- wlug - list.wlug.org.nz

USB Type-C Authentication Program Launched
by Peter Reutemann 02 Jan '19

02 Jan '19

'With the arrival of USB-C a few years back, plugging into laptops, tablets and smartphones became even easier than before. But there are potential security risks. The USB Type-C Authentication Program launched today aims to address such issues. From a report: The new protocol from the USB Implementers Forum (USB-IF) can be used to validate the authenticity of a cable, charger or hardware at the moment of connection, and stop attacks in their tracks. The USB-IF has chosen DigiCert to operate registrations and certificate authority services for the new specification, which makes use of 128-bit cryptographic-based authentication for certificate format, digital signing, hash and random number generation. "USB Type-C Authentication gives OEMs the opportunity to use certificates that enable host systems to confirm the authenticity of a USB device or USB charger, including such product aspects as the descriptors, capabilities and certification status," said DigiCert in a press release. "This protects against potential damage from non-compliant USB chargers and the risks from maliciously embedded hardware or software in devices attempting to exploit a USB connection."' -- source: https://it.slashdot.org/story/19/01/02/2025207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

wget Command Stores Extended Attributes
by Lawrence D'Oliveiro 02 Jan '19

02 Jan '19

Here’s something I didn’t know: the “wget” command saves the URL where it got a downloaded file as an extended attribute of the file. This behaviour isn’t mentioned anywhere in the man page or in the info file, that I can find. Unfortunately, this can lead to a security issue where the URL includes confidential password details. And it appears other apps, like Chrome, do a similar thing. <https://www.theregister.co.uk/2019/01/02/wget_bug_fix/>

1 0

Banana Pi 24-Core ARM Server Running Ubuntu Breaks Cover
by Peter Reutemann 27 Dec '18

27 Dec '18

'ARM-based server processors have threatened to take on Intel in the data center for some time but not much has materialized thus far in terms of significant deployments. However, a new breed of low cost ARM server implementations may be in the works with a many-core platform called Banana Pi. The latest Banana Pi device being teased is something very different in the form of a 24-core ARM server that speculation suggests might be sold as a Banana Pi server board or as a finished server product. A video has surfaced that reportedly shows a 24-core ARM Cortex-A53 processor with 32GB of RAM, though the OS only sees 29.4GB of that RAM. The OS is Ubuntu 18.04.1 LTS with MATE desktop. Unless the processor used in this device is something unannounced, and that seems unlikely, the chip itself would likely be a SocioNext SC2A11. The same processor is used in the Linaro Developer Box. The demo shows the server fully loaded at 100% CPU utilization building a Linux kernel and reportedly the system also supports NVMe storage as well as TensorFlow workloads for machine learning. Not much else is known about the system at this time but it's an interesting development in the Linux server space to be sure.' -- source: https://hardware.slashdot.org/story/18/12/27/0556243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Requesting The Data You’ve Left Online
by Lawrence D'Oliveiro 26 Dec '18

26 Dec '18

Article from a correspondent for the Otago Daily Times <https://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=12182555> about what he discovered when he asked Google, Facebook, the NZ Police, the NZSIS and various credit ratings companies what information they had on him. All except one responded with rather sobering amounts of personal detail.

1 0

LibreHunt: The Linux Distro Counsellor
by Lawrence D'Oliveiro 23 Dec '18

23 Dec '18

Here’s a site <https://www.librehunt.org/> which purports to suggest a suitable Linux distro for you, based on your answers to questions about your ability, needs etc. The selection is made from a “curated” list of just 44 distros, to simplify things.

1 0

Word For The Week: “Kaomoji”
by Lawrence D'Oliveiro 20 Dec '18

20 Dec '18

For those who might previously have gone “(＠_＠)” or “¯\_(ツ)_/¯” when they heard this word, here it is all explained: <http://kaomoji.ru/en/>. So now you can be all “\(^ヮ^)/” instead. Actually I came across that word in this article <https://arstechnica.com/gadgets/2018/12/windows-10-will-make-it-easier-to-%…>, which reports that Windows 10 will make it easier to enter these character sequences.

1 0

Bye bye Mongo, Hello Postgres
by Peter Reutemann 20 Dec '18

20 Dec '18

'In April the Guardian switched off the Mongo DB cluster used to store our content after completing a migration to PostgreSQL on Amazon RDS. This post covers why and how' -- source: https://www.theguardian.com/info/2018/nov/30/bye-bye-mongo-hello-postgres Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Facebook Does Not “Sell” Your Data, But ...
by Lawrence D'Oliveiro 20 Dec '18

20 Dec '18

... they sure as hell have been rather free and easy in sharing it with others <https://www.techdirt.com/articles/20181219/10370941268/facebooks-latest-pri…>. Seems a bunch of companies have had extra-privileged access to user data on Facebook, and they in turn supplied information about those users back to Facebook. This is how the “People You May Know” feature is able to make links like between different patients of the same psychiatrist, and other things equally dodgy ethically, if not downright illegal (or at least they should be). And this may be how Amazon was able to make a (spurious) association between a book reviewer and the book author, and disallow the review on that basis, just because the reviewer had previously followed the author on Facebook.

1 0

kflickr wants http/ssl
by Barry Marchant 19 Dec '18

19 Dec '18

Hi all, When I try to start kflickr from cmd line I get a msg HTTP request to Flickr.com failed. (msg: SSL is required). Am I missing a pkg? or is there another problem? System is x86-64 running Mageia5 TIA Barry

3 2

How Computers Got Shockingly Good At Recognizing Images
by Lawrence D'Oliveiro 19 Dec '18

19 Dec '18

Some good background on the origins of all the current hubbub over automated image recognition: <https://arstechnica.com/science/2018/12/how-computers-got-shockingly-good-a…>. A key breakthrough came in 2012, when a team at the University of Toronto combined the “convolutional” neural network concept with a massive deployment of sheer computing power to leave its competitors in the dust in the “ImageNet” image-recognition competition that year. That team are now working at Google. Oh, and the recognition algorithms are now scoring better than many humans in some areas.

2 2

Windows 10 October 2018 Update Is Getting There
by Lawrence D'Oliveiro 19 Dec '18

19 Dec '18

Microsoft seems to think its October update is now worth inflicting on “advanced” users <https://arstechnica.com/gadgets/2018/12/windows-10-october-2018-update-now-…>. The more general populace will have to wait a bit longer. I wonder when we’ll see the November update ...

1 0

You’ve Heard Of The Wayback Machine, Now Meet Archive Team
by Lawrence D'Oliveiro 18 Dec '18

18 Dec '18

You probably already know about the Wayback machine <https://archive.org/>. You might think of them as the “respectable” side of trying to save snapshots of old websites: they respect robots.txt and takedown demands. Well, now meet the, um, more “wild and woolly” side with the same mission: Archive Team <https://archiveteam.org/>. They describe themselves as ... a loose collective of rogue archivists, programmers, writers and loudmouths dedicated to saving our digital heritage. Since 2009 this variant force of nature has caught wind of shutdowns, shutoffs, mergers, and plain old deletions - and done our best to save the history before it's lost forever. Along the way, we've gotten attention, resistance, press and discussion, but most importantly, we've gotten the message out: IT DOESN'T HAVE TO BE THIS WAY. I just heard about them because they were trying to save all the X-rated blogs on tumblr.com before these disappeared, on orders of new owner Verizon. The company tried to block them from achieving this mission, but they found a way around the block (NSFW language) <https://www.techdirt.com/articles/20181216/22420341242/as-final-fuck-you-to…>.

