-its-time-to-build-y…>: A lot of you are probably muttering, "right, pfSense, sure." Some of you might even be thinking about smoothwall or untangle NG. I played with most of the firewall distros out there, but I decided to go more basic, more old school: a plain, CLI-only install of Ubuntu Server and a few iptables rules. His benchmarks show his homebrew router handily beating off-the-shelf products in wired performance. In wireless performance, however, he feels available PC cards are way behind what dedicated router boxes can do.

1 0

Serious Linux Kernel Vulnerability Patched
by Peter Reutemann 19 Jan '16

19 Jan '16

"A patch for a critical Linux kernel flaw, present in the code since 2012, is expected to be pushed out today. The vulnerability affects versions 3.8 and higher, said researchers at startup Perception Point who discovered the vulnerability. The flaw also extends to two-thirds of Android devices, the company added. An attacker would require local access to exploit the vulnerability on a Linux server. A malicious mobile app would get the job done on an Android device. The vulnerability is a reference leak that lives in the keyring facility built into the various flavors of Linux. The keyring encrypts and stores login information, encryption keys and certificates, and makes them available to applications." -- source: http://linux.slashdot.org/story/16/01/19/1326212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

WLUG meeting next Monday
by Peter Reutemann 19 Jan '16

19 Jan '16

Hi everyone We have a WLUG meeting coming up next Monday: "Lawrence D'Oliveiro and Ian Stewart will demo RAID 1 configurations and also using rsync for backups." More details: http://www.meetup.com/WaikatoLinuxUsersGroup/events/228022101/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mr “Linux Software RAID” Stepping Down
by Lawrence D'Oliveiro 18 Jan '16

18 Jan '16

Neil Brown, the guy who has been mostly responsible for the software RAID subsystem on Linux since he created it over a decade and a half ago, has decided to hand over the reins <http://phoronix.com/scan.php?page=news_item&px=Neil-Brown-Last-MD>. No drama involved, he just seems to have lost interest.

1 0

Fedora Linux Might Drop Incremental Upgrades
by Peter Reutemann 17 Jan '16

17 Jan '16

"As you might know, Fedora and many other GNU/Linux distributions require users to do an incremental upgrade when attempting to move from an older version of the operating system to the most recent one. For example, if you want to upgrade from Fedora 21 to Fedora 23, you will have first to upgrade to Fedora 22. Lately, Fedora upgrades have become more stable and reliable, mostly because of some brand-new technologies, such as the DNF package manger. Fedora's Adam Williamson theorizes about an innovative method that might support official upgrade of the Fedora Linux operating system across two releases in the future." -- source: http://linux.slashdot.org/story/16/01/16/2156219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bug that can leak crypto keys just fixed in widely used OpenSSH
by Peter Reutemann 17 Jan '16

17 Jan '16

'A critical bug that can leak secret cryptographic keys has just just been fixed in OpenSSH, one of the more widely used implementations of the secure shell (SSH) protocol. The vulnerability resides only in the version end users use to connect to servers and not in versions used by servers. A maliciously configured server could exploit it to obtain the contents of the connecting computer's memory, including the private encryption key used for SSH connections. The bug is the result of code that enables an experimental roaming feature in OpenSSH versions 5.4 to 7.1 "The matching server code has never been shipped, but the client code was enabled by default and could be tricked by a malicious server into leaking client memory to the server, including private client user keys," OpenSSH officials wrote in an advisory published Thursday. "The authentication of the server host key prevents exploitation by a man-in-the-middle, so this information leak is restricted to connections to malicious or compromised servers." The advisory said that anyone using a vulnerable version should update right away. Those who are unable to update should disable roaming by adding the string UseRoaming no to the global ssh_config(5) file or to the user configuration in ~/.ssh/config, or by entering -UseRoaming=no on the command line.' -- source: http://arstechnica.com/security/2016/01/bug-that-can-leak-crypto-keys-just-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fwd: Global Game Jam and Unity Game Engine Introductory Course.
by William Mckee 15 Jan '16

15 Jan '16

Attached an Email I got from Bill Rogers regarding Global Game Jam and some Unity3d training. http://blogs.unity3d.com/2015/08/26/unity-comes-to-linux-experimental-build… cheers, William. ---------- Forwarded message ---------- From: Bill Rogers <coms0108(a)cs.waikato.ac.nz> Date: Tue, Jan 12, 2016 at 11:44 PM Subject: Global Game Jam and Unity Game Engine Introductory Course. To: Bill Rogers <coms0108(a)cs.waikato.ac.nz> Hi Everyone, I'm sending this to all CS and CGD students, 2015 GGJ participants and High School Entrants in the NZ Programming Contest. If you are interested, good. If not feel free to pass it on to anyone you know who might be. If it is unwelcome spam, sorry about that. Global Game Jam is just over two weeks away. As usual we are running a site at Waikato University. On Friday 29th we kick off at 5pm with the 2016 Jam. We are also running an introductory session on using the Unity Game Engine prior to the jam on Thursday 21st January (just over one week away). For those who are new to the idea, GGJ is an international game (computer and board) development festival. For 48 hours (Friday 5pm to Sunday 5pm) people gather and develop games following a theme announced at the start. Almost anyone can take part (at Waikato we have an age limit of 16 or over). If you can program, design, develop artwork, have game ideas, or can game test, or would just like to watch, come and participate. To find out more about this year's event at Waikato and to register go to globalgamejam.org.nz The entry fee at Waikato is $25 - for that you get a t-shirt and meals for the weekend. You can come with friends or come alone and join a team formed at the event. So, if you would like ... 1. ... to attend the Unity Training Session on Thursday Jan 21st (from 1pm) please reply to this email. 2. ... to take part at the Waikato Site for Global Game Jam 2016, please register at globalgamejam.org.nz. (We will ask you for the $25 in due course.) 3. ... to know more about GGJ and see games developed in previous years, visit the global site at www.globalgamejam.org. (Please register to take part at our site, not at the global one.) Bill Rogers and Brian Cole Waikato GGJ Site 2016

