- wlug - list.wlug.org.nz

Chrome 78 Arrives With New APIs, Dark Mode Improvements On Android and iOS
by Peter Reutemann 23 Oct '19

23 Oct '19

'Google today launched Chrome 78 for Windows, Mac, Linux, Android, and iOS. The release includes the CSS Properties and Values API, Native File System API, new Origin Trials, and dark mode improvements on Android and iOS. You can update to the latest version now using Chrome's built-in updater or download it directly from google.com/chrome. With over 1 billion users, Chrome is both a browser and a major platform that web developers must consider. In fact, with Chrome's regular additions and changes, developers often have to stay on top of everything available -- as well as what has been deprecated or removed. Chrome 78, for example, removes the XSS Auditor due to privacy concerns. Chrome 78 implements the CSS Properties and Values API to let developers register variables as full custom properties. There's a new Native File System API that lets developers build web apps that interact with files on the user's local device. Chrome 78 adds to the Original Trials introduced in Chrome 77, such as Signed Exchanges and SMS Receiver API. "The former allow a distributor to provide content signed by a publisher," reports VentureBeat. "The latter allows websites to access SMS messages that are delivered to the user's phone." Other features that are rolling out gradually include the ability to be able to highlight and right-click a phone number link in Chrome and forward the call to their Android device. "Some users might also see an option to share their clipboard content between their computers and Android devices," adds VentureBeat. "Chrome is also getting Google Drive integration. From Chrome's address bar, you will be able to search for Google Drive files that you have access to." ' -- source: https://tech.slashdot.org/story/19/10/22/224233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

An Interview With Former Purism CTO Zlatan Todoric Hints At Chaos At Purism
by Peter Reutemann 23 Oct '19

23 Oct '19

'Phoronix published an interview with former Purism CTO Zlatan Todoric who left Purism in September 2018. The story hints quite strongly at chaotic situations over at Purism. He started at the company in 2015, when it was a small outfit, and steered it into the bigger company that it is now. To him the smartphone development for the Librem 5 was a mistake and way too early. He has high hopes for the Pinephone, who according to him are doing things right. The first "Aspen" batch of the Purism Librem 5 are supposed to be shipping, though seemingly only people related to Purism are showing off their devices.' -- source: https://linux.slashdot.org/story/19/10/22/2152232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 70 Arrives With Social Tracking Blocked By Default
by Peter Reutemann 23 Oct '19

23 Oct '19

'Mozilla today launched Firefox 70 for Windows, Mac, Linux, Android, and iOS. Firefox 70 includes social tracking protection, a Privacy Protections report, new Lockwise features, and performance improvements on Windows and macOS. Firefox 70 for desktop is available for download now on Firefox.com, and all existing users should be able to upgrade to it automatically. The Android version is trickling out slowly on Google Play and the iOS version is on Apple's App Store. According to Mozilla, Firefox has about 250 million active users, making it a major platform for web developers to consider. With Firefox 70, Mozilla now also includes social tracking protection under the Standard setting. It blocks cross-site tracking cookies from sites like Facebook, Twitter, and LinkedIn.' -- source: https://news.slashdot.org/story/19/10/22/1610219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox To Get Page Translation Feature, Like Chrome
by Peter Reutemann 23 Oct '19

23 Oct '19

'Mozilla developers are working on adding an automatic page translation feature to Firefox, similar to the one included in Google Chrome. However, Firefox's page translation feature will be different from the one supported in Google Chrome. Instead of relying on cloud-based text translation services (like Google Translate, Bing Translator, or Yandex.Translate), Firefox will use a client-side, machine learning-based translation library, currently being developed part of the Bergamot Project, which received $3.35 million in EU funding from the European Union's Horizon 2020 research and innovation programme.' -- source: https://news.slashdot.org/story/19/10/22/1712239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Disney+ Does Not Work On Linux Devices
by Peter Reutemann 22 Oct '19

22 Oct '19

'If you plan on streaming content from the new Disney+ streaming service on Linux devices, you'll likely be greeted with Error Code 83. Fedora Linux package maintainer Hans De Goede from the Netherlands first made the unpleasant discovery. gHacks reports: De Goede noticed that Disney+ would not work in any of the web browsers that he tried on systems running Fedora Linux. He tried Firefox and Chrome, and both times Disney+ threw the error "error code 83." Disney+ Support was not able to assist de Goede. It replied with a generic message stating that the error was known and that it happened often when customers tried to play Disney+ in web browsers or using certain devices. Support recommended to use the official applications on phones or tablets to watch the shows or movies. Other streaming services, e.g. Netflix, work fine on Linux. A user on the Dutch site Tweakers dug deeper and uncovered the response code that the site returned when a device or browser was used that could not be used to play streams. According to the information, error code 83 means that the platform verification status is incompatible with the security level. Disney uses the DRM solution Widevine to protect its streams from unauthorized activity. Widevine supports three different security levels, called 1, 2 and 3, which have certain requirements. The supported level determines the maximum stream quality and may even prevent access to a stream if the requirements are not met. It appears that Disney set Widevine to a more restrictive level than its competitors. The decision affects Disney+ on Linux devices and on other devices that don't support the selected Widevine security standard. ' -- source: https://linux.slashdot.org/story/19/10/21/2128213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Remember Sure-Fi? Lostik is open standards Lora you can play with
by Peter Reutemann 22 Oct '19

22 Oct '19

'A lot of readers commented on our earlier report on Sure-Fi long-range, low-bandwidth RF chirp communicators that we should test generic Lora gear. Lora is the open standard that Sure-Fi began with and built on top of, and it's available in a variety of inexpensive kits. Most of those kits are aimed at low-level maker-style integration with IoT gear like Arduino, but I found a couple of preassembled kits with generic USB interfaces suitable for use with regular x86 computers. One of those, Lostik, had consistently better user reviews and glowingly boasted of its "extensive documentation," so we picked a pair up for $46 apiece and got to testing. We should be clear about one thing up front—nobody should claim that any Lora device has "extensive documentation" with a straight face. Lostik seems to have more documentation than any of its competitors, but figuring out exactly what it would do felt like learning to play pirated video games in the 1980s. What we eventually discovered was that Lora devices are sort of like dial-up modems all connected to a single party line—they run on serial interfaces over which they can be issued commands and can send or receive data. It's possible to use a generic terminal emulator (at 57,600bps, 8 data bits, 1 stop bit, and no parity) to communicate directly with Lostik, but you'll need to understand its commands—analogous to the Hayes AT modem commands of yore—if you do. That was a bridge too far for us, so we said the heck with it and just lightly modified the ./sender.py and ./receiver.py sample scripts from Lostik's Github repository and used them for some simple range testing. These scripts don't require (or offer) any kind of authentication or pairing; any Lora device running receiver.py will successfully receive data from any Lora device running sender.py within its effective range.' -- source: https://arstechnica.com/gadgets/2019/10/lostik-usb-lora-radios/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Popular VPN Service NordVPN Says it Was Hacked
by Peter Reutemann 22 Oct '19

22 Oct '19

'NordVPN, a virtual private network provider that promises to "protect your privacy online," has confirmed it was hacked. From a report: The admission comes following rumors that the company had been breached. It first emerged that NordVPN had an expired internal private keys exposed, potentially allowing anyone to spin out their own servers imitating NordVPN. For its part, NordVPN has claimed a "zero logs" policy. "We don't track, collect, or share your private data," the company says. But the breach is likely to cause alarm that hackers may have been in a position to access some user data. NordVPN told TechCrunch that one of its datacenters was accessed in March 2018. "One of the datacenters in Finland we are renting our servers from was accessed with no authorization," said NordVPN spokesperson Laura Tyrell. The attacker gained access to the server -- which had been active for about a month -- by exploiting an insecure remote management system left by the datacenter provider, which NordVPN said it was unaware that such a system existed.' -- source: https://it.slashdot.org/story/19/10/21/1447208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Avast Says Hackers Breached Internal Network Through Compromised VPN Profile
by Peter Reutemann 22 Oct '19

22 Oct '19

'Czech cyber-security software maker Avast disclosed today a security breach that impacted its internal network. In a statement published today, the company said it believed the attack's purpose was to insert malware into the CCleaner software, similar to the infamous CCleaner 2017 incident. Avast said the breach occurred because the attacker compromised an employee's VPN credentials, gaining access to an account that was not protected using a multi-factor authentication solution. The intrusion was detected on September 23, but Avast said it found evidence of the attacker targeting its infrastructure going as far back as May 14, this year. The identity of the attacker is currently unknown, but the company said hackers didn't manage to modify CCleaner downloads this time aroun' -- source: https://it.slashdot.org/story/19/10/21/187216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Visiting New Zealand
by Aaron 21 Oct '19

21 Oct '19

I am a longtime Linux developer and will be staying with friends in Rotarua from Feb 2 through April 21. I'd love to both attend and present at a Linux User Group while I'm there. Presentation idea description: The voice interface represents another big shift in user interfaces, and could be as big a shift as the shift from switches to terminals, the switch from terminals to windowed GUIs, or the switch from full computers to small touchscreen devices. Unfortunately, right now most of these devices are little more than a telephone for talking to a server in the cloud. That is a big problem for privacy, and presents the user with a false choice between access and privacy. Today's computers are capable of handling a verbal interface without requiring a cloud service to handle all of your requests. I am one of the developers on the Naomi Project, a free and open source voice assistant (https://projectnaomi.com) It is a plugin based system based on Jasper (http://jasperproject.github.io/) and depending on how the user chooses to configure it, can run totally offline. In this presentation, I'd like to introduce people to the Naomi Project, talk about the benefits of a verbal interface, talk about the current architectures of virtual assistants, and ways in which that architecture can be altered to provide better privacy, and also do a comparison of offline speech to text and text to speech solutions, including Pocketsphinx, Mozilla Deepspeech, Kaldi, and Julius. Finally, I will invite people to participate in building and improving Naomi. There is a lot to do and much of it is both engaging and cutting-edge. Please let me know if you are interested, or if you know of other active groups I should contact. Thanks, Aaron

2 1

Researchers abuse Alexa and Google Home to eavesdrop and phish passwords
by Peter Reutemann 21 Oct '19

21 Oct '19

'By now, the privacy threats posed by Amazon Alexa and Google Home are common knowledge. Workers for both companies routinely listen to audio of users—recordings of which can be kept forever—and the sounds the devices capture can be used in criminal trials. Now, there's a new concern: malicious apps developed by third parties and hosted by Amazon or Google. The threat isn't just theoretical. Whitehat hackers at Germany's Security Research Labs developed eight apps—four Alexa "skills" and four Google Home "actions"—that all passed Amazon or Google security-vetting processes. The skills or actions posed as simple apps for checking horoscopes, with the exception of one, which masqueraded as a random-number generator. Behind the scenes, these "smart spies," as the researchers call them, surreptitiously eavesdropped on users and phished for their passwords.' -- source: https://arstechnica.com/information-technology/2019/10/alexa-and-google-hom… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Project Trident Ditches BSD For Linux
by Peter Reutemann 21 Oct '19

21 Oct '19

'Project Trident is moving from FreeBSD to Void Linux, reports Its FOSS: According to a later post, the move was motivated by long-standing issues with FreeBSD. These issues include "hardware compatibility, communications standards, or package availability continue to limit Project Trident users". According to a conversation on Telegram, FreeBSD has just updated its build of the Telegram client and it was nine releases behind everyone else. The lead dev of Project Trident, Ken Moore, is also the main developer of the Lumina Desktop. The Lumina Desktop has been on hold for a while because the Project Trident team had to do so much work just to keep their packages updated. (Once they complete the transition to Void Linux, Ken will start working on Lumina again.) After much searching and testing, the Project Trident team decided to use Void Linux as their new base. More from the Project Trident site: It's important to reiterate that Project Trident is a distribution of an existing operating system. Project Trident has never been a stand-alone operating system. The goal of Project Trident is enhancing the usability of an operating system as a graphical workstation through all sorts of means: custom installers, automatic setup routines, graphical utilities, and more... The more we've tested Void Linux, the more impressed we have been. We look forward to working with an operating system that helps Project Trident continue to provide a stable, high-quality graphical desktop experience.' -- source: https://linux.slashdot.org/story/19/10/20/2227228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Samsung Won't Support Linux on DeX Once Android 10 Arrives
by Peter Reutemann 21 Oct '19

21 Oct '19

'If you've been using Linux on DeX (aka Linux on Galaxy) to turn your Samsung phone into a PC, you'll need to make a change of plans. Samsung is warning users that it's shutting down the Linux on DeX beta program, and that its Android 10 update won't support using the open source OS as a desktop environment. The company didn't explain why it was shutting things down, but it did note that the Android 10 beta is already going without the Linux option... Samsung is still committed to DeX, and recently enabled its desktop-style space on Macs and Windows PCs. However, it's clear that the dreams of fully replacing a PC with your Galaxy phone will have to wait, at least for now.' -- source: https://linux.slashdot.org/story/19/10/20/0051217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla is Sharing YouTube Horror Stories To Prod Google For More Transparency
by Peter Reutemann 21 Oct '19

21 Oct '19

'CNET reports on a new crowdsourced public awareness campaign: Mozilla is publishing anecdotes of YouTube viewing gone awry -- anonymous stories from people who say they innocently searched for one thing but eventually ended up in a dark rabbit hole of videos. It's a campaign aimed at pressuring Google's massive video site to make itself more accessible to independent researchers trying to study its algorithms. "The big problem is we have no idea what is happening on YouTube," said Guillaume Chaslot, who is a fellow at Mozilla, a nonprofit best known for its unit that makes and operates the Firefox web browser. Chaslot is an ex-Google engineer who has investigated YouTube's recommendations from the outside after he left the company in 2013. (YouTube says he was fired for performance issues.) "We can see that there are problems, but we have no idea if the problem is from people being people or from algorithms," he said.... Mozilla is publishing 28 stories it's terming #YouTubeRegrets; they include, for example, an anecdote from someone who who said a search for German folk songs ended up returning neo-Nazi clips, and a testimonial from a mother who said her 10-year-old daughter searched for tap-dancing videos and ended up watching extreme contortionist clips that affected her body image. ' -- source: https://news.slashdot.org/story/19/10/20/1927234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

WAV Audio Files Are Now Being Used To Hide Malicious Code
by Peter Reutemann 21 Oct '19

21 Oct '19

'Two reports published in the last few months show that malware operators are experimenting with using WAV audio files to hide malicious code. The first of these new malware campaigns abusing WAV files was reported back in June by Symantec security researchers who said they spotted a Russian cyber-espionage group known as Waterbug (or Turla) using WAV files to hide and transfer malicious code from their server to already-infected victims. The second malware campaign was spotted this month by BlackBerry Cylance. In a report published today and shared with ZDNet last week, Cylance said it saw something similar to what Symantec saw a few months before. But while the Symantec report described a nation-state cyber-espionage operation, Cylance said they saw the WAV steganography technique being abused in a run-of-the-mill crypto-mining malware operation.' -- source: https://it.slashdot.org/story/19/10/20/200249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Privacy-Respecting Smart Home System Can Work Offline and Sends Fake Data
by Peter Reutemann 21 Oct '19

21 Oct '19

'A publicly-funded group of designers, artists and privacy experts from Amsterdam have designed a smart home system prototype to "prove it's technically possible to build a privacy respecting smart home while maintaining convenience." Its controller uses an Arduino Nano to disconnect the system from the internet during times when it's not in use. They're building everything on Mozilla's open smart home gateway software. The system's microphone is a separate USB device that can be easily unplugged. For extra security, the devices don't even use wifi to communicate. "The Candle devices offer the advantages of a smart home system -- such as voice control, handy automations and useful insights -- without the downsides of sending your data to the cloud and feeling watched in your own home," explains their blurb for Dutch Design Week, where they're launching their prototypes of trust-worthy smart locks, thermostats, and other Internet of Things devices: Most smart devices promises us an easier life, but they increasingly disappoint; they eavesdrop, share our data with countless third parties, and offer attractive targets to hackers. Candle is different. Your data never leaves your home, all devices work fine without an internet connection, and everything is open source and transparent. One of the group's members is long-time Slashdot reader mrwireless, who shares an interesting observation: Smart homes track everything that happens inside them. For developing teenagers, this makes it more difficult to sneak in a date or break the rules in other subtle ways, which is a normal, healthy part of growing up. Candle is a prototype smart home that tries to mitigate these issue. It has given its sensors the ability to generate fake data for a while. In the future, children could get a monthly fake data allowance. Some of the devices have "skirts", simple fabric covers that can be draped over the devices to hide their screen. If you own a dust sensor, this can be useful if your mother in law comes over and you haven't vacuumed in a while.' -- source: https://yro.slashdot.org/story/19/10/20/216238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Unpatched Linux bug may open devices to serious attacks over Wi-Fi
by Peter Reutemann 18 Oct '19

18 Oct '19

'A potentially serious vulnerability in Linux may make it possible for nearby devices to use Wi-Fi signals to crash or fully compromise vulnerable machines, a security researcher said. The flaw is located in the RTLWIFI driver, which is used to support Realtek Wi-Fi chips in Linux devices. The vulnerability triggers a buffer overflow in the Linux kernel when a machine with a Realtek Wi-Fi chip is within radio range of a malicious device. At a minimum, exploits would cause an operating-system crash and could possibly allow a hacker to gain complete control of the computer. The flaw dates back to version 3.10.1 of the Linux kernel released in 2013. "The bug is serious," Nico Waisman, who is a principal security engineer at Github, told Ars. "It's a vulnerability that triggers an overflow remotely through Wi-Fi on the Linux kernel, as long as you're using the Realtek (RTLWIFI) driver." The vulnerability is tracked as CVE-2019-17666. Linux developers proposed a fix on Wednesday that will likely be incorporated into the OS kernel in the coming days or weeks. Only after that will the fix make its way into various Linux distributions.' -- source: https://arstechnica.com/information-technology/2019/10/unpatched-linux-flaw… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

IBM+Red Hat: A Successful Acquisition For A Change?
by Lawrence D'Oliveiro 18 Oct '19

18 Oct '19

IBM reports <https://www.theregister.co.uk/2019/10/17/ibm_q3_2019_financials/> that its Red Hat division has been doing quite nicely since it was acquired. This is in contrast to the rest of the company, which seems to be continuing its long, slow downward slide. I have seen mention elsewhere of economic studies that show that, on average, corporate mergers and acquisitions tend to destroy value rather than create it (e.g. the all-too-common scenario of “big company buys small company and then drives away its customers and shuts it down”). The realization of actual “synergies” seems to be the exception rather than the rule. Maybe IBM will continue jettisoning its other parts, and end up being just Red Hat in all but name...

1 0

Bug In Python Script May Have Affected Hundreds Of Studies
by Lawrence D'Oliveiro 18 Oct '19

18 Oct '19

A set of Python scripts popularly used to analyze chemistry data has had a long-standing bug in that it had assumptions about the order in which filenames in a directory would be returned <https://arstechnica.com/information-technology/2019/10/chemists-discover-cr…>. The code worked correctly on Windows and an older version of macOS, but discrepancies crept in on Linux and on newer macOS. The fix was to sort the returned names into a consistent order before processing. I just note this Twitter comment from one of the original authors: When I wrote the scripts 6 years ago, the OS was able to handle the sorting. That would never have been true on Linux. There have never been any guarantees about ordering of directory entries on POSIX-compliant systems. Note the docs <https://docs.python.org/3/library/glob.html#glob.glob> clearly say: Whether or not the results are sorted depends on the file system. One of the researchers who found (and fixed) the bug says ... he hopes the paper will get scientists to pay more attention to the computational side of experiments in the future.

2 7

Germany's Cybersecurity Agency Recommends Firefox As Most Secure Browser
by Peter Reutemann 18 Oct '19

18 Oct '19

'Firefox is the only browser that received top marks in a recent audit carried out by Germany's cyber-security agency -- the German Federal Office for Information Security (or the Bundesamt fur Sicherheit in der Informationstechnik -- BSI). The BSI tested Mozilla Firefox 68 (ESR), Google Chrome 76, Microsoft Internet Explorer 11, and Microsoft Edge 44. The tests did not include other browsers like Safari, Brave, Opera, or Vivaldi. The audit was carried out using rules detailed in a guideline for "modern secure browsers" that the BSI published last month, in September 2019. The BSI normally uses this guide to advise government agencies and companies from the private sector on what browsers are safe to use. The article includes a list of all the minimum requirements required for the BSI to consider a browser "secure." It also lists the areas where the other browsers failed, such as: Lack of support for a master password mechanism (Chrome, IE, Edge); No built-in update mechanism (IE), and No option to block telemetry collection (Chrome, IE, Edge)' -- source: https://news.slashdot.org/story/19/10/17/2136219 Cheers, Pete -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hard drives not mounting
by Ian Young 17 Oct '19

17 Oct '19

Hi John (et al) I am going to assume these are drives formatted NTFS. Of late I have encountered drives from Windows machines which Linux won't mount, I think ntfs-3g is a bit finicky about this in recent versions. Get in touch with me directly if you wish, I have a gadget which will connect drives via USB to avoid having to put them into a machine. Some distributions may be able to see the drives even if Mint doesn't wish to, we could try various versions.

1 0

Google Ejects Open-Source WireGuard From Play Store Over Donation Links
by Peter Reutemann 17 Oct '19

17 Oct '19

'Google appears to be removing apps that have donation links, including open-source apps where donations are one of the main sources of revenue. WireGuard, a free and open-source VPN, has been reportedly dropped over this according to WireGuard lead developer Jason Donenfeld. Phoronix reports: After waiting days for Google to review the latest version of their secure VPN tunnel application, it was approved and then removed and delisted -- including older versions of WireGuard. The reversal comes on the basis of violating their "payments policy." The only bit of possible "payments" within the WireGuard app is a donation link within the program taking the user to the WireGuard website should anyone want to donate to support this promising open-source secure networking tech. An appeal to the situation was also rejected by Google, Donenfeld has confirmed this morning on their mailing list. In trying to make it back into Android's Play Store, Jason has dropped the donation link from the Android app version while it's still awaiting review from Google. ' -- source: https://news.slashdot.org/story/19/10/16/2215248 Cheers, peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting NEXT Monday
by Peter Reutemann 17 Oct '19

17 Oct '19

Hi everyone Due to Labor Day falling on our usual meeting slot and the university no longer opening up rooms on public holidays, this month's meeting takes place a week earlier, ie next Monday! "Creating a low power consumption Print Server using a Raspberry Pi. Peter Reutemann will present/demo the material prepared by Ian Stewart as he cannot attend the meeting unfortunately." -- details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/257884319/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Calibre Replacement Considerations
by Lawrence D'Oliveiro 17 Oct '19

17 Oct '19

This blog post <https://anarc.at/software/desktop/calibre/> popped up in my screensaver display a few minutes ago, and was interesting enough for me to find the original. Calibre is the well-known software package for viewing and managing ebooks and converting between formats. As the blog writer says: It's used by Linux geeks as well as Windows power-users and vastly surpasses any native app shipped by ebook manufacturers. I know almost exactly zero people that have an ebook reader that do *not* use Calibre. However, there seem to be quite a few problems with it, not the least of which is that the principal developer seems to have trouble appreciating security vulnerabilities. Another issue is that it is written in Python 2 (though an in-progress port to Python 3 seems to be mostly “going well”). At one point the developer claimed that wasn’t a big deal, as he could continue to maintain Python 2 himself after it became obsolete upstream, but he seems to have backtracked from that position. One pressing problem is that newer versions of Calibre depend on Python 2 libraries that are no longer available in Debian (and therefore would also disappear from all the usual Debian derivatives, like Ubuntu and Linux Mint). However, the list of useful functions that Calibre performs is remarkably long, so finding substitutes for them all is going to be rather daunting.

2 1

In 2019, multiple open source companies changed course—is it the right move?
by Peter Reutemann 17 Oct '19

17 Oct '19

'Free and open source software enables the world as we know it in 2019. From Web servers to kiosks to the big data algorithms mining your Facebook feed, nearly every computer system you interact with runs, at least in part, on free software. And in the larger tech industry, free software has given rise to a galaxy of startups and enabled the largest software acquisition in the history of the world. Free software is a gift, a gift that made the world as we know it possible. And from the start, it seemed like an astounding gift to give. So astounding in fact that it initially made businesses unaccustomed to this kind of generosity uncomfortable. These companies weren't unwilling to use free software, it was simply too radical and by extension too political. It had to be renamed: "open source." Once that happened, open source software took over the world. Recently, though, there's been a disturbance in the open source force. Within the last year, companies like Redis Labs, MongoDB, and Confluent all changed their software licenses, moving away from open source licenses to more restrictive terms that limit what can be done with the software, making it no longer open source software. The problem, argue Redis Labs, MongoDB and others, is a more modern tech trend: hosted software services. Also known as, "the cloud." Also known as Amazon AWS. Amazon, for its part, came out swinging, releasing its own version of the code behind Elastic Search this spring in response to licensing changes at Elastic (the company behind Elastic Search). And besides a new trademark dispute over Amazon's naming convention, Elastic has a very different response from that of MongoDB and Redis—it hasn't said a word in protest.' -- source: https://arstechnica.com/information-technology/2019/10/is-the-software-worl… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hard drives
by john 17 Oct '19

17 Oct '19

I sent this yesterday with four screenshots not aware that I may incur the wrath of the moderator. Here is a copy of the e-mail minus the pretty pictures. My neighbor just gave me a couple of failed Sea-gate hard drives to test I put them (one at a time) into my Linux mint machine. They showed up in my computer but would not mount.(see attachments) I ran the "Disks" utility which reported exactly the same problem (one incident of over temperature) for both disks However it stated that the disks were OK. One disk has 500GB of movies and TV series The other 375GB Operas and areas. The disks were used by a Mother and Son on two laptops and were cross pollinated between the two. I doubt that forcing a mount would reap a reward in this case. If any one can help with this it would be neat. Cheers John..

2 1

Interview With Fedora Project Leader Matthew Miller On 15 Years of Fedora
by Peter Reutemann 17 Oct '19

17 Oct '19

'Fedora -- as a Linux distribution -- will celebrate the 15th anniversary of its first release in November, though its technical lineage is much older, as Fedora Core 1 was created following the discontinuation of Red Hat Linux 9 in favor of Red Hat Enterprise Linux (RHEL). Five years after the start of Fedora.next, the distribution is on the right track -- stability has improved, and work on minimizing hard dependencies in packages and containers, including more audio/video codecs by default, flicker-free boot, and lowering power consumption for notebooks, among other changes, have greatly improved the Fedora experience, while improvements in upstream projects such as GNOME and KDE have likewise improved the desktop experience. In a wide-ranging interview with TechRepublic, Fedora project leader Matthew Miller discussed lessons learned from the past, popular adoption and competing standards for software containers, potential changes coming to Fedora, as well as hot-button topics, including systemd.' -- source: https://linux.slashdot.org/story/19/10/16/1712207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meetup.com: members will pay soon
by Peter Reutemann 16 Oct '19

16 Oct '19

Hi everyone Came across this news item from meetup.com: https://www.meetup.com/lp/paymentchanges Members will soon get charged USD 2 per month for using meetup.com. So far, it was only the organizers that had to cough up money. The idea is to lower costs for organizers and ensure that people RSVPing actually show up. I'll put this as topic for the upcoming AGM. In the meantime, we should start looking for alternatives. E.g.: https://alternativeto.net/software/meetup/ Personally, I like GetTogether (https://gettogether.community/) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

UK’s AMD-CPU-Based Archer2 Supercomputer At Edinburgh Uni
by Lawrence D'Oliveiro 15 Oct '19

15 Oct '19

What’s notable about this super <https://www.theregister.co.uk/2019/10/15/uk_archer2_supercomputer/> is that it uses AMD CPUs instead of Intel, and it is (mostly) CPU-only, with a small number of GPUs available on the side.