1 1

MIPS Goes Open Source
by Peter Reutemann 18 Dec '18

18 Dec '18

'Junko Yoshida, writing for EETimes: Without question, 2018 was the year RISC-V genuinely began to build momentum among chip architects hungry for open-source instruction sets. That was then. By 2019, RISC-V won't be the only game in town. Wave Computing (Campbell, Calif.) announced Monday (Dec. 17) that it is putting MIPS on open source, with MIPS Instruction Set Architecture (ISA) and MIPS' latest core R6 available in the first quarter of 2019. Art Swift, hired by Wave this month as president of its MIPS licensing business, described the move as critical to accelerate the adoption of MIPS in an ecosystem. Going open source is "a big plan" that Wave CEO Derek Meyer, a MIPS veteran, has been quietly fostering since Wave acquired MIPS Technologies in June, explained Swift. Swift himself is a MIPS alumnus who worked at the company as a vice president of marketing and business development for four years. Wave, which styles itself as a tech startup poised to bring "AI and deep learning from the datacenter to the edge," sees MIPS as a key to advancing Wave's AI into a host of uses and applications. Included in MIPS instruction sets are extensions such as SIMD (single instruction, multiple data) and DSP. Swift promised that MIPS will bring to the open-source community "commercial-ready" instruction sets with "industrial-strength" architecture. "Chip designers will have opportunities to design their own cores based on proven and well tested instruction sets for any purposes," said Swift.' -- source: https://news.slashdot.org/story/18/12/17/1954247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Red Hat Enterprise Linux Comes To Windows 10 in the Form of WLinux Enterprise
by Peter Reutemann 18 Dec '18

18 Dec '18

'Mark Wilson writes: Earlier in the year open-source software startup Whitewater Foundry brought WLinux to the Windows Subsystem for Linux (WSL). Not content with creating the first native Linux distribution for WSL, the company has now gone a step further, targeting enterprise users with WLinux Enterprise. Whitewater Foundry says that WLinux Enterprise is the first product to support the industry-standard Red Hat Enterprise Linux on Windows Sub' -- source: https://tech.slashdot.org/story/18/12/17/2041255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google isn’t the company that we should have handed the Web over to
by Peter Reutemann 17 Dec '18

17 Dec '18

'With Microsoft's decision to end development of its own Web rendering engine and switch to Chromium, control over the Web has functionally been ceded to Google. That's a worrying turn of events, given the company's past behavior. Chrome itself has about 72 percent of the desktop-browser market share. Edge has about 4 percent. Opera, based on Chromium, has another 2 percent. The abandoned, no-longer-updated Internet Explorer has 5 percent, and Safari—only available on macOS—about 5 percent. When Microsoft's transition is complete, we're looking at a world where Chrome and Chrome-derivatives take about 80 percent of the market, with only Firefox, at 9 percent, actively maintained and available cross-platform. The mobile story has stronger representation from Safari, thanks to the iPhone, but overall tells a similar story. Chrome has 53 percent directly, plus another 6 percent from Samsung Internet, another 5 percent from Opera, and another 2 percent from Android browser. Safari has about 22 percent, with the Chinese UC Browser sitting at about 9 percent. That's two-thirds of the mobile market going to Chrome and Chrome derivatives. In terms of raw percentages, Google won't have quite as big a lock on the browser space as Microsoft did with Internet Explorer—Internet Explorer 6 peaked at around 80 percent, and all versions of Internet Explorer together may have reached as high as 95 percent. But Google's reach is, in practice, much greater: not only is the Web a substantially more important place today than it was in the early 2000s, but also there's a whole new mobile Web that operates in addition to the desktop Web.' -- source: https://arstechnica.com/gadgets/2018/12/the-web-now-belongs-to-google-and-t… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Do Alternative Software Licenses Represent Open Source's 'Midlife Crisis'?
by Peter Reutemann 16 Dec '18

16 Dec '18

'"it is clear to me that open source -- now several decades old and fully adult -- is going through its own midlife crisis," writes Joyent CTO Bryan Cantrill. [O]pen source business models are really tough, selling software-as-a-service is one of the most natural of them, the cloud service providers are really good at it -- and their commercial appetites seem boundless. And, like a new cherry red two-seater sports car next to a minivan in a suburban driveway, some open source companies are dealing with this crisis exceptionally poorly: they are trying to restrict the way that their open source software can be used. These companies want it both ways: they want the advantages of open source -- the community, the positivity, the energy, the adoption, the downloads -- but they also want to enjoy the fruits of proprietary software companies in software lock-in and its concomitant monopolistic rents. If this were entirely transparent (that is, if some bits were merely being made explicitly proprietary), it would be fine: we could accept these companies as essentially proprietary software companies, albeit with an open source loss-leader. But instead, these companies are trying to license their way into this self-contradictory world: continuing to claim to be entirely open source, but perverting the license under which portions of that source are available. Most gallingly, they are doing this by hijacking open source nomenclature. Of these, the laughably named commons clause is the worst offender (it is plainly designed to be confused with the purely virtuous creative commons), but others...are little better... "[T]heir business model isn't their community's problem, and they should please stop trying to make it one," Cantrill writes, adding letter that "As we collectively internalize that open source is not a business model on its own, we will likely see fewer VC-funded open source companies (though I'm honestly not sure that that's a bad thing)..." He also points out that "Even though the VC that led the last round wants to puke into a trashcan whenever they hear it, business models like 'support', 'services' and 'training' are entirely viable!" Jay Kreps, Co-founder of @confluentinc, has posted a rebuttal on Medium. "How do you describe a license that lets you run, modify, fork, and redistribute the code and do virtually anything other than offer a competing SaaS offering of the product? I think Bryan's sentiment may be that it should be called the Evil Proprietary Corruption of Open Source License or something like that, but, well, we disagree."' -- source: https://news.slashdot.org/story/18/12/15/2221232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

The Last Independent Mobile OS
by Peter Reutemann 16 Dec '18

16 Dec '18

'The year was 2010 and the future of mobile computing was looking bright. The iPhone was barely three years old, Google's Android had yet to swallow the smartphone market whole, and half a dozen alternative mobile operating systems -- many of which were devoutly open source -- were preparing for launch. Eight years on, you probably haven't even heard of most of these alternative mobile operating systems, much less use them. Today, Android and iOS dominate the global smartphone market and account for 99.9 percent of mobile operating systems. Even Microsoft and Blackberry, longtime players in the mobile space with massive revenue streams, have all but left the space. Then there's Jolla, the small Finnish tech company behind Sailfish OS, which it bills as the "last independent alternative mobile operating system." Jolla has had to walk itself back from the edge of destruction several times over the course of its seven year existence, and each time it has emerged battered, but more determined than ever to carve out a spot in the world for a truly independent, open source mobile operating system. Jolla's Sailfish OS rose from the ashes of Nokia and Intel's ill-fated collaboration, MeeGo. The MeeGo project launched in 2010 in an attempt to merge Intel's Linux-based Moblin OS and Nokia's Maemo software platform into a single open-source mobile operating system that could take on Google. By 2011, Android had already surpassed Nokia in the smartphone market, a fact that wasn't lost on Nokia's CEO Stephen Elop, who in a memo described the company as standing on a "burning platform." Nokia only ever released one phone running MeeGo: the Nokia N9, which ended up being well received despite its limited release. But it was too little, too late. By 2011, Nokia was bleeding talent and it was clear that MeeGo wasn't going to keep the company competitive in the rapidly changing smartphone market. In a last-ditch effort, Nokia struck a partnership with Microsoft to provide the hardware for its next generation of Windows Phones, abandoning MeeGo entirely. The same couldn't be said for those developers who had worked on MeeGo and, before that, an open source mobile OS called Mer, based on Intel's Maemo system. In October 2011, three developers that had worked on Mer sent a message on a mailing list calling for the creation of a "MeeGo 2.0." At the same time, developer Sami Pienimaki and two others left Nokia to found their own company, which would use this new version of MeeGo as the basis for an open source mobile OS. And thus, Sailfish was born. In a cheeky homage to the "burning platform" memo, Pienimaki and his fellow defectors decided to name their company Jolla, a Finnish word connoting a small boat or life raft. Jolla has since turned to Russia and China, both of which were hungry for a secure alternative to Google-based systems. In late 2016, Sailfish OS achieved domestic certification in Russia for government and corporate us. Around the same time, Sailfish was also making moves in China. In early 2017, the Sailfish China Consortium gained the exclusive rights and license to develop a Chinese OS based on Sailfish.' -- source: https://hardware.slashdot.org/story/18/12/16/0758215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Tesla Model 3 Modded To Run Ubuntu
by Peter Reutemann 16 Dec '18