1 0

Another Advantage Of Linux Software RAID
by Lawrence D'Oliveiro 11 Jan '16

11 Jan '16

I am a long-time fan of Linux software RAID. But in reading an online discussion which happened to mention variations in actual sizes of storage devices (disks or flash) of supposedly identical capacity, I realized that there is yet another advantage of Linux software RAID: the fact that it can build arrays out of disk partitions, not necessarily entire disks. This means you can create the partitions to be a standard size, slightly smaller than the maximum capacity of the disk. (Each disk will have just one partition on it, the rest of the disk being unused.) Then if you have to replace a failed disk, you can create a new partition of the same size on the replacement. Otherwise, if you use the entire disk, you run the risk that the new disk is a bit smaller than the old one, and trying to add it to the RAID container may fail.

5 12

X.Org Might Lose Its Domain Name
by Lawrence D'Oliveiro 11 Jan '16

11 Jan '16

Seems like the ownership of the x.org domain was not properly handed over during the reorg of the organization into a nonprofit. So now it is likely to expire in a matter of days, unless some (unspecified) back-room maneouvring succeeds... <http://phoronix.com/scan.php?page=news_item&px=X.Org-Domain-Woes>

1 1

a quad core Atom from Intel with added Windows 10
by Ian Young 09 Jan '16

09 Jan '16

Anyone got a use case? http://hardware.slashdot.org/story/16/01/07/2218254/intels-next-gen-compute… What on earth is Core-M you may possibly ask? 'Delving a little deeper into exactly what Core M offers, its headline figure is a Thermal Deisgn Power (TDP - read max power consumption) of just 4.5W. This compares to around 10-15W for a typical laptop processor and 50-100W for desktop processors. Previously this level of power draw was only possible in severely under-powered Atom processors, such as the Bay-Trail line, which were really only good for more simple tablet-type devices. Core M really is the first processor to bridge the gap between ultra-low TDP and acceptable laptop performance. Read more at http://www.trustedreviews.com/opinions/intel-core-m-everything-you-need-to-…'

2 1

Programmers’ Note-To-Selves
by Lawrence D'Oliveiro 08 Jan '16

08 Jan '16

An Ubuntu kernel engineer has done an analysis of how many instances there are in the Linux kernel of comments saying “FIXME” or “TODO”. The total numbers of these are increasing with the size of the code, but at least the number of FIXMEs per source line seems to be going down. <http://phoronix.com/scan.php?page=news_item&px=Linux-Kernel-FIXME-TODO>

1 0

Elementary OS' Freya Dumbs Down Linux
by Peter Reutemann 07 Jan '16

07 Jan '16

'The release last month of Elementary OS Freya version 0.3.2 showed little has changed in this new-style Linux distro that wraps its own lightweight desktop design around the Ubuntu core. Elementary OS first appeared in 2011. I last looked at its Freya beta release in 2014. I liked its fresh, new look and simplified approach to desktop management. However, my hopes for more features and a faster-evolving desktop environment in the latest release went unfulfilled.' -- source: http://www.linuxtoday.com/infrastructure/elementary-os-freya-dumbs-down-lin… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android N switches to OpenJDK, Google tells Oracle it is protected by the GPL
by Peter Reutemann 07 Jan '16

07 Jan '16

'The Oracle v. Google legal battle over the use of Java in Android keeps on going, but this week Google made a change to Android that it hopes will let the company better navigate its current legal trouble. Google told VentureBeat that it in "Android N," the next major version of Android, it is swapping Android's Java libraries from its own Apache Harmony-based implementation to one based on Oracle's OpenJDK—yes that Oracle, the same company suing Google. OpenJDK is the "official" open source version of the Java Platform, and Oracle makes it available under the GPL with a linking exception.' -- source: http://arstechnica.com/tech-policy/2016/01/android-n-switches-to-openjdk-go… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Murdock On The Birth Of Debian
by Lawrence D'Oliveiro 06 Jan '16

06 Jan '16

Noted Free Culture rapporteur Glyn Moody recalls his 1999 interview with late Debian founder Ian Murdock about the genesis of the project: <http://arstechnica.com/information-technology/2016/01/the-birth-of-debian-i…>. As Murdock told me in 1999, the problems arose from the fact that "the fellow who was doing [SLS] was trying to do everything himself. And so I looked on that and I thought, well, you know, if Linux has taught us anything it's that that kind of model is sub-optimal. What we really ought to do is we ought try to take the model that Linux has pioneered, intentionally or not, and try to get the same benefits from that for building the system around it."