1 0

Google's Auto-Delete Tools Are Practically Worthless For Privacy
by Peter Reutemann 15 Oct '19

15 Oct '19

'By default, Google collects a vast amount of data on users' behavior, including a lifelong record of web searches, locations, and YouTube views. But amid a privacy backlash and ongoing regulatory threats, the company has started to hype its recently released privacy tools, like the ability to automatically delete some of the data it collects about you -- data that helps power its $116 billion ad business. [...] In reality, these auto-delete tools accomplish little for users, even as they generate positive PR for Google. Experts say that by the time three months rolls around, Google has already extracted nearly all the potential value from users' data, and from an advertising standpoint, data becomes practically worthless when it's more than a few months old. "Anything up to one month is extremely valuable," says David Dweck, the head of paid search at digital ad firm WPromote. "Anything beyond one month, we probably weren't going to target you anyway." Dweck says that in the digital ad industry, recent activity is essential. If you start searching on Google for real estate or looking up housing values, for instance, Google might lump you into a "prospective home buyers" category for advertisers. That information becomes instantly valuable to realtors, appraisers, and lenders for ad targeting, and it could remain valuable for a while as other companies, such as painters or appliance brands, try to follow up on your home buying. Still, it's unusual for advertisers to target users based on their activity from months earlier, Dweck says.' -- source: https://yro.slashdot.org/story/19/10/15/1933230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Flaw In Sudo Enables Non-Privileged Users To Run Commands As Root
by Peter Reutemann 15 Oct '19

15 Oct '19

'A vulnerability has been discovered in Sudo -- one of the most important, powerful, and commonly used utilities that comes as a core command installed on almost every UNIX and Linux-based operating system. The vulnerability in question is a sudo security policy bypass issue that could allow a malicious user or a program to execute arbitrary commands as root on a targeted Linux system even when the "sudoers configuration" explicitly disallows the root access. Sudo, stands for "superuser do," is a system command that allows a user to run applications or commands with the privileges of a different user without switching environments -- most often, for running commands as the root user. The vulnerability, tracked as CVE-2019-14287 and discovered by Joe Vennix of Apple Information Security, is more concerning because the sudo utility has been designed to let users use their own login password to execute commands as a different user without requiring their password. What's more interesting is that this flaw can be exploited by an attacker to run commands as root just by specifying the user ID "-1" or "4294967295." That's because the function which converts user id into its username incorrectly treats -1, or its unsigned equivalent 4294967295, as 0, which is always the user ID of root user. The vulnerability affects all Sudo versions prior to the latest released version 1.8.28, which has been released today.' -- source: https://linux.slashdot.org/story/19/10/14/2231235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Apple's Safari Browser Is Sending Some Users' IP Addresses To China's Tencent
by Peter Reutemann 14 Oct '19

14 Oct '19

'"Apple, which often positions itself as a champion of privacy and human rights, is sending some IP addresses from users of its Safari browser on iOS to Chinese conglomerate Tencent -- a company with close ties to the Chinese Communist Party," reports the Reclaim the Net blog: Apple admits that it sends some user IP addresses to Tencent in the "About Safari & Privacy" section of its Safari settings.... The "Fraudulent Website Warning" setting is toggled on by default which means that unless iPhone or iPad users dive two levels deep into their settings and toggle it off, their IP addresses may be logged by Tencent or Google when they use the Safari browser. However, doing this makes browsing sessions less secure and leaves users vulnerable to accessing fraudulent websites... Even if people install a third-party browser on their iOS device, viewing web pages inside apps still opens them in an integrated form of Safari called Safari View Controller instead of the third-party browser. Tapping links inside apps also opens them in Safari rather than a third-party browser. These behaviors that force people back into Safari make it difficult for people to avoid the Safari browser completely when using an iPhone or iPad. Engadget adds that it's "not clear" whether or not Tencent is actually collecting IP addresses from users outside of China. ("You'll see mention of the collection in the U.S. disclaimer, but that doesn't mean it's scooping up info from American web surfers.") But Reclaim the Net points out that the possibility is troubling, in part because Safari is the #1 most popular mobile internet browser in America, with a market share of over 50%.' -- source: https://apple.slashdot.org/story/19/10/14/033225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AGM next month
by Peter Reutemann 14 Oct '19

14 Oct '19

Hi everyone We have our AGM coming up next month, November 25th: Agenda (preliminary) • President's Report • Treasurer's Report • Election of 2020 Committee • General business • Consumption of pizza Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/257884356/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bell Labs Plans Big 50th Anniversary Event For Unix
by Peter Reutemann 14 Oct '19

14 Oct '19

'Photographer Peter Adams launched a "Faces of Open Source" portrait project in 2014. This week he posted a special announcement on the web site of Bell Labs: Later this month, Bell Labs will celebrate the 50th anniversary of Unix with a special two day "Unix 50" event at their historic Murray Hill headquarters. This event should be one for the history books with many notable Unix and computer pioneers in attendance...! As I was making those photographs (which will be on display at the event), I gained much insight into Bell Labs and the development of Unix. However, it was some of the more personal stories and anecdotes that brought Bell Labs to life and gave me a feel for the people behind the code. One such time was when Ken Thompson (who is an accomplished pilot) told me how he traveled to Russia after the fall of the Soviet Union in order to fly in a MiG-29 fighter jet... Brian Kernighan told me about how a certain portrait of Peter Weinberger found its way into some very interesting places. These included the concrete foundation of a building on Bell Labs campus, the cover images printed onto Unix CD-ROMs, and most notably, painted on the top of a nearby water tower. Which brings us to another important piece of Unix mythology that I learned about: the fictitious Bell Labs employee G.R. Emlin (a.k.a. "the gremlin").... A lot of this folklore (including the gremlin) is going to be on display at the Unix 50 event. The archivists at Bell Labs have outdone themselves by pulling together a massive collection of artifacts taken from the labs where Unix was developed for over 30 years. I was able to photograph a few of these artifacts last year, but so much more will be exhibited at this event -- including several items from the personal archives of some attendees. As if that wasn't enough, the event will also showcase a number of vintage computers and a look into Bell Labs future with a tour of their Future X Labs. The article includes some more quick stories about the Unix pioneers at Bell Labs (including "the gremlin") and argues that "the decision to freely distribute Unix's source code (to anyone who asked for it) inadvertently set the stage for the free and open source software movements that dominate the technology industry today... "In hindsight, maybe 1969 should be called the 'summer of code.'"' -- source: https://tech.slashdot.org/story/19/10/12/1625237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Planting tiny spy chips in hardware can cost as little as $200
by Peter Reutemann 14 Oct '19

14 Oct '19

'More than a year has passed since Bloomberg Businessweek grabbed the lapels of the cybersecurity world with a bombshell claim: that Supermicro motherboards in servers used by major tech firms, including Apple and Amazon, had been stealthily implanted with a chip the size of a rice grain that allowed Chinese hackers to spy deep into those networks. Apple, Amazon, and Supermicro all vehemently denied the report. The National Security Agency dismissed it as a false alarm. The Defcon hacker conference awarded it two Pwnie Awards, for "most overhyped bug" and "most epic fail." And no follow-up reporting has yet affirmed its central premise. But even as the facts of that story remain unconfirmed, the security community has warned that the possibility of the supply chain attacks it describes is all too real. The NSA, after all, has been doing something like it for years, according to the leaks of whistle-blower Edward Snowden. Now researchers have gone further, showing just how easily and cheaply a tiny, tough-to-detect spy chip could be planted in a company's hardware supply chain. And one of them has demonstrated that it doesn't even require a state-sponsored spy agency to pull it off—just a motivated hardware hacker with the right access and as little as $200 worth of equipment.' -- source: https://arstechnica.com/information-technology/2019/10/planting-tiny-spy-ch… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fwd: [NZLUG] Sysadmin Miniconf CFP - Linux.conf.au 2020 on The Gold Coast
by Peter Reutemann 11 Oct '19

11 Oct '19

Apologies for cross-posting. Cheers, Peter -------- Original Message -------- From: Simon Lyall <simon(a)darkmere.gen.nz> Sent: October 11, 2019 9:50:45 PM GMT+13:00 To: NZ Linux Users Group <nzlug(a)lists.nzoss.org.nz> Subject: [NZLUG] Sysadmin Miniconf CFP - Linux.conf.au 2020 on The Gold Coast The Sysadmin Miniconf is being held on The Gold Coast in January. We are looking for talks about all aspects of System Administration and Operations. Sysadmin Miniconf Call for Presentations https://sysadmin.miniconf.org/cfp20.html The Sysadmin Miniconf is part of Linux.conf.au, a 5-day technical conference being held in The Gold Coast in January 2020. There are 12 Single-day Miniconfs on specific topics such as Kubernetes, Documentation, Kernel and Security being held as part of the conference. The Miniconfs are currently looking for talk proposals https://linux.conf.au/programme/miniconfs/ Tickets for Linux.conf.au are now available: https://linux.conf.au/ Please forward to your colleagues, peers, or others you think may be interested -- Simon Lyall | Very Busy | Web: http://www.simonlyall.com/ "To stay awake all night adds a day to your life" - Stilgar _______________________________________________ NZLUG mailing list NZLUG(a)lists.nzoss.org.nz http://lists.nzoss.org.nz/mailman/listinfo/nzlug -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

System76 Will Begin Shipping 2 Linux Laptops With Coreboot-Based Open Source Firmware
by Peter Reutemann 10 Oct '19

10 Oct '19

'System76, the Denver-based Linux PC manufacturer and developer of Pop OS, has some stellar news for those who prefer their laptops a little more open. Later this month the company will begin shipping two of their laptop models with its Coreboot-powered open source firmware. >From a report: Beginning today, System76 will start taking pre-orders for both the Galago Pro and Darter Pro laptops. The systems will ship out later in October, and include the company's Coreboot-based open source firmware which was previously teased at the 2019 Open Source Firmware Conference. (Coreboot, formerly known as LinuxBIOS, is a software project aimed at replacing proprietary firmware found in most computers with a lightweight firmware designed to perform only the minimum number of tasks necessary to load and run a modern 32-bit or 64-bit operating system.) What's so great about ripping out the proprietary firmware included in machines like this and replacing it with an open alternative? To begin with, it's leaner. System76 claims that users can boot from power off to the desktop 29% faster with its Coreboot-based firmware. [...] Both of these laptops can be kitted out with 10th-Generation Intel CPUs (specifically the i5-10210U and the i7-10510U), and both have glare-resistant matte 1080p IPS displays. Beginning at $949, the Galago Pro features an all-aluminum chassis, a wealth of connectivity options including HDMI, DisplayPort to USB-C and Thunderbolt, and can be configured with up to 32GB of RAM and up to 6TB of storage space. The Darter Pro, meanwhile, can be built out with 32GB of RAM and up to 2TB of storage, and features up to 10 hours of battery life.' -- source: https://hardware.slashdot.org/story/19/10/10/1847228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Forum cracks the vintage passwords of Ken Thompson and other Unix pioneers
by Peter Reutemann 10 Oct '19

10 Oct '19

'As one of the original versions of Unix, BSD is an ancient operating system. So it shouldn’t come as a surprise that it used what are, by today’s standards, strange, even ridiculous security. For one, the hashing function protecting passwords, though state of the art 40 years ago, is now trivial to crack. Stranger still, the password hashes of some BSD creators were included in publicly available source code. And then, there are the passwords people chose. Last week, technologist Leah Neukirchen reported finding a source tree for BSD version 3, circa 1980, and successfully cracking passwords of many of computing’s early pioneers. In most of the cases the success was the result of the users choosing easy-to-guess passwords. BSD co-inventor Dennis Ritchie, for instance, used “dmac” (his middle name was MacAlistair); Stephen R. Bourne, creator of the Bourne shell command line interpreter, chose “bourne”; Eric Schmidt, an early developer of Unix software and now the executive chairman of Google parent company Alphabet, relied on “wendy!!!” (the name of his wife); and Stuart Feldman, author of Unix automation tool make and the first Fortran compiler, used “axolotl” (the name of a Mexican salamander). Weakest of all was the password for Unix contributor Brian W. Kernighan: “/.,/.,”—representing a three-character string repeated twice using adjacent keys on a QWERTY keyboard. (None of the passwords included the quotation marks.) But there were at least five plaintext passwords that remained out of reach. They included those belonging to Turkish computer scientist Özalp Babaoğlu, Unix software developer Howard Katseff, and crucial Unix contributors Tom London and Bob Fabry. But the uncracked hash that seemed to occupy Neukirchen the longest was the password used by Ken Thompson, another Unix co-inventor. “I never managed to crack ken's password with the hash ZghOT0eRm4U9s, and I think I enumerated the whole 8 letter lowercase + special symbols key space,” Neukirchen reported in the above-linked thread, posted to the Unix Heritage Society mailing list. “Any help is welcome.' -- source: https://arstechnica.com/information-technology/2019/10/forum-cracks-the-vin… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A detailed look at Ubuntu’s new experimental ZFS installer
by Peter Reutemann 10 Oct '19

10 Oct '19

'Yesterday brought exciting news on the ZFS and Ubuntu fronts—experimental ZFS root support in the installer for Ubuntu's upcoming interim release, Eoan Ermine. The feature appeared in the 2019-10-09 daily build of Eoan—it's not in the regular beta release and, in fact, wasn't even in the "current daily" when we first went to download it. It's that new! (Readers wanting to play with the new functionality can find it in today's daily build, available here.)' -- source: https://arstechnica.com/information-technology/2019/10/a-detailed-look-at-u… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Schneier Slams Australia's Encryption Laws and CyberCon Speaker Bans
by Peter Reutemann 09 Oct '19

09 Oct '19

'Governments breaking encryption is bad, and "will get worse once breaking encryption means people can die," says one of the world's leading security experts. From a report: "Australia has some pretty draconian laws about forcing tech companies to break security," says cryptographer and computer security professional Bruce Schneier. He's referring to the controversial Telecommunications and Other Legislation Amendment (Assistance and Access) Act 2018, which came into force in December. "I actually don't like that, because stuff that you do flows downhill to the US. So stop doing that," he told the Australian Cybersecurity Conference, or CyberCon, in Melbourne on Wednesday. Schneier's argument against breaking encrypted communications is simple. "You have to make a choice. Either everyone gets to spy, or no one gets to spy. You can't have 'We get to spy, you don't.' That's not the way the tech works," he said. "As this tech becomes more critical to life, we simply have to believe, accept, that securing it is more important than leaving it insecure so you can eavesdrop on the bad guys."' -- source: https://it.slashdot.org/story/19/10/09/1855255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Tor Project Removes 13.5% of Current Servers For Running EOL Versions
by Peter Reutemann 09 Oct '19

09 Oct '19

'The Tor Project has removed from its network this week more than 800 servers that were running outdated and end-of-life (EOL) versions of the Tor software. The removed servers represent roughly 13.5% of the 6,000+ servers that currently comprise the Tor network and help anonymize traffic for users across the world. Roughly 750 of the removed servers represent Tor middle relays, and 62 are exit relays -- where users exit the Tor network onto the world wide web after having their true location hidden through the Tor network. The organization said it plans to release a Tor software update in November that will natively reject connections with EOL Tor server versions by default, without any intervention from the Tor Project staff. "Until then, we will reject around 800 obsolete relays using their fingerprints," the Tor Project said in a statement this week.' -- source: https://tech.slashdot.org/story/19/10/09/1853238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Critical Remote Code Execution Flaw Fixed In Popular Terminal App For MacOS
by Peter Reutemann 09 Oct '19

09 Oct '19

'iTerm2 users: It's time to upgrade. A security audit sponsored by the Mozilla Open Source Support Program uncovered a critical remote code execution (RCE) vulnerability in the popular open-source terminal app for macOS. ITerm2 is an open-source alternative to the built-in macOS Terminal app, which allows users to interact with the command-line shell. Terminal apps are commonly used by system administrators, developers and IT staff in general, including security teams, for a variety of tasks and day-to-day operations. The iTerm2 app is a popular choice on macOS because it has features and allows customizations that the built-in Terminal doesn't, which is why the Mozilla Open Source Support Program (MOSS) decided to sponsor a code audit for it. The MOSS was created in the wake of the critical and wide-impact Heartbleed vulnerability in OpenSSL with the goal of sponsoring security audits for widely used open-source technologies. The flaw, which is now tracked as CVE-2019-9535, has existed in iTerm2 for the past seven years and is located in the tmux integration. Tmux is a terminal multiplexer that allows running multiple sessions in the same terminal window by splitting the terminal screen. The flaw was fixed in iTerm2 version 3.3.6, which was released today.' -- source: https://apple.slashdot.org/story/19/10/09/2048214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Essential Reveals Project Gem Smartphone With Very Long, Unusual Design
by Peter Reutemann 09 Oct '19

09 Oct '19

'Andy Rubin, the controversial mobile industry executive who co-founded Android, left Google amid allegations of sexual misconduct while retaining a huge severance package, and went on to create the Essential Phone, has tweeted photos teasing an upcoming device with an elongated design and very tall UI composed of card-like apps. The Verge reports: It look extremely small in his hands, too. The device has a large button and volume rocker on the right edge and a fingerprint divot around back, below what appears to be a single main camera. And as you can see, these devices have some decidedly flashy finishes that change color when you view them at different angles -- a sea green that shifts to yellow and blue, for example. An Essential spokesperson confirmed to the The Verge that this is the company's new phone, adding: "We've been working on a new device that's now in early testing with our team outside the lab. We look forward to sharing more in the near future." A couple hours later, Essential tweeted some slightly more official images of the new phone, which it's calling Project Gem. XDA-Developers also spotted some leaked code that mentions the divot on the rear of the device may activate its voice assistant when you tap your finger to it. They also suggest it runs Android and packs a Qualcomm Snapdragon 730 processor. ' -- source: https://mobile.slashdot.org/story/19/10/09/0519214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel Kills Kaby Lake G, Vows To Offer Drivers For Five Years
by Peter Reutemann 09 Oct '19

09 Oct '19

'When Kaby Lake G debuted at CES 2018, it made a big bang. No one expected sworn rivals Intel and AMD to collaborate on a CPU package, marrying a 7th-gen Kaby Lake CPU with a unique AMD Radeon RX Vega GPU. But what began with a bang ended Monday with an unceremonious memo. >From a report: The Product Change Notification published by Intel on Monday confirmed that pretty much every single Kaby Lake G, including the Core i7-8706G, the Core i7-8705G, and the Core i5-8305G, would be discontinued. Last call for orders will be on January 17, 2020, and the final shipments are scheduled for July 31, 2020. While the end of life of a processor isn't typically a big deal to consumers who own them, one sticking point could have been driver support. Specifically, Kaby Lake G drivers for the custom AMD Radeon RX Vega M graphics come only from Intel. With a normal discrete GPU, the consumer would download drivers from the original company, such as Nvidia or AMD. With Kaby Lake G kaput, where does that leave Kaby Lake G-owners? Intel said the company will follow its standard policy and provide driver support for Kaby Lake G for five years from the launch of the product. All told, that probably means another 3.5 years of driver updates.' -- source: https://slashdot.org/story/19/10/09/142229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fedora Drops 32-Bit Linux
by Peter Reutemann 09 Oct '19

09 Oct '19

'Brian Fagioli, writing for BetaNews: Beginning with the upcoming version 31 of the operating system, i686 32-bit processor support is being dropped by the Fedora Project. "The i686 architecture essentially entered community support with the Fedora 27 release. Unfortunately, there are not enough members of the community willing to do the work to maintain the architecture. Don't worry, though -- Fedora is not dropping all 32-bit packages. Many i686 packages are still being built to ensure things like multilib, wine, and Steam will continue to work," says Justin Forbes of Fedora Project. Forbes further explains, "While the repositories are no longer being composed and mirrored out, there is a koji i686 repository which works with mock for building 32-bit packages, and in a pinch to install 32-bit versions which are not part of the x86_64 multilib repository. Of course, maintainers expect this will see limited use. Users who simply need to run a 32-bit application should be able to do so with multilib on a 64-bit system."' -- source: https://tech.slashdot.org/story/19/10/09/154256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Internal Email Shows GitHub Plans To Renew ICE Contract
by Peter Reutemann 09 Oct '19

09 Oct '19

'GitHub CEO Nat Friedman explained why the company plans to renew a contract with U.S. Immigration and Customs Enforcement (ICE), even though he and others at GitHub oppose ICE's policy of separating children from parents at the border, Motherboard reported on Wednesday, citing an internal GitHub email. From a report: The email shows the continuing debate within the tech industry about whether companies should work specifically with ICE, and comes as a host of other companies have dealt with employee protests over corporate involvement with ICE. "In August, the GitHub leadership team learned about a pending renewal of our product by the U.S. Immigration & Customs Enforcement (ICE) agency. Since then, we have been talking with people throughout the company, based on our own personal concerns and those raised by Hubbers," Friedman's email reads, referring to GitHub employees. Evan Greer, deputy director at activism group Fight for the Future tweeted a copy of the email on Tuesday. Motherboard also separately obtained a copy of the email from a source inside GitHub. The product up for renewal is a license of GitHub Enterprise Server, an on-premises deployment of GitHub that customers can run on their own server, according to the email. ICE originally bought a license in April, 2016.' -- source: https://developers.slashdot.org/story/19/10/09/1557245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Twitter transgression proves why its flawed 2FA system is such a privacy trap
by Peter Reutemann 09 Oct '19

09 Oct '19

'If ever there was a surefire way to sour users against a two-factor authentication system that was already highly flawed, Twitter has found it. On Tuesday, the social media site said that it used phone numbers and email addresses provided for 2FA protection to tailor ads to users. Twitter requires users to provide a valid phone number to be eligible for 2FA protection. A working cell phone number is mandatory even when users' 2FA protection is based solely on security keys or authenticator apps, which don't rely on phone numbers to work. Deleting a phone number from a user's Twitter settings immediately withdraws account from Twitter 2FA, as I confirmed just prior to publishing this post.' -- sources: https://arstechnica.com/information-technology/2019/10/twitter-used-phone-n… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

'Collapse OS' Is An Open-Source Operating System For the Post-Apocalypse
by Peter Reutemann 09 Oct '19

09 Oct '19

'Collapse OS is a new open-source operating system built specifically for use during humanity's darkest days. According to its creator, software developer Virgil Dupras, Collapse OS is what the people of the future will need to reconfigure their scavenged iPhones. For now, though, he's hosting the project on GitHub and looking for contributors. Motherboard reports: According to the Collapse OS site, Dupras envisions a world where the global supply chain collapses by 2030. In this possible future -- kind of a medium-apocalypse -- populations won't be able to mass produce electronics anymore, but they'll still be an enormous source of political and social power. Anyone who can scavenge electronics and reprogram them will gain a huge advantage over those who don't. Dupras believes that the biggest problem for tech savvy post-apocalyptic people will be microcontrollers -- tiny computers embedded in circuit boards that control the functions of computer systems. Collapse OS will work with Z80 8-bit microprocessors. Though less common today than 16- and 32-bit components, the 8-bit Z80 can be found in desktop computers, cash registers, musical instruments, graphing calculators, and everything in between. In a Reddit Q&A, Dupras explained that the Z80 was chosen "because it's been in production for so long and because it's been used in so many machines, scavenger have good chances of getting their hands on it." According to the product page, Collapse OS currently can run on a homebrew Z80-based computer called the RC2014, and on Reddit Dupras said it could theoretically run on a Sega Genesis console.' -- source: https://news.slashdot.org/story/19/10/08/2036204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

You Can Now Overclock a Raspberry Pi 4 For Some Nice Performance Gains
by Peter Reutemann 08 Oct '19

08 Oct '19

'The Raspberry Pi 4 is one of the cheapest single-board computers around. The new 4th generation is a solid performance lift over its predecessor and good bang for the buck if you're interested in learning Linux, working with embedded computing, or just want to kick back and play some retro games on an emulator. In addition, the latest version of the Raspberry Pi Foundation's Linux distribution, Raspbian Buster, comes with a new firmware revision for the tiny DIY PC that removes its 2GHz clock speed limit and allows voltage adjustments to wring out additional performance, with proper cooling of course. In testing, while there are no guarantees in overclocking, HotHardware was able to realize more than a 40% lift in their Raspberry Pi 4's processor clock speed, and a 50% boost to the GPU with an air-cooled mini case kit. Combined, they're not enough to turn the Pi 4 into your every day PC, but the performance gains are measurable and valuable. All it takes is a quick firmware update and a couple of Linux commands to dial things in.' -- source: https://hardware.slashdot.org/story/19/10/08/0312213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Thunderbird Announces OpenPGP Support
by Peter Reutemann 08 Oct '19

08 Oct '19

'On the Mozilla Thunderbird blog it was announced that for the future Thunderbird 78 release, planned for summer 2020, they will add built-in functionality for email encryption and digital signatures using the OpenPGP standard. This addresses a feature request opened on Bugzilla almost 20 years ago and has been one of the top voted bugs for most of that period.' -- source: https://it.slashdot.org/story/19/10/08/209254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

D-Link Home Routers Open To Remote Takeover Will Remain Unpatched
by Peter Reutemann 08 Oct '19

08 Oct '19

'D-Link won't patch a critical unauthenticated command-injection vulnerability in its routers that could allow an attacker to remotely take over the devices and execute code. Threatpost reports: The vulnerability (CVE-2019-16920) exists in the latest firmware for the DIR-655, DIR-866L, DIR-652 and DHP-1565 products, which are Wi-Fi routers for the home market. D-Link last week told Fortinet's FortiGuard Labs, which first discovered the issue in September, that all four of them are end-of-life and no longer sold or supported by the vendor (however, the models are still available as new via third-party sellers). The root cause of the vulnerability, according to Fortinet, is a lack of a sanity check for arbitrary commands that are executed by the native command-execution function. Fortinet describes this as a "typical security pitfall suffered by many firmware manufacturers." With no patch available, affected users should upgrade their devices as soon as possible. ' -- source: https://it.slashdot.org/story/19/10/08/2016251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Attackers exploit 0-day vulnerability that gives full control of Android phones
by Peter Reutemann 06 Oct '19

06 Oct '19

'Attackers are exploiting a zero-day vulnerability in Google’s Android mobile operating system that can give them full control of at least 18 different phone models, including four different Pixel models, a member of Google’s Project Zero research group said on Thursday night. There’s evidence the vulnerability is being actively exploited, either by exploit developer NSO Group or one of its customers, Project Zero member Maddie Stone said in a post. NSO representatives, meanwhile, said the "exploit has nothing to do with NSO." Exploits require little or no customization to fully root vulnerable phones. The vulnerability can be exploited two ways: (1) when a target installs an untrusted app or (2) for online attacks, by combining the exploit with a second exploit targeting a vulnerability in code the Chrome browser uses to render content. “The bug is a local privilege escalation vulnerability that allows for a full compromise of a vulnerable device,” Stone wrote. “If the exploit is delivered via the Web, it only needs to be paired with a renderer exploit, as this vulnerability is accessible through the sandbox.”' -- source: https://arstechnica.com/information-technology/2019/10/attackers-exploit-0d… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Russian Malware 'Patches' Chrome and Firefox To Fingerprint TLS Traffic
by Peter Reutemann 06 Oct '19