16 Dec '18

'CleanTechnica is reporting that someone hacked the infotainment system of a Tesla Model 3 and got root access and installed Linux distribution Ubuntu. Redditor trsohmers is able to show an Ubuntu command shell running alongside the Tesla OS. Since Tesla supports a browser that allows you to visit any site, could this be leveraged into remote hacks? It could also mean that if Tesla sells a long-range version of the Model 3, but limits it via software, people might try to remove the block. One could potentially get a 15-day trial of full self-driving for free and extend that 15-day window forever. At least he had some guts messing with $50,000 hardware that phones home all the time. Will Tesla brick his car to attempt to disprove the security issue?' -- source: https://news.slashdot.org/story/18/12/15/0355250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Evelyn Berezin Has Died
by Lawrence D'Oliveiro 15 Dec '18

15 Dec '18

Among her many achievements: While IBM had been producing word processors of a sort for a few years when Berezin developed hers in 1968, she was the first to use semiconductor chips to make a true computing system for this purpose. IBM's solution used a typewriter and a magnetic tape drive and was much less efficient to use. <https://arstechnica.com/gadgets/2018/12/evelyn-berezin-creator-of-the-first…>

1 0

Automatically Generating Fake Photos
by Lawrence D'Oliveiro 15 Dec '18

15 Dec '18

Look at the photo grid about halfway down this article <https://www.theregister.co.uk/2018/12/14/ai_created_photos/>: as I understand it, the main facial features are taken from the photos down the leftmost column; these are then resynthesized into a new orientation, expression and other embellishments (including hair colour/style, gender and apparent age!) to match the photos across the topmost row. Or something like that. Apparently, Nvidia is planning to publish its source code. Kids, you may not be able to afford the hardware to try this at home ...

1 0

Windows Server 2019 Officially Supports OpenSSH For the First Time
by Peter Reutemann 13 Dec '18

13 Dec '18

'Microsoft said in 2015 that it would build OpenSSH, a set of utilities that allow clients and servers to connect securely, into Windows, while also making contributions to its development. Neowin: Since then, the company has delivered on that promise in recent releases of Windows 10, being introduced as a feature-on-demand in version 1803. However, Windows Server hadn't received the feature until now, at least not in an officially supported way -- Windows Server version 1709 included it as a pre-release feature. But that's finally changed, as Microsoft this week revealed that Windows Server 2019, which was made available (again) in November, includes OpenSSH as a supported feature.' -- source: https://slashdot.org/story/18/12/13/1947257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

In a Test, 3D Model of a Head Was Able To Fool Facial Recognition System of Several Popular Android Smartphones
by Peter Reutemann 13 Dec '18

13 Dec '18

'Forbes magazine tested four of the most popular handsets running Google's operating systems and Apple's iPhone to see how easy it'd be to break into them with a 3D-printed head. All of the Android handsets opened with the fake. Apple's phone, however, was impenetrable. From the report: For our tests, we used my own real-life head to register for facial recognition across five phones. An iPhone X and four Android devices: an LG G7 Linq, a Samsung S9, a Samsung Note 8 and a OnePlus 6. I then held up my fake head to the devices to see if the device would unlock. For all four Android phones, the spoof face was able to open the phone, though with differing degrees of ease. The iPhone X was the only one to never be fooled. There were some disparities between the Android devices' security against the hack. For instance, when first turning on a brand new G7 Linq, LG actually warns the user against turning facial recognition on at all. No surprise then that, on initial testing, the 3D-printed head opened it straightaway. [...] The OnePlus 6 came with neither the warnings of the other Android phones nor the choice of slower but more secure recognition.' -- source: https://apple.slashdot.org/story/18/12/13/1438218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Kernel Developers Discuss Dropping x32 Support
by Peter Reutemann 12 Dec '18

12 Dec '18

'It was just several years ago that the open-source ecosystem began supporting the x32 ABI, but already kernel developers are talking of potentially deprecating the support and for it to be ultimately removed.. [...] While the x32 support was plumbed through the Linux landscape, it really hasn't been used much. Kernel developers are now discussing the future of the x32 ABI due to the maintenance cost involved in still supporting this code but with minimal users. Linus Torvalds is in favor of sunsetting x32 and many other upstream contributors in favor of seeing it deprecated and removed.' -- source: https://linux.slashdot.org/story/18/12/12/1336210 More information on x32 ABI: https://en.wikipedia.org/wiki/X32_ABI Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

Getting Shown Pregnancy Ads After Child Was Stillborn
by Lawrence D'Oliveiro 12 Dec '18

12 Dec '18

An op-ed on the pitfalls of algorithmically-targeted advertising, originally from the Washington Post <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=121760…>: Please, Tech Companies, I implore you: If your algorithms are smart enough to realize that I was pregnant, or that I've given birth, then surely they can be smart enough to realize that my baby died, and advertise to me accordingly - or maybe, just maybe, not at all. Unfortunately, the old adage “if you’re not paying for the product, then you are the product” applies yet again. Notwithstanding a personal reply from a high-up Facebook exec at the end of the above article, don’t expect these algorithms to be “smart enough” to do anything more than maximize advertising revenue. Anything more ends up counting as “unnecessary expenditure”.

2 1

FreeBSD 12 Released
by Peter Reutemann 12 Dec '18

12 Dec '18

'The 12th version of the FreeBSD has been released, bringing support for updated hardware. Some of the highlights include: OpenSSL has been updated to version 1.1.1a (LTS). Unbound has been updated to version 1.8.1, and DANE-TA has been enabled by default. OpenSSH has been updated to version 7.8p1. Additonal capsicum(4) support has been added to sshd(8). Clang, LLVM, LLD, LLDB, compiler-rt and libc++ has been updated to version 6.0.1. The vt(4) Terminus BSD Console font has been updated to version 4.46. The bsdinstall(8) utility now supports UEFI+GELI as an installation option. The VIMAGE kernel configuration option has been enabled by default. The NUMA option has been enabled by default in the amd64 GENERIC and MINIMAL kernel configurations. The netdump(4) driver has been added, providing a facility through which kernel crash dumps can be transmitted to a remote host after a system panic. The vt(4) driver has been updated with performance improvements, drawing text at rates ranging from 2- to 6-times faster. Various improvements to graphics support for current generation hardware. Support for capsicum(4) has been enabled on armv6 and armv7 by default. The UFS/FFS filesystem has been updated to consolidate TRIM/BIO_DELETE commands, reducing read/write requests due to fewer TRIM messages being sent simultaneously. The NFS version 4.1 server has been updated to include pNFS server support. The pf(4) packet filter is now usable within a jail(8) using vnet(9). The bhyve(8) utility has been updated to add NVMe device emulation. The bhyve(8) utility is now able to be run within a jail(8). Various Lua loader(8) improvements. KDE has been updated to version 5.12.' -- source: https://bsd.slashdot.org/story/18/12/12/1510202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Could NZ Get Its Own “Assistance and Access” Law?
by Lawrence D'Oliveiro 11 Dec '18