1 0

Microsoft's Latest Patent Aggression Comes Under Fire From the EFF, Former GNU/Linux Company the Patent's Target
by Peter Reutemann 04 Jan '16

04 Jan '16

'MICROSOFT, which is connected to many patent trolls (includingIntellectual Ventures, the world’s biggest), is still busy suing companies. Microsoft has a long history of patent aggression, including patent litigation against Linux (not just threats thereof). As longtime readers of this site may know, this and only this was the raison d’être of this Web site. “…since winning a case for infringement of design patents can lead to a damage analysis based on “lost profits,” which can theoretically lead to a patent owner getting all of a defendant’s profits.” –Joe MullinAs we noted the other day, referring tothe original from the EFF, Microsoft is now attacking a company that once dominated word processing. Microsoft allegedly engaged in competition crimes against this company, leading to decades of expensive litigation. This company also pioneered some important GNU/Linux efforts until Microsoft shut these down with a mysterious deal (which we wrote about on several occasions around 2007). Well, Microsoft is now trying to drive this company into bankruptcy, using patents. What’s the name of this company? Corel. We have a whole category about Corel (with 51 articles, as well as leaked court documents). History is important here and it’s imperative that people properly study Corel to truly grasp how severe this situation really is.' -- source: http://techrights.org/2015/12/31/patent-aggression-against-corel/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Leap of Faith -- Replacing Ubuntu Server with openSUSE Leap
by Peter Reutemann 04 Jan '16

04 Jan '16

"I run a local file and media server, which is a very important part of my digital life -- it hosts all of my files. Everything. I have been using an Ubuntu 14.04 server running on a self-assembled PC. But, it’s a big, noisy system and generates too much heat. So, I planned to move to smaller form factor, such as System76's Meerkat." -- source: http://www.linux.com/news/enterprise/systems-management/874378 -- Meerkat link: https://system76.com/desktops/meerkat Cheers, Peer -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Debian mourns the passing of Ian Murdock
by Peter Reutemann 31 Dec '15

31 Dec '15

"With a heavy heart Debian mourns the passing of Ian Murdock, stalwart proponent of Free Open Source Software, Father, Son, and the 'ian' in Debian." source: https://bits.debian.org/2015/12/mourning-ian-murdock.html Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz

3 3

Inside Red Star OS
by Lawrence D'Oliveiro 30 Dec '15

30 Dec '15

North Korea has developed its own Linux distro, chock-full of features to allow every action of its users to be tracked. Some researchers have been taking it apart to see how these features work. <http://www.theregister.co.uk/2015/12/29/north_korea_red_star_os/>

1 0

The Guardian Project
by Lawrence D'Oliveiro 25 Dec '15

25 Dec '15

Just been watching the latest in the “Rebel Geeks” series on Al Jazeera. Today the episode was called “A Bigger Brother” <http://www.aljazeera.com/programmes/rebelgeeks/2015/12/bigger-brother-15121…>, centred around the use of an open-source Android app called CameraV. The aim of this app is to record video along with a whole heap of corroborating metadata (GPS coordinates, local wi-fi networks etc) to make the footage credible enough, in particular proof enough against accusations of tampering, to be used as evidence in court. This is particularly important where the video is documenting crimes committed by people in positions of power and trust, such as the police. They used a nice term for this: “sousveillance” (watching done by ordinary people from below), as compared to the more usual “surveillance” (watching by those in privileged positions from above). One interesting comment made in the program was that the phone needs to look like it is not capturing video while the app is running, because in a place like Rio De Janeiro, the cops will grab phones away from people who they think are filming them. I did some digging around on GitHub, and found that this app is part of the Guardian Project, and they have a whole bunch of other useful-looking tools related to encryption, privacy and so on <https://github.com/guardianproject> They also have a website <https://guardianproject.info/>.

1 0

HTTP Error Code 451 Approved For Censored Web Pages
by Peter Reutemann 21 Dec '15

21 Dec '15

'The Internet Engineering Steering Group (IESG) has finally approved the new 451 status code for HTTP error messages involving web pages which have been repressed or removed for legal or political reasons. The initiative was proposed in 2013, and gained interest from various groups, such as Lumen (formerly Chilling Effects), who see the potential of the Bradbury-inspired code to help develop comprehensive indexes of censorship on the internet. Mark Nottingham, chair the IETF HTTP Working Group, says, "It'll be an RFC after some work by the RFC Editor and a few more process bits, but effectively you can start using it now."' -- source: http://yro.slashdot.org/story/15/12/21/1549258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspbian Levels the Field With Latest Update
by Peter Reutemann 18 Dec '15

18 Dec '15

"During all the Pi Zero hype and showcasing, most of us probably didn't realize that the Raspbian OS got a much needed update. While this update isn't a major release, it still contained some amazing features. If you are running Raspbian Jessie, then take a moment to read over this article so you won't be left out in the cold. I'll go over the best parts of the update and also provide install instructions on how to get all this on your current Raspbian install." -- source: http://www.linuxtoday.com/infrastructure/raspbian-levels-the-field-with-lat… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