06 Oct '19

'A Russian cyber-espionage hacker group has been spotted using a novel technique that involves patching locally installed browsers like Chrome and Firefox in order to modify the browsers' internal components. The end goal of these modifications is to alter the way the two browsers set up HTTPS connections, and add a per-victim fingerprint for the TLS-encrypted web traffic that originates from the infected computers... According to a Kaspersky report published this week, hackers are infecting victims with a remote access trojan named Reductor, through which they are modifying the two browsers. This process involves two steps. They first install their own digital certificates to each infected host. This would allow hackers to intercept any TLS traffic originating from the host. Second, they modify the Chrome and Firefox installation to patch their pseudo-random number generation (PRNG) functions. These functions are used when generating random numbers needed for the process of negotiating and establishing new TLS handshakes for HTTPS connections. Turla hackers are using these tainted PRNG functions to add a small fingerprint at the start of every new TLS connection. The attack is being attributed to Turla, "a well-known hacker group believed to operate under the protection of the Russian government," ZDNet reports. And though the remote-access trojan already grants full control over a victim's device, one theory is the modified browsers offer "a secondary surveillance mechanism" if that trojan was discovered and removed. Researchers believe the malware is installed during file transfers over HTTP connections, suggesting an ISP had been compromised, according to the article. "A January 2018 report from fellow cyber-security firm ESET revealed that Turla had compromised at least four ISPs before, in Eastern Europe and the former Soviet space, also with the purpose of tainting downloads and adding malware to legitimate fil' -- source: https://news.slashdot.org/story/19/10/06/2242221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Might Bring Its Edge Browser To Linux
by Peter Reutemann 06 Oct '19

06 Oct '19

'Microsoft appears to be porting its Edge browser to Linux, reports ZDNet: "We on the MS Edge Dev team are fleshing out requirements to bring Edge to Linux, and we need your help with some assumptions," wrote Sean Larkin, a member of Microsoft's Edge team.... Chrome, of course, is already available for Linux, so Microsoft should be able to deliver Chromium-based Edge to Linux distributions with minimal fuss.... [I]n June Microsoft Edge developers said there are "no technical blockers to keep us from creating Linux binaries" and that it is "definitely something we'd like to do down the road". Despite Chrome's availability on Linux, the Edge team noted there is still work to be done on the installer, updaters, user sync, and bug fixes, before it could be something to commit to properly. Slashdot reader think_nix shared a link to the related survey that the Edge team has announced on Twitter. "If you're a dev who depends on Linux for dev, testing, personal browsing, please take a second to fill out this survey."' -- source: https://linux.slashdot.org/story/19/10/05/1723204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

To Fight Spectre-Like Attacks, Intel Suggests a New Kind of Memory
by Peter Reutemann 06 Oct '19

06 Oct '19

'Intel researchers published a paper last week suggesting a new kind of CPU memory to block side-channel attacks like Meltdown and Spectre, according to ZDNet: SAPM -- or Speculative-Access Protected Memory -- is the work of Intel STORM (STrategic Offensive Research & Mitigations), a team of elite security researchers that Intel assembled since 2017 to work on creating mitigations for all the speculative-execution attacks that have impacted the CPU maker's products. SAPM is only an idea for the moment, and there are no silicon prototypes. Intel STORM engineers only released "the theory and possible implementation options," to provide "a ground base for other researchers to improve upon and also for the industry to consider...." Intel STORM researchers say SAPM will implement protections at the hardware level and will work with both physical and virtual memory addresses. "SAPM can be applied to specific memory ranges, with the attribute that any memory access to such memory type will be instruction-level serialized, meaning that any speculative execution beyond the SAPM-accessing instruction will be stopped pending the successful retirement of this SAPM-accessing instruction," Intel STORM developers said in their short description of SAPM's basic principles... Intel STORM researchers say the second part (backend) of most speculative execution attacks performs the same actions. SAPM was designed to introduce hardware-based protections against the backend part of most attacks. It's because of this concept that Intel's research team believes that SAPM will also future-proof the next generations of Intel CPUs against other -- currently undiscovered -- speculative execution attacks. "Intel STORM researchers don't deny that there's a performance hit," the article adds. "However, this impact is low and could be mitigated further by dropping other existing protections."' -- source: https://hardware.slashdot.org/story/19/10/05/0315201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

COSMO and Psions
by tom butz 06 Oct '19

06 Oct '19

The Psions were good as long as there was still a dial-up Internet around: they could even generate the DTMF-tones out of telephone-numbers and use them to dial using your phone's microphone. I've kept a 3c-model because of its database program. None of the Psions actually were phones. As they only supported dial-up Internet, I had a look for ISP's that still supported that, and found one (serving the Australian Outback). Unfortunately they didn't accept new customers. As far as second screens are concerned, a while ago there was a Finnish/Russian phone/PDA that had a black and white additional screen on its back. That one drew very little power and could be used for notes and - checking who called. Typing, however, was as clumsy as on any phone. The COSMO features a colour-screen on its back - coloured LEDs instead obviously would've been as user-friendly as Morse-code (for telling you who was calling, if you didn't want to open your phone). In a perfect world, developers would have come up with a Psion keyboard, Internet/WiFi/Bluetooth capability and a black and white screen at the back. Today's cameras are good at taking/watching photos/videos, and they are a lot less chunky.

1 0

Psion Reborn
by Lawrence D'Oliveiro 05 Oct '19

05 Oct '19

The Cosmo Communicator should be shipping to its backers next week <https://www.theregister.co.uk/2019/10/04/planet_launches_cosmo_communicator…>. It has more than a passing resemblance to the Psion clamshell pocket PCs of the 1990s, except this one has an open design, intended to allow it to run a choice of open-source operating systems. This looks to be a niche market, compared to the millions of units shipped by all the usual big-name vendors. But if they can make enough money--and keep enough customers happy--to stay in business, why not?

1 0

Award For “Most Spectacular Misuse Of Microsoft Excel”?
by Lawrence D'Oliveiro 04 Oct '19

04 Oct '19

Astronaut Tim Peake blames the spreadsheet for his dialling a wrong number during his stint on the International Space Station <https://www.theregister.co.uk/2019/10/02/future_decoded_peake/>: "I'm still blaming that on the software, I imported my contacts address book in Excel and all the 9s got rounded up to 0s…" Will people never learn <https://www.youtube.com/watch?v=S8wO4ppE9L8> ...

1 0

Attorney General Bill Barr Will Ask Zuckerberg To Halt Plans For End-To-End Encryption Across Facebook's Apps
by Peter Reutemann 03 Oct '19

03 Oct '19

'Attorney General Bill Barr, along with officials from the United Kingdom and Australia, is set to publish an open letter to Facebook CEO Mark Zuckerberg asking the company to delay plans for end-to-end encryption across its messaging services until it can guarantee the added privacy does not reduce public safety. From a report: A draft of the letter, dated Oct. 4, is set to be released alongside the announcement of a new data-sharing agreement between law enforcement in the US and the UK; it was obtained by BuzzFeed News ahead of its publication. Signed by Barr, UK Home Secretary Priti Patel, acting US Homeland Security Secretary Kevin McAleenan, and Australian Minister for Home Affairs Peter Dutton, the letter raises concerns that Facebook's plan to build end-to-end encryption into its messaging apps will prevent law enforcement agencies from finding illegal activity conducted through Facebook, including child sexual exploitation, terrorism, and election meddling. "Security enhancements to the virtual world should not make us more vulnerable in the physical world," the letter reads. "Companies should not deliberately design their systems to preclude any form of access to content, even for preventing or investigating the most serious crimes." The letter calls on Facebook to prioritize public safety in designing its encryption by enabling law enforcement to gain access to illegal content in a manageable format and by consulting with governments ahead of time to ensure the changes will allow this access. While the letter acknowledges that Facebook, which owns Facebook Messenger, WhatsApp, and Instagram, captures 99% of child exploitation and terrorism-related content through its own systems, it also notes that "mere numbers cannot capture the significance of the harm to children."' -- source: https://it.slashdot.org/story/19/10/03/1847213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

MorphOS 3.12 Released
by Peter Reutemann 03 Oct '19

03 Oct '19

'Mike Bouma shares a post from MorphZone, detailing the latest update to the AmigaOS-like computer operating system known as MorphOS: The MorphOS development team is proud to announce the public release of MorphOS 3.12. This new version introduces brand new dual-monitor capabilities to various Powerbook laptops as well as G5 desktop systems, and features improved thermal management, fan control and dynamic CPU frequency switching, which provide increased energy efficiency and reduced noise levels. Additionally, the Helios Firewire stack has been fully integrated into the core OS and we added support for hundreds of modern printers and scanners. The installation and troubleshooting guides should be carefully read prior to installation. You can download MorphOS 3.12 here.' -- source: https://tech.slashdot.org/story/19/10/02/219220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AMD Ryzen Pro 3000 series desktop CPUs will offer full RAM encryption
by Peter Reutemann 02 Oct '19

02 Oct '19

'Monday, AMD announced Ryzen Pro 3000 desktop CPUs would be available in Q4 2019. This of course raises the question, "What's a Ryzen Pro?" The business answer: Ryzen Pro 3000 is a line of CPUs specifically intended to power business-class desktop machines. The Pro line ranges from the humble dual-core Athlon Pro 300GE all the way through to Ryzen 9 Pro 3900, a 12-core/24-thread monster. The new parts will not be available for end-user retail purchase and are only available to OEMs seeking to build systems around them. >From a more technical perspective, the answer is that the Ryzen Pro line includes AMD Memory Guard, a transparent system memory encryption feature that appears to be equivalent to the AMD SME (Secure Memory Encryption) in Epyc server CPUs. Although AMD's own press materials don't directly relate the two technologies, their description of Memory Guard—"a transparent memory encryption (OS and application independent DRAM encryption) providing a cryptographic AES encryption of system memory"—matches Epyc's SME exactly. AMD Memory Guard is not, unfortunately, available in standard Ryzen 3000 desktop CPUs. If you want to build your own Ryzen PC with full memory encryption from scratch, you're out of luck for now.' -- source: https://arstechnica.com/gadgets/2019/10/amd-ryzen-pro-3000-series-desktop-c… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Most mobile browsers display the Web, that’s it—Vivaldi Mobile can change that
by Peter Reutemann 01 Oct '19

01 Oct '19

'Vivaldi—makers of the power user's favorite Web browser—has finally released a mobile version. Vivaldi for Android (sorry iOS users, it's Android-only for now) brings most of what's great about Vivaldi to your phone, and thanks to Vivaldi's sync service, you can even have all your desktop data on your mobile device. Web browsers are perhaps the most important piece of software we use in 2019. Our devices are often little more than small windows onto the Web, and the browser is what we use to see and explore what's in that window. For all its importance though, the modern browser, especially the mobile Web browser, offers precious little in the way of features. It displays the Web and... that's about it. Want to interact with what you see? You're mostly out of luck. Most people probably like their browser this way. Google, maker of the most widely used mobile browser, rarely does anything without extensive user testing. If Chrome is minimalist, it's safe to assume it's that way because Google has determined that's what its users want. And since most other browsers copy whatever Google Chrome does, most mobile Web browsers end up as minimalistic pieces of software. On the desktop, of course, there has long been an exception to the uniformly dumbed-down offerings of Chrome, Firefox, and Safari—Vivaldi. Led by CEO Jon S. von Tetzchner, co-founder and former CEO of Opera, Vivaldi's primary goal is to build a useful browser, a tool you can bend to your will rather than the other way around. You can customize Vivaldi the way you like. Its preferences may be overwhelming at first glance, but if you dig in, you can make Vivaldi do just about whatever you want it to do. For this reason, Vivaldi is often called a "power user's browser" (as opposed to, I guess, the powerless user's browser). For all that, there was always one big problem with Vivaldi: it was desktop only. The company said it was working on a mobile version from the beginning, and von Tetzchner told me several times he was already using it. But there was nothing for the rest of us. Now Vivaldi Mobile is here (again, for Android users at least). Technically, it's a beta release and all the common cautions regarding beta software apply, but I've been using it for over a month now and have had no problems. Or, I should say, I have had problems, but updates prior to the public release eliminated all of them. And even if there were still bugs, Vivaldi would still be more useful than any other browser on my phone based on this recent testing—and yes, I've tried nearly all of today's mobile browsers, even the small, cottage efforts.' -- source: https://arstechnica.com/information-technology/2019/10/vivaldi-mobile-revie… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google's DNS-Over-TLS Plans Scrutinized By US Congress
by Peter Reutemann 01 Oct '19

01 Oct '19

'Google's plans to implement DNS over TLS in Chrome are being investigated by a committee in the U.S. House of Representatives, while the Justice Department has "recently received complaints" about the practice, according to the Wall Street Journal. An anonymous reader quotes Engadget: While Google says it's pushing for adoption of the technology to prevent spying and spoofing, House investigators are worried this would give the internet giant an unfair advantage by denying access to users' data. The House sent a letter on September 13th asking if Google would use data handled through the process for commercial purposes... Internet service providers are worried that they may be shut out of the data and won't know as much about their customers' traffic patterns. This could "foreclose competition in advertising and other industries," an alliance of ISPs told Congress in a September 19th letter... Mozilla also wants to use the format to secure DNS in Firefox, and the company's Marshall Erwin told the WSJ that the antitrust gripes are "fundamentally misleading." ISPs are trying to undermine the standard simply because they want continued access to users' data, Erwin said. Unencrypted DNS helps them target ads by tracking your web habits, and it's harder to thwart DNS tracking than cookies and other typical approaches. ' -- source: https://tech.slashdot.org/story/19/09/29/2033247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

UK Court Rules That E-Mail Sig Blocks Can Sign Contracts
by Lawrence D'Oliveiro 30 Sep '19

30 Sep '19

An e-mail exchange has been ruled to be a binding contract <https://www.theregister.co.uk/2019/09/30/email_signature_legally_binding_co…> because the senders included their names at the end, as people commonly do.

1 0

Linus Torvalds Approves New Kernel 'Lockdown' Feature
by Peter Reutemann 30 Sep '19

30 Sep '19

'"After years of countless reviews, discussions, and code rewrites, Linus Torvalds approved on Saturday a new security feature for the Linux kernel, named 'lockdown'," reports ZDNet: The new feature will ship as a LSM (Linux Security Module) in the soon-to-be-released Linux kernel 5.4 branch, where it will be turned off by default; usage being optional due to the risk of breaking existing systems. The new feature's primary function will be to strengthen the divide between userland processes and kernel code by preventing even the root account from interacting with kernel code -- something that it's been able to do, by design, until now. When enabled, the new "lockdown" feature will restrict some kernel functionality, even for the root user, making it harder for compromised root accounts to compromise the rest of the OS... "When enabled, various pieces of kernel functionality are restricted," said Linus Torvalds, Linux kernel creator, and the one who put the final stamp of approval on the module yesterday. This includes restricting access to kernel features that may allow arbitrary code execution via code supplied by userland processes; blocking processes from writing or reading /dev/mem and /dev/kmem memory; block access to opening /dev/port to prevent raw port access; enforcing kernel module signatures; and many more others, detailed here.' -- source: https://linux.slashdot.org/story/19/09/30/0312211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Promises UK Government DNS-Over-HTTPS Won't Be Default in UK
by Peter Reutemann 30 Sep '19

30 Sep '19

'"Despite looking to make DNS-over-HTTPS the default for its American users, Mozilla has assured culture secretary Nicky Morgan that this won't be the case in the UK," reports Gizmodo: DNS-over-HTTPS has been fairly controversial, with the Internet Services Providers Association nominating Mozilla for an 'Internet Villain' over the whole thing, saying it will "bypass UK filtering obligations and parental controls, undermining internet safety standards in the UK." In his letter to Morgan, Mozilla vice president of global policy, trust and security, Alan Davidson, stressed that the company "has no plans to turn on our DNS-over-HTTPS feature by default in the United Kingdom and will not do so without further engagement with public and private stakeholders". He did add that Mozilla does "strongly believe that DNS-over-HTTPS would offer real security benefits to UK citizens. The DNS is one of the oldest parts of the internet's architecture, and remains largely untouched by efforts to make the web more secure. "Because current DNS requests are unencrypted, the road that connects your citizens to their online destination is still open and used by bad actors looking to violate user privacy, attack communications, and spy on browsing activity. People's most personal information, such as their health-related data, can be tracked, collected, leaked and used against people's best interest. Your citizens deserve to be protected from that threat."' -- source: https://news.slashdot.org/story/19/09/29/0434233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Do We Need To Rethink What Free Software Is?
by Peter Reutemann 30 Sep '19

30 Sep '19

'Matthew Garrett is a security developer at Google and a Linux contributor who in 2014 won the Free Software Foundation's annual "Advancement of Free Software" award. But now he's asking if we need to re-think what free software is: If users can pay Amazon to provide a hosted version of a piece of software, there's little incentive for them to pay the authors of that software. This has led to various projects adopting license terms such as the Commons Clause that effectively make it nonviable to provide such a service, forcing providers to pay for a commercial use license instead. In general the entities pushing for these licenses are VC backed companies who are themselves benefiting from free software written by volunteers that they give nothing back to, so I have very little sympathy. But it does raise a larger issue -- how do we ensure that production of free software isn't just a mechanism for the transformation of unpaid labour into corporate profit...? At the same time, people are spending more time considering some of the other ethical outcomes of free software. Copyleft ensures that you can share your code with your neighbour without your neighbour being able to deny the same freedom to others, but it does nothing to prevent your neighbour using your code to deny other fundamental, non-software, freedoms. As governments make more and more use of technology to perform acts of mass surveillance, detention, and even genocide, software authors may feel legitimately appalled at the idea that they are helping enable this by allowing their software to be used for any purpose. The JSON license includes a requirement that "The Software shall be used for Good, not Evil", but the lack of any meaningful clarity around what "Good" and "Evil" actually mean makes it hard to determine whether it achieved its aims. As stewards of the free software definition, the Free Software Foundation should be taking the lead in ensuring that these issues are discussed. The priority of the board right now should be to restructure itself to ensure that it can legitimately claim to represent the community and play the leadership role it's been failing to in recent years, otherwise the opportunity will be lost and much of the activist energy that underpins free software will be spent elsewhere. If free software is going to maintain relevance, it needs to continue to explain how it interacts with contemporary social issues. If any organisation is going to claim to lead the community, it needs to be doing that.' -- source: https://news.slashdot.org/story/19/09/28/1741229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Purism's Librem 5 Phone Starts Shipping. It Can Run Linux Desktop Apps
by Peter Reutemann 30 Sep '19

30 Sep '19

'On Tuesday Purism announced their first Librem 5 smartphones were rolling off the assembly line and heading to customers. "Seeing the amazing effort of the Purism team, and holding the first fully functioning Librem 5, has been the most inspirational moment of Purism's five year history," said their founder and CEO Todd Weaver. On Wednesday they posted a video announcing that the phones were now shipping, and Friday they posted a short walk-through video. "The crowdsourced $700 Linux phone is actually becoming a real product," reports Ars Technica: Purism's demand that everything be open means most of the major component manufacturers were out of the question. Perhaps because of the limited hardware options, the internal construction of the Librem 5 is absolutely wild. While smartphones today are mostly a single mainboard with every component integrated into it, the Librem 5 actually has a pair of M.2 slots that house full-size, off-the-shelf LTE and Wi-Fi cards for connectivity, just like what you would find in an old laptop. The M.2 sockets look massive on top of the tiny phone motherboard, but you could probably replace or upgrade the cards if you wanted... [Y]ou're not going to get cutting-edge hardware at a great price with the Librem 5. That's not the point, though. The point is that you are buying a Linux phone, with privacy and open source at the forefront of the design. There are hardware kill switches for the camera, microphone, WiFi/Bluetooth, and baseband on the side of the phone, ensuring none of the I/O turns on unless you want it to. The OS is the Free Software Foundation-endorsed PureOS, a Linux distribution that, in this case, has been reworked with a mobile UI. Purism says it will provide updates for the "lifetime" of the device, which would be a stark contrast to the two years of updates you get with an Android phone. PureOS is a Debian-based Linux distro, and on the Librem 5, you'll get to switch between mobile versions of the Gnome and KDE environments. If you're at all interested in PureOS, Purism's YouTube page is worth picking through. Dozens of short videos show that, yes, this phone really runs full desktop-class Linux. Those same videos show the dev kit running things like the APT package manager through a terminal, a desktop version of Solitaire, Emacs, the Gnome disk utility, DOSBox, Apache Web Server, and more. If it runs on your desktop Linux computer, it will probably run on the Librem 5, albeit with a possibly not-touch-friendly UI. The Librem 5 can even be hooked up to a monitor, keyboard, and mouse, and you can run all these Linux apps with the normal input tools... Selling a smartphone is a cutthroat business, and we've seen dozens of companies try and fail over the years. Purism didn't just survive long enough to ship a product -- it survived in what is probably the hardest way possible, by building a non-Android phone with demands that all the hardware components use open code. Making it this far is an amazing accomplishment. ' -- source: https://mobile.slashdot.org/story/19/09/29/0548215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Libre-RISC-V 3D CPU/GPU Seeks Grants For Ambitious Expansion
by Peter Reutemann 30 Sep '19

30 Sep '19

'The NLNet Foundation is a non-profit supporting privacy, security, and the "open internet". Now the open source Libre RISC-V hybrid CPU/GPU is applying for eight additional grants from the NLNet Foundation, according to this update from the project's Luke Kenneth Casson Leighton (Slashdot reader #517,947): Details on each Grant Application are on the newly-opened RISC-V Community Forum. The general idea is to kick RISC-V into a commercially-viable mass-volume high gear by putting forward funding proposals for NEON/SSE-style Video Acceleration to be upstreamed for use by ffmpeg, vlc, mplayer and gstreamer; hardware-assisted Mesa 3D (a port of the RADV Vulkan Driver to RISC-V), and a hardware-accelerated OpenCL port to RISC-V. This all in a "Hybrid" fashion (a la NEON/SSE) as opposed to the "usual" way that 3D and Video is done, which hugely complicate both software drivers and applications debugging. In addition, the Libre RISC-V SoC itself is applying for grants to do a gcc port supporting its Vectorisation Engine including auto-vectorisation, and, crucially, to do an entirely Libre-licensed ASIC Layout using LIP6.fr coriolis2, working in tandem with Chips4Makers to create a 180nm commercially-viable single-core dual-issue test ASIC. The process takes approximately 2-3 months for approval. Once accepted, anyone may be the direct (tax-deductible) recipient of NLNet donations, for sub-tasks completed. Worth noting: Puri.sm is sponsoring the project, and, given NLNet's Charitable Status, donations from Corporations (or individuals) are 100% tax-deductible.' -- source: https://hardware.slashdot.org/story/19/09/29/1845252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Richard Stallman Is Still Head of the GNU Project
by Peter Reutemann 30 Sep '19

30 Sep '19

'On Thursday, Richard Stallman reminded the GNU Project mailing list that "On September 16 I resigned as president of the Free Software Foundation, but the GNU Project and the FSF are not the same. I am still the head of the GNU Project (the Chief GNUisance), and I intend to continue as such." The next day, with no explanation, a one-sentence update appeared on his personal blog at Stallman.org announcing that "I hereby step down as head of the GNU Project, effective immediately." But a few commenters on social media speculated that the post could have come from someone who'd hijacked Stallman's site -- and sure enough, that sentence had been removed by Sunday morning. In addition, for what it's worth Techrights.org posted an unconfirmed claim Sunday from "a generally reliable source" that "Stallman.org was defaced by an FSF employee. The deface has been reverted, and the domain appears to now be operating on non-FSF infrastructure..." But whatever's happening, Richard Stallman is still living the life of Richard Stallman. Friday he also posted that he's looking for a room in a shared house or apartment for at least two months. "There should not be a cat (unless hypoallergenic), or a dog that jumps up excitedly on people (unless quite small), or a digital listening device such as Echo, Siri or 'Hello Google', or a card lock that records who opens the door. I will ask about cameras."' -- source: https://news.slashdot.org/story/19/09/29/054211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Roll On The Paperless Office?
by Lawrence D'Oliveiro 30 Sep '19

30 Sep '19

The “Paperless Office” was a prediction from back in the 1970s or so that, with the increasing use of electronic automation for business data processing, the need for paper documents would diminish over time and eventually go away. Then with the increasing popularity of PCs came the demand for printers to print the documents created with them, and it seemed the trend was the opposite--electronic automation was producing even more paper documents than ever, rather than less. Well, maybe we have seen “peak paper”, according to <https://www.theregister.co.uk/2019/09/13/wall_street_analyst_slashes_hp_inc…>: The company is currently trying to dig itself out a hole of its own making: it mis-forecast toner cartridge revenues in EMEA for FY'19 that started in October last year, not factoring in the burgeoning demand for cloned or remanufactured alternatives or - seemingly - that businesses are printing less than they used to.

4 10

4K / Ultra High Definition Monitors
by Ian Stewart 27 Sep '19

27 Sep '19

Hi Folks, For those of you at last nights meeting you'll recollect there was some discussion on Ultra High Definition<https://en.wikipedia.org/wiki/4K_resolution> computer monitors (i.e. "4K" monitors). With such a large resolution monitor there were jokes made about sitting on the other side of the room in order to use your computer. Today I found links to a Canadian web-site that seems to have created a science out of how far to sit in front of a TV monitor... https://www.rtings.com/tv/reviews/by-size/size-to-distance-relationship ...and... https://www.rtings.com/tv/learn/4k-ultra-hd-uhd-vs-1080p-full-hd-tvs-and-up… ...apparently you sit closer to a 4K/UHD TV monitor than a 1080/HD TV monitor. In fact, if you sit too far away from a 4K/UHD monitor then there is no point in having one and you should have stuck with a 1080/HD monitor! I notice that PB-Tech for the category of 4K Monitors<https://www.pbtech.co.nz/category/peripherals/monitors/4k-monitors>, the sizes are mostly in the range 24 inch to 32 inch, while 4K TVs<https://www.pbtech.co.nz/category/tv-av/tvs/4k-televisions> have screens in the range 43 inch to 86 inch. The cheapest 32 inch 4K monitor I found was a Kogan 32" Ultra HD 4K FreeSync IPS Monitor (3840 x 2160) that is available by purchasing on-line at NZ$370 plus shipping from kogan<https://www.kogan.com/nz/buy/kogan-32-ultra-hd-4k-freesync-ips-monitor-3840…>. Getting a 4K monitor is one thing, being able to feed it with true 4K created video is the next challenge. I don't think it will be coming out of a Freeview box in NZ for a while ;-) However, with the adoption and take-up of the AV1<https://en.wikipedia.org/wiki/AV1> standard, then more 4K video content should become available to stream from the internet. If your Desktop PC doesn't have a 4K (3980 x 1920 pixel) graphics capability, then don't forget that for a starting price of around $150 will be required for a PCI-e 4K graphics adapter<https://www.pbtech.co.nz/product/VGAGBV11032/Gigabyte-GeForce-GT1030-2GB-GD…>. cheers, Ian.