11 Dec '18

The ever-perceptive Juha Saarinen gives his commentary <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=121750…> on the law recently passed in Australia to compel access to decrypted forms of encrypted communications. Thanks to the new law requiring them to quietly add that backdoor that mustn't be called a backdoor into their code, Aussie developers can no longer be trusted by their international peers. You can't say no when government agencies issue a notice, saying absolutely do not tell your employer about it or you'll cop a hefty punishment. But the law is not supposed to achieve this by introducing “systemic weaknesses” into the encryption. Can you use that as a defence against having to weaken the encryption? Not a chance. The not-so-fine irony is that the Aussie Government is doing the same thing it alleges the Chinese spies would force Huawei to do, and which was considered dangerous enough to ban the telco equipment vendor from national communications networks. This gets pointed out repeatedly about similar discussions in the US, UK etc. But there seems to be a mentality among politicians, law enforcement, spies etc that “we’re the good guys, they’re the bad guys, therefore what we do cannot be classed in the same league as what they do”. Forgetting that what makes us good is that we don’t act like bad guys. And the kicker: The risk now is that other Five-Eyes countries, including New Zealand, follow Australia into making the same monumental mistake. What are the odds?

1 0

New Firefox Suggests Ways To Get More Out of the Web
by Peter Reutemann 11 Dec '18

11 Dec '18

'Starting Tuesday, Firefox will nudge you to try out options designed to make the web more interesting, more useful or more productive. From a report: Mozilla's new Firefox 64 keeps an eye on what you're up to and prompts you to try extensions and features that could help you with that activity, the browser maker said. For example, if you open the same tab lots of times, it could suggest you pin it to your tab strip for easier future access. Other suggestions include installing the Facebook Container extension to curtail the social network's snooping, a Google Translate extension to tap into Google's service, and the Enhancer for YouTube extension to do things like block ads and control playback on Google's video site. The feature could help you customize Firefox more to your liking -- something that could help you stick with the browser in the face of Google Chrome's dominance. And that, in turn, could help Mozilla pursue its push toward a privacy-respecting web that's not just effectively controlled by Chrome.' -- source: https://news.slashdot.org/story/18/12/11/1756217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Super Micro Says Review Found No Malicious Chips in Motherboards
by Peter Reutemann 11 Dec '18

11 Dec '18

'Computer hardware maker Super Micro Computer told customers on Tuesday that an outside investigations firm had found no evidence of any malicious hardware in its current or older-model motherboards. >From a report: In a letter to customers, the San Jose, California, company said it was not surprised by the result of the review it commissioned in October after a Bloomberg article reported that spies for the Chinese government had tainted Super Micro equipment to eavesdrop on its clients.' -- source: https://hardware.slashdot.org/story/18/12/11/1410200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android Trojan Steals Money From PayPal Accounts Even With 2FA On
by Peter Reutemann 11 Dec '18

11 Dec '18

'ESET researchers have discovered a new Android Trojan using a novel Accessibility-abusing technique that targets the official PayPal app, and is capable of bypassing PayPal's two-factor authentication. A report elaborates: At the time of writing, the malware is masquerading as a battery optimization tool, and is distributed via third-party app stores. After being launched, the malicious app terminates without offering any functionality and hides its icon. This video, courtesy of ESET, demonstrates the process in practice.' -- source: https://it.slashdot.org/story/18/12/11/1722251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Fixes Notepad
by Lawrence D'Oliveiro 11 Dec '18

11 Dec '18

Windows Notepad has never been able to handle any newline convention other than the old DOS/Windows/CP/M one (CR-LF). Now, after so many decades, Microsoft has finally decided to give it “universal newline” capability, so it can handle lines ending in LF-only (Unix/Linux) and CR-only (old MacOS) <http://www.theregister.co.uk/2018/05/08/windows_notepad_unix_macos_line_end…>. Gee, I wonder how many lines of code that took...

2 2

No, I Didn’t Know That
by Lawrence D'Oliveiro 11 Dec '18

11 Dec '18

Would you believe, malware can make money by generating fake clicks on ads? Would you further believe, that ad networks pay more for clicks from Apple devices than from Android? Can you guess what happens next? <https://www.theregister.co.uk/2018/12/10/android_ios_clickfraud/>

1 0

Presentations using the Waikato Uni video projector - Console windows font size.
by Ian Stewart 11 Dec '18

11 Dec '18

Hi, This is mostly a memo to myself as I have twice been caught out with Linux consoles being displayed with too small a font on the Uni video projector. However the following may also be useful to other presenters in the future. Most wlug presentations are done with a Linux laptop or PC running in a GUI Environment that is connected to the video projector. If you open a GUI console terminal window or web-browser window and the video projector display is difficult to read, then you can increase the size with the keystroke sequence Control + Shift + Plus, or decrease the size with Control + Minus. Linux also has 6 x console windows available. The keystroke sequence Ctrl + Alt + F1 opens tty1 console, through to Ctrl + Alt + F6 opening tty6 console. Note that Ctrl + Alt + F7 returns you to the laptops GUI environment. As your laptop/pc is likely to auto-size to the resolution of the video projector, then I think your laptop will opt to displaying the 1080p resolution of 1920 x 1080 pixels. By default your Linux consoles are likely to be configured to display a "Fixed" font of "8x16". When you display your console window with the video projector then one page of the display will be about 60 lines of text with 200 characters across the page. This is almost impossible to read on the projector screen. One way to overcome this problem this is to edit... /etc/default/console-setup You will see... FONTFACE="Fixed" FONTSIZE="8x16" At the bottom of the file add something like... # For Waikato University Video Projector # Choices of Fontsize with Terminus font: # 6x12, 8x14, 8x16, 10x20, 11x22, 12x24, 14x28, 16x32 FONTFACE="Terminus" FONTSIZE="14x28" ...save the changes to the console-setup file and execute... $ setupcon The console displayed should now be about 35 rows by 80 character cells, and should allow everyone to read what is displayed. cheers, Ian. PS: Another approach to making these changes is... $ dpkg-reconfigure console-setup ...this will step through 4 x graphical input screens. From these screens select "Terminus" as the Font and the "14x28" as the Font size. To restore to the original settings run dpkg-reconfigure console-setup again and select "Fixed" and "8x16".