Items From Blender Conference 2015
by Lawrence D'Oliveiro 17 Dec '15

17 Dec '15

I saw from Peter’s posting that Blender got one of the “top 10 open source projects” awards on opensource.com this year. And they had their Blender Conference 2015 about a month ago. A couple of notable related articles I found on opensource.com are “Teaching Teens 3D Animation With Blender” <https://opensource.com/life/15/12/blender-interview-tom-haines-3dami> where this nonprofit called 3Dami offers a free, intensive 7-day course to selected students. Quote on the (much-maligned) Blender interface: Many do prefer to use Blender outside our events. Once you have got over the bump of its interface being different to other software, you soon learn just how insanely fast it is—its interface is different for a very good reason, and its hard to accept the slow down of using other software. Some students actually learn that lesson during our event: More than a few have turned up moaning that we aren't using a certain piece of software beginning with "M," but they usually get why we use Blender by the time they leave. I do know that one of our students is making money using Blender, and I expect others to join them given time. Another one, relevant to a University research setting, is “Visualize Astrophysics Data With Blender” <https://opensource.com/life/15/11/blender-conference-interview-jill-naiman-…>. Besides Blender, this also builds on a Python-based astrophysics simulation framework called “yt”. (Aside: the more we become accustomed to being able to use keyword searches to find everything online, the more annoyed some of us become with short names that are hard to search for. Is this good or bad? Discuss.) I suspect there are bits there that could be adapted to other kinds of physical simulation. More presentations to see here: <https://www.youtube.com/user/BlenderFoundation/videos>

1 0

end of year: best of open source
by Peter Reutemann 16 Dec '15

16 Dec '15

Top 10 open source projects of 2015 https://opensource.com/business/15/12/top-10-open-source-projects-2015 Bossies 2015: The Best of Open Source Software Awards http://www.infoworld.com/article/2984437/open-source-tools/bossies-2015-the… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AMD Goes Open Source, Announces GPUOpen Initiative, Linux Compiler, Drivers
by Peter Reutemann 15 Dec '15

15 Dec '15

'AMD announced today that the company is releasing a slew of open-source software and tools to give game developers, heterogeneous applications, and HPC applications deeper access to the GPU and GPU resources. AMD and their Radeon Technologies Group (RTG) are looking for ways to ease game development, so developers can more easily re-use code and port their games from consoles over to the PC. With GPUOpen, game developers will have direct access to GPU hardware, as well as access to a large collection of open source effects, tools, libraries and SDKs, which are being made available on GitHub under an MIT open-source license. As part of the effort, the company is also releasing a new HCC C++ compiler which will be a tool in enabling developers to more easily leverage the resources of discrete GPU hardware in heterogeneous systems. The HCC complier also allows developers to convert CUDA code to portable C++. According to AMD, internal testing shows that in many cases 90 percent or more of CUDA code can be automatically converted into C++ with the final 10 percent converted manually in the widely popular C++ language. An early access program for the "Boltzmann Initiative" tools is planned for Q1 2016.' -- source: http://news.slashdot.org/story/15/12/15/1429257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Collabora and OwnCloud Announce LibreOffice Online
by Peter Reutemann 15 Dec '15

15 Dec '15

'Collabora Productivity, a UK-based consulting company, has collaborated with ownCloud Inc. to release a developer edition of online LibreOffice, which they call CODE (Collabora Online Development Edition). "The office suite implementation runs on ownCloud server. That's where all the processing and heavy lifting is done. The rendering happens at the client side. Currently there are three apps: writer (equivalent to MS Word), spreadsheet (Excel) and presentation (PowerPoint). At the moment users can create new documents and edit them. Other functionality, such as collaborative editing, is in the pipeline."' -- source: http://tech.slashdot.org/story/15/12/15/1849234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Finding Differences Between Binary Files
by Lawrence D'Oliveiro 14 Dec '15

14 Dec '15

Hi folks. As mentioned in passing last night, diff(1) isn’t much help for tracking down differences between two non-text files: all it will say is the files differ. However, there is a way to get detail on the differences, and that is to use a hex dump command like xxd(1) to produce text output from those binary files, and diff that text output instead. Thus, instead of diff binfile1 binfile2 you do diff <(xxd binfile1) <(xxd binfile2) This will quickly narrow down runs of changed bytes, and possibly even small sections of inserted or deleted bytes as well.

1 0

Raspberry π As A Thin Client?
by Lawrence D'Oliveiro 14 Dec '15

14 Dec '15

Citrix has posted a demo of a Raspberry π giving smooth performance running a thin client OS. <http://www.theregister.co.uk/2015/12/14/vdi_comes_to_the_raspberry_pi/> A game-changer for VDI?