2 4

Cloudflare, Google Chrome, and Firefox Add HTTP/3 Support
by Peter Reutemann 27 Sep '19

27 Sep '19

'HTTP/3, the next major iteration of the HTTP protocol, is getting a big boost today with support added in Cloudflare, Google Chrome, and Mozilla Firefox. From a report: Starting today, Cloudflare announced that customers will be able to enable an option in their dashboards and turn on HTTP/3 support for their domains. That means that whenever users visit a Cloudflare-hosted website from an HTTP/3-capable client, the connection will automatically upgrade to the new protocol, rather than being handled via older versions. On the browser side, Chrome Canary added support for HTTP/3 earlier this month. Users can enable it by using the Chrome command-line flags of "--enable-quic --quic-version=h3-23". In addition, Mozilla too announced it would roll out support for HTTP/3. The browser maker is scheduled to ship HTTP/3 in an upcoming Firefox Nightly version later this fall.' -- source: https://news.slashdot.org/story/19/09/26/1710239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Phrase Of The Week: “Chaos Engineering”
by Lawrence D'Oliveiro 27 Sep '19

27 Sep '19

How about a company that offers “Failure-As-A-Service” <https://www.theregister.co.uk/2019/09/26/organizing_chaos_gremlin_announces…>? That is, they make it easier to deliberately trigger various kinds of infrastructure problems and outages (under controlled conditions, of course) to make sure that your systems that are supposed to be designed for resiliency, actually do what they say on the tin. Quote from their Senior Site Reliability Engineer: “I like to do a CPU attack first. It's the Hello World of chaos engineering.”

1 0

Why So Many Apps Are Asking To Use Bluetooth on iOS 13
by Peter Reutemann 26 Sep '19

26 Sep '19

'Apple's new iOS 13 update adds a new privacy measure that requires apps to get your consent in order to use your device's Bluetooth. From a report: After installing the latest version of iOS, trust me when I say you'll be surprised by the number of apps asking for Bluetooth permission the next time you open them. Some might seem very strange (like Dunkin' Donuts in my case), but others probably won't make you think twice about giving the thumbs-up. The reason Apple implemented this is because Bluetooth has enabled companies to sneakily track your location over Bluetooth by using beacons in stores, shopping malls, and even on popular city streets if they're placed within range of a place you'd walk by. This is entirely separate from your iPhone's location privacy settings, which makes it seem all the more underhanded. A beacon is very easily able to detect your device's Bluetooth chip and log that with a retailer or some other app on your phone. So getting more strict about Bluetooth is a good move by Apple to prevent unwanted tracking of its customers. Similarly, the company is also getting even more transparent about location, showing you on a map how often and where apps have recorded your position. This prompt is much easier to understand, and will probably startle people into slimming down the list of apps that can monitor where they are. As it should!' -- source: https://apple.slashdot.org/story/19/09/26/1928204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

High-severity vulnerability in vBulletin is being actively exploited
by Peter Reutemann 26 Sep '19

26 Sep '19

'Attackers are mass-exploiting an anonymously disclosed vulnerability that makes it possible to take control of servers running vBulletin, one of the Internet’s most popular applications for website comments. Sites running the app should take comments offline until administrators install a patch that vBulletin developers released late Wednesday morning. The vulnerability was disclosed through an 18-line exploit that was published on Monday by an unidentified person. The exploit allows unauthenticated attackers to remotely execute malicious code on just about any vBulletin server running versions 5.0.0 up to 5.5.4. The vulnerability is so severe and easy to exploit that some critics have described it as a back door.' -- source: https://arstechnica.com/information-technology/2019/09/public-exploit-code-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The /e/ Google-Free, Pro-Privacy Android Clone Is Now Available
by Peter Reutemann 26 Sep '19

26 Sep '19

'Gael Duval, creator of the popular early Linux distribution, Mandrake Linux, wanted a smartphone, which was open source, would run a wide variety of popular software, and protect your privacy. His answer was the Android-based /e/ operating system and smartphones. While it's still in beta, both its code and refurbished Samsung phones running it are now available. Duval's approach hasn't been to reinvent the mobile operating system wheel, but instead to clean up Android of its Google privacy-invading features and replace them with privacy-respecting one, in which, as Duval said in an interview, "Your data is your data." To do this, he's started with LineageOS. This is an Android-based operating system, which is descended from the failed CyanogenMod Android fork. According to Duval, the /e/ operating system is a Lineage OS fork. It also blends in features from the Android Open Source Project (AOSP) 7, 8, and 9 source-code trees. In the /e/ OS all Google services have been removed and replaced with MicroG services. MicroG replaces Google's libraries with purely open-source implementations without hooks to Google's services. This includes libraries and apps which provide Google Play, Maps, Geolocation, and Messaging services for the Android applications when they need them. What this means is that you can run some Android apps, which normally only work on a fully Google-enabled Android phone on an /e/ phone. These compatible apps are available via the /e/ app store. The /e/ platform also comes with its own services, the report notes. For example, its search program uses Qwant, a popular, privacy-first European-based search engine, and for cloud storage, you get /e/'s own cloud, which is based on the open-source NextCloud. You can download and install /e/ on 85 different smartphone models. You can also buy an /e/ phone today if you're in the EU.' -- source: https://linux.slashdot.org/story/19/09/25/2129247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Developer Made an Ad Blocker That Works On Podcasts and Radio
by Peter Reutemann 25 Sep '19

25 Sep '19

'Meet AdBlock Radio, an adblocker for live radio streams and podcasts. Its creator, Alexandre Storelli, told Motherboard he hopes to help companies "develop alternative business models for radio and podcast lovers that do not want ads." "Ads exploit the weaknesses of many defenseless souls," Storelli told Motherboard. "Ads dishonestly tempt people, steal their time and promise them a higher social status. Blocking them will be a relieving experience for many." Most audio ads exploit "auditory artifacts" to produce an ad that can't be ignored or tuned out because it feels louder than it actually is -- this has gotten so bad that there has actually been a "sonic arms race" where ads have been made increasingly louder over the years. "Adblock Radio detects audio ads with machine-learning and Shazam-like techniques," Storelli wrote about the project. He said he's been working on it for more than three years and that it uses techniques such as speech recognition, acoustic fingerprinting, and machine learning to detect known ad formats. It uses a crowdsourced database of ads and "acoustic fingerprinting," which converts audio features into a series of numbers that can be combed by an algorithm. Storelli has made Adblock Radio open-source and given detailed instructions on how to build on it, integrate it into user devices, and deploy it in a way that pressures radio stations (and podcasts) to self-regulate the quality of their ads.' -- source: https://entertainment.slashdot.org/story/19/09/25/2056215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android 10 Go Edition Improves Speed and Security For Low-cost Phones
by Peter Reutemann 25 Sep '19

25 Sep '19

'Android Go has made smartphones more accessible by focusing on lower-cost devices, but it's frequently pokey and sometimes insecure -- not a great introduction to modern mobile tech. Google is aware of this, though, and it's tackling those issues head-on with its newly unveiled Android 10 Go edition. From a report: The scaled-back version of Android 10 puts a strong focus on speed, with faster and more memory-efficient app switching as well as launching that's 10 percent faster than in Android 9 Go. It should be more reliable, too. For some, data protection may be the real star of the show. Android 10 Go edition includes a new Adiantum encryption system that should secure data without affecting performance or requiring special hardware. You won't have to worry that your sensitive info is vulnerable simply because you bought an entry-level device.' -- source: https://mobile.slashdot.org/story/19/09/25/1648239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft’s Cascadia Font Offers Ligatures For Programmers
by Lawrence D'Oliveiro 25 Sep '19

25 Sep '19

I just heard of this <https://devblogs.microsoft.com/commandline/cascadia-code/>, though it was apparently announced back in May. It has OpenType context-dependent substitutions for displaying “>=” as “≥”, “/=” as “≠” among others. Me? I just think it’s about time programming languages supported those Unicode characters directly.

1 0

Quantum Computers Are Analog Computers
by Lawrence D'Oliveiro 25 Sep '19

25 Sep '19

Google continues to experiment with quantum computing <https://arstechnica.com/science/2019/09/paper-leaks-showing-a-quantum-compu…>. This latest result (albeit preliminary) sounds impressive: But that seriously understates what's going on here. Every calculation that's done on a quantum computer will end up being a measurement of a quantum system. And in this case, there is simply no way to get that probability distribution using a classical computer. With this system, we can get it in under 10 minutes, and most of that time is spent in processing that doesn't involve the qubits. As the researchers put it, "To our knowledge, this experiment marks the first computation that can only be performed on a quantum processor." but it is still just reinforcing the point I made earlier <https://list.waikato.ac.nz/hyperkitty/list/wlug(a)list.waikato.ac.nz/thread…>, that quantum computers are just a reboot of the old idea of “analog” computers. These are able to do fast simulations of physical systems (in this case, a quantum probability distribution), to limited precision. But they continue to be useless for number-theoretic calculations, such as factoring large integers. Or code cracking.

1 0

EU Right To Be Forgotten Is For Europe Only
by Lawrence D'Oliveiro 25 Sep '19

25 Sep '19

The EU Court of Justice has ruled in favour of Google <https://arstechnica.com/tech-policy/2019/09/google-wins-case-as-court-rules…>, in saying that France’s claim that any “right to be forgotten” has to be implemented worldwide cannot apply. While it is true that, in an always-online connected world, the ease of bypassing regional bans makes a mockery of local laws, how do you reconcile the ability of one country to impose communication blocks on others with the idea of national sovereignty?

1 0

Linux Foundation Exec Believes Edge Computing Will Be More Important Than Cloud Computing
by Peter Reutemann 23 Sep '19

23 Sep '19

'Once upon a time, back when we all had mainframes and then servers in our offices, we had edge computing. Our compute power was literally down the hall. Then, along came the cloud, and all that changed. Computers were hundreds of miles but milliseconds away. Now, with the rise of IoT, 5G, and our never-satisfied need for speed, edge computing is coming back with a vengeance. Indeed, at his keynote at Open Networking Summit in Belgium, Arpit Joshipura, The Linux Foundation's general manager of networking, said "edge computing will overtake cloud computing" by 2025. When Joshipura is talking about edge computing, he means compute and storage resources that are five to 20 milliseconds away. He also means edge computing should be an open, interoperable framework. This framework should be independent of hardware, silicon, cloud, or operating system. Open-edge computing should also work with any edge-computing use case: Internet of Things (IoT) edge, a telecom edge, cloud edge, or enterprise edge, whatever, "Our goal here is to unify all of these." This is being done via LF Edge. This Linux Foundation organization seeks to bring all edge computing players under one umbrella with one technology. Its purpose is to create a software stack that unifies a fragmented edge market around a common, open vision for the future of the industry. To make this happen, Joshipura announced two more projects were being incorporated into LF Edge: Baetyl and Fledge.' -- source: https://slashdot.org/story/19/09/23/1722226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GNU's Former Kernel Maintainer Shares 'A Reflection on the Departure of Richard Stallman'
by Peter Reutemann 22 Sep '19

22 Sep '19

'Thomas Bushnell, BSG, founded GNU's official kernel project, GNU Hurd, and maintained it from 1990 through 2003. This week on Medium he posted "a reflection on the departure of RMS." There has been some bad reporting, and that's a problem. While I have not waded through the entire email thread Selam G. has posted, my reaction was that RMS did not defend Epstein, and did not say that the victim in this case was acting voluntarily. But it's not the most important problem. It's not remotely close to being the most important problem. This was an own-goal for RMS. He has had plenty of opportunities to learn how to stfu when that's necessary. He's responsible for relying too much on people's careful reading of his note, but even that's not the problem. He thought that Marvin Minsky was being unfairly accused. Minsky was his friend for many many years, and I think he carries a lot of affection and loyalty for his memory. But Minsky is also dead, and there's plenty of time to discuss at leisure whatever questions there may be about his culpability. RMS treated the problem as being "let's make sure we don't criticize Minsky unfairly", when the problem was actually, "how can we come to terms with a history of MIT's institutional neglect of its responsibilities toward women and its apparent complicity with Epstein's crimes". While it is true we should not treat Minsky unfairly, it was not -- and is not -- a pressing concern, and by making it his concern, RMS signaled clearly that it was much more important to him than the question of the institution's patterns of problematic coddling of bad behavior. And, I think, some of those focusing themselves on careful parsing of RMS's words are falling into the same pitfall as he.... Minsky was RMS's protector for a long long time. He created the AI Lab, where I think RMS found the only happy home he ever knew. He kept the rest of the Institute at bay and insulated RMS from attack (as did other faculty that also had befriended RMS). I was around for most of the 90s, and I can confirm the unfortunate reality that RMS's behavior was a concern at the time, and that this protection was itself part of the problem... Bushnell also calls Stallman "a tragic figure. He is one of the most brilliant people I've met, who I have always thought desperately craved friendship and camaraderie, and seems to have less and less of it all the time. This is all his doing; nobody does it to him. But it's still very sad. As far as I can tell, he believes his entire life's work is a failure..." But Bushnell concludes that "It is time for the free software community to leave adolescence and move to adulthood, and this requires leaving childish tantrums, abusive language, and toxic environments behind."' -- source: https://news.slashdot.org/story/19/09/21/0253227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Debian May Need To Re-Evaluate Its Interest In 'Init System Diversity'
by Peter Reutemann 22 Sep '19

22 Sep '19

'"Debian Project Leader Sam Hartman has shared his August 2019 notes where he outlines the frustrations and issues that have come up as a result of init system diversity with some developers still aiming to viably support systemd alternatives within Debian," reports Phoronix: Stemming from elogind being blocked from transitioning to testing and the lack of clarity into that, Hartman was pulled in to try to help mediate the matter and get to the bottom of the situation with a lack of cooperation between the elogind and systemd maintainers for Debian as well as the release team. Elogind is used by some distributions as an implementation of systemd's logind, well, outside of systemd as a standalone daemon. Elogind is one of the pieces to the puzzle for trying to maintain a modern, systemd-free Linux distribution. Various issues were raised that are trying to be worked through albeit many Debian developers face time limitations and other factors like emotional exhaustion. Hartman noted in his August notes, "I think we may be approaching a point where we need to poll the project -- to have a GR and ask ourselves how committed we are to the different parts of this init diversity discussion. Reaffirming our support for sysvinit and elogind would be one of the options in any such GR. If that option passed, we'd expect all the maintainers involved to work together or to appoint and empower people who could work on this issue. It would be fine for maintainers not to be involved so long as they did not block progress. And of course we would hold the discussions to the highest standards of respect."' -- source: https://linux.slashdot.org/story/19/09/21/042213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Phrase Of The Week: “Tab Bankruptcy”
by Lawrence D'Oliveiro 22 Sep '19

22 Sep '19

What happens when you accumulate a growing bunch of open pages in your browser, meaning to look at them in the next few days, but never get around to it? Until you have so many tabs open, you realize you will never have time to check them out, so you abandon them all and start again? That’s called “declaring tab bankruptcy”. And here <https://github.com/jsvine/tab-bankrupter> is a Chrome extension that lets you do that, while preserving pinned tabs, but saves a record of all the tabs you’ve abandoned. So, you know, you can change your mind and come back to them later ... Then you’ll probably want another extension to let you declare saved-bankruptcy bankruptcy, where you wipe all your bankruptcy saves and start again ...

1 0

A Novel Use For GitHub
by Lawrence D'Oliveiro 22 Sep '19

22 Sep '19

Came across this GitHub repo <https://github.com/tewhalen/bmw_e30>, which doesn’t actually contain any code. Instead, the owner is using the issues feature to keep track of servicing items for his car. Why do it on a public server? Well, the guy is a BMW owner ...

1 0

At The Open-Core Summit
by Lawrence D'Oliveiro 20 Sep '19

20 Sep '19

A bunch of companies <https://www.theregister.co.uk/2019/09/20/open_source_companies_cloud/> have met to share a common annoyance: that big corporations like Amazon, Google and Microsoft are able to profit from their open-source software without giving anything back. I’m not sure what you can do about it, though. Attempts to impose more restrictive conditions on licences seem to have backfired. The AGPL seems to have been the only one of these efforts to have any legs, and I’m doubtful it has really achieved much.

1 0

German Interior Ministry Wants To Ensure “Digital Sovereignty”
by Lawrence D'Oliveiro 20 Sep '19

20 Sep '19

Germany wants to avoid having too much reliance on specific software/service vendors, like Microsoft and cloud suppliers <https://www.theregister.co.uk/2019/09/19/german_government_report_digital_s…>. How to deal with this? Answers suggested were * Negotiate new contracts with those same suppliers that get rid of the objectionable things, like telemetry * Diversify: stick with proprietary software, just get it from more suppliers * Use Open Source. Real-world results seem mixed? (Munich was cited as a “failure”). Also, Open Source software can end up acquired by proprietary vendors anyway. But then again, why should such acquisitions be such a big deal? Have they not heard of “forks”? Word I learned today: “Schmerzpunkt”.

1 0

How the Internet Archive is Waging War on Misinformation
by Peter Reutemann 19 Sep '19

19 Sep '19

'San Francisco-based non-profit is archiving billions of web pages in a bid to preserve web history. From a report: Since the 2016 US election, as fears about the power of fake news have intensified, the archive has stepped up its efforts to combat misinformation. At a time when false and ultra-partisan content is rapidly created and spread, and social media pages are constantly updated, the importance of having an unalterable record of who said what, when has been magnified. "We're trying to put in a layer of accountability," said founder Brewster Kahle. Mr Kahle founded the archive, which now employs more than 100 staff and costs $18m a year to run, because he feared that what was appearing on the internet was not being saved and catalogued in the same way as newspapers and books. The organisation is funded through donations, grants and the fees it charges third parties that request specific digitisation services. So far, the archive has catalogued 330bn web pages, 20m books and texts, 8.5m audio and video recordings, 3m images and 200,000 software programs. The most popular, public websites are prioritised, as are those that are commonly linked to. Some information is free to access, some is loaned out (if copyright laws apply) and some is only available to researchers. Curled up in a chair in his office after lunch, Mr Kahle lamented the combined impact of misinformation and how difficult it can be for ordinary people to access reliable sources of facts. "We're bringing up a generation that turns to their screens, without a library of information accessible via screens," said Mr Kahle. Some have taken advantage of this "new information system", he argued -- and the result is "Trump and Brexit." Having a free online library is crucial, said Mr Kahle, since "[the public is] just learning from whateverâ...âis easily available."' -- source: https://tech.slashdot.org/story/19/09/19/1858249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Protocol found in webcams and DVRs is fueling a new round of big DDoSes
by Peter Reutemann 19 Sep '19

19 Sep '19

'Hackers have found a new way to amplify the crippling effects of denial-of-service techniques by abusing an improperly implemented tool found in almost 1 million network-connected cameras, DVRs, and other Internet-of-things devices. The technique abuses WS-Discovery, a protocol that a wide array of network devices use to automatically connect to one another. Often abbreviated as WSD, the protocol lets devices send user datagram protocol packets that describe the device capabilities and requirements over port 3702. Devices that receive the probes can respond with replies that can be tens to hundreds of times bigger. WSD has shipped with Windows since Vista and is one of the ways the operating system automatically finds network-based printers.' -- source: https://arstechnica.com/information-technology/2019/09/in-the-wild-ddoses-a… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Adobe Raking It In
by Lawrence D'Oliveiro 18 Sep '19

18 Sep '19

That rentware business model continues to pay off very handsomely <https://www.theregister.co.uk/2019/09/18/adobe_results/>. Users may grumble, but as long as they don’t actually do anything about it, why should Adobe worry?

1 0

OBS Studio
by Peter Reutemann 18 Sep '19

18 Sep '19

Came across the OBS Studio project last night by accident (never heard of it before!): "Free and open source software for video recording and live streaming. Download and start streaming quickly and easily on Windows, Mac or Linux. High performance real time video/audio capturing and mixing. Create scenes made up of multiple sources including window captures, images, text, browser windows, webcams, capture cards and more. Set up an unlimited number of scenes you can switch between seamlessly via custom transitions. Intuitive audio mixer with per-source filters such as noise gate, noise suppression, and gain. Take full control with VST plugin support." -- source: https://obsproject.com/ I'll give it a go for my next video recording project. :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

MITRE’s Latest Common Weakness Enumeration List
by Lawrence D'Oliveiro 18 Sep '19

18 Sep '19

The CWE is not a list of security vulnerabilities as such, but of factors which commonly lead to security vulnerabilities <https://www.theregister.co.uk/2019/09/18/the_25_most_dangerous_software_wea…>. The methodology of the list has changed from the previous one (from back in 2011), so it’s hard to say that the changes are down to different (improved?) coding practices. Still, two thirds of the entries are the same in both lists.

1 0

Researchers Uncover 125 Vulnerabilities Across 13 Routers and NAS Devices
by Peter Reutemann 18 Sep '19

18 Sep '19

'Independent Security Evaluators (ISE) discovered a total of 125 different security vulnerabilities across 13 IoT devices, likely affecting millions of consumers. Help Net Security reports: In nearly all the devices (12 of the 13), ISE achieved its goal of obtaining remote root-level access. The table below shows the types of vulnerabilities that ISE identified in the targets. All 13 of the devices evaluated by ISE had at least one web application vulnerability such as cross-site scripting (XSS), operating system command injection (OS CMDi), or SQL injection (SQLi) that could be leveraged by an attacker to get remote access to the device's shell or gain access to the device's administrative panel. ISE obtained root shells on 12 of the devices, allowing complete control over the device. Six of them can be remotely exploited without authentication: the Asustor AS-602T, Buffalo TeraStation TS5600D1206, TerraMaster F2-420, Drobo 5N2, Netgear Nighthawk R9000, and TOTOLINK A3002RU. "We found that many of these issues were trivial to exploit and should have been discovered even in a rudimentary vulnerability assessment," says ISE founder Stephen Bono. "This indicates that these manufacturers likely undergo no such assessment whatsoever, that the bug bounty programs they employ are ineffective, that vulnerability disclosures sent to them are not addressed, or more likely, all of the above."' -- source: https://it.slashdot.org/story/19/09/17/2053202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

HP Printers Try To Send Data Back To HP About Your Devices and What You Print
by Peter Reutemann 17 Sep '19

17 Sep '19

'Robert Heaton: Last week my in-laws politely but firmly asked me to set up their new HP printer. I protested that I'm completely clueless about that sort of thing, despite my tax-return-job-title of "software engineer." Still remonstrating, I was gently bundled into their study with an instruction pamphlet, a cup of tea, a promise to unlock the door once I'd printed everyone's passport forms, and a warning not to try the window because the roof tiles are very loose. At first the setup process was so simple that even a computer programmer could do it. But then, after I had finished removing pieces of cardboard and blue tape from the various drawers of the machine, I noticed that the final step required the downloading of an app of some sort onto a phone or computer. This set off my crapware detector. [...] It was a way to try and get people to sign up for expensive ink subscriptions and/or hand over their email addresses, plus something even more nefarious that we'll talk about shortly (there were also some instructions for how to download a printer driver tacked onto the end). This was a shame, but not unexpected. I'm sure that the HP ink department is saddled with aggressive sales quotas, and no doubt the only way to hit them is to ruthlessly exploit people who don't know that third-party cartridges are just as good as HP's and are much cheaper. Fortunately, the careful user can still emerge unscathed from this phase of the setup process by gingerly navigating the UI patterns that presumably do fool some people who aren't paying attention.' -- source: https://hardware.slashdot.org/story/19/09/17/1454203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Firefox Moving To a Faster 4-Week Release Cycle
by Peter Reutemann 17 Sep '19

17 Sep '19

'Mozilla announces in a blog post: We typically ship a major Firefox browser (Desktop and Android) release every 6 to 8 weeks. Building and releasing a browser is complicated and involves many players. To optimize the process, and make it more reliable for all users, over the years we've developed a phased release strategy that includes 'pre-release' channels: Firefox Nightly, Beta, and Developer Edition. With this approach, we can test and stabilize new features before delivering them to the majority of Firefox users via general release. And today we're excited to announce that we're moving to a four-week release cycle! We're adjusting our cadence to increase our agility, and bring you new features more quickly. In recent quarters, we've had many requests to take features to market sooner. Feature teams are increasingly working in sprints that align better with shorter release cycles. Considering these factors, it is time we changed our release cadence. Starting Q1 2020, we plan to ship a major Firefox release every 4 weeks. Firefox ESR release cadence (Extended Support Release for the enterprise) will remain the same. In the years to come, we anticipate a major ESR release every 12 months with 3 months support overlap between new ESR and end-of-life of previous ESR. The next two major ESR releases will be ~June 2020 and ~June 2021.' -- source: https://news.slashdot.org/story/19/09/17/1750247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fedora Linux 31 Beta is Here
by Peter Reutemann 17 Sep '19

17 Sep '19

'Fedora 31 is due later this year, but first, there needs to be some beta testing. And so, today, Fedora 31 Beta is made available for download. Unfortunately, details surrounding version 31 are a bit sparse. With that said, one big change involves Fedora users with ARM 64-based single board computers, such as a Raspberry Pi. Those folks will get access to an additional desktop spin -- the lightweight Xfce. Workstation users will be treated to GNOME 3.34, but not the final version that was released recently. Don't worry -- when Fedora leaves beta status, and is officially released, you can be sure the stable GNOME 3.34 will be included. Remember, Fedora is one of the best ways to experience a vanilla GNOME desktop environment.' -- source: https://linux.slashdot.org/story/19/09/17/1836214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Richard Stallman’s Last Interview As FSF President
by Lawrence D'Oliveiro 17 Sep '19

17 Sep '19

Seems the great prophet has bumbled into matters where perhaps he should have kept his mouth shut, and is now stepping down from the FSF. But leaving that aside, this interview <https://www.theregister.co.uk/2019/09/17/richard_stallman_interview/> has the usual choice nuggets on subjects he does know something about: One thing that has changed is that nowadays, a non-free program is typically malware as well. That was not the case in 1983. In 1983, when a proprietary software product was discovered to be malware, it was scandalous. It was shocking. It made the news, sort of at least in the tech press, because this wasn't the usual case. It there was a certain level of scruples, even among proprietary software developers. But over the years, those scruples have evaporated, as companies raced each other to the bottom in terms of mistreating their own users. And now, almost any non free program you run is mistreating you somehow.