1 0

Malicious Sites Abuse 11-Year-Old Firefox Bug That Mozilla Failed To Fix
by Peter Reutemann 11 Dec '18

11 Dec '18

'Malware authors, ad farmers, and scammers are abusing a Firefox bug to trap users on malicious sites. From a report: This wouldn't be a big deal, as the web is fraught with this kind of malicious sites, but these websites aren't abusing some new never-before-seen trick, but a Firefox bug that Mozilla engineers appear to have failed to fix in the 11 years ever since it was first reported back in April 2007. The bug narrows down to a malicious website embedding an iframe inside their source code. The iframe makes an HTTP authentication request on another domain. [...] For the past few years, malware authors, ad farmers, and scammers have been abusing this bug to lure users on sites where they show all sorts of nasties, such as tech support scams, ad farms that reload the page with new ads in a loop, pages that push users to buy fake gift cards, or sites that offer malware-laced software updates. Whenever users try to leave, the owners of these shady sites trigger the authentification modal in a loop.' -- source: https://news.slashdot.org/story/18/12/10/0220258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ESET Discovers 21 New Linux Malware Families
by Peter Reutemann 11 Dec '18

11 Dec '18

'In a report published last week by cyber-security firm ESET, the company detailed 21 "new" Linux malware families. All operate in the same manner, as trojanized versions of the OpenSSH client. From a report: They are developed as second-stage tools to be deployed in more complex "botnet" schemes. Attackers would compromise a Linux system, usually a server, and then replace the legitimate OpenSSH installation with one of the trojanized versions.' -- source: https://linux.slashdot.org/story/18/12/10/1538203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Faxes To Be Banned At The NHS
by Lawrence D'Oliveiro 10 Dec '18

10 Dec '18

The UK’s National Health Service is being forced to phase out its heavy reliance on fax machines <https://www.theregister.co.uk/2018/12/10/hancock_fax_ban_nhs/> and resort to more, um, “digital” alternatives like e-mail instead: However, it's worth noting that just last week, up to 1.2 million staffers were locked out of their NHSmail accounts after Accenture reportedly botched a data centre upgrade. [Helen Stokes-Lampard, chair of the Royal College of General Practitioners] raised similar concerns about the resilience of the IT systems the NHS is racing to introduce. "What's shocking is how often digital innovations fall over," she said. "It doesn't mean we shouldn’t do it, but what it does mean is we have to be realistic about with the time scales for this."

1 0

National Oracle System Is A Write-Off
by Lawrence D'Oliveiro 10 Dec '18

10 Dec '18

Looks like the nationwide attempt to streamline and update the IT systems of all the DHBs is now going to be written off <https://www.theregister.co.uk/2018/12/10/national_oracle_solution_write_dow…>. It hasn’t officially been abandoned, mind you, but because it’s been “on hold” for so long, the DHBs are now obliged to start recording “impairments” in their accounts over their investment in the system. By the way, the Waikato DHB was one of the four that managed a rollout of the system so far. Not sure whether that stays in place or gets rolled back...

1 0

How to Auto Backup Files to USB Media When Connected
by Peter Reutemann 10 Dec '18

10 Dec '18

'A backup is the last defense against data loss, offering a means to restore original data. You can use either a removable media such as an external hard drive or USB flash disk or a shared network folder, or a remote host to back up your data. It’s very easy (and equally essential) to automatically backup your important files without you having to remember to do so. In this article, we will learn how to auto backup data to a removable media after connecting it to your Linux machine. We will test with an external disk. This is a basic guide to get you started with using udev for real-life solutions.' -- source: https://www.tecmint.com/auto-backup-files-to-usb-media-in-linux/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

Linux.org's DNS Got Hijacked
by Peter Reutemann 09 Dec '18

09 Dec '18

'Linux.org reports: Wednesday afternoon around 5pm EST someone was able to get into the registrar account for our domain and point DNS to another server -- as well as lock us out from changing it. They pointed the domain name to a pretty rude page for most of the evening until Cloudflare stepped in and blocked the domain for us. After a lot of back and forth with our registrar, we were able to get things back under our control. I'd like to point out that our server environment was not touched so there are no worries about your data. We've gone over security protocols and are tightening things up that may have slipped through in the past. Thanks for your support! Linux.org apparently pointed to a page exclaiming "G3T 0WNED L1NUX N3RDZ", which also included a NSFW picture, some abusive language, a shout-out to recently-deceased programmer Terry Davis, and a link to an article about Linus Torvalds' controversial apology for "his hostile behavior towards others in the community." Long-time Slashdot reader Grady Martin says he also saw the page pointing to "presumably doxed info" about the creator of Linux's code of conduct, a fact confirmed by a report in the Register. "As for how it was hacked, [Linux.org owner Mike] McLagan blames the public Whois displaying his partner's email address -- presumably the hacker worked their way into the Yahoo email account listed as the admin of the site and from there requested a password change in her Network Solutions account to gain access to the domain."' -- source: https://it.slashdot.org/story/18/12/08/0355227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

50 Years Since “The Mother Of All Demos”
by Lawrence D'Oliveiro 08 Dec '18

08 Dec '18

On the 9th of December 1968, Doug Engelbart did a demo of NLS, his system for real-time interactive collaboration at a distance. This was also the first known use of a computer mouse. <https://www.techdirt.com/articles/20181207/15484041180/been-50-years-take-s…>

1 0

Running Linux Mint 19.1
by tom butz 07 Dec '18

07 Dec '18

Linux Mint 19.1 works well using my laptop (Toshiba Z930 6 GB RAM) and a USB3 connection to a 500G USB3-harddisk. I first tried a fast 10-speed 64GB SD-card, but that actually seemed to be slower - and the SD-card would have worn out in the end. For some reason Mint has got a swapFILE in the root directory - pretty hard on the SD-card. I haven't got USB3.1 (yet). 19.1 supports Bluetooth in both directions: under Mint 19, I couldn't send from Mint to my Android phone (Android 7.1) 19.1 also features snapshots. I didn't have to test them as I prefer to run Mint off my laptop (no power-cuts there). Occasionally I run it off my MacMini (8 GB of RAM, OS 10.7.5). The MacOS is too old for many things, and to avoid having to buy new Mac gear, I 'upgraded' by running Mint on it. Tom Butz.

3 2

Report: Microsoft is scrapping Edge, switching to just another Chrome clone
by Peter Reutemann 06 Dec '18

06 Dec '18

'Windows Central reports that Microsoft is planning to replace its Edge browser, which uses Microsoft's own EdgeHTML rendering engine and Chakra JavaScript engine, with a new browser built on Chromium, the open source counterpart to Google's Chrome. The new browser has the codename Anaheim. The report is short on details. The easiest thing for Microsoft to do would be to use Chromium's code wholesale—the Blink rendering engine, the V8 JavaScript engine, and the Chrome user interface with the Google Account parts omitted—to produce something that looks, works, and feels almost identical to Chrome. Alternatively, Redmond could use Blink and V8 but wrap them in Edge's user interface (or some derivative thereof), to retain its own appearance. It might even be possible to do something weird, such as use Blink with the Chakra JavaScript engine. We'll have to wait and see.' -- source: https://arstechnica.com/gadgets/2018/12/report-microsoft-is-scrapping-edge-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

White House Cybersecurity Advisor Gets Hacked
by Lawrence D'Oliveiro 05 Dec '18

05 Dec '18

Rudy Giuliani, the White House cybersecurity advisor, has posted a tweet <https://www.nzherald.co.nz/world/news/article.cfm?c_id=2&objectid=12172128> <https://www.techdirt.com/articles/20181205/07205841164/rudy-giulianis-paran…> where he meant to say “... just as the President left for G-20. In July...” Unfortunately he left out the space in “G-20. In”, turning it into “G-20.In”, which Twitter automatically formatted as a link. Someone noticed that the domain name in question was available, and promptly snapped it up and used it to post an anti-Trump message. This has made Mr Giuliani somewhat angry. He has tried to blame Twitter for the slipup, claiming the social media service “allowed someone to invade my text with a disgusting anti-President message”, as though he was not the one who created the link in the first place. Remember, this man has the job of advising the entire executive arm of the US government on keeping people’s computer usage secure. I wonder if he’s figured out how to delete a tweet yet?