1 0

MIT Creates Tor Alternative That Floods Networks With Fake Data
by Peter Reutemann 13 Dec '15

13 Dec '15

"An anonymous reader writes with word that MIT researchers "created an alternative to Tor, a network messaging system called Vuvuzela that pollutes the network with dummy data so the NSA won't know who's talking to who." Initial tests show the systems overhead adding a 44-second delay, but the network can work fine and preserve anonymity even it has more than 50% of servers compromised." -- source: http://yro.slashdot.org/story/15/12/13/1522224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

Firefox OS smartphones are dead
by Peter Reutemann 12 Dec '15

12 Dec '15

The phone ecosystem just got smaller: "Mozilla is ending its plan to build an OS for smartphones. Today at Mozilla's "Mozlando" developer event, the company announced that it would stop developing and selling Firefox OS smartphones. " -- source: http://arstechnica.com/gadgets/2015/12/firefox-os-smartphones-are-dead/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How To Win Friends And Influence People
by Lawrence D'Oliveiro 12 Dec '15

12 Dec '15

And show your appreciation to open-source developers. <https://github.com/JuliaLang/IJulia.jl/issues/398> Or not...

3 2

Is Your Son A Computer Hacker?
by Lawrence D'Oliveiro 10 Dec '15

10 Dec '15

A guide for the perplexed. As in, if you weren’t perplexed before reading this, you will be after <http://www.adequacy.org/stories/2001.12.2.42056.2147.html>. Watch out for that nasty Lunix and that devil incarnate, Linyos Torovoltos! Seems like there are some other similar gems to be found on that site, all dating from the early ’00s. Nice that they keep it online.

1 0

Let's Encrypt Is Now In Public Beta
by Peter Reutemann 03 Dec '15

03 Dec '15

"As of today, Let's Encrypt is in Public Beta. If you're comfortable running beta software that may have a few bugs and rough edges, you can use it to instantly obtain and install certificates for any HTTPS website or TLS service." -- source: http://yro.slashdot.org/story/15/12/03/2016238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

It’s Here: The Internet Of Wrongs
by Lawrence D'Oliveiro 03 Dec '15

03 Dec '15

One of the presentations at the upcoming Kiwicon in Wellington is going to be about a device built out of a Raspberry π Zero using “nothing more than off-the-shelf components and "questionable life choices"”. It looks for attempts to connect to Instagram and other “social-media vanity” sites (including rugby), and blocks them by returning bogus responses. Quote: “It is exceptionally effective at selfie-drenched "music" festivals and coffee shops”. <http://www.theregister.co.uk/2015/12/02/british_hacker_turns_raspberry_pi_z…>

2 1

Why Algebraic Eraser may be the riskiest cryptosystem you’ve never heard of
by Peter Reutemann 30 Nov '15

30 Nov '15

"A potential standard for securing network-connected pacemakers, automobiles, and other lightweight devices has suffered a potentially game-over setback after researchers developed a practical attack that obtains its secret cryptographic key. Known as Algebraic Eraser, the scheme is a patented way to establish public encryption keys without overtaxing the limited amounts of memory and computational resources that often constrain so-called Internet of Things (IoT) devices. Developed by scientists from Shelton, Connecticut-based SecureRF, it's similar to the Diffie-Hellman key exchange in that it allows two parties who have never met to securely establish a key over an insecure channel." -- source: http://arstechnica.com/security/2015/11/why-algebraic-eraser-may-be-the-mos… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

When Is “Free Software” Not Free?
by Lawrence D'Oliveiro 30 Nov '15

30 Nov '15

Linux kernel developer Matthew Garrett has posted some criticisms of projects like Mozilla, Red Hat and Ubuntu that develop or redistribute Free software, but tack on an “intellectual property rights policy”. Basically that means they claim ownership of certain logos and trademarks, so if you want to fully exercise your Four Freedoms, you have to strip those out before you are allowed to redistribute what you receive from them. <http://lwn.net/Articles/665175/> One particularly worrying thing is this comment from Garrett (mjg59) on the above article: Canonical refuse to tell you what changes you need to make to the packages in order to do so.

1 0

Pi Zero: A full Raspberry Pi for just $5
by Peter Reutemann 28 Nov '15

28 Nov '15

"Have you ever wanted a Raspberry Pi but thought that £16/$25—roughly three packs of cigarettes—was a little exorbitant for a complete computer capable of running Linux? Well, I have good news: the Raspberry Pi Foundation has just released the Pi Zero, a single-board computer that costs just £4/$5." -- source: http://arstechnica.com/gadgets/2015/11/pi-zero-a-full-raspberry-pi-for-just… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 4

Ubuntu 16.04 LTS Will Ship With Linux Kernel 4.4 LTS
by Peter Reutemann 27 Nov '15

27 Nov '15

"The current daily build of the Ubuntu 16.04 LTS (Xenial Xerus) remains based on the Linux 4.2 kernel packages of the stable Ubuntu 15.10 (Wily Werewolf) operating system, while the latest and most advanced Linux 4.3 kernel is tracked on the master-next branch of the upcoming operating system. In the meantime, the Ubuntu Kernel Team announced plans for moving to Linux kernel 4.4 for the final release of the Ubuntu 16.04 LTS (Xenial Xerus) operating system." -- source: http://linux.slashdot.org/story/15/11/26/1920204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