1 0

Password-exposing bug purged from LastPass extensions
by Peter Reutemann 16 Sep '19

16 Sep '19

'Developers of the LastPass password manager have patched a vulnerability that made it possible for websites to steal credentials for the last account the user logged into using the Chrome or Opera extension. The vulnerability was discovered late last month by Google Project Zero researcher Tavis Ormandy, who privately reported it to LastPass. In a write-up that became public on Sunday, Ormandy said the flaw stemmed from the way the extension generated popup windows. In certain situations, websites could produce a popup by creating an HTML iframe that linked to the Lastpass popupfilltab.html window rather than through the expected procedure of calling a function called do_popupregister(). In some cases, this unexpected method caused the popups to open with a password of the most recently visited site.' -- source: https://arstechnica.com/information-technology/2019/09/lastpass-fixes-bug-t… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Say hello to 802.11ax: Wi-Fi 6 device certification begins today
by Peter Reutemann 16 Sep '19

16 Sep '19

'Today, the Wi-Fi Alliance launched its Wi-Fi Certified 6 program, which means that the standard has been completely finalized, and device manufacturers and OEMs can begin the process of having the organization certify their products to carry the Wi-Fi 6 branding. If you need a bit of a catch-up, Wi-Fi 6—aka 802.11ax—is the next generation of Wi-Fi. 802.11ax will, at least in theory, allow many more nearby devices to use the same Wi-Fi channels and frequencies without causing as much congestion and lag as Wi-Fi 5 (better known as 802.11ac) and Wi-Fi 4 (802.11n) do. That's the good news. The bad news is that very few of these benefits can be seen just from buying a Wi-Fi 6 router—you need most, if not all, of the devices in range (both yours and, ideally, any neighbors') to also support Wi-Fi 6 before you see the improvements. 802.11ax also mandates support for the WPA3 encryption and authentication protocol. WPA3 provides considerably better security for your Wi-Fi network than WPA2 did, and due to its adoption of Simultaneous Authentication of Equals (SAE), it will hopefully prove more robust toward future attacks as well.' -- source: https://arstechnica.com/gadgets/2019/09/say-hello-to-802-11ax-wi-fi-6-devic… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Pine64 Confirms $25 'PineTime' Smartwatch for Linux Smartphones
by Peter Reutemann 16 Sep '19

16 Sep '19

'Besides their Linux laptops, single-board computers, and tablets, Pine64 is now also working on "PineTime," a new $25 smartwatch for Linux smartphones running open source software (and based on either ARM Mbed or FreeRTOS), reports Liliputing.com: The company describes the PineTime watch as a companion for Linux smartphones... you know, like the company's upcoming $150 PinePhone. For either or both of those reasons, it could appeal to folks who may not have wanted in on the smartphone space until now... The PineTime uses an existing watch body that's used by other device makers, but Pine64 is choosing custom internal hardware. The PineTime will support Bluetooth 5.0, a heart rate monitor, and multi-day battery life and the watch features a zinc alloy & plastic case and comes with a charging dock... At this point the PineTime is described as a side project, which means it's not a top priority for Pine64. While the company says the picture above is an actual photo of a prototype, Pine64 is still seeking software developers interested in contributing to the project, and the company's primary focus at this point will still be other upcoming devices like the PineBook Pro laptop and PinePhone smartphone.' -- source: https://news.slashdot.org/story/19/09/15/2345229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 5.3 Released
by Peter Reutemann 16 Sep '19

16 Sep '19

'This release includes support for AMD Navi GPUs; support for the umwait x86 instructions that let processes wait for short amounts of time without spinning loops; a 'utilization clamping' mechanism that is used to boost interactivity on power-asymmetric CPUs used in phones; a new pidfd_open(2) system call that completes the work done to let users deal with the PID reuse problem; 16 millions of new IPv4 addresses in the 0.0.0.0/8 range are made available; support for Zhaoxin x86 CPUs; support Intel Speed Select for easier power selection in Xeon servers; and support for the lightweight hypervisor ACRN, built for embedded IoT devices. As always, many other new drivers and improvements can be found in the changelog.' -- source: https://linux.slashdot.org/story/19/09/15/2319220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

meeting next Monday
by Peter Reutemann 16 Sep '19

16 Sep '19

Hi everyone We have a WLUG meeting coming up next week: "Lawrence D'Oliveiro will talk about how he set up greylisting (https://en.wikipedia.org/wiki/Greylisting) on his VPS to reduce the amount of spam, what lessons he learned and what pitfalls to avoid." -- details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/257884313 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Debian 10: Playing catch-up with the rest of the Linux world (that’s a good thing)
by Peter Reutemann 13 Sep '19

13 Sep '19

Ars Technica has a review of Debian 10 which got released in July: 'The Debian project, the upstream mother of countless Linux distributions, has released Debian 10, also known as "Buster." And yes, that's a reference to the character from Toy Story. All Debian releases are named after Toy Story characters. Over the years, Debian has built a well-deserved reputation as a rock-solid distro for those who don't want the latest and greatest and instead prefer the stability that comes from sticking with what works. Naturally, Debian gets security updates, bug fixes, and maintenance releases like any distro, but don't expect major updates to applications or desktop environments with this Linux flavor. Right now, as with every release, Debian is pretty close to up to date with what the rest of the Linux world is doing. But Buster will be supported for five years, and Debian 11 won't arrive for at least two years (Buster comes just 26 months after Debian 9, though it has been five years since the big tweaks of Debian 8). So as time goes on, Buster will look increasingly outdated.' -- source: https://arstechnica.com/information-technology/2019/09/debian-10-playing-ca… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Is Taking Over--For Better Or For Worse
by Lawrence D'Oliveiro 13 Sep '19

13 Sep '19

You’ve probably come across pictures of Windows crash screens in various entertaining places, like public signage. Well, Linux is now taking over there, too <https://www.theregister.co.uk/2019/09/12/inlinkuk_crashed_ubuntu/>. And yes, whereas it was hilariously out-of-date versions of Windows before (XP remained quite common, for example), now it’s out-of-date versions of Linux.

1 0

Arch Linux-based Manjaro 18.1.0 'Juhraya' Now Available With GNOME, KDE, or Xfce
by Peter Reutemann 13 Sep '19

13 Sep '19

'Manjaro may have lofty goals of becoming a successful company, but let's be honest -- users of the Linux-based operating system don't really care about that. Don't get me wrong, I am sure most members of the Linux community are rooting for the newly-formed company's success, but they are probably more interested in the excellent operating system itself. Today, Manjaro Linux 18.1.0 "Juhraya" finally becomes available for download, and it isn't without some controversy. You see, rather than just offer up LibreOffice like most distributions, Juhraya offers an alternative choice at installation -- FreeOffice. "After six months of development, version 18.1 of Manjaro Linux is now available. Juhraya offers numerous improvements, especially with regard to Office productivity applications and package management. Another significant innovation in Manjaro 18.1 is the integrated support for FlatPak and Snap packages. For this purpose, the graphical package management tool 'bauh' (formerly known as 'fpakman' ) is now available to users," says Philip Muller, Manjaro developer.' -- source: https://linux.slashdot.org/story/19/09/12/1947223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Simjacker Attack Exploited In the Wild To Track Users For At Least Two Years
by Peter Reutemann 13 Sep '19

13 Sep '19

'Security researchers have disclosed today a major SMS-based attack method being abused in the real world by a surveillance vendor to track and monitor individuals. An anonymous reader shares a report: "We are quite confident that this exploit has been developed by a specific private company that works with governments to monitor individuals," security researchers from AdaptiveMobile Security said in a report. "We believe this vulnerability has been exploited for at least the last 2 years by a highly sophisticated threat actor in multiple countries, primarily for the purposes of surveillance." The attack, named Simjacker, works by attackers sending SMS messages to victims' phones. The SMS messages contain STK instructions that are run by a victim's SIM card to gather location data and the IMEI code, which is then sent through an SMS message to a logging system. Researchers said they've seen Simjacker being abused to track hundreds of victims for two years, yet it is unclear if the victims are criminals tracked by law enforcement, or dissidents tracked by oppressive regimes. Over one billion smartphone users use SIM cards deemed vulnerable to this attack.' -- source: https://it.slashdot.org/story/19/09/12/1637232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Period Tracker Apps Used By Millions Of Women Are Sharing Incredibly Sensitive Data With Facebook
by Peter Reutemann 11 Sep '19

11 Sep '19

'Period tracker apps are sending deeply personal information about women's health and sexual practices to Facebook, new research has found. From a report: UK-based advocacy group Privacy International, sharing its findings exclusively with BuzzFeed News, discovered period-tracking apps including MIA Fem and Maya sent women's use of contraception, the timings of their monthly periods, symptoms like swelling and cramps, and more, directly to Facebook. Women use such apps for a range of purposes, from tracking their period cycles to maximizing their chances of conceiving a child. On the Google Play store, Maya, owned by India-based Plackal Tech, has more than 5 million downloads. Period Tracker MIA Fem: Ovulation Calculator, owned by Cyprus-based Mobapp Development Limited, says it has more than 2 million users around the world. They are also available on the App Store. The data sharing with Facebook happens via Facebook's Software Development Kit (SDK), which helps app developers incorporate particular features and collect user data so Facebook can show them targeted ads, among other functions. When a user puts personal information into an app, that information may also be sent by the SDK to Facebook.' -- source: https://yro.slashdot.org/story/19/09/10/209208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Will Soon Encrypt DNS Requests By Default
by Peter Reutemann 11 Sep '19

11 Sep '19

'This month Firefox will make DNS over encrypted HTTPS the default for the U.S., with a gradual roll-out starting in late September, reports Engadget: Your online habits should be that much more private and secure, with fewer chances for DNS hijacking and activity monitoring. Not every request will use HTTPS. Mozilla is relying on a "fallback" method that will revert to your operating system's default DNS if there's either a specific need for them (such as some parental controls and enterprise configurations) or an outright lookup failure. This should respect the choices of users and IT managers who need the feature turned off, Mozilla said. The team is watching out for potential abuses, though, and will "revisit" its approach if attackers use a canary domain to disable the technology. Users will be given the option to opt-out, explains Mozilla's official announcement. "After many experiments, we've demonstrated that we have a reliable service whose performance is good, that we can detect and mitigate key deployment problems, and that most of our users will benefit from the greater protections of encrypted DNS traffic." "We feel confident that enabling DNS-over-HTTPS by default is the right next step."' -- source: https://news.slashdot.org/story/19/09/08/0318237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

The State Of Windows RT Strike 2
by Lawrence D'Oliveiro 11 Sep '19

11 Sep '19

The IFA show currently on in Berlin <https://www.theregister.co.uk/2019/09/10/windows_on_arm_intel/> has a couple of exhibitors showing off devices running Windows-on-ARM. (Or, more accurately, Windows-on-specific-Qualcomm-ARM-chipsets-only.) While they offer good battery life, they are expensive, and have compatibility issues (no emulation for 64-bit Windows x86 executables, only 32-bit ones). And Intel clearly doesn’t like them.

1 0

Mozilla Launches VPN as Part of Resurrected Firefox Test Pilot Program
by Peter Reutemann 10 Sep '19

10 Sep '19

'Mozilla is resurrecting its recently expunged Test Pilot program with a renewed focus on privacy-focused tools and products. The Firefox developer today lifted the lid on the first product to emerge from the new Test Pilot, and it appears to be something akin to a virtual private network (VPN) in all but name. From a report: Firefox Private Network, as the new tool is called, is available in beta today for logged-in Firefox desktop users in the U.S. only, and is accessible through a browser extension. By way of a quick recap, Mozilla debuted Firefox Test Pilot a decade ago but then relaunched it back in 2016. Test Pilot went on to attain an average of 100,000 daily users, each looking to test Mozilla's latest developments -- including a price-tracking feature for online shoppers, content recommendations based on browsing activity, and more. Some of these became full-fledged features within Firefox and others did not, but back in January Mozilla announced it was killing its Test Pilot program altogether. This came as something of a surprise given Mozilla's own statements about the success of the program. At the time, Mozilla said it was "evolving" its approach to experimentation and suggested it was looking to ideate more widely across the company. Fast-forward nine months, and Firefox Test Pilot is back for a third time.' -- source: https://yro.slashdot.org/story/19/09/10/1514241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Weakness in Intel chips lets researchers steal encrypted SSH keystrokes
by Peter Reutemann 10 Sep '19

10 Sep '19

'In late 2011, Intel introduced a performance enhancement to its line of server processors that allowed network cards and other peripherals to connect directly to a CPU's last-level cache, rather than following the standard (and significantly longer) path through the server's main memory. By avoiding system memory, Intel's DDIO—short for Data-Direct I/O—increased input/output bandwidth and reduced latency and power consumption. Now, researchers are warning that, in certain scenarios, attackers can abuse DDIO to obtain keystrokes and possibly other types of sensitive data that flow through the memory of vulnerable servers. The most serious form of attack can take place in data centers and cloud environments that have both DDIO and remote direct memory access enabled to allow servers to exchange data. A server leased by a malicious hacker could abuse the vulnerability to attack other customers. To prove their point, the researchers devised an attack that allows a server to steal keystrokes typed into the protected SSH (or secure shell session) established between another server and an application server.' -- source: https://arstechnica.com/information-technology/2019/09/weakness-in-intel-ch… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Thousands of Servers Infected With New Lilocked (Lilu) Ransomware
by Peter Reutemann 10 Sep '19

10 Sep '19

'Thousands of web servers have been infected and had their files encrypted by a new strain of ransomware named Lilocked (or Lilu). Infections have been happening since mid-July, and have intensified in the past two weeks, ZDNet has learned. Based on current evidence, the Lilocked ransomware appears to target Linux-based systems only. The way the Lilocked gang breaches servers and encrypts their content is currently unknown. A thread on a Russian-speaking forum puts forward the theory that crooks might be targeting systems running outdated Exim (email) software. It also mentions that the ransomware managed to get root access to servers by unknown means. Lilocked doesn't encrypt system files, but only a small subset of file extensions, such as HTML, SHTML, JS, CSS, PHP, INI, and various image file formats. This means infected servers continue to run normally. According to French security researcher Benkow, Lilocked has encrypted more than 6,700 servers, many of which have been indexed and cached in Google search results. However, the number of victims is suspected to be much much higher. Not all Linux systems run web servers, and there are many other infected systems that haven't been indexed in Google search results. Why it should scare you: - affects Linux servers - so far the vector of infection / vulnerability is unknown - you can craft a Google search to watch it spread! ' -- source: https://it.slashdot.org/story/19/09/09/2246218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Web Scraping Is Legal--For Now
by Lawrence D'Oliveiro 10 Sep '19

10 Sep '19

LinkedIn has been suing a company called hiQ for scraping information from public user profiles, and so far it has lost, twice <https://www.theregister.co.uk/2019/09/09/hiq_wins_linkedin_appeal/>. But of course LinkedIn, being owned by Microsoft, has much deeper legal pockets, and will simply continue a war of attrition until hiQ gives up.

1 0

Guidemaster: How to buy a Chromebook, plus our best picks
by Peter Reutemann 10 Sep '19

10 Sep '19

'Chromebooks dominated the affordable laptop scene in 2018. The same wasn't true just a few years ago, when most were unclear what to do with Google's browser-based operating system. But now, after Chromebooks have successfully infiltrated the education market, users both young and old are familiar with Chrome OS. Chrome OS runs exclusively on Chromebooks, the name for the laptops, two-in-ones, and now tablets that run Google's operating system. If you've used the Chrome Web browser before, you know how to use Chrome OS—the browser is the portal to nearly everything you can do on Chrome OS. Google created an operating system that's simple to use, efficient, and low maintenance in the sense that it doesn't take a ton of power to run a Chromebook well. All of those factors, plus the recent introduction of Android apps into the ecosystem, have made Chromebooks popular with younger users, teachers, and anyone who works and plays primarily within the confines of the Chrome Web browser. As people gravitate to Chromebooks, OEMs have been producing more and more of them. There is a plethora of Chromebooks available now, some at dirt cheap prices and others at premium prices, making it hard to know which you should buy. Luckily, Ars has tested some of the most popular Chromebooks, and we can offer some insight as to which ones are worth your money.' -- source: https://arstechnica.com/gadgets/2019/09/guidemaster-how-to-buy-a-chromebook… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Chrome OS Bug Started Mistakenly Sending 'Final Update' Notifications
by Peter Reutemann 09 Sep '19

09 Sep '19

'Like it or not, Chromebooks do have something of an expiration date when you purchase them, namely that one day they'll stop receiving updates. Thankfully, that date is typically over five years after the Chromebook's original release. For some, however, Chrome OS has been wrongly indicating this week that their Chromebook has received its "final update" many years too early. Just like the Chrome browser on desktop and Android, Chrome OS has four different update "channels" -- Stable, Beta, Dev, and Canary. Each one of these after Stable trades a level of stability for more rapid updates, with Canary receiving highly unstable updates almost every day. People who are bold enough to put their Chromebook on Dev or Canary have been facing an interesting new issue for the past few days. Upon restarting their device, Chrome OS immediately displays a notification warning that "this is the last automatic software and security update for this Chromebook." Of course, if you're seeing this message this week, there's a decent chance that this is not actually the case. Instead, these final update warnings are caused by a bug in the most recent versions of Chrome OS. ' -- source: https://tech.slashdot.org/story/19/09/09/0113215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Feature-rich Vivaldi Browser Arrives on Android
by Peter Reutemann 09 Sep '19

09 Sep '19

'Almost three years after launching its desktop version, cross-platform browser Vivaldi has finally released its mobile app today. From a report: The brainchild of Opera's co-founder Jon von Tetzchner published an Android beta version today that brings swipe gesture for navigation, built-in note-taking functionality, and privacy controls including a no-tracking option. While the browser is in beta, I've been using it for a few days, and I haven't faced any major hiccups. Here are some of the features I enjoyed in the new mobile version: Easy bookmark management, easy navigation, plenty of option for tab management, and dark mode, screen capture, notes, and no-tracking features.' -- source: https://tech.slashdot.org/story/19/09/09/1610214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Manjaro Linux Tries Forming A Company To Fund Full-Time Development
by Peter Reutemann 09 Sep '19

09 Sep '19

'Forbes.com shares some big Linux news: Since 2011, Arch Linux-based Manjaro has focused on being a simple-to-use, accessible Linux desktop distribution with a friendly community... But as of today, Manjaro Linux is no longer just a Linux distribution -- it's officially transforming into a company with ambitious plans for its future. Say hello to Manjaro GmbH & Co. KG. The announcement happened just hours ago, via Manjaro developer Philip Müller. It's not the catchiest name, but the advantages to this move seem beneficial to the both the Manjaro project and the community using it. Müller says that for quite some time he's been researching "ways to secure the project in its current form and how to allow for activities which can't be undertaken as a 'hobby project.'" Crucially, he and the team wanted to reach new heights and be able to invest considerably more time into the project, without compromising the way its currently operating. To that end, the Manjaro team is announcing the formation of an established company, Manjaro GmbH & Co. KG, "to enable full-time employment of maintainers and exploration of future commercial opportunities." They'll also be taking on Blue Systems -- a German IT company specializing in Free and Libre software -- as an advisor. Additionally, the team will transfer the ownership of all donations -- and the allocation of donations -- to fiscal hosts CommunityBridge and OpenCollective, which will both secure donations and make their use transparent... At this stage is look like there's a distinction between what will change in the immediate future, and what the company will strive for. The biggest immediate change -- one that Manjaro supporters may applaud -- is that developers Philip Müller and Bernhard Landauer can now commit to the distribution in a full-time capacity, with an eye toward taking on even more employees down the road. "One of our main goals is to improve our infrastructure and continuously work on the essentials and requirements of our distro as a professional endeavor," writes Müller. "Our hope is to soon be able to include additional contributors on a paid basis."' -- source: https://linux.slashdot.org/story/19/09/08/2342247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Purism Finally Starts Shipping Its Privacy-Focused 'Librem 5' Smartphone
by Peter Reutemann 09 Sep '19

09 Sep '19

'"It's here! Purism announces shipment of the Librem 5," writes long-time Slashdot reader Ocean Consulting: Librem 5 is a landmark mobile device with a dedicated platform, runs PureOS Linux, and is the first mobile phone to seek hardware certification from the Free Software Foundation. Initially a crowd sourced funding campaign, the phone embraces principles of free software and user privacy. IP native communication is supported via Matrix. Privacy features include hardware kill switches for camera, microphone, cellular, wifi, Bluetooth and GPS. "The Librem 5 phone is built from the ground up to respect the privacy, security, and freedoms of society," reads the site's official announcement. "It is a revolutionary approach to solving the issues that people face today around data exploitation -- putting people in control of their own digital lives." They're adopting an "iterative" shipping schedule -- publishing a detailed schedule defining specific batches and their features with corresponding shipping dates. "Each iteration improves upon the prior in a rapid rolling release throughout the entire first version of the phone... As slots in a particular early batch free up, we will open it up for others in a later batch to join in, according to the date of the order."' -- source: https://mobile.slashdot.org/story/19/09/08/2228201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Google's Chrome Has My Dead Grandpa's Data and He Never Used the Internet'
by Peter Reutemann 08 Sep '19

08 Sep '19

'Forbes article by Joe Toscano, a former experience design consultant for Google who in 2017 "decided to step away from my role consulting with Google, due to ethical concerns." This summer he got a big surprise when he looked in Chrome's "addresses" panel at chrome://settings/addresses It turns out Google has info connecting me to my grandma (on my dad's side) who's alive and well but has never had the internet, and my grandpa (on my mom's side), who recently passed away in March 2019 and also never had the internet. This was disturbing for several reasons, the biggest of which being that neither of them had ever logged onto the internet in their lives. Neither even had the internet in their homes their entire lives! Beyond that, Google knew their exact addresses and their middle initials. I couldn't even have told you those things about my grandparents... [T]he data wasn't manually entered by me or anyone using my account, but yet the data is associated with my account? How did that happen? The only thing I can think of is that at one point in history my grandpa gave his information to someone or some company in real life and his information was sold to Google at one point or another... But then that led me to another question: How did his data get associated with my Google account...? Other questions I have: What other information does Google have about me/my family/others that I don't know about...? He's now asking readers if they have any idea how Google connected him to his dead grandpa -- and whether Google is somehow creating an ancestry database. Toscano also discovered Chrome has been creating a list of "Never Saved" passwords at chrome://settings/passwords?search=credentials even though "At no point did I tell Google to create and store a list of websites I had logged into that they didn't get access to but would like access to at some point in the future. Maybe in the Terms of Service/Privacy Policy I agreed to this, but who knows? Not the majority of us, and it's just creepy." And in an update Toscano writes that he hopes the article will "provoke thought" about "why we willingly allow this to happen": Why is it okay that the internet is designed to be a surveillance machine? Why isn't it designed to be private by design? Is this how we want to carry on? Just because something is legal doesn't mean it's right. What would you like to see done? How would you like to see things changed?' -- source: https://yro.slashdot.org/story/19/09/07/168245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Kiwis Seem Skeptical About Streaming
by Lawrence D'Oliveiro 08 Sep '19

08 Sep '19

<https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=122652…>: ... according to research conducted by Opinion Compare, more than half of us are unhappy at the prospect of having to stream the six-week tournament, which will be broadcast on Spark Sport. Seems like people have little confidence that Spark Sport will be able to deliver a reliable service, even though ... in the event Spark's streaming falls over during the Rugby World Cup, the telco has said it will transfer coverage to TVNZ "within a few minutes".

1 1

Voice-Mimicking Software Reportedly Used In Major Theft
by Lawrence D'Oliveiro 05 Sep '19

05 Sep '19

>From the “If Mission Impossible* Were Being Remade Today” files <https://www.stuff.co.nz/technology/digital-living/115560260/artificial-inte…>: Thieves used voice-mimicking software to imitate a UK company executive's speech and dupe his subordinate into sending hundreds of thousands of dollars to a secret account, the company's insurer said, in a remarkable case that some researchers are calling one of the world's first publicly reported artificial intelligence heists. How was the scam exposed? After the thieves made a second request, the director grew suspicious and called his boss directly. Then the thieves called back, unravelling the ruse: The fake "'Johannes' was demanding to speak to me whilst I was still on the phone to the real Johannes!" the director wrote in an email the insurer shared with The Washington Post. *That’s the original classic TV series, not the movies, of course.

1 0

Zero-day privilege escalation disclosed for Android
by Peter Reutemann 05 Sep '19

05 Sep '19

'Researchers have disclosed a zero-day vulnerability in the Android operating system that gives a major boost to attackers who already have a toe-hold on an affected device. The privilege-escalation flaw is located in the V4L2 driver, which Android and other Linux-based OSes use to capture real-time video. The vulnerability results from a "lack of validating the existence of an object prior to performing operations on the object," researchers with Trend Micro's Zero Day Initiative said in a blog post published Wednesday. Attackers who already have untrusted code running with low privileges on a device can exploit the bug to access privileged parts of the Android kernel. The severity score is rated a 7.8 out of a possible 10 points.' -- source: https://arstechnica.com/information-technology/2019/09/android-zeroday-give… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Free Software Advocate Richard Stallman Spoke at Microsoft Research This Week
by Peter Reutemann 05 Sep '19

05 Sep '19

'Free Software advocate Richard M. Stallman gave a talk at Microsoft Campus yesterday. Stallman was invited by Microsoft Research. Stallman's talk was related -- as most of his talks -- with Free Software, Privacy and the GPLv3. He also had a list of small requests to Microsoft: "make Github push users to better software license hygiene, make hardware manufacturers to publish their hardware specs, make it easier to workaround Secure Boot." While Microsoft has changed its attitude toward Open Source Software in the last years, this does not mean RMS has made peace with Microsoft: "If you're wondering whether Stallman's distaste for Microsoft has lessened over the years, his personal home page makes it clear that it has not".' -- source: https://news.slashdot.org/story/19/09/05/1720205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android 10 Launches Today, and Pixel Phones Get the Day One Update
by Peter Reutemann 04 Sep '19

04 Sep '19

'Android 10 is finally finished! The next big Android update, which we've been examining for most of the year as the "Android Q Beta," starts rolling out to devices today. As usual, Android 10 is arriving on Pixel phones first (even the three-year-old Pixel 1), and Google says it is "working with a number of partners to launch or upgrade devices to Android 10 this year." Google has introduced a new branding strategy for Android, by the way, so there's no "Q" snack name with this release. In 2019, it's just "Android 10." Android 10 brings a number of changes to the world's most popular mobile operating system. First up, devices are getting "fully gestural" navigation, which lets you navigate around the phone with swipe gestures. Just like the implementation on the iPhone X, gesture navigation removed the need for a dedicated space for navigation buttons, allowing for more space for app content. There's finally full support for a dark theme, which will turn the entire system UI and any supported apps from the usual black text on a white background to white text on a black background. (That option significantly reduces the amount of light a phone puts out and saves battery life on OLED displays.) Google has also promised dark mode support for "all" of the Google apps in time for Android 10's launch, so we should be seeing updates to Gmail, Google Play, Google Maps, and a million other Google apps sometime soon. Other features of Android 10 include a faster share sheet, a "bubbles" API for floating apps, 230 new emoji, improved security and privacy options, and smarter notification panel.' -- source: https://tech.slashdot.org/story/19/09/03/218224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

InvizBox 2 redefines what “privacy” routers can do
by Peter Reutemann 04 Sep '19

04 Sep '19

'Four years ago, in the wake of some controversy over another Kickstarter-based launch, a team in Ireland decided to produce a better Wi-Fi router for travel privacy. Called the InvizBox, the router was focused on making connecting to privacy-focused network services such as VPNs and the Tor anonymizing network easier. A lot has happened since then. And now, InvizBox has released a new iteration of its wired Wi-Fi router, the InvizBox 2. Two years ago, the InvizBox team achieved its crowd-funding goals to move ahead with this design. After a long road, that funding has finally paid off. Totally open source, bundled with a VPN service capable of delivering up to 100 megabits per second of traffic (your broadband willing), and painless to configure, this little disc-shaped router is powerful enough to be a primary home router—or it can be used on the road when plugged into a potentially unfriendly local network to tunnel users out to safety. The router can also be used in concert with InvizBox Go—a mobile Wi-Fi router with VPN capability—to create a safe tunnel back to your home network. The base price for InvizBox 2 is $99, but there's a discount available right now for orders through the InvizBox site.' -- source: https://arstechnica.com/information-technology/2019/09/invizbox-2-redefines… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

An Interview With Eben Upton
by Lawrence D'Oliveiro 03 Sep '19

03 Sep '19

Head of the Raspberry π Foundation, Eben Upton, chats to The Register <https://www.theregister.co.uk/2019/09/03/eben_upton_pi_store/> about his wildly successful brainchild. All models put together are shipping 6 million units per year. Increasing numbers of them are going to system integrators in China, who are building them into commercial products that are then sold worldwide. Asked whether Windows 10 IoT Edition will ever run on the π 4: "We have nothing to share", said Upton, before sighing that it was "a shame." Also: ... back when the original Pi launched, Upton said the questions were: "Can you run Office? Can you run Internet Explorer?" Now, the question (which will be music to Linux fans' ears) is "Can you run Chromium?" as the Microsoft requirement dwindles. Somehow I get the feeling that Windows 10 on Raspberry π is a dying product ...