1 0

Google Personalizes Search Results Even When You're Logged Out, a DuckDuckGo Study Finds
by Peter Reutemann 05 Dec '18

05 Dec '18

'According to a new study conducted by Google competitor DuckDuckGo, it does not seem possible to avoid personalization when using Google search, even by logging out of your Google account and using the private browsing "incognito" mode. From a report: DuckDuckGo conducted the study in June of this year, at the height of the US midterm election season. It did so with the ostensible goal of confirming whether Google's search results exacerbate ideological bubbles by feeding you only information you've signaled you want to consume via past behavior and the data collected about you. It's not clear whether that question can be reliably answered with these findings, and it's also obvious DuckDuckGo is a biased source with something to gain by pointing out how flawed Google's approach may be. But the study's findings are nonetheless interesting because they highlight just how much variance there are in Google search results, even when controlling for factors like location.' -- source: https://search.slashdot.org/story/18/12/04/1610237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Kubernetes' First Major Security Hole Discovered
by Peter Reutemann 05 Dec '18

05 Dec '18

'Kubernetes has become the most popular cloud container orchestration system by far, so it was only a matter of time until its first major security hole was discovered. And the bug, CVE-2018-1002105, aka the Kubernetes privilege escalation flaw, is a doozy. It's a CVSS 9.8 critical security hole. From a report: With a specially crafted network request, any user can establish a connection through the Kubernetes application programming interface (API) server to a backend server. Once established, an attacker can send arbitrary requests over the network connection directly to that backend. Adding insult to injury, these requests are authenticated with the Kubernetes API server's Transport Layer Security (TLS) credentials. Can you say root? I knew you could. Worse still, "In default configurations, all users (authenticated and unauthenticated) are allowed to perform discovery API calls that allow this escalation." So, yes, anyone who knows about this hole can take command of your Kubernetes cluster.' -- source: https://it.slashdot.org/story/18/12/04/1958222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers breach Quora.com and steal password data for 100 million users
by Peter Reutemann 04 Dec '18

04 Dec '18

'Brace yourself for yet another massive data breach. Quora.com, a site where people ask and answer questions on a range of topics, said hackers breached its computer network and accessed a variety of potentially sensitive personal data for about 100 million users. Compromised information includes cryptographically protected passwords, full names, email addresses, data imported from linked networks, and a variety of non-public content and actions, including direct messages, answer requests, and downvotes. The breached data also included public content and actions, such as questions, answers, comments, and upvotes. In a post published late Monday afternoon, Quora officials said they discovered the unauthorized access on Friday. They have since hired a digital forensics and security firm to investigate and have also reported the breach to law enforcement officials.' -- source: https://arstechnica.com/information-technology/2018/12/quora-says-hackers-s… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Blockchain Study Finds 0% Success Rate and Vendors Don't Call Back When Asked For Evidence
by Peter Reutemann 04 Dec '18

04 Dec '18

'Though Blockchain has been touted as the answer to everything, a study of 43 solutions advanced in the international development sector has found exactly no evidence of success. From a report: Three practitioners including erstwhile blockchain enthusiast John Burg, a Fellow at the US Agency for International Development (USAID), looked at instances of the distributed crypto ledger being used in a wide range of situations by NGOs, contractors and agencies. But they drew a complete blank. "We found a proliferation of press releases, white papers, and persuasively written articles," Burg et al wrote. "However, we found no documentation or evidence of the results blockchain was purported to have achieved in these claims. We also did not find lessons learned or practical insights, as are available for other technologies in development." Blockchain vendors were keen to puff the merits of the technology, but when the three asked for proof of success in the field, it all went very quiet. "We fared no better when we reached out directly to several blockchain firms, via email, phone, and in person. Not one was willing to share data on program results, MERL [monitoring, evaluation, research and learning] processes, or adaptive management for potential scale-up. Despite all the hype about how blockchain will bring unheralded transparency to processes and operations in low-trust environments, the industry is itself opaque." Burg was an enthusiastic advocate for blockchain until recently -- as he explained in this Medium post.' -- source: https://news.slashdot.org/story/18/12/03/2058244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Twitter User Hacks 50, 000 Printers To Tell People To Subscribe To a YouTube Channel
by Peter Reutemann 03 Dec '18

03 Dec '18

'A Twitter user using the pseudonym of @TheHackerGiraffe has hacked over 50,000 printers to print out flyers telling people to subscribe to PewDiePie's YouTube channel. The message the printers received was a simple one. It urged people to subscribe to PewDiePie's YouTube channel in order for PewDiePie -- a famous YouTuber from Sweden, real name Felix Kjellberg -- to keep the crown of most subscribed to YouTube channel. If this sounds ...odd... it's because over the past month, an Indian record label called T-Series has caught up and surpassed PewDiePie, once considered untouchable in terms of YouTube followers. The Swedish Youtube star made a comeback after his fans banded together in various social media campaigns, but T-Series is catching up with PewDiePie again.' -- source: https://hardware.slashdot.org/story/18/12/02/2241230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Is Linux Taking Over The World?
by Peter Reutemann 02 Dec '18

02 Dec '18

'"2019 just might be the Year of Linux -- the year in which Linux is fully recognized as the powerhouse it has become," writes Network World's "Unix dweeb." The fact is that most people today are using Linux without ever knowing it -- whether on their phones, online when using Google, Facebook, Twitter, GPS devices, and maybe even in their cars, or when using cloud storage for personal or business use. While the presence of Linux on all of these systems may go largely unnoticed by consumers, the role that Linux plays in this market is a sign of how critical it has become. Most IoT and embedded devices -- those small, limited functionality devices that require good security and a small footprint and fill so many niches in our technology-driven lives -- run some variety of Linux, and this isn't likely to change. Instead, we'll just be seeing more devices and a continued reliance on open source to drive them. According to the Cloud Industry Forum, for the first time, businesses are spending more on cloud than on internal infrastructure. The cloud is taking over the role that data centers used to play, and it's largely Linux that's making the transition so advantageous. Even on Microsoft's Azure, the most popular operating system is Linux. In its first Voice of the Enterprise survey, 451 Research predicted that 60 percent of nearly 1,000 IT leaders surveyed plan to run the majority of their IT off premises by 2019. That equates to a lot of IT efforts relying on Linux. Gartner states that 80 percent of internally developed software is now either cloud-enabled or cloud-native. The article also cites Linux's use in AI, data lakes, and in the Sierra supercomputer that monitors America's nuclear stockpile, concluding that "In its domination of IoT, cloud technology, supercomputing and AI, Linux is heading into 2019 with a lot of momentum." And there's even a long list of upcoming Linux conferences...' -- source: https://linux.slashdot.org/story/18/12/01/2018223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Node.js Event-Stream Hack Reveals Open Source 'Developer Infrastructure' Exploit
by Peter Reutemann 02 Dec '18