20 Years of GIMP
by Peter Reutemann 24 Nov '15

24 Nov '15

'Back in 1995, University of California students Peter Mattis and Kimball Spencer were members of the eXperimental Computing Facility, a Berkeley campus organization. In June of that year, the two hinted at their intentions to write a free graphical image manipulation program as a means of giving back to the free software community. On November 21st, 20 years ago today, Peter Mattis announced the availability of the "General Image Manipulation Program" on Usenet (later "GNU Image Manipulation Program"). Over the years, GIMP amassed a huge amount of new features designed for all kinds of users and practical applications: general image editing, retouching and color grading, digital painting, graphic design, science imaging, and so on. To celebrate the 20th anniversary, there is an update of the current stable branch of GIMP. The newly released version 2.8.16 features support for layer groups in OpenRaster files, fixes for layer groups support in PSD, various user interface improvements, OSX build system fixes, translation updates, and more.' -- source: http://tech.slashdot.org/story/15/11/22/2019259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Fwd: [Roundcube Announce] Roundcube Webmail 1.2-beta out now
by Simon Green 23 Nov '15

23 Nov '15

Good morning all, Roundcube 1.2-beta has been released, Among other enhancements, this release supports either server side or client side PGP encryption. As far as I know, this is the first open source web based e-mail client that does so. -- Simon -------- Original Message -------- Subject: [Roundcube Announce] Roundcube Webmail 1.2-beta out now Date: 24/11/2015 5:15 am From: Thomas Bruederli <thomas(a)roundcube.net> We're proud to announce that the beta release of the next major version 1.2 of Roundcube webmail is out now for download and testing. With this milestone we introduce new features primarily focusing on security and PGP encryption: * PHP7 compatibility * PGP encryption * Drag-n-drop attachments from mail preview to compose window * Mail messages searching with predefined date interval * Improved security measures to protect from brute-force attacks And of course plenty of small improvements and bug fixes. The PGP encryption support in Roundcube comes with two options: Mailvelope -------------- The integration of this browser plugin [1] for Firefox and Chrome comes out of the box in Roundcube 1.2 and is enabled if the Mailvelope API is detected in a user's browser. See the Mailvelope documentation [2] how to enable it for your site. Read more about the Mailvelope integration and how this looks like in Alec's blog [3]. Enigma plugin ------------------- This Roundcube plugin adds server-side PGP encryption features to Roundcube. Enabling this means that users need to fully trust the webmail server as encryption is done on the server GnuPG and private keys are also stored there. In order to activate server-side PGP encryption for all your users, the 'enigma' plugin, which is shipped with this package, has to be enabled in the Roundcube config. See the plugin's README for details. Also read Alec's blogpost about the Enigma plugin and how it works [4]. Both encryption features are pretty new and not yet perfectly documented. We'd much appreciate your feedback and your contribution to the end-user documentation [5] or our wiki page [6]. IMPORTANT: with this version, we finally deprecate some old Roundcube library functions [7]. Plugin developers, please test your plugins thoroughly and look for deprecation warnings in the logs. These function will be removed in the final 1.2.0 release and can therefore render plugins dysfunctional. See the full changelog on trac.roundcube.net [8] and download the new packages from https://roundcube.net/download Please note that this is a beta release and we recommend to test it on a separate environment. And don't forget to backup your data before installing it! Enjoy and please share your experience either through our mailing lists or as comments in the blog posts mentioned above. Kind regards, Thomas [1] https://www.mailvelope.com [2] https://www.mailvelope.com/en/help#watchlist [3] https://kolabian.wordpress.com/2015/10/10/mailvelope-integration-pgp-encryp… [4] https://kolabian.wordpress.com/2015/10/13/enigma-plugin-pgp-encryption/ [5] http://trac.roundcube.net/wiki/Online_Help [6] http://trac.roundcube.net/wiki/Dev_Encryption [7] https://github.com/roundcube/roundcubemail/blob/master/program/include/bc.p… [8] http://trac.roundcube.net/wiki/Changelog

2 1

Rebel Geeks: Meet Your Maker
by Lawrence D'Oliveiro 20 Nov '15

20 Nov '15

Some on this list should be interested in this series on Al Jazeera called “Rebel Geeks”. The episode this week featured Massimo Banzi, one of the founders of Arduino, at the Maker Faire in Shenzhen, China. It also talks about the Safecast project, which was a volunteer group that came together in the wake of the Fukushima disaster to provide radiation data more extensive than anything the Government was able to offer. You can watch it on-line here <http://www.aljazeera.com/programmes/rebelgeeks/2015/11/technology-maker-mov…>.

1 0

Linux Mint 1.73 BETA
by Peter Reutemann 18 Nov '15

18 Nov '15

Linux Mint 17.3 "Rosa" BETA is out, using Cinnamon and MATE: http://blog.linuxmint.com/?p=2937 http://blog.linuxmint.com/?p=2938 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Open source projects rely on donated time—what motivates participants?
by Peter Reutemann 18 Nov '15

18 Nov '15

"Open source software packages like WordPress and Firefox have been major influences on modern computing. In statistics, open source software known as “R” has become the most popular environment for statistical computation and data analysis. A recent paper in PNAS studied the developers who make this software so successful to understand what motivates them and why they find contributing satisfying." -- source: http://arstechnica.com/science/2015/11/open-source-projects-rely-on-donated… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Dirk And Linus Show Comes To Seoul
by Lawrence D'Oliveiro 17 Nov '15