1 0

Over 47,000 Supermicro Servers Are Exposing BMC Ports on the Internet
by Peter Reutemann 03 Sep '19

03 Sep '19

'Catalin Cimpanu, writing for ZDNet: More than 47,000 workstations and servers, possibly more, running on Supermicro motherboards are currently open to attacks because administrators have left an internal component exposed on the internet. These systems are vulnerable to a new set of vulnerabilities named USBAnywhere that affect the baseboard management controller (BMC) firmware of Supermicro motherboards. Patches are available to fix the USBAnywhere vulnerabilities, but Supermicro and security experts recommend restricting access to BMC management interfaces from the internet, as a precaution and industry best practice.' -- source: https://tech.slashdot.org/story/19/09/03/2029210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android Exploits Are Now Worth More Than iOS Exploits for the First Time
by Peter Reutemann 03 Sep '19

03 Sep '19

'Zerodium, a company which claims it buys and then resells software exploits to government and law enforcement agencies, has updated its price list today, and Android exploits are worth more than iOS exploits for the first time ever. From a report: According to the company, starting today, a zero-click (no user interaction) exploit chain for Android can get hackers and security researchers up to $2.5 million in rewards. A similar exploit chain impacting iOS is worth only $2 million. Zerodium's new price for Android exploits is almost twelve times more when compared to the maximum of $200,000 the company was willing to offer a year ago, and even 100 times more than Zerodium was paying for some of the lower-impact Android exploits. Zerodium has timed its announcement with Google's official release for Android 10, scheduled for late' -- source: https://tech.slashdot.org/story/19/09/03/164253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 69 Ratchets Up Tracking Protection, Switching it On by Default
by Peter Reutemann 03 Sep '19

03 Sep '19

'Mozilla has switched on Firefox's tracking protection feature for everyone on Windows and Android, dialing up its effort to protect privacy from website publishers and advertisers that would like to keep tabs on your online behavior. From a report: Mozilla enabled tracking protection for new Firefox users in June, but now it's on for everyone, the nonprofit said Tuesday. Tracking protection is all the rage among browser makers, including Apple's Safari, Brave Software's Brave and Microsoft's new Chromium-based Edge. Even Google's Chrome, long the laggard among major browsers, is starting to tackle the problem. It's a thorny issue for websites and advertisers that seek to improve advertising revenue by targeting ads based on their assessment of your interests. "Currently over 20% of Firefox users have Enhanced Tracking Protection on. With today's release, we expect to provide protection for 100% of ours users by default," Mozilla said in a blog post Tuesday.' -- source: https://news.slashdot.org/story/19/09/03/1322212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Upcoming Firefox Update Will Decrease Power Usage on macOS by Up To Three Times
by Peter Reutemann 03 Sep '19

03 Sep '19

'Mozilla teased today an upcoming update for Firefox on macOS that it says will reduce power consumption by a factor of up to three. From a report: The primary beneficiaries of this upcoming update are Macbook users, who can now expect longer battery lives while using Firefox. Firefox's increased battery consumption has been a problem for Mozilla, and a black stain on the Firefox Quantum release -- a revamped, performance-centric version of the older Firefox browser. While Firefox Quantum has received praises for its increased page loading speeds, Macbook users haven't been that delighted, especially when they're mobile and have to rely on the notebook's battery as long as possible.' -- source: https://news.slashdot.org/story/19/09/03/0654202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

mailman server upgrade
by Peter Reutemann 03 Sep '19

03 Sep '19

Hi everyone The university will be upgrading the mailman server on Monday Sept 2nd, which also hosts the WLUG mailing list. Unfortunately, the email I received notifying me about the upgrade did not state when or how long the outage will be, only that the new admin interface will be available after 5pm (NZ time). Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Greg Kroah-Hartman Reveals His New Favorite Linux Distro
by Peter Reutemann 02 Sep '19

02 Sep '19

'Top Linux kernel developer Greg Kroah-Hartman gave a new 30-minute interview with TFIR during the Open Source Summit, 2019. He discusses security in the post-Spectre world, remembers when Microsoft joined the Linux distros mailing list, and acknowledges good-naturedly that he and Richard Stallman "approach things from a different standpoint". An anonymous reader writes: In the interview Kroah-Hartman talks about downsides of living in the Hague. "My son's school actually mandates that they all have MacBooks. So he has a MacBook, my wife has a MacBook, and that's about it." But of course, Kroah-Hartman himself is always using Linux. So what distro does he use? "I don't use openSUSE any more, I use Arch. And my build system I think is actually running Fedora. I have a number of virtual machines still running Gentoo, Dubya, and Fedora to do some testing on some userspace tools. But yeah, all my laptops and everything is switched over to Arch these days... I have a Chromebook that I play around with, and you can run Linux applications, and you can of course SSH into anything..." Why Arch? "At the moment it had something that I needed. I don't remember what it was, the latest development version, what not -- and I've known a number of the Arch developers over the years. Their idea of a constantly rolling, forward-moving system is the way to go... It's neutral, it's community-based, it has everything I need. It works really really well. I've actually converted my cloud instances that I have all to Arch... It's nice." And in addition, "Their Wiki is amazing. The documentation -- it's like one of the best resources out there these days... If you look up any userspace program and how to configure it and use it. Actually, the systemd Arch Wiki pages are one of the most amazing resources out there... "One of the main policies of Arch, or philosophies, is you stay as close to the upstream as possible. And as a developer, I want that... They're really good in feedback to the community. Because I want that testing -- I want to make sure that things are fixed. And if it is broken, I learn about it quickly and I fix it and push the stuff out. So that's actually a really good feedback loop. And that's some of the reasons I need it."' -- source: https://linux.slashdot.org/story/19/09/02/0018252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel Engineer Launches Working Group To Bring Rust 'Full Parity With C'
by Peter Reutemann 01 Sep '19

01 Sep '19

'Someone from the Rust language governance team gave an interesting talk at this year's Open Source Technology Summit. Josh Triplett (who is also a principal engineer at Intel), discussed "what Intel is contributing to bring Rust to full parity with C," in a talk titled Intel and Rust: the Future of Systems Programming. An anonymous reader quotes Packt: Triplett believes that C is now becoming what Assembly was years ago. "C is the new Assembly," he concludes. Developers are looking for a high-level language that not only addresses the problems in C that can't be fixed but also leverage other exciting features that these languages provide. Such a language that aims to be compelling enough to make developers move from C should be memory safe, provide automatic memory management, security, and much more... "Achieving parity with C is exactly what got me involved in Rust," says Triplett. Triplett's first contribution to the Rust programming language was in the form of the 1444 RFC, which was started in 2015 and got accepted in 2016. This RFC proposed to bring native support for C-compatible unions in Rust that would be defined via a new "contextual keyword" union... He is starting a working group that will focus on achieving full parity with C. Under this group, he aims to collaborate with both the Rust community and other Intel developers to develop the specifications for the remaining features that need to be implemented in Rust for system programming. This group will also focus on bringing support for systems programming using the stable releases of Rust, not just experimental nightly releases of the compiler. Last week Triplett posted that the FFI/C Parity working group "is in the process of being launched, and hasn't quite kicked off yet" -- but he promised to share updates when it does.' -- source: https://developers.slashdot.org/story/19/08/31/1540225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Should the Linux Kernel Accept Drivers Written In Rust?
by Peter Reutemann 01 Sep '19

01 Sep '19

'Packt's recent story about Rust had the headline "Rust is the future of systems programming, C is the new Assembly." But there was an interesting discussion about the story on LWN.net. One reader suggested letting people write drivers for the Linux kernel in Rust. ("There's a good chance that encouraging people to submit their wacky drivers in Rust would improve the quality of the driver, partly because you can focus attention on the unsafe parts.") And that comment drew an interesting follow-up: "I spoke with Greg Kroah-Hartman, and he said he'd be willing to accept a framework in the kernel for writing drivers in Rust, as long as 1) for now it wasn't enabled by default (even if you did "make allyesconfig") so that people don't *need* Rust to build the kernel, and 2) it shows real benefits beyond writing C, such as safe wrappers for kernel APIs."' -- source: https://linux.slashdot.org/story/19/08/31/2138249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Office’s New “Save Experience”
by Lawrence D'Oliveiro 31 Aug '19

31 Aug '19

It should be so simple. Windows has a File Save dialog built in. Developers can call the API, with options to customise it if need be. Well, two APIs actually: the old Common File Dialog and the Common Item Dialog introduced in Windows Vista. But this was not good enough for the Office team and in Office 2010, Microsoft introduced the Backstage as a document management feature. ... If you are not so lucky and the location you want does not appear in the Backstage, you click Browse, and the old Windows Save dialog appears. In this case, instead of saving you time, the Backstage has added an extra step. There is a further wrinkle to the Backstage. In Options, you can set "Don't show the Backstage when opening or saving files with keyboard shortcut." As this option implies, this means you do not see the Backstage when invoking Save with Ctrl-S, but you do if you go to "File – Save As". However you do not if you go to "File – Save", even with an unsaved document. Consistency, who needs it? <https://www.theregister.co.uk/2019/08/30/saving_documents_in_microsoft_offi…>

1 0

Fwd: GovHack 2019
by Peter Reutemann 30 Aug '19

30 Aug '19

Please see attached flyer for details. The venue at uni is open to non-university people as well. Cheers, Peter -------- Original Message -------- From: David Nichols <david.nichols(a)waikato.ac.nz> Sent: August 30, 2019 1:23:09 PM GMT+10:00 To: cs-staff(a)waikato.ac.nz, cs-phd <cs-phd(a)waikato.ac.nz> Subject: GovHack 2019 Hi, could you advertise GovHack in your Moodle course instances and lectures? ========================================= Can you make something useful from government data sources? A weekend of protoptying, hacking and collaborative fun: https://govhack.org/events/hamilton/ The event is free and there are usually some cash prizes put forward by the sponsors: https://www.waikato.ac.nz/news-opinion/media/2016/govhack-nz-success-for-un… <https://elearn.waikato.ac.nz/%20https:/www.waikato.ac.nz/news-opinion/media…> ====================================== thanks Dave -- Dr David Nichols Department of Computer Science University of Waikato Hamilton 3240, New Zealand https://cs.waikato.ac.nz/~daven/ https://orcid.org/0000-0003-0321-7267 -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How Insurance Companies Are Fuelling A Rise In Ransomware Attacks
by Lawrence D'Oliveiro 29 Aug '19

29 Aug '19

The cost to a business of trying to recover “kidnapped” documents from backups is often so high that it becomes cheaper to simply pay the ransom. And insurance companies seem happy to go along with this <https://arstechnica.com/information-technology/2019/08/how-insurance-compan…>. And the consequence, of course, is that the crims get even more bold and more demanding ...

1 0

Fwd: [nzpug] some CC licensed ebooks (PDF)
by Peter Reutemann 27 Aug '19

27 Aug '19

Apologies for cross-posting, but these ebooks may be of interest to you. Cheers, Peter -------- Original Message -------- From: "Guy K. Kloss" <guy(a)kloss.nz> Sent: August 27, 2019 6:01:51 PM GMT+10:00 To: New Zealand Python User Group <nzpug(a)googlegroups.com> Subject: [nzpug] some CC licensed ebooks (PDF) Kia ora, there's a Python book here as well, but I didn't check the quality of it. But there are a bunch of other books of varying levels of quality. All licensed in open source (CC-SA) and published (I think) by Stack Overflow. https://goalkicker.com/ The odd one might be interesting to the odd one ... Cheers, Guy -- ----> µ wisdom brought to you by Guy K. Kloss <---- »Wo kämen wir hin, wenn jeder sagen würde | ... guy(a)kloss.nz ... "wo kämen wir hin?" | Phone: +64-9-550 8499 und keiner ginge los, | Mobile: +64-210 2323 715 um zu sehen, wo wir hinkämen« -- You received this message because you are subscribed to the Google Groups "New Zealand Python User Group" group. To unsubscribe from this group and stop receiving emails from it, send an email to nzpug+unsubscribe(a)googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/nzpug/7f89885c-0c08-407b-d9bc-571c2028ed8…. -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Knoppix 8.6 - anyone have the iso?
by Ian Young 26 Aug '19

26 Aug '19

I have not so far been able to download the 4.3 gig DVD iso file after a number of attempts from various mirrors - I have not found any in New Zealand. Anyone have the iso? Professor Knopper has it seems removed systemd from Knoppix. "The still controversial startup systemd, which has been a little outrageous due to security vulnerabilities just recently <https://www.zdnet.com/article/new-linux-systemd-security-holes-uncovered/>, has been integrated in Debian since Jessie [8.0], and has been removed since Knoppix 8.5. I bypass hard dependencies on the boot system with my own packages. To still get a systemd-like session management, and thus retain the ability to shut down and restart the system as a normal user, I run the session manager "elogind" instead. This bypasses systemd's interference with many system components and reduces the complexity of the overall system. If you want to start your own services at startup, you do not need to create any systemd units, but simply enter them in the text file */etc/rc.local*, which contains explanatory examples."

3 2

KDE Konsole v19
by Lawrence D'Oliveiro 24 Aug '19

24 Aug '19

Just did my roughly-monthly Debian Unstable upgrade. The most noticeable change so far (apart from Linux kernel 5.2) is a new version of the KDE Konsole terminal emulator, going from version 18 to version 19. This one has close icons by default on each tab, which I have decided (after closing one tab I didn’t mean to) are too dangerous to click accidentally, so I have turned them off. Another change is that the shortcuts for moving tabs left/right have changed from ctrl-shift-left/right to ctrl-alt-left/right. This means I have to move my fingers slightly from the ctrl-shift-T shortcut that creates a new tab, to the ones for reordering it. On the other hand, I don’t do that too often ...

1 0

Google Chrome Proposes 'Privacy Sandbox' To Reform Advertising Evils
by Peter Reutemann 24 Aug '19

24 Aug '19

'Google's Chrome team proposed a "privacy sandbox" Thursday that's designed to give us the best of both worlds: ads that publishers can target toward our interests but that don't infringe our privacy. From a report: It's a major development in an area where Chrome, the dominant browser, has lagged competitors. Browsers already include security sandboxes, restrictions designed to confine malware to limit its possible damage. Google's proposed privacy sandbox would similarly restrict tracking technology, according to proposal details Google published. The privacy sandbox is "a secure environment for personalization that also protects user privacy," said Justin Schuh, a director of Chrome Engineering focused on security matters, in a privacy sandbox blog post. "Our goal is to create a set of standards that is more consistent with users' expectations of privacy." For example, Chrome would restrict some private data to the browser -- an approach rival Brave Software has taken with its privacy-focused rival web browser. And it could restrict sharing personal data until it's shared across a large group of people using technologies called differential privacy and federated learning.' -- source: https://yro.slashdot.org/story/19/08/22/1453220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

How The National Library Preserves New Zealand’s Digital Heritage
by Lawrence D'Oliveiro 24 Aug '19

24 Aug '19

A nice overview <https://www.stuff.co.nz/national/115118698/how-the-national-library-preserv…> of what it means to preserve historical documents in the digital online age. What happens when the legal obligations of the National Library collide with the terms and conditions of overseas-run sites hosting content posted by New Zealanders? How do you deal with private/defamatory/pornographic material? Proprietary file formats? Some people are even donating their e-mail archives to the Library.

1 0

Fwd: [NZLUG] Windows rebate?
by Peter Reutemann 23 Aug '19

23 Aug '19

Apologies for cross-posting, but this will be of interest to this group as well. Cheers, Peter ---------- Forwarded message --------- From: Atom Smasher <atom(a)smasher.org> Date: Fri, Aug 23, 2019 at 10:49 AM Subject: Re: [NZLUG] Windows rebate? To: NZ Linux Users Group <nzlug(a)lists.nzoss.org.nz> I was hoping this battle had already been fought, but apparently not. After some phone calls, it seems the best course of action now is to contact The Commerce Commission of New Zealand and file a complaint pursuant to the Fair Trading Act. They don't handle these complaints individually, but they will consider them in aggregate. So the more people complain, the more likely that it will be taken seriously. * 0800 943 600 * contact(a)comcom.govt.nz * https://comcom.govt.nz/make-a-complaint Relevant points seem to be that Microsoft has effectively created a monopoly whereby purchasers of new computers are forced to purchase a copy of, and non-transferable license for, their Windows operating system (approx retail price of OEM Windows 10 is $160). Building ones own computer from parts, or purchasing a computer from specialty retailers may be an option in some cases, but this severely limits consumer choices and they're not viable options for a lot of people. While it may not be practical to "force" retailers to stock Windows-free PC hardware, there should be a standard process for obtaining a fair refund for unused and unwanted Windows operating system licenses. -- ...atom ________________________ http://atom.smasher.org/ 762A 3B98 A3C3 96C9 C6B7 582A B88D 52E4 D9F5 7808 ------------------------------------------------- "Sometimes I think we're alone in the universe, and sometimes I think we're not. In either case the idea is quite staggering." -- Arthur C. Clarke _______________________________________________ NZLUG mailing list NZLUG(a)lists.nzoss.org.nz http://lists.nzoss.org.nz/mailman/listinfo/nzlug -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 6

Security Researchers Find Several Bugs In Nest Security Cameras
by Peter Reutemann 23 Aug '19

23 Aug '19

'Hackers could have logged into your Nest Cam IQ Indoor and watch whatever was happening in your home by taking advantage of a vulnerability found by security researchers. The hackers could have also prevented you from using the camera, or use access to it to break into your home network. Researchers Lilith Wyatt and Claudio Bozzato of Cisco Talos discovered the vulnerabilities and disclosed them publicly on August 19. The two found eight vulnerabilities that are based in the Nest implementation of the Weave protocol. The Weave protocol is designed specifically for communications among Internet of Things or IoT devices. Nest has provided a firmware update that the company says will fix the vulnerabilities. The vulnerabilities apply to version 4620002 of the Nest Cam IQ indoor device. You can check the version of your camera on the Nest app. Nest says that the updates will happen automatically if your camera is connected to the internet. "We've fixed the disclosed bugs and started rolling them out to all Nest Camera IQs," Google said in a statement to ZDNet. "The devices will update automatically so there's no action required from users."' -- source: https://it.slashdot.org/story/19/08/22/2134208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Backdoor found in Webmin, a popular web-based utility for managing Unix servers
by Peter Reutemann 22 Aug '19

22 Aug '19

'A backdoor mechanism was found in Webmin, a popular web-based application used by system administrators to manage remote Unix-based systems, such as Linux, FreeBSD, or OpenBSD servers. The backdoor mechanism would allow a remote attacker to execute malicious commands with root privileges on the machine running Webmin. Once this machine is compromised, an attacker could then use it to launch attacks on the systems managed through Webmin. [...] According to one of the Webmin developers, the vulnerability was not the result of a coding mistake, but was actually "malicious code injected into compromised build infrastructure."' -- source: https://www.zdnet.com/article/backdoor-found-in-webmin-a-popular-web-based-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android Ditches Desserts as Q Becomes 10
by Peter Reutemann 22 Aug '19

22 Aug '19

'The next version of the Android operating system (OS) will not be named after a dessert or sweet treat, ending a tradition that started in 2009. From a report: Following the pattern, the name of the new version would have started with Q. But Google said it had ditched the naming scheme because it made it difficult for consumers to know which version of the OS was the latest. The new edition, which will be released later this year, will be called Android 10. Previous versions of the mobile operating system have been nicknamed Jellybean, Kitkat and Lollipop' -- source: https://tech.slashdot.org/story/19/08/22/187243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Planet Needs a New Internet
by Peter Reutemann 22 Aug '19

22 Aug '19

'When climate change comes for our coffee and our wine, we'll moan about it on Twitter, read about it on our favorite websites, and watch diverting videos on YouTube to fill the icy hole in our hearts. We'll do all this until the websites go dark and the networks go down because eventually, climate change will come for our internet, too. That is, unless we can get the web ready for the coming storms. Huge changes will be needed because right now, the internet is unsustainable. On the one hand, rising sea levels threaten to swamp the cables and stations that transmit the web to our homes; rising temperatures could make it more costly to run the data centers handling ever-increasing web traffic; wildfires could burn it all down. On the other, all of those data centers, computers, smartphones, and other internet-connected devices take a prodigious amount of energy to build and to run, thus contributing to global warming and hastening our collective demise. To save the internet and ourselves, we'll need to harden and relocate the infrastructure we've built, find cleaner ways to power the web, and reimagine how we interact with the digital world. Ultimately, we need to recognize that our tremendous consumption of online content isnâ(TM)t free of consequences -- if we're not paying, the planet is. You probably don't think about it when you're liking a photo or reading an article, but everything you do online is underpinned by a globe-spanning labyrinth of physical infrastructure. There are the data centers hosting the web and managing enormous flows of information on the daily. There are the fiber cables transmitting data to into our homes and offices, and even across oceans. There are cell towers sending and receiving countless calls and texts on the daily.' -- source: https://tech.slashdot.org/story/19/08/22/1733253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

KNOPPIX Live GNU/Linux System Is Now Based on Debian GNU/Linux 10 "Buster"
by Peter Reutemann 21 Aug '19

21 Aug '19

'KNOPPIX 8.6 is now available based on the software repositories of the recently released Debian GNU/Linux 10 "Buster" operating system series, but also packing some elements from the Debian Uunstable (Sid) repos. It's powered by the latest Linux 5.2 kernel series and X.Org Server 7.7 display server to support newer graphics cards and computer hardware. Best of all, Knoppix 8.6 is shipping with both 32-bit and 64-bit kernels to support old and new computers. The 64-bit version of KNOPPIX 8.6 supports machines with more than 4GB of RAM (system memory), as well as chroot into 64-bit installations for system rescue tasks. Moreover, the bootloader starts the 64-bit kernel automatically whenever a 64-bit CPU is detected.' -- source: https://news.softpedia.com/news/knoppix-live-gnu-linux-system-is-now-based-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bitbucket Dropping Support For Mercurial
by Peter Reutemann 21 Aug '19

21 Aug '19

'Bitbucket, once one of the largest Mercurial repository hosting sites, said Tuesday it plans to remove Mercurial features and repositories from its platform on June 1, 2020. In a blog post, Bitbucket wrote: As we surpass 10 million registered users on the platform, we're at a point in our growth where we are conducting a deeper evaluation of the market and how we can best support our users going forward. After much consideration, we've decided to remove Mercurial support from Bitbucket Cloud and its API. Bitbucket will stop letting users create new Mercurial repositories starting February 1, 2020, and start removing all the Mercurial repositories four months later. So you will want to backup your repositories and switch to a different platform in the coming months. A different user pointed out, "Another shitty aspect of bitbucket dropping mercurial support and deleting all the old repositories in 2020: all yt pull request discussions from before 2017 are going to be deleted. There's valuable context for how the code got written in those discussions." Several users have expressed their concerns over this decision. Sebastien Jodogne, CSO at Osimis, said, "This is an extremely concerning decision that endangers diversity in the computer science industry by pushing the de facto hegemony of git." For those of you affected by this, you can consider a number of platforms including SourceForge to host and manage your repositories. ' -- source: https://developers.slashdot.org/story/19/08/20/1654253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

IBM is Moving OpenPower Foundation To The Linux Foundation
by Peter Reutemann 21 Aug '19

21 Aug '19

'IBM makes the Power Series chips, and as part of that has open sourced some of the underlying technologies to encourage wider use of these chips. The open source pieces have been part of the OpenPower Foundation. Today, the company announced it was moving the foundation under The Linux Foundation, and while it was at it, announced it was open sourcing several other important bits. From a report: Ken King, general manager for OpenPower at IBM, says that at this point in his organization's evolution, they wanted to move it under the auspices of the Linux Foundation. But IBM didn't stop there. It also announced that it was open sourcing some of the technical underpinnings of the Power Series chip to make it easier for developers and engineers to build on top of the technology. Perhaps most importantly, the company is open sourcing the Power Instruction Set Architecture (ISA). These are "the definitions developers use for ensuring hardware and software work together on Power," the company explained. King sees open sourcing this technology as an important step for a number of reasons around licensing and governance. "The first thing is that we are taking the ability to be able to implement what we're licensing, the ISA instruction set architecture, for others to be able to implement on top of that instruction set royalty free with patent rights," he explained. The company is also putting this under an open governance workgroup at the OpenPower Foundation.' -- source: https://news.slashdot.org/story/19/08/20/197244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

WebKit Introduces New Tracking Prevention Policy
by Peter Reutemann 21 Aug '19

21 Aug '19

'WebKit, the open source HTML engine used by Apple's Safari browser and a number of others, has created a new policy on tracking prevention. The short version is that many forms of tracking will now be treated the same way as security flaws, being blocked or mitigated with no exceptions. While on-site tracking will still be allowed (and is practically impossible to prevent anyway), all forms of cross-site tracking and covert tracking will be actively and aggressively blocked.' -- source: https://it.slashdot.org/story/19/08/20/1522235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

tilix - terminal emulator
by Peter Reutemann 20 Aug '19

20 Aug '19

Hi everyone I've been a long-term user of the gnome terminal and then the mate terminal (after switching to Linux Mint). Despite the tab-support that these terminals offer, there were occasions when I missed being able to tile (ie vertical or horizontal split) in the same window rather than opening another window (and then moving/resizing it to make it fit better). Over the last month or so, I've been trialing "tilix" as my everyday terminal and I have to say that I'm very happy with it! According to the website, tilix is "an advanced GTK3 tiling terminal emulator that follows the Gnome Human Interface Guidelines" Here is the project page (incl screenshots) if you want to know more: https://gnunn1.github.io/tilix-web/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Is Your HDMI Cable Streaming-Compatible?
by Lawrence D'Oliveiro 20 Aug '19

20 Aug '19

It seems <https://www.stuff.co.nz/sport/rugby/rugby-world-cup/115128021/rugby-world-c…> that some people hoping to watch streams of the Rugby World Cup on a TV or external monitor connected via an HDMI cable from their PC may be out of luck. If the client software thinks you’re trying to record the stream, it will block it. And some cables will trigger this block, even if they’re just connecting to a monitor.