02 Dec '18

'"[O]n Nov. 26 it was publicly revealed that a widely deployed open-source Node.js programming language module known as event-stream had been injected with malicious code that looked to steal cryptocurrency wallets," reports eWeek, adding "The event-stream library has over two million downloads." An anonymous reader quotes Ars Technica: The backdoor came to light [November 20th] with this report from Github user Ayrton Sparling. Officials with the NPM, the open source project manager that hosted event-stream, didn't issue an advisory until six days later.... "This compromise was not targeting module developers in general or really even developers," an NPM official told Ars in an email. "It targeted a select few developers at a company, Copay, that had a very specific development environment set up. Even then, the payload itself didn't run on those developers' computers; rather, it would be packaged into a consumer-facing app when the developers built a release. The goal was to steal Bitcoin from this application's end users...." According to the Github discussion that exposed the backdoor, the longtime event-stream developer no longer had time to provide updates. So several months ago, he accepted the help of an unknown developer. The new developer took care to keep the backdoor from being discovered. Besides being gradually implemented in stages, it also narrowly targeted only the Copay wallet app. The malicious code was also hard to spot because the flatmap-stream module was encrypted. The attack is the latest to exploit weaknesses in a widely used supply chain to target downstream end users... The supply-chain attacks show one of the weaknesses of open source code. Because of its openness and the lack of funds of many of its hobbyist developers and users, open source code can be subject to malicious modifications that often escape notice. "The time has come," concludes Ars Technica, "for maintainers and users of open source software to devise new measures to better police the millions of packages being used all around us." Sophos' security blog also asks why so many developers "immediately and blindly trusted the new maintainer," and shared a concerned comment from developer named Chris Northwood.' -- source: https://it.slashdot.org/story/18/12/01/2217231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Australia Has Rushed Through Its Copyright Amendment Bill
by Lawrence D'Oliveiro 30 Nov '18

30 Nov '18

Seems like the Aussie government has disregarded <https://www.theregister.co.uk/2018/11/28/australia_to_build_a_pirateproof_f…> <https://www.techdirt.com/articles/20181127/13425541113/australian-parliamen…> most of the objections to its plan to impose more draconian copyright restrictions on Internet usage. Rightsholders will be able to get injunctions against sites whose “primary effect” (no longer just “primary purpose”) is to facilitate copyright infringement, and they will also have “adaptive injunctions”, meaning they can reinterpret an existing court order as circumstances change, instead of having to go back to court to get a new order. You’d think a statement like “The Government has zero tolerance for online piracy. It is theft...” should be an instant disqualification from making any kind of statement about copyright law...

1 0

Mass Router Hack Exposes Millions of Devices To Potent NSA Exploit
by Peter Reutemann 29 Nov '18

29 Nov '18

'More than 45,000 Internet routers have been compromised by a newly discovered campaign that's designed to open networks to attacks by EternalBlue, the potent exploit that was developed by, and then stolen from, the National Security Agency and leaked to the Internet at large, researchers say. From a report: The new attack exploits routers with vulnerable implementations of Universal Plug and Play to force connected devices to open ports 139 and 445, content delivery network Akamai said in a blog post. As a result, almost 2 million computers, phones, and other network devices connected to the routers are reachable to the Internet on those ports. While Internet scans don't reveal precisely what happens to the connected devices once they're exposed, Akamai said the ports --which are instrumental for the spread of EternalBlue and its Linux cousin EternalRed -- provide a strong hint of the attackers' intentions. The attacks are a new instance of a mass exploit the same researchers documented in April. They called it UPnProxy because it exploits Universal Plug and Play -- often abbreviated as UPnP -- to turn vulnerable routers into proxies that disguise the origins of spam, DDoSes, and botnets.' -- source: https://tech.slashdot.org/story/18/11/29/1849254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Proprietary Software Subverts Security Of Your PC
by Lawrence D'Oliveiro 28 Nov '18

28 Nov '18

Audio company Sennheiser has just issued a fix <https://arstechnica.com/information-technology/2018/11/sennheiser-discloses…> for a really nasty vulnerability where their software for Windows and Mac would install a special fake browser certificate that the machine would continue to trust thereafter, even after the software was removed. Unfortunately, because the installation also included the private key for that certificate (which is never supposed to be distributed), it could then be exploited by arbitrary third parties to trick such machines into trusting random sites.

1 0

Deleting Windows Server Child Folder Changes Parent Folder Permissions
by Lawrence D'Oliveiro 28 Nov '18

28 Nov '18

<https://www.theregister.co.uk/2018/11/28/microsoft_windows_10_server_2016_p…>: ... Microsoft's support team [said] initially that the behaviour was by design and introduced in Windows Server 2016. Interestingly, it only occurs when folders are deleted (or cut and pasted) using File Explorer. Using the command line makes things behave as one would expect. It also only occurred when using a local path. Deleting using a UNC path was fine.

1 0

Half of all Phishing Sites Now Have the Padlock
by Peter Reutemann 27 Nov '18

27 Nov '18

'You may have heard you should look for the padlock symbol at the top of a website before entering your password or credit card information into an online form. It's well-meaning advice, but new data shows it isn't enough to keep your sensitive information secure. From a report: Recent data from anti-phishing company PhishLabs shows that 49 percent of all phishing sites in the third quarter of 2018 bore the padlock security icon next to the phishing site domain name as displayed in a browser address bar. That's up from 25 percent just one year ago, and from 35 percent in the second quarter of 2018. This alarming shift is notable because a majority of Internet users have taken the age-old "look for the lock" advice to heart, and still associate the lock icon with legitimate sites. A PhishLabs survey conducted last year found more than 80% of respondents believed the green lock indicated a website was either legitimate and/or safe. In reality, the https:// part of the address (also called "Secure Sockets Layer" or SSL) merely signifies the data being transmitted back and forth between your browser and the site is encrypted and can't be read by third parties. The presence of the padlock does not mean the site is legitimate, nor is it any proof the site has been security-hardened against intrusion from hackers.' -- source: https://it.slashdot.org/story/18/11/27/1521240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AGM next week
by Peter Reutemann 26 Nov '18

26 Nov '18

Hi everyone Just a friendly reminder that our AGM is next Monday: https://www.meetup.com/WaikatoLinuxUsersGroup/events/246737212/ In order to be eligible to vote, "only those people who were paid members in the previous financial year and who have signed a membership form for the then-current financial year will be eligible to vote." (https://github.com/WLUG/charter/blob/master/rules_140120.pdf) See you next Monday! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Two Linux Kernels Revert Performance-Killing Spectre Patches
by Peter Reutemann 25 Nov '18

25 Nov '18

'Friday Greg Kroah-Hartman released stable point releases of Linux kernel 4.19.4, as well as 4.14.83 and 4.9.139. While they were basic maintenance updates, the 4.19.4 and 4.14.83 releases are significant because they also reverted the performance-killing Spectre patches (involving "Single Thread Indirect Branch Predictors", or STIBP) that had been back-ported from Linux 4.20, according to Phoronix: There is improved STIBP code on the way for Linux 4.20 that by default just applies STIBP to SECCOMP threads and processes requesting it via prctl() but otherwise is off by default (that behavior can also be changed via kernel parameters). Once that code is ready to go for Linux 4.20, we may see it then back-ported to these stable trees. Aside from reverting STIBP, these point releases just have various fixes in them as noted for 4.19.4, 4.14.83, and 4.9.139. Last Sunday Linus Torvalds complained that the performance impact of the STIPB code "was clearly way more expensive than people were told," according to ZDNet: "When performance goes down by 50 percent on some loads, people need to start asking themselves whether it was worth it. It's apparently better to just disable SMT entirely, which is what security-conscious people do anyway," wrote Torvalds. "So why do that STIBP slow-down by default when the people who *really* care already disabled SMT?"' -- source: https://linux.slashdot.org/story/18/11/24/2320228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Alphabet's Cybersecurity Group Touts Its New Open Source Private VPN
by Peter Reutemann 25 Nov '18