17 Nov '15

Snippets from <http://lwn.net/Articles/662106/>: Is there anybody out there who understands the entire kernel? Linus said that nobody does. There are some people who have a good overview of the whole kernel, and Linus, at least, generally knows who to blame for any specific problem. But with a project the size of the kernel it's not possible for anybody to have a deep understanding of the whole thing. ... With regard to how an aspiring kernel developer should start, Linus has always said the same thing: he can't tell developers what to do. It is important, instead, that developers work on things they *want* to do. ... How many kernel compiles has he done? It used to take about twelve minutes to compile a kernel; over time, the kernel has gotten bigger, but the hardware has gotten faster; the current time is about 22 minutes for an allmodconfig kernel. He does about ten builds per day during the merge window, a couple otherwise. Kernel development has been happening for about 8800 days; the bottom line, Linus guessed, was about 100,000 compiles. ... What about the Git project — what made that project successful? Linus gave a lot of credit to BitKeeper which, despite its licensing issues, changed how the kernel community did development. Git, of course, is an [Linus Torvalds] improvement on BitKeeper, but BitKeeper showed the benefits of distributed development when nobody else was working in that area. Once Git was around, its use by the kernel community helped it to spread quickly. Its immutable object model turned out to make it easy for service providers to use, enabling companies like GitHub. Ten years ago, developers were resistant to thinking about source-code management issues; Git forced them to look at it and to realize how much better distributed source-code management is. Git was not the first in this area, but it was the one that created wide awareness of a better way of doing things.

1 0

WLUG AGM next Monday
by Peter Reutemann 17 Nov '15

17 Nov '15

Hi everyone Our Annual General Meeting (AGM) is next week on Monday. Agenda (preliminary) - President's Report - Treasurer's Report - Election of 2016 Committee - Consumption of pizza http://www.meetup.com/WaikatoLinuxUsersGroup/events/226192341/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Calibrate your Monitor with these Open Source Tools
by Peter Reutemann 17 Nov '15

17 Nov '15

"What is seen on your display and what the image should look like can be two quite different things. If you value image quality and accuracy, calibration of your monitor will be important. Anyone involved in digital photography, graphic design or artwork will recognise the importance that their monitor is producing the best results, showing true colors and black levels. The following open source tools are invaluable for anyone looking for accurate color reproduction." -- source: http://www.linuxtoday.com/infrastructure/calibrate-your-monitor-with-these-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Sourceforge going mubar?!
by Ian Young 17 Nov '15

17 Nov '15

Anyone happen to know whether Sourceforge is more than usually impaired at the moment (messed up beyond all recognition)? Any download I attempt is extremely slow, this from two networks. And Australia seems to been excised from the map of mirrors. Don't even get me started on the wall to wall advertising, and the cumbersome process of displaying info on whatever project one is trying to d/l after a d/l has commenced.

2 1

Linux 4.4 Kernel To Bring Raspberry Pi Graphics Driver, Open-Channel SSD Support
by Peter Reutemann 16 Nov '15

16 Nov '15

"Linux 4.4-rc1 has been released. New features of Linux 4.4 include a Raspberry Pi kernel mode-setting driver, support for 3D acceleration by QEMU guest virtual machines, AMD Stoney APU support, Qualcomm Snapdragon 820 support, expanded eBPF virtual machine programs, new hardware peripheral support, file-system fixes, faster SHA crypto support on Intel hardware, and LightNVM / Open-Channel SSD support." -- source: http://linux.slashdot.org/story/15/11/16/0313205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

SUSE LEAP 421 live versions
by Ian Young 16 Nov '15

16 Nov '15

This looks interesting and not a large download. http://geckolinux.github.io/ And the inimitable man from Sweden has been at it again in a break from brewing up his Android and Pi versions. http://opsus.exton.net/

1 0

Non-Copyleft Licences “Put The FOSS Community At Risk Of Collapse”
by Lawrence D'Oliveiro 12 Nov '15

12 Nov '15

HP’s CTO Martin Fink gave the closing keynote at the recent LinuxCon Europe conference. He argued that the proliferation of open-source software licences is (once again) having a bad effect on the health of software projects <http://lwn.net/Articles/660428/>. That much would not be so controversial, except he also claims that the use of non-copyleft “permissive” licences is adding to the problem. He justifies his argument thus: The Apache 2.0 license is currently the most widely used "permissive" license. But the thing that developers overlook when adopting it, he said, is that by using Apache they are also making a choice about how much work they will have to put into building any sort of community around the project. If you look at Apache-licensed projects, he noted, "you'll find that they are very top-heavy with 'governance' structures." Technical committees, working groups, and various boards, he said, are needed to make such projects function. But if you look at copyleft projects, he added, you find that those structures simply are not needed. The difference stems from the fact that in Apache-licensed projects, "you've always got people who are trying to go off and do their own proprietary thing." That makes their contributions to the open-source project difficult to integrate and often at odds with other participants. In a copyleft project, such as the kernel, "there is no incentive to try and carve out your own little area." As a result, contributors just do their work and the project advances. Certainly this statement of his is beyond dispute: “Copyleft is a simple, good thing: share and share alike.”