1 0

New Attack exploiting serious Bluetooth weakness can intercept sensitive data
by Peter Reutemann 20 Aug '19

20 Aug '19

'Researchers have demonstrated a serious weakness in the Bluetooth wireless standard that could allow hackers to intercept keystrokes, address books, and other sensitive data sent from billions of devices. Dubbed Key Negotiation of Bluetooth—or KNOB for short—the attack forces two or more devices to choose an encryption key just a single byte in length before establishing a Bluetooth connection. Attackers within radio range can then use commodity hardware to quickly crack the key. From there, attackers can use the cracked key to decrypt data passing between the devices. The types of data susceptible could include keystrokes passing between a wireless keyboard and computer, address books uploaded from a phone to a car dashboard, or photographs exchanged between phones. KNOB doesn't require an attacker to have any previously shared secret material or to observe the pairing process of the targeted devices. The exploit is invisible to Bluetooth apps and the operating systems they run on, making the attack almost impossible to detect without highly specialized equipment. KNOB also exploits a weakness in the Bluetooth standard itself. That means, in all likelihood, that the vulnerability affects just about every device that's compliant with the specification. The researchers have simulated the attack on 14 different Bluetooth chips—including those from Broadcom, Apple, and Qualcomm—and found all of them to be vulnerable. "The Key Negotiation Of Bluetooth (KNOB) attack exploits a vulnerability at the architectural level of Bluetooth," the researchers wrote in a research paper published this week. "The vulnerable encryption key negotiation protocol endangers potentially all standard compliant Bluetooth devices, regardless [of] their Bluetooth version number and implementation details. We believe that the encryption key negotiation protocol has to be fixed as soon as possible."' -- source: https://arstechnica.com/information-technology/2019/08/new-attack-exploitin… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Should HTTPS Certificates Expire After Just 397 Days?
by Peter Reutemann 19 Aug '19

19 Aug '19

'Google has made a proposal to the unofficial cert industry group that "would cut lifespan of SSL certificates from 825 days to 397 days," reports ZDNet. No vote was held on the proposal; however, most browser vendors expressed their support for the new SSL certificate lifespan. On the other side, certificate authorities were not too happy, to say the least. In the last decade and a half, browser makers have chipped away at the lifespan of SSL certificates, cutting it down from eight years to five, then to three, and then to two. The last change occured in March 2018, when browser makers tried to reduce SSL certificate lifespans from three years to one, but compromised for two years after pushback from certificate authorities. Now, barely two years later after the last change, certificate authorities feel bullied by browser makers into accepting their original plan, regardless of the 2018 vote... This fight between CAs and browser makers has been happening in the shadows for years. As HashedOut, a blog dedicated to HTTPS-related news, points out, this proposal is much more about proving who controls the HTTPS landscape than everything. "If the CAs vote this measure down, there's a chance the browsers could act unilaterally and just force the change anyway," HashedOut said. "That's not without precendent, but it's also never happened on an issue that is traditionally as collegial as this. "If it does, it becomes fair to ask what the point of the CA/B Forum even is. Because at that point the browsers would basically be ruling by decree and the entire exercise would just be a farce." Security researcher Scott Helme "claims that this process is broken and that bad SSL certificates continue to live on for years after being mississued and revoked -- hence the reason he argued way back in early 2018 that a shorter lifespan for SSL certificates would fix this problem because bad SSL certs would be phased out faster." But the article also notes that Timothy Hollebeek, DigiCert's representative at the CA/B Forum argues that the proposed change "has absolutely no effect on malicious websites, which operate for very short time periods, from a few days to a week or two at most. After that, the domain has been added to various blacklists, and the attacker moves on to a new domain and acquires new certificates."' -- source: https://tech.slashdot.org/story/19/08/18/1833223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Intel Patches Three High-Severity Vulnerabilities
by Peter Reutemann 18 Aug '19

18 Aug '19

'Intel's latest patches "stomped out three high-severity vulnerabilities and five medium-severity flaws," reports Threatpost: One of the more serious vulnerabilities exist in the Intel Processor Identification Utility for Windows, free software that users can install on their Windows machines to identify the actual specification of their processors. The flaw (CVE-2019-11163) has a score of 8.2 out of 10 on the CVSS scale, making it high severity. It stems from insufficient access control in a hardware abstraction driver for the software, versions earlier than 6.1.0731. This glitch "may allow an authenticated user to potentially enable escalation of privilege, denial of service or information disclosure via local access" according to Intel. Users are urged to update to version 6.1.0731. Intel stomped out another high-severity vulnerability in its Computing Improvement Program, which is program that Intel users can opt into that uses information about participants' computer performance to make product improvement and detect issues. However, the program contains a flaw (CVE-2019-11162) in the hardware abstraction of the SEMA driver that could allow escalation of privilege, denial of service or information disclosure... A final high-severity flaw was discovered in the system firmware of the Intel NUC (short for Next Unit of Computing), a mini-PC kit used for gaming, digital signage and more. The flaw (CVE-2019-11140) with a CVSS score of 7.5 out of 10, stems from insufficient session validation in system firmware of the NUC. This could enable a user to potentially enable escalation of privilege, denial of service and information disclosure. An exploit of the flaw would come with drawbacks -- a bad actor would need existing privileges and local access to the victim system. The article notes that the patches "come on the heels of a new type of side-channel attack revealed last week impacting millions of newer Intel microprocessors manufactured after 2012."' -- source: https://it.slashdot.org/story/19/08/18/0030201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Slackware, the Longest Active Linux Distro, Finally Has a Patreon Page
by Peter Reutemann 18 Aug '19

18 Aug '19

'"Slackware is the longest active Linux distribution project, founded in 1993," writes TheBAFH (Slashdot reader #68,624). "Today there are many Linux distributions available, but I've remained dedicated to this project as I believe it still holds an important place in the Linux ecosystem," writes Patrick J. Volkerding on a new Patreon page. He adds that Slackware's users "know that Slackware can be trusted not to constantly change the way things work, so that your investment in learning Slackware lasts longer than it would with a system that's a moving target... Your support is greatly appreciated, and will make it possible for me to continue to maintain this project." TheBAFH writes: The authenticity of the Patreon page has been confirmed by Mr. Volkerding in a post in the Slackware forum of LinuxQuestions.org. "I was going to wait to announce it until I had a few more planned updates done in -current that would be getting things closer to an initial 15.0 beta release, but since it's been spotted in the wild I'll confirm it." Slashdot also emailed Patrick J. Volkerding at Slackware.com last summer and confirmed that that is indeed the account that he's posting from on LinuxQuestions. At the time, he was still trying to find the time to get a Patreon page set up. "I've been trying to catch up on nearly a decade of neglecting everything other than Slackware, but I'm at least getting more caught up."' -- source: https://linux.slashdot.org/story/19/08/16/238254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Unique Kaspersky AV User ID Allowed 3rd-Party Web Tracking
by Peter Reutemann 15 Aug '19

15 Aug '19

'Kaspersky antivirus solutions injected in the web pages visited by its users an identification number unique for each system. This started in late 2015 and could be used to track a user's browsing interests. From a report: Versions of the antivirus product, paid and free, up to 2019, displayed this behavior that allows tracking regardless of the web browser used, even when users started private sessions. Signaled by c't magazine editor Ronald Eikenberg, the problem was that a JavaScript from a Kaspersky server loaded from an address that included a unique ID for every user. Scripts on a website can read the HTML source and glean the Kaspersky identifier, which Eikenberg determined to remain unchanged on the system.' -- source: https://it.slashdot.org/story/19/08/15/1849235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Researchers Found World-Readable Database Used To Secure Buildings Around the Globe
by Peter Reutemann 15 Aug '19

15 Aug '19

'Researchers said they have found a publicly accessible database containing almost 28 million records -- including plain-text passwords, face photos, and personal information -- that was used to secure buildings around the world. Ars Technica reports: Researchers from vpnMentor reported on Wednesday that the database was used by the Web-based Biostar 2 security system sold by South Korea-based Suprema. Biostar uses facial recognition and fingerprint scans to identify people authorized to enter warehouses, municipal buildings, businesses, and banks. vpnMentor said the system has more than 1.5 million installations in a wide range of countries including the U.S., the UK, Indonesia, India, and Sri Lanka. According to vpnMentor, the 23-gigabyte database contained more than 27.8 million records used by Biostar to secure customer facilities. The data included usernames, passwords and user IDs in plaintext, building access logs, employee records including start dates, personal details, mobile device data, and face images. The researchers said the data also included more than 1 million records containing actual fingerprint scans, but the report provided no data to support the claim. "The vpnMentor researchers said they discovered the exposed database on August 5 and privately reported the finding two days later," reports Ars Technica. "The data wasn't secured until Tuesday, six days later."' -- source: https://it.slashdot.org/story/19/08/14/2256231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Quote Of The Week
by Lawrence D'Oliveiro 15 Aug '19

15 Aug '19

Well, my nomination, anyway <https://forums.theregister.co.uk/forum/all/2019/08/13/windows_notepad_flaw/…>: ... looking at XP era material with a code profiler is like looking at a Vegas motel room under a strong blacklight. Some things cannot be unseen.

1 0

Tech firms “can and must” put backdoors in encryption, AG Barr says
by Peter Reutemann 15 Aug '19

15 Aug '19

'US Attorney General William Barr today launched a new front in the feds' ongoing fight against consumer encryption, railing against the common security practice and lamenting the "victims" in its wake. "The deployment of warrant-proof encryption is already imposing huge costs on society," Barr claimed in remarks at a cybersecurity conference held at Fordham University Tuesday morning. Barr added that encryption "seriously degrades" law enforcement's ability to "detect and prevent a crime before it occurs," as well as making eventual investigation and prosecution of crime more difficult. The existence of encryption means "converting the Internet and communications into a law-free zone" that criminals will happily take advantage of to do more crimes, Barr added, likening it to a neighborhood that local cops have abandoned. The cost of encryption, he said, is measured in "victims" who might have been saved from crime if law enforcement had been able to lawfully intercept communications earlier. He also accused tech firms of "dogmatic" posturing, saying lawful backdoor access "can be and must be" done, adding, "We are confident that there are technical solutions that will allow lawful access to encrypted data and communications by law enforcement, without materially weakening the security provided by encryption."' -- source: https://arstechnica.com/tech-policy/2019/07/tech-firms-can-and-must-put-bac… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Researcher Makes Legit-Looking iPhone Lightning Cables That Will Hijack Your Computer
by Peter Reutemann 14 Aug '19

14 Aug '19

'A researcher known as MG has modified Lightning cables with extra components to let him remotely connect to the computers that the cables are connected to. "It looks like a legitimate cable and works just like one. Not even your computer will notice a difference. Until I, as an attacker, wirelessly take control of the cable," MG said. Motherboard reports: One idea is to take this malicious tool, dubbed O.MG Cable, and swap it for a target's legitimate one. MG suggested you may even give the malicious version as a gift to the target -- the cables even come with some of the correct little pieces of packaging holding them together. MG typed in the IP address of the fake cable on his own phone's browser, and was presented with a list of options, such as opening a terminal on my Mac. From here, a hacker can run all sorts of tools on the victim's computer. The cable comes with various payloads, or scripts and commands that an attacker can run on the victim's machine. A hacker can also remotely "kill" the USB implant, hopefully hiding some evidence of its use or existence. MG made the cables by hand, painstakingly modifying real Apple cables to include the implant. "In the end, I was able to create 100 percent of the implant in my kitchen and then integrate it into a cable. And these prototypes at Def con were mostly done the same way," he said. MG did point to other researchers who worked on the implant and graphical user interface. He is selling the cables for $200 each. ' -- source: https://apple.slashdot.org/story/19/08/13/2240213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hack in the box: Hacking into companies with “warshipping”
by Peter Reutemann 13 Aug '19

13 Aug '19

'Penetration testers have long gone to great lengths to demonstrate the potential chinks in their clients' networks before less friendly attackers exploit them. But in recent tests by IBM's X-Force Red, the penetration testers never had to leave home to get in the door at targeted sites, and the targets weren't aware they were exposed until they got the bad news in report form. That's because the people at X-Force Red put a new spin on sneaking in—something they've dubbed "warshipping." Using less than $100 worth of gear—including a Raspberry Pi Zero W, a small battery, and a cellular modem—the X-Force Red team assembled a mobile attack platform that fit neatly within a cardboard spacer dropped into a shipping box or embedded in objects such as a stuffed animal or plaque. At the Black Hat security conference here last week, Ars got a close look at the hardware that has weaponized cardboard. We've looked at such devices, typically referred to as "drop boxes," before. Ars even used one in our passive surveillance of an NPR reporter, capturing his network traffic and routing a dump of his packets across the country for us to sift through. Covert drop boxes (once a specialty of Pwnie Express) have taken the form of "wall wart" device chargers, Wi-Fi routers, and even power strips. And mobile devices have also been brought to play, allowing "war walking"—attacks launched remotely as a device concealed in a bag, suitcase, or backpack is carried nonchalantly into a bank, corporate lobby, or other targeted location. But unless you're trying to get your daily steps in, IBM X-Force Red Global Managing Partner and Head Charles Henderson told Ars that you can just let a shipping company do the work for you. "There have been people that have shipped cell phones, things like that," Henderson noted. "The thing that's cool about this is, this is the wall of the box. It can be easily built into the cardboard. If you get a phone shipped to you, you're suspicious of it. If you get a box or maybe a plaque that says you're the new [chief information security officer] of the year, you might not." The plaque might just go right up on the wall. "Put a $13 solar charger panel on the plaque, and that makes it a permanent fixture in a CISO's office... a $13 panel that, and actually, by the time it discharges the battery, between times when we check in, that can charge it back up. So technically you could do pretty much infinite, up to the life of the battery, if you set that in the right place." The hardware has also been planted in a stuffed animal and even inside the case of a normal Wi-Fi router.' -- source: https://arstechnica.com/information-technology/2019/08/hack-in-the-box-hack… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Facebook Paid Contractors To Transcribe Users' Audio Chats
by Peter Reutemann 13 Aug '19

13 Aug '19

'Facebook has been paying hundreds of outside contractors to transcribe clips of audio from users of its services, Bloomberg reported Tuesday, citing people with knowledge of the work. From the report: The work has rattled the contract employees, who are not told where the audio was recorded or how it was obtained -- only to transcribe it, said the people, who requested anonymity for fear of losing their jobs. They're hearing Facebook users' conversations, sometimes with vulgar content, but do not know why Facebook needs them transcribed, the people said. Facebook confirmed that it had been transcribing users' audio and said it will no longer do so, following scrutiny into other companies. "Much like Apple and Google, we paused human review of audio more than a week ago," the company said Tuesday. The company said the users who were affected chose the option in Facebook's Messenger app to have their voice chats transcribed. The contractors were checking whether Facebook's artificial intelligence correctly interpreted the messages, which were anonymized. [...] The social networking giant, which just completed a $5 billion settlement with the U.S. Federal Trade Commission after a probe of its privacy practices, has long denied that it collects audio from users to inform ads or help determine what people see in their news feeds.' -- source: https://yro.slashdot.org/story/19/08/13/200217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Landmark 2.80 Release of Open Source Blender 3D With Improved UI Now Available
by Peter Reutemann 11 Aug '19

11 Aug '19

'"In the 3D content creation space, where are lot of professional 3D software costs anywhere from 2K to 8K Dollars a license, people have always hoped that the free, open source 3D software Blender would some day be up to the job of replacing expensive commercial 3D software packages," writes Slashdot reader dryriver: This never happened, not because Blender didn't have good 3D features technically, but rather because the Blender Foundation simply did not listen to thousands of 3D artists screaming for a "more standard UI design" in Blender. Blender's eccentric GUI with reversed left-click-right-click conventions, keyboard shortcuts that don't match commercial software and other nastiness just didn't work for a lot of people. After years of screaming, Blender finally got a much better and more familiar UI design in release 2.80, which can be downloaded here. Version 2.80 has many powerful features, but the standout feature is that after nearly 10 years of asking, 3D artists finally get a better, more standard, more sensible User Interface. This effectively means that for the first time, Blender can compete directly with expensive commercial 3D software made by industry leaders like Autodesk, Maxon, NewTek and SideFX. Why the Blender Foundation took nearly a decade to revise the software's UI is anybody's guess.' -- source: https://news.slashdot.org/story/19/08/11/1842258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Can Swap Space Solve System Performance Issues?
by Peter Reutemann 11 Aug '19

11 Aug '19

'Earlier this week on the Linux kernel mailing list, Artem S. Tashkinov described a low-memory scenario where "the system will stall hard. You will barely be able to move the mouse pointer. Your disk LED will be flashing incessantly..." "I'm afraid I have bad news for the people snickering at Linux here," wrote Chris Siebenmann, a sys-admin at the University of Toronto's CS lab. "If you're running without swap space, you can probably get any Unix to behave this way under memory pressure..." In the old days, this usually was not very much of an issue because system RAM was generally large compared to the size of programs and thus the amount of file-backed pages that were likely to be in memory. That's no longer the case today; modern large programs such as Firefox and its shared libraries can have significant amounts of file-backed code and data pages (in addition to their often large use of dynamically allocated memory, ie anonymous pages). A production engineer (now on Facebook's Web Foundation team) wrote about experiencing similar issues years ago when another company had disabled swapping when they replaced or reinstalled machines -- leading to lots of pages from hosts that had to be dealt with. This week they wrote: I stand by my original position: have some swap. Not a lot. Just a little. Linux boxes just plain act weirdly without it. This is not permission to beat your machine silly in terms of memory allocation, either... If you allocate all of the RAM on the machine, you have screwed the kernel out of buffer cache it sorely needs. Back off. Put another way, disk I/O that isn't brutally slow costs memory. Network I/O costs memory. All kinds of stuff costs memory. It's not JUST the RSS of your process. Other stuff you do needs space to operate. If you try to fill a 2 GB box with 2 GB of data, something's going to have a bad day! You have to leave room for the actual system to run or it's going to grind to a stop.' -- source: https://linux.slashdot.org/story/19/08/10/041223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Spectre-like CPU Vulnerability Bypasses Existing Defenses
by Peter Reutemann 11 Aug '19

11 Aug '19

'Researchers from security firm Bitdefender discovered and reported a year ago a new CPU vulnerability that 'abuses a system instruction called SWAPGS and can bypass mitigations put in place for previous speculative execution vulnerabilities like Spectre,' writes Lucian Constantin for CSO. There are three attack scenarios involving SWAPGS, the most serious of which 'can allow attackers to leak the contents of arbitrary kernel memory addresses. This is similar to the impact of the Spectre vulnerability.' Microsoft released mitigations for the vulnerability in July's Patch Tuesday, although details were withheld until August 6 when Bitdefender released its whitepaper and Microsoft published a security advisory.' -- source: https://it.slashdot.org/story/19/08/10/0523206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Remember Autorun.inf Malware In Windows? Turns Out KDE Offers Something Similar
by Peter Reutemann 11 Aug '19

11 Aug '19

'A security researcher has published proof-of-concept (PoC) code for a vulnerability in the KDE software framework. A fix is not available at the time of writing. The bug was discovered by Dominik "zer0pwn" Penner and impacts the KDE Frameworks package 5.60.0 and below. The KDE Frameworks software library is at the base of the KDE desktop environment v4 and v5 (Plasma), currently included with a large number of Linux distributions. The vulnerability occurs because of the way the KDesktopFile class (part of KDE Frameworks) handles .desktop or .directory files. It was discovered that malicious .desktop and .directory files could be created that could be used to run malicious code on a user's computer. When a user opens the KDE file viewer to access the directory where these files are stored, the malicious code contained within the .desktop or .directory files executes without user interaction — such as running the file. Zero user interaction is required to trigger code execution — all you have to do is to browse a directory with a malicious file using any of KDE file system browsing applications like Dolphin. When ZDNet contacted KDE for a comment Tuesday, their spokesperson provided this response. "We would appreciate if people would contact security(a)kde.org before releasing an exploit into the public, rather than the other way around, so that we can decide on a timeline together."' -- source: https://it.slashdot.org/story/19/08/10/2257259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Severe local 0-Day escalation exploit found in Steam Client Services
by Peter Reutemann 09 Aug '19

09 Aug '19

'Earlier today, disgruntled security researcher Vasily Kravets released a zero-day vulnerability in the Windows version of the ubiquitous gaming service Steam. The vulnerability allows any user to run arbitrary code with LOCALSYSTEM privileges using just a very few simple commands. The vulnerability lies within Steam Client Service. The service may be started or stopped by unprivileged users. This becomes a problem because, when run,Steam Client Service automatically sets permissions on a range of registry keys. If a mischievous—or outright malicious—user were to symlink one of these keys to that belonging to another service, it becomes possible for arbitrary users to start or stop that service as well. This becomes even more problematic when you realize that it's possible to pass arguments to services that run under extremely privileged accounts—such as msiserver, the Windows Installer service.' -- source: https://arstechnica.com/gaming/2019/08/severe-local-0-day-escalation-exploi… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linux Journal Ceases Publication
by Peter Reutemann 09 Aug '19

09 Aug '19

'Not too long after Linus Torvalds wrote his own Unix kernel, which he called Linux, in the summer of 1991, a magazine was founded by enthusiasts to focus on the operating system. For nearly three decades Linux Journal has been an authority magazine on all things Linux, but it is now shuttering doors, it said late Wednesday. The announcement comes about two years after the periodical said it would cease to exist, but it was able to find some backing -- from Privacy Internet Access group -- to resume operations later on. The team said on Wednesday that all staff members had been laid off and the company was left with no operating funds to continue in any capacity. It remains committed to keeping the website afloat for another few weeks.' -- source: https://news.slashdot.org/story/19/08/08/1354211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

Red Hat Joins the RISC-V Foundation
by Peter Reutemann 08 Aug '19

08 Aug '19

'Red Hat has joined the RISC-V Foundation to help foster this open-source processor ISA. Phoronix reports: While we're still likely years away from seeing any serious RISC-V powered servers at least that can deliver meaningful performance, Red Hat has been active in promoting RISC-V as an open-source processor instruction set architecture and one of the most promising libre architectures we have seen over the years. Red Hat developers have already helped in working on Fedora's RISC-V support and now the IBM-owned company is helping out more and showing their commitment by joining the RISC-V Foundation. Red Hat joins the likes of Google, NVIDIA, Qualcomm, SiFive, Western Digital, IBM, and Samsung as among the many RISC-V members. ' -- source: https://linux.slashdot.org/story/19/08/08/213253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

WordPress Team Working on Daring Plan To Forcibly Update Old Websites
by Peter Reutemann 08 Aug '19

08 Aug '19

'The developers behind the WordPress open-source content management system (CMS) are working on a plan to forcibly auto-update older versions of the CMS to more recent releases. From a report: The goal of this plan is to improve the security of the WordPress ecosystem, and the internet as a whole, since WordPress installations account for more than 34% of all internet websites. Officially supported versions include only the last six WordPress major releases, which currently are all the versions between v4.7 and v5.2. The plan is to slowly auto-update old WordPress sites, starting with v3.7, to the current minimum supported version, which is the v4.7 release. The WordPress team said it plans to monitor this tiered forced auto-update process for errors and site breakage. If there's something massively wrong, then auto-update can be stopped altogether. If only a few individual sites break, than those site will be rolled back to their previous versions and the owner will be notified via email.' -- source: https://it.slashdot.org/story/19/08/08/1523212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AMD Lands Google, Twitter as Customers With Newest Server Chip
by Peter Reutemann 08 Aug '19

08 Aug '19

'Advanced Micro Devices on Wednesday released the second generation of its processor chip for data centers and said that it had landed Alphabet's Google and Twitter as customers. From a report: AMD competes against Intel to supply chips for data centers that power internet-based services. Both firms have come to rely on data center chips for growth because personal computer sales have stagnated as users shifted to mobile devices. AMD's newest generation of server chip, called EPYC, uses a new chip-making technology from its contract manufacturers that helps the chips have better performance while consuming less power. Intel, which makes chips in its own factories instead of relying on contractors, is behind schedule delivering chips made with its own newer manufacturing process. It plans to release them next year.' -- source: https://tech.slashdot.org/story/19/08/08/1553202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Less TV, More Online
by Lawrence D'Oliveiro 08 Aug '19

08 Aug '19

In Britain, at least <https://www.theregister.co.uk/2019/08/07/punters_switching_off_telly_boxes_…>, people are spending less time watching conventional broadcast TV and more time watching vids on YouTube and Netflix. In related news, famed (and feared) US ratings agency Nielsen <https://www.techdirt.com/articles/20190805/08212442723/after-missing-cord-c…> has fallen on hard times as its broadcast (FTA and cable) company customers suffer a similar trend. The irony was that they were the ones forcing it not to make any measurements of the “cord-cutting” phenomenon, because it made them look bad; and as a result its service has now declined into irrelevance.