1 0

Multics vs Unix
by Lawrence D'Oliveiro 12 Nov '15

12 Nov '15

I’ve been reading the introductory “Multics Concepts and Utilization” book <http://bitsavers.trailing-edge.com/pdf/honeywell/multics/F01_multicsIntroCo…> over at Bitsavers. Multics (the “MULTiplexed Information and Computing Service”) was, for its time, an extremely ambitious operating system project. It was first introduced in 1965, in the form of a series of papers at the AFIPS Fall Joint Computer Conference of that year <http://www.computer.org/csdl/proceedings/afips/1965/5066/00/index.html>. Of course, it took far too long (7 years) to reach production quality. In that time, a small group of researchers at AT&T Bell Labs grew tired of waiting, and decided to create their own, less ambitious system, which they called “UNIX” as a tongue-in-cheek homage to “Multics”. And the rest, as they say, is history. But, nevertheless, Multics remained an influential system. There are even some present-day fans of it gathered at <http://multicians.org/>. Apparently they have got the OS booting on an emulator of the original GE 645 hardware. Though it was mostly written in a high-level language (PL/I), Multics was never a portable OS; to support its advanced virtual-memory and security features, it required special processor hardware support which was not common in those days. Even today, Multics has some features which can be considered innovative and uncommon. It may be true that, for example, SELinux can match all of its security capabilities and more. But some aspects of its file-protection system seem, to me, to make sharing of data between users a bit easier than your typical Linux/POSIX-type system. For a start, there seems to be no concept of file “ownership” as such. Or even of POSIX-style file protection modes (read/write/execute for owner/group/world). Instead, all file and directory access is controlled via access-control lists (ACLs). Directories have a permission called “modify”, which effectively gives a matching entity (user, group, process) owner-type rights over that directory; except that more than one entity can have that permission at once. Thus, a group of users working on a common project can all be given this “modify” access to a shared directory for that project, allowing them all to put data there, read it back again, control access to it, delete it etc on a completely equal basis. Contrast this with POSIX/Linux, where every file has to have exactly one owner; even if they create that file in a shared directory, it still gives the creating user a special status over that file, that others with write access to the containing directory do not have. (Multics also offers a separate “append” permission, that allows the possessor to create an item in a directory, without having the ability to remove an item once it’s there.) One radical idea introduced in Unix was its profligate use of multiple processes. Every new command you executed (except for the ones built into the shell) required the creation of a new process, often several processes. Other OSes tended to look askance at this; it seemed somehow wasteful, perhaps even sinful to spawn so many processes so readily and discard them so casually. The more conventional approach was to create a single process at user login, and execute nearly all commands within the context of that. There were special commands for explicitly creating additional processes (e.g. for background command execution), but such process creation did not simply happen as a matter of course. Gradually, over time, the limitations of the single-process approach became too much to ignore, and the versatility of the Unix approach won over (nearly) everybody. Multics, however, is of the old school. More than that, the process even preserves global state, including static storage, in-between runs of programs, and this applies across different programs, not just reruns of the same one. For example, in FORTRAN, there is the concept of a “common block”. If you run two different programs that both refer to the same common block, then the second one will see values left in the block by the first one. To completely reinitialize everything, you need to invoke the “new_proc” command, which effectively deletes your process and gives you a fresh one. One common irritation I find on POSIX/Linux systems is the convention that every directory has to have an entry called “.”, pointing to itself, and one called “..”, pointing to its parent. This way these names can be used in relative pathnames to reach any point in the directory hierarchy. But surely it is unnecessary to have explicit entries for these names cluttering up every directory; why not just build their recognition as a special case into the pathname-parsing logic in the kernel, once and for all? That way, directory-traversal routines in user programs don’t have to be specially coded to look for, and skip these entries, every single time. Multics doesn’t seem to have this problem. An absolute pathname begins with “>” (which is the separator for pathname components, equivalent to POSIX “/”), while a relative pathname doesn’t. Furthermore, a relative pathname can begin with one or more “<” characters, indicating the corresponding number of steps up from the current working directory. Unlike POSIX “..”, you can’t have “<” characters in the middle of the pathname, which is probably not a big loss. It is interesting to see other features which are nearly, but not quite, the same as, corresponding features in Unix. For example, there is a search path for executables, to save you typing the entire pathname to run the program. However, this does not seem as flexible as the $PATH environment-variable convention observed by Unix/POSIX shells. In particular, it does not seem possible to remove the current directory from the search path, which we now know can be a security risk. Another one is the concept of “active functions” and “active strings”. These allow you to perform substitutions of dynamically-computed values into a command line. However, they are not as general as the Unix/POSIX concept of “command substitution”, where an entire shell command can supply its output to be interpolated into another command. Instead of having a completely separate vocabulary of “active functions” which can only be used for such substitutions, Unix/POSIX unifies this with the standard set of commands, any of which can be used in this way. There are other features of Multics that others more familiar with it might want to see mentioned (the single-level store concept, where “everything is a memory segment”, versus Unix “everything is a file”? I/O redirection based on “switches”—symbolic references to files, versus Unix integer “file descriptors”?). But then, this long-winded essay would become even longer-winded :). So if you are interested in this particular piece of computing history, feel free to follow up the links above. In summary, Multics is very much a museum piece, not something you would want to use today for regular work—not in its original form. But I think there are still one or two ideas there that we could usefully copy and adapt to a present-day OS, particularly a versatile one like Linux.

1 1