1 0

What all the stuff in email headers means—and how to sniff out spoofing
by Peter Reutemann 07 Aug '19

07 Aug '19

'I pretty frequently get requests for help from someone who has been impersonated—or whose child has been impersonated—via email. Even when you know how to "view headers" or "view source" in your email client, the spew of diagnostic wharrgarbl can be pretty overwhelming if you don't know what you're looking at. Today, we're going to step through a real-world set of (anonymized) email headers and describe the process of figuring out what's what. Before we get started with the actual headers, though, we're going to take a quick detour through an overview of what the overall path of an email message looks like in the first place. (More experienced sysadmin types who already know what stuff like "MTA" and "SPF" stand for can skip a bit ahead to the fun part!)' -- source: https://arstechnica.com/information-technology/2019/08/ars-forensic-files-h… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Skype, Slack, other Electron-based apps can be easily backdoored
by Peter Reutemann 07 Aug '19

07 Aug '19

'The Electron development platform is a key part of many applications, thanks to its cross-platform capabilities. Based on JavaScript and Node.js, Electron has been used to create client applications for Internet communications tools (including Skype, WhatsApp, and Slack) and even Microsoft's Visual Studio Code development tool. But Electron can also pose a significant security risk because of how easily Electron-based applications can be modified without triggering warnings. At the BSides LV security conference on Tuesday, Pavel Tsakalidis demonstrated a tool he created called BEEMKA, a Python-based tool that allows someone to unpack Electron ASAR archive files and inject new code into Electron's JavaScript libraries and built-in Chrome browser extensions. The vulnerability is not part of the applications themselves but of the underlying Electron framework—and that vulnerability allows malicious activities to be hidden within processes that appear to be benign. Tsakalidis said that he had contacted Electron about the vulnerability but that he had gotten no response—and the vulnerability remains. While making these changes required administrator access on Linux and MacOS, it only requires local access on Windows. Those modifications can create new event-based "features" that can access the file system, activate a Web cam, and exfiltrate information from systems using the functionality of trusted applications—including user credentials and sensitive data. In his demonstration, Tsakalidis showed a backdoored version of Microsoft Visual Studio Code that sent the contents of every code tab opened to a remote website.' -- source: https://arstechnica.com/information-technology/2019/08/skype-slack-other-el… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google releases the 6th and final beta for Android Q
by Peter Reutemann 07 Aug '19

07 Aug '19

'We are quickly approaching launch day for Android Q, Google's 29th release of Android. At some point in the near future we should see a statue-unveiling, official confirmation that this is "Android 10," and the highly anticipated "Q" snack name [Editor's suggestion]. First though, we have to see the sixth-and-final beta release out the door, which is happening today. Android Q Beta 6 is rolling out to Pixel phones now and participating third-party devices in the coming weeks. Final APIs for developers were locked down in Beta 4, so Beta 5 and 6 are mostly about squishing bugs and polishing up the final interface. Fully gestural navigation is a major feature of Android Q, and with the Beta 5 launch came the announcement that gesture navigation would not work with third-party home apps at launch, presumably due to a lack of time to work out the pile of bugs that have been reported. Even with third-party home screen compatibility off the table, it seems like Google will be working on gesture navigation down to the wire. Beta 5 came with a new gesture for the Google Assistant and new rules for developers. In Beta 6, Google says it has "made further refinements to Gesture Navigation in Beta 6 based on user feedback" and now has a sensitivity setting for the back gesture. The back gesture involves swiping in from the edge of the screen, which can interfere with apps that require horizontal scrolling. Newly updated apps are supposed to design around the new back gesture; the sensitivity setting should help find a balance for older apps with conflicting swipe areas.' -- source: https://arstechnica.com/gadgets/2019/08/google-releases-the-6th-and-final-b… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Contractors Are Listening To Some Skype Calls
by Peter Reutemann 07 Aug '19

07 Aug '19

'Contractors working for Microsoft are listening to personal conversations of Skype users conducted through the app's translation service, according to a cache of internal documents, screenshots, and audio recordings obtained by Motherboard. From a report: Although Skype's website says that the company may analyze audio of phone calls that a user wants to translate in order to improve the chat platform's services, it does not say some of this analysis will be done by humans. The Skype audio obtained by Motherboard includes conversations from people talking intimately to loved ones, some chatting about personal issues such as their weight loss, and others seemingly discussing relationship problems. Other files obtained by Motherboard show that Microsoft contractors are also listening to voice commands that users speak to Cortana, the company's voice assistant.' -- source: https://yro.slashdot.org/story/19/08/07/1432204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FFmpeg 4.2, Open-Source Multimedia Framework Released
by Peter Reutemann 07 Aug '19

07 Aug '19

'Dubbed "Ada," the FFMpeg 4.2 series introduces some exciting new features and improvements, among which we can mention support for decoding AV1 files via the libdav1d library, support for ARIB STD-B24 caption (profiles A and C) based on the libaribb24 library, and support for decoding HEVC 4:4:4 content in nvdec and cuviddec. FFmpeg 4.2 also comes with support for decoding HEVC 4:4:4 content in VDPAU (Video Decode and Presentation API for Unix), support for using Clang to compile CUDA kernels, the ability for the mov muxer to write tracks with unspecified language instead of English by default, a GIF parser, as well as the removal of the libndi-newtek component.' -- source: https://news.softpedia.com/news/ffmpeg-4-2-ada-open-source-multimedia-frame… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Catches Russian State Hackers Using IoT Devices To Breach Networks
by Peter Reutemann 06 Aug '19

06 Aug '19

'Hackers working for the Russian government have been using printers, video decoders, and other so-called Internet-of-things devices as a beachhead to penetrate targeted computer networks, Microsoft officials warned on Monday. "These devices became points of ingress from which the actor established a presence on the network and continued looking for further access," officials with the Microsoft Threat Intelligence Center wrote in a post. "Once the actor had successfully established access to the network, a simple network scan to look for other insecure devices allowed them to discover and move across the network in search of higher-privileged accounts that would grant access to higher-value data." Microsoft researchers discovered the attacks in April, when a voice-over-IP phone, an office printer, and a video decoder in multiple customer locations were communicating with servers belonging to "Strontium," a Russian government hacking group better known as Fancy Bear or APT28. In two cases, the passwords for the devices were the easily guessable default ones they shipped with. In the third instance, the device was running an old firmware version with a known vulnerability. While Microsoft officials concluded that Strontium was behind the attacks, they said they weren't able to determine what the group's ultimate objectives were. Microsoft says they have notified the makers of the targeted IoT devices so they can add new protections. "Monday's report also provided IP addresses and scripts organizations can use to detect if they have also been targeted or infected," adds Ars Technica. "Beyond that, Monday's report reminded people that, despite Strontium's above-average hacking abilities, an IoT device is often all it needs to gain access to a targeted network."' -- source: https://it.slashdot.org/story/19/08/06/0115233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Performs Poorly In Low RAM / Memory Pressure Situations On The Desktop
by Peter Reutemann 06 Aug '19

06 Aug '19

'It's been a gripe for many running Linux on low RAM systems especially is that when the Linux desktop is under memory pressure the performance can be quite brutal with the system barely being responsive. The discussion over that behavior has been reignited this week. From a report: Developer Artem S Tashkinov took to the kernel mailing list over the weekend to express his frustration with the kernel's inability to handle low memory pressure in a graceful manner. If booting a system with just 4GB of RAM available, disabling SWAP to accelerate the impact/behavior, and launching a web browser and opening new web pages / tabs can in a matter of minutes bring the system down to its knees. Artem elaborated on the kernel mailing list, "Once you hit a situation when opening a new tab requires more RAM than is currently available, the system will stall hard. You will barely be able to move the mouse pointer. Your disk LED will be flashing incessantly (I'm not entirely sure why). You will not be able to run new applications or close currently running ones. This little crisis may continue for minutes or even longer. I think that's not how the system should behave in this situation. I believe something must be done about that to avoid this stall."' -- source: https://linux.slashdot.org/story/19/08/06/1839206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Final Red Hat Enterprise Linux 7 Version Released
by Peter Reutemann 06 Aug '19

06 Aug '19

'The last RHEL release, RHEL 7.7, is now available for current Red Hat Enterprise Linux subscribers via the Red Hat Customer Portal. ZDNet reports on what's new: RHEL 7.7's most important updates are support for the latest generation of enterprise hardware and remediation for the recently disclosed ZombieLoad vulnerabilities. The latest RHEL 7 also includes network stack performance enhancements. With this release, you can offload virtual switching operations to network interface card (NIC) hardware. What that means for you is, if you're using virtual switching and network function virtualization (NFV), you'll see better network performance on cloud and container platforms such as Red Hat OpenStack Platform and Red Hat OpenShift. RHEL 7.7 users can also use Red Hat's new predictive problem shooter: Red Hat Insights. This uses a software-as-a-service (SaaS)-based predictive analytics approach to spot, assess, and mitigate potential problems to their systems before they can cause trouble. For developers, RHEL 7.7 comes with Python 3.6 interpreter, and the pip and setup tools utilities. Previously, Python 3 versions were available only as a part of Red Hat Software Collections. Moving on to the cloud, RHEL 7.7 Red Hat Image Builder is now supported. This feature, which is also in RHEL 8, enables you to easily create custom RHEL system images for cloud and virtualization platforms such as Amazon Web Services (AWS), VMware vSphere, and OpenStack. To help cloud-native developers, RHEL 7.7 includes full support for Red Hat's distributed-container toolkit -- buildah, podman, and skopeo -- on RHEL workstations. After building on the desktop, programmers can use Red Hat Universal Base Image to build, run, and manage containerized applications across the hybrid cloud.' -- source: https://linux.slashdot.org/story/19/08/06/208202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Half of All Google Chrome Extensions Have Fewer Than 16 Installs
by Peter Reutemann 05 Aug '19

05 Aug '19

'There are 188,620 extensions available on the Chrome Web Store, and while you might think this provides a wide variety of choices for Chrome users, in reality, most of these extensions are dead or dwindling, with very few having active installations. From a report: All in all, about 50% of all Chrome extensions have fewer than 16 installs, meaning that half of the Chrome extension ecosystem is actually more of a ghost town, according to a recent scan of the entire Chrome Web Store conducted by Extension Monitor. Further, 19,379 extensions (just over 10%) have zero installs, and 25,540 extensions (13% of the total) have just one user. The scan found that there are very few Chrome extensions that managed to establish a dedicated userbase. According to Extension Monitor, around 87% of all extensions have fewer than 1,000 installs.' -- source: https://tech.slashdot.org/story/19/08/05/144246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Huawei Tests Smartphone With Own OS, Could Potentially Start Selling Them Later This Year
by Peter Reutemann 05 Aug '19

05 Aug '19

'Huawei is testing a smartphone equipped with Hongmeng, the company's self-developed operating system, which could potentially go on sale by the end of this year, Chinese state-media outlet Global Times reported. From a report: The release of a Hongmeng-powered smartphone would mark a major step for China's Huawei, the world's second-biggest maker of smartphones, as U.S. government actions threaten its access to Google's Android operating system. The device will be priced at around 2,000 yuan ($288), the Global Times said on Sunday, citing unnamed sources. That will place the device toward the low-end segment of the smartphone market. Huawei executives have previously described Hongmeng as an operating system designed for internet-of-things products. Last month the company said the first major devices powered by Hongmeng would be its upcoming line of Honor-brand smart TVs.' -- source: https://mobile.slashdot.org/story/19/08/05/1515218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GNOME and KDE Join Forces To Co-Host Linux App Summit
by Peter Reutemann 05 Aug '19

05 Aug '19

'GNOME and KDE are co-hosting this year's Linux App Summit (LAS) in Barcelona from November 12th to 15th. An anonymous reader shared the big announcement: LAS is the first collaborative event co-hosted by the two organizations since the Desktop Summit in 2009. Both organizations are eager to bring their communities together in building an application ecosystem that transcends individual distros and broadens the market for everyone involved. KDE and GNOME will no longer be taking a passive role in the free desktop sector. With the joint influence of the two desktop projects, LAS will shepherd the growth of the FOSS desktop by encouraging the creation of quality applications, seeking opportunities for compensation for FOSS developers, and fostering a vibrant market for the Linux operating system. * "I am excited to see GNOME and KDE working together on LAS, and I believe that the event will help lay down strong foundations for collaborative cross-project development that would benefit Linux users across all distributions and on any compatible device." -- Christel Dahlskjaer, Private Internet Access and freenode Project Lead. * "Together with GNOME, counting with the collaboration of many distributions and application developers, we'll have the opportunity to work side by side, share our perspectives and offer the platform that the next generation of solutions will be built on." -- Aleix Pol Gonzalez, KDE e.V Vice-President says about the inaugural effort about LAS. * "By partnering with KDE we show the desire to build the kind of application ecosystem that demonstrates that Open Source and Free Software are important; the technology and organization we build to achieve this is valuable and necessary." -- GNOME executive director, Neil McGovern * "The desktop wars is not really a thing any more. It makes more sense to work together and pool resources." -- Paul Brown, a KDE Communications Specialist (quoted by ZDNet) ZDNet called the collaboration "a major step forward," giving their story the headline "GNOME and KDE work together on the Linux desktop." But the Twitter feed for the KDE community quickly clarified that KDE "is working with GNOME to create a common, fair, sustainable and open app ecosystem, not a desktop." "The GNOME and KDE communities want to provide users with free and open applications that will respect their privacy and rights. That is what Linux App Summit is about."' -- source: https://linux.slashdot.org/story/19/08/03/0240209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Just Stopped Displaying 'www' and 'https' In Chrome's Address Bar
by Peter Reutemann 04 Aug '19

04 Aug '19

'"Google has finally chopped the 'www' from Chrome's address bar after delaying the controversial move due to a backlash," reports TechRepublic: The move to remove 'www' was initially planned for last year, when Google announced it would cut "trivial subdomains" from the address bar in Chrome 69. Now Google has begun truncating the visible URL in Chrome for desktop and Android, rolling out the change in version 76 of the browser, released this week. By default sites in Chrome now no longer display the "https" scheme or the "www" subdomain, with the visible address starting after this point. To view the full URL, users now have to click the address bar twice on desktop and once on mobile. Google has argued the move is driven by a desire for greater simplicity and usability of Chrome... However the announcement provoked a fresh wave of criticism, from those who say the move will confuse users and even potentially make it easier for them to inadvertently connect to fake sites... There are also some who claim Google's motivation in changing how the URL is displayed may be to make it harder for users to tell whether they are on a page hosted on Google's Accelerated Mobile Pages subdomain... Google says it has also built a Chrome extension that doesn't obfuscate the URL to "help power users recognize suspicious sites and report them to Safe Browsing". Despite the backlash from some online, Chrome isn't the first browser to truncate the URL in this way, with Apple's Safari similarly hiding the full address. ' -- source: https://tech.slashdot.org/story/19/08/03/0317238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Amazon Quietly Gives Alexa's Voice Recordings a 'No Human Review' Option
by Peter Reutemann 04 Aug '19

04 Aug '19

'"Amazon Alexa users can now choose whether human reviewers listen to recordings of their exchanges with the AI assistant," reports VentureBeat, citing an Amazon spokesperson. To ensure people don't listen to voice recordings collected following each exchange with Alexa, go to Settings, tap the Alexa Privacy link, then choose Manage How Your Data Improves Alexa. Users can also delete their voice recordings via the Alexa app or Amazon website. The news follows Amazon's introduction of an "Alexa, delete what I said today" voice command in May... Earlier this week, Google and Apple both pledged to suspend some of their voice data review by people. ' -- source: https://yro.slashdot.org/story/19/08/04/0159227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Vulnerabilities Found In WPA3 WiFi Standard
by Peter Reutemann 04 Aug '19

04 Aug '19

'Slashdot reader Artem S. Tashkinov writes: Mathy Vanhoef and Eyal Ronen have recently disclosed two new additional bugs impacting WPA3. The security researched duo found the new bugs in the security recommendations the WiFi Alliance created for equipment vendors in order to mitigate the initial Dragonblood attacks [found by the same two security researchers]. "Just like the original Dragonblood vulnerabilities from April, these two new ones allow attackers to leak information from WPA3 cryptographic operations and brute-force a WiFi network's password," reports ZDNet. More from ZDNet: "[The] Wi-Fi standard is now being updated with proper defenses, which might lead to WPA3.1," Vanhoef said. "Although this update is not backwards-compatible with current deployments of WPA3, it does prevent most of our attacks," the researchers said. But besides just disclosing the two new Dragonblood vulnerabilities, the two researchers also took the chance to criticize the WiFi Alliance again for its closed standards development process that doesn't allow for the open-source community to contribute and prevent big vulnerabilities from making it into the standard in the first place. "This demonstrates that implementing Dragonfly and WPA3 without side-channel leaks is surprisingly hard," the researchers said. "It also, once again, shows that privately creating security recommendations and standards is at best irresponsible and at worst inept." While these type of feedback might be ignored when coming from other researchers, it means more when it comes from Vanhoef. The Belgian researchers is the one who discovered the KRACK attack that broke the WPA2 WiFi authentication standard and forced the WiFi Alliance to develop the WPA3 standard, which it launched in June 2018.' -- source: https://mobile.slashdot.org/story/19/08/04/1821237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Listening Post On VPNs
by Lawrence D'Oliveiro 03 Aug '19

03 Aug '19

This week’s episode of “The Listening Post” on Al Jazeera <https://www.aljazeera.com/programmes/listeningpost/2019/07/vazajato-dirty-d…> covers, in the latter part, an overview of the increasing popularity of VPNs. It also mentions some of their potential pitfalls.

1 0

Did Facebook End The Encryption Debate?
by Peter Reutemann 02 Aug '19

02 Aug '19

'Forbes contributor Kalev Leetaru argues that "the encryption debate is already over -- Facebook ended it earlier this year." The ability of encryption to shield a user's communications rests upon the assumption that the sender and recipient's devices are themselves secure, with the encrypted channel the only weak point... [But] Facebook announced earlier this year preliminary results from its efforts to move a global mass surveillance infrastructure directly onto users' devices where it can bypass the protections of end-to-end encryption. In Facebook's vision, the actual end-to-end encryption client itself such as WhatsApp will include embedded content moderation and blacklist filtering algorithms. These algorithms will be continually updated from a central cloud service, but will run locally on the user's device, scanning each cleartext message before it is sent and each encrypted message after it is decrypted. The company even noted that when it detects violations it will need to quietly stream a copy of the formerly encrypted content back to its central servers to analyze further, even if the user objects, acting as true wiretapping service... If Facebook's model succeeds, it will only be a matter of time before device manufacturers and mobile operating system developers embed similar tools directly into devices themselves, making them impossible to escape... Governments would soon use lawful court orders to require companies to build in custom filters of content they are concerned about and automatically notify them of violations, including sending a copy of the offending content. Rather than grappling with how to defeat encryption, governments will simply be able to harness social media companies to perform their mass surveillance for them, sending them real-time alerts and copies of the decrypted content. Putting this all together, the sad reality of the encryption debate is that after 30 years it is finally over: dead at the hands of Facebook. If the company's new on-device content moderation succeeds it will usher in the end of consumer end-to-end encryption and create a framework for governments to outsource their mass surveillance directly to social media companies, completely bypassing encryption. In the end, encryption's days are numbered and the world has Facebook to thank. ' -- source: https://it.slashdot.org/story/19/07/27/206248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Apple’s AirDrop and password sharing features can leak iPhone numbers
by Peter Reutemann 02 Aug '19

02 Aug '19

'Apple makes it easy for people to locate lost iPhones, share Wi-Fi passwords, and use AirDrop to send files to other nearby devices. A recently published report demonstrates how snoops can capitalize on these features to scoop up a wealth of potentially sensitive data that in some cases includes phone numbers. Simply having Bluetooth turned on broadcasts a host of device details, including its name, whether it's in use, if Wi-Fi is turned on, the OS version it’s running, and information about the battery. More concerning: using AirDrop or Wi-Fi password sharing broadcasts a partial cryptographic hash that can easily be converted into an iPhone’s complete phone number. The information—which in the case of a Mac also includes a static MAC address that can be used as a unique identifier—is sent in Bluetooth Low Energy packets. The information disclosed may not be a big deal in many settings, such as work places where everyone knows everyone anyway. The exposure may be creepier in public places, such as a subway, a bar, or a department store, where anyone with some low-cost hardware and a little know-how can collect the details of all Apple devices that have BLE turned on. The data could also be a boon to companies that track customers as they move through retail outlets. As noted above, in the event someone is using AirDrop to share a file or image, they’re broadcasting a partial SHA256 hash of their phone number. In the event Wi-Fi password sharing is in use, the device is sending partial SHA256 hashes of its phone number, the user’s email address, and the user’s Apple ID. While only the first three bytes of the hash are broadcast, researchers with security firm Hexway (which published the research) say those bytes provide enough information to recover the full phone number.' -- source: https://arstechnica.com/information-technology/2019/08/apples-airdrop-and-p… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

When Open Source Software Comes With a Few Catches
by Peter Reutemann 02 Aug '19

02 Aug '19

'As open source software grows more popular, and important, developers face an existential question: How to make money from something you give away for free? An anonymous reader shares a report: The Open Source Initiative standards body says an open source license must allow users to view the underlying source code, modify it, and share it as they see fit. Independent developers and large companies alike now routinely release software under these licenses. Many coders believe open collaboration results in better software. Some companies open their code for marketing purposes. Open source software now underpins much technology, from smartphone operating systems to government websites. Companies that release software under open source licenses generate revenue in different ways. Some sell support, including Red Hat, which IBM acquired for $34 billion earlier this month. Others, like cloud automation company HashiCorp, sell proprietary software based on the open source components. But with the rise of cloud computing, developers see their open source code being bundled into services and sold by other companies. Amazon, for example, sells a cloud-hosted service based on the popular open source database Redis, which competes with a similar cloud-hosted service offered by Redis Labs, the sponsor of the open source project. To protect against such scenarios, companies behind popular open source projects are restricting how others can use their software. Redis Labs started the trend last year when it relicensed several add-ons for its core product under terms that essentially prohibit offering those add-ons as part of a commercial cloud computing service. That way, Amazon and other cloud providers can't use those add-ons in their competing Redis services. Companies that want the functionality provided by those add-ons need to develop those features themselves, or get permission from Redis Labs. [...] Analytics company Confluent and database maker CockroachDB added similar terms to their licenses, preventing cloud computing companies from using some or all of their code to build competing services. Taking a slightly different tack, MongoDB relicensed its flagship database product last year under a new "Server Side Public License" (SSPL) that requires companies that sell the database system as a cloud service also release the source code of any additional software they include.' -- source: https://news.slashdot.org/story/19/08/01/1522211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Office 365 Declared Illegal In German Schools Over Privacy Concerns
by Lawrence D'Oliveiro 01 Aug '19

01 Aug '19

Rules over data access mean that none of the cloud-based suites (whether from Apple, Google or Microsoft) can be used in the German state of Hesse <https://arstechnica.com/information-technology/2019/07/germany-threatens-to…>. Who will blink first?

2 2

GitHub Starts Blocking Developers In Countries Facing US Trade Sanctions
by Peter Reutemann 01 Aug '19

01 Aug '19

'After a developer based in the Crimea region of Ukraine was blocked from GitHub this week, the Microsoft-owned software development platform said it has started restricting accounts in countries facing U.S. trade sanctions. GitHub lists Crimea, Cuba, Iran, North Korea, and Syris as countries facing U.S. sanctions. ZDNet reports: As the developer reports, his website https://tkashkin.tk, which is hosted on GitHub, now returns a 404 error. He also can't create new private GitHub repositories or access them. While his website could easily be moved to another hosting provider, the block does pose a challenge for his work on GameHub, which has an established audience on GitHub. GitHub does offer developers an appeal form to dispute restrictions but [the developer] told ZDNet that, at this point, there's nothing to gain by appealing the restriction. "It is just pointless. My account is flagged as restricted and, in order to unflag it, I have to provide a proof that I don't live in Crimea. I am in fact a Russian citizen with Crimean registration, I am physically in Crimea, and I am living in Crimea my entire life," he said. "For individual users, who are not otherwise restricted by U.S. economic sanctions, GitHub currently offers limited restricted services to users in these countries and territories. This includes limited access to GitHub public repository services for personal communications only," it says. GitHub notes on its page about U.S. trade controls that its paid-for on-premise software -- aimed to enterprise users -- may be an option for users in those circumstances. "Users are responsible for ensuring that the content they develop and share on GitHub.com complies with the U.S. export control laws, including the EAR (Export Administration Regulations) and the U.S. International Traffic in Arms Regulations (ITAR)," GitHub says. "The cloud-hosted service offering available at Github.com has not been designed to host data subject to the ITAR and does not currently offer the ability to restrict repository access by country. If you are looking to collaborate on ITAR- or other export-controlled data, we recommend you consider GitHub Enterprise Server, GitHub's on-premises offering."' -- source: https://tech.slashdot.org/story/19/07/26/2157202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Google Reveals Fistful of Flaws In Apple's iMessage App
by Peter Reutemann 31 Jul '19

31 Jul '19

'Google researchers have shared details of five flaws in Apple's iMessage software that could make its devices vulnerable to attack. The BBC reports: In one case, the researchers said the vulnerability was so severe that the only way to rescue a targeted iPhone would be to delete all the data off it. Another example, they said, could be used to copy files off a device without requiring the owner to do anything to aid the hack. Apple released fixes last week. But the researchers said they had also flagged a sixth problem to Apple, which had not been rectified in the update to its mobile operating system. Apple's own notes about iOS 12.4 indicate that the unfixed flaw could give hackers a means to crash an app or execute commands of their own on recent iPhones, iPads and iPod Touches if they were able to discover it. Apple has not commented on this specific issue, but has urged users to install the new version of iOS, which addresses Google's other discoveries as well as a further range of glitches and threats. One of the two Google researchers involved - Natalie Silvanovich - intends to share more details of her findings at a presentation at the Black Hat conference in Las Vegas next month.' -- source: https://apple.slashdot.org/story/19/07/30/237228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Hottest Phones For the Next Billion Users Aren't Smartphones
by Peter Reutemann 31 Jul '19

31 Jul '19

'Millions of first-time internet consumers from the Ivory Coast to India and Indonesia are connecting to the web on smart feature phones that cost only about $25. "[T]hese hybrid phones, fueled by inexpensive mobile data, provide some basic apps and internet access in addition to calling and texting," the Wall Street Journal reports. >From the report: While global smartphone sales began sliding last year as markets became saturated, smart feature phone shipments tripled to around 75 million from 2017, according to research firm Counterpoint. Some 84 million are likely to be shipped this year. Even as rich nations start to roll out 5G technologies, some 3.4 billion people around the world remain cut off from the internet, according to We Are Social, another research firm. Most of them already use traditional, unconnected mobile phones, meaning they can easily make the transition to similarly shaped devices capable of high-speed web connections. Smart feature phones aren't only inexpensive, but they also have physical keypads that are less intimidating than touch screens for those new to the technology. Meanwhile, their batteries last for days, a bonus in places where electricity is unreliable. There is a trade-off for the low price. The devices typically have slower and less powerful components, only basic cameras and their screens are usually just a few inches in size, factors that contribute to their longer battery life. There also are fewer apps available for smart feature phones.' -- source: https://mobile.slashdot.org/story/19/07/30/2317234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome 76 Arrives With Flash Blocked By Default
by Peter Reutemann 31 Jul '19

31 Jul '19

'Google today launched Chrome 76 for Windows, Mac, Linux, Android, and iOS. The release includes Adobe Flash blocked by default, Incognito mode detection disabled, multiple PWA improvements, and more developer features. You can update to the latest version now using Chrome's built-in updater or download it directly from google.com/chrome. Google has been taking baby steps to kill off Flash for years. In 2015, Chrome started automatically pausing less important Flash content. In 2016, Chrome started blocking "behind the scenes" Flash content and using HTML5 by default. In July 2017, however, Adobe said it would kill Flash by 2020. With Chrome 76, Flash is now blocked by default. Users can still turn it on in settings, but next year, Flash will be removed from Chrome entirely.' -- source: https://apple.slashdot.org/story/19/07/30/2059214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Bill Would Ban Autoplay Videos and Endless Scrolling
by Peter Reutemann 31 Jul '19

31 Jul '19

Though not relevant to NZ legally speaking, it is still good to see that there is movement to avoid design that disadvantages the user: 'A new bill, sponsored by Sen. Josh Hawley (R-MO), targets snapstreaks, YouTube autoplay, and endless scrolling that, the bill alleges, are designed in a way to make services "addictive." Reader Zorro writes: Hawley's Social Media Addiction Reduction Technology Act, or the SMART Act, would ban these features that work to keep users on platforms longer, along with others, like Snapstreaks, that incentivize the continued use of these products. If approved, the Federal Trade Commission and Health and Human Services could create similar rules that would expire after three years unless Congress codified them into law. "Big tech has embraced a business model of addiction," Hawley said. "Too much of the 'innovation' in this space is designed not to create better products, but to capture more attention by using psychological tricks that make it difficult to look away." Deceptive design played an enormous part in last week's FTC settlement with Facebook, and Hawley's bill would make it unlawful for tech companies to use dark patterns to manipulate users into opting into services. For example, "accept" and "decline" checkboxes would need to be the same font, color, and size to help users make better, more informed choices. "Social media companies deploy a host of tactics designed to manipulate users in ways that undermines their wellbeing," said Josh Golin, executive director of campaign for a Commercial Free Childhood.' -- source: https://news.slashdot.org/story/19/07/30/1742213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apple's AWDL Protocol Plagued By Flaws That Enable Tracking and MitM Attacks
by Peter Reutemann 31 Jul '19

31 Jul '19

'Apple Wireless Direct Link (AWDL), a protocol installed on over 1.2 billion Apple devices, contains vulnerabilities that enable attackers to track users, crash devices, or intercept files transferred between devices via man-in-the-middle (MitM) attacks. From a report: These are the findings of a research project that started last year at the Technical University of Darmstadt, in Germany, and has recently concluded, and whose findings researchers will be presenting later this month at a security conference in the US. The project sought to analyze the Apple Wireless Direct Link (AWDL), a protocol that Apple rolled out in 2014 and which also plays a key role in enabling device-to-device communications in the Apple ecosystem. While most Apple end users might not be aware of the protocol's existence, AWDL is at the core of Apple services like AirPlay and AirDrop, and Apple has been including AWDL by default on all devices the company has been selling, such as Macs, iPhones, iPads, Apple watches, Apple TVs, and HomePods. But in the past five years, Apple has never published any in-depth technical details about how AWDL works. This, in turn, has resulted in very few security researchers looking at AWDL for bugs or implementation errors.' -- source: https://apple.slashdot.org/story/19/07/30/1723254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0