25 Nov '18

'Alphabet's cybersecurity division Jigsaw has designed a new open source private VPN aimed at journalists and the people sending them data. "Their work makes them more vulnerable to attack," said Santiago Andrigo, Jigsaw's product manager. "It can get really scary when they're outed and you're passing over information." Unscrupulous VPN providers can steal your identity, peek in on your data, inject their own ads on non-secure pages, or analyze your browsing habits and sell that information to advertisers, says one Jigsaw official. And you can't know for sure whether you can trust them, no matter what they say in the app store. "Journalists should be aware that their online activities might be subject to surveillance either by government agencies, their internet service providers or a hacker with malicious intent," said Laura Tich, technical evangelist for Code for Africa, a resource for African journalists. "As surveillance becomes ubiquitous in today's world, journalists face an increasing challenge in establishing secure communication in the digital space." The new private VPN, dubbed "Outline", is specifically designed to be resistant to censorship — because it's harder to detect as a VPN (and therefore is less likely to be blocked). Outline uses an encrypted socks5 proxy that looks like normal internet traffic. Once the user chooses a server location, Outline spins up a DigitalOcean server on Ubuntu, installs Docker, and imports an image of the actual server. It's been named Outline because in places where internet use may be restricted — it gives you a line out.' -- source: https://yro.slashdot.org/story/18/11/25/0117226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Gmail Bug Allows Sending Messages Anonymously
by Peter Reutemann 25 Nov '18

25 Nov '18

'Earlier this week software developer Tim Cotten discovered a serious glitch in Gmail. An anonymous reader quotes BleepingComputer: Tampering with the 'From:' header by replacing some text with an <object>, <script> or <img> tag causes the interface to show a blank space instead of the sender's address.... Opening the email does not help, either, as the sender's address continues to remain hidden and shows no info even when hovering on it, an action that typically reveals the details.... Trying to reply to the message is also of no help. Cotten attempted this thinking that Gmail would read the original email headers and determine the destination. "Wrong again! Gmail is at a complete loss at what to do!" Cotten writes in a blog post that details his new finding.... Using the Show Original option, which allows users with more experience to trace an email, the desired detail is still unavailable in the user-friendly view. Looking at the raw info, however, shows the source address buried at the end of the <img> tag Cotten used in his experiment. He didn't even have to spell correctly the data type to trigger the bug. Unfortunately, it is highly unlikely that the average Gmail user will be able to navigate to this area and determine who the apparently anonymous message is coming from. Due to this, for these users the risk of phishing is high. Cotten's bug report "relies on his previous discovery that proved how a malformed 'From:' header allows placing an arbitrary email address in the sender field," the article points out, also noting a third recently-reported Gmail bug that "allows fraudsters to create a 'mailto:' link that populates the destination field in the app with whatever address they want; the latter was reported about 19 months ago to Google and is still present in the Gmail app for Android." "According to the developer, one solution Google could implement to avoid forging the From field is to properly check the email headers and deny communication with an anomalous structure in the sender or recipient fields. Another method proposed by Cotten is Joran Greef's project Ronomon, which can trigger errors when email specifications are not followed." Threatpost reported Tuesday that Google "did not respond to a request for comment."' -- source: https://it.slashdot.org/story/18/11/25/1731238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Potentially disastrous Rowhammer bitflips can bypass ECC protections
by Peter Reutemann 22 Nov '18

22 Nov '18

'In early 2015, researchers unveiled Rowhammer, a cutting-edge hack that exploits unfixable physical weaknesses in the silicon of certain types of memory chips to transform data they stored. In the 42 months that have passed since then, an enhancement known as error-correcting code (or ECC) available in higher-end chips was believed to be an absolute defense against potentially disastrous bitflips that changed 0s to 1s and vice versa. Research published Wednesday has now shattered that assumption.' -- source: https://arstechnica.com/information-technology/2018/11/potentially-disastro… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Have We Reached Peak Silicon Valley?
by Lawrence D'Oliveiro 21 Nov '18

21 Nov '18

From <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=121638…>: ... global smartphone sales saw their first year-on-year fall in history at the end of 2017. Apple seemed unaffected at the time, but its latest quarterly results now show falls in unit sales, as a result of which it will stop reporting them in future. >From beginnings that we might date to around the mid-1970s, PC sales (and development) went on an uninterrupted upward curve right through the 1990s, only starting to stutter around about the 2000s. The smartphone revolution, even if it includes the Symbian era and not just Android and Apple, has not lasted quite as long. So what new information-processing technology will ignite the mass market next? If any?

2 1

Germany Proposes Rules For Home Router Security
by Lawrence D'Oliveiro 21 Nov '18

21 Nov '18

The federal German body responsible for information security has published some recommendations for how consumers’ internet routers should behave by default, including limiting the initially-enabled services, requiring firewall functionality, and mandating the deletion of all personal data on a factory reset <https://www.theregister.co.uk/2018/11/20/germany_versus_openwrt_ccc/>. This looks like a welcome first step, even if some argue it doesn’t go far enough.

1 0

Microsoft Azure Outage Fixed, Office 365 Still Broken
by Lawrence D'Oliveiro 20 Nov '18

20 Nov '18

They fixed Azure by turning the multi-factor authentication servers off and on again <https://www.theregister.co.uk/2018/11/19/microsoft_azure_office_outage_late…>. Lawrence “You Couldn’t Make This Up” D’Oliveiro

2 1

Microsoft Disputing Its NZ Tax Payments
by Lawrence D'Oliveiro 19 Nov '18

19 Nov '18

The IRD is demanding that Microsoft NZ pay more tax <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=121627…>. This is over the whole notorious business of “transfer pricing”, where sales by multinational corporations are recorded in jurisdictions where they attract less tax, rather than where the customers are located. Looks like there have already been some changes to this, though obviously the dispute would be over whether those changes are enough: From February 2018, the local unit's accounts were extended to include the distribution of computer software and hardware, having previously covered marketing. The change effectively means local product sales are being captured. Concomitant with this: The changes to Microsoft's revenue recognition also seem to route GST through the local unit, with GST payments of $8.1 million in the year ended June 30, compared to just $13,441 a year earlier. Man, that’s quite a jump. All of Microsoft’s NZ customers incurring just $13,441 in GST over an entire year ...

1 0

A little collection of cool unix terminal/console/curses tools
by Peter Reutemann 19 Nov '18

19 Nov '18

'Kristof Kovacs: Just a list of 20 (now 28) tools for the command line. Some are little-known, some are just too useful to miss, some are pure obscure -- I hope you find something useful that you weren't aware of yet! Use your operating system's package manager to install most of them. (Thanks for the tips, everybody!) ' -- source: https://kkovacs.eu/cool-but-obscure-unix-tools Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mark Shuttleworth Reveals Ubuntu 18.04 Will Get a 10-Year Support Lifespan
by Peter Reutemann 18 Nov '18

18 Nov '18

'At the OpenStack Summit in Berlin last week, Ubuntu Linux founder Mark Shuttleworth said in a keynote that Ubuntu 18.04 Long Term Support (LTS) support lifespan would be extended from five years to 10 years. "I'm delighted to announce that Ubuntu 18.04 will be supported for a full 10 years," said Shuttleworth, "In part because of the very long time horizons in some of industries like financial services and telecommunications but also from IoT where manufacturing lines for example are being deployed that will be in production for at least a decade." ZDNet reports: Ubuntu 18.04 released in April 2018. While the Ubuntu desktop gets most of the ink, most of Canonical's dollars comes from server and cloud customers. It's for these corporate users Canonical first extended Ubuntu 12.04 security support, then Ubuntu 14.04's support, and now, preemptively, Ubuntu 18.04. In an interview after the keynote, Shuttleworth said Ubuntu 16.04, which is scheduled to reach its end of life in April 2021, will also be given a longer support life span. When it comes to OpenStack, Shuttleworth promised again to support versions of OpenStack dating back to 2014's IceHouse. Shuttleworth said, "What matters isn't day two, what matters is day 1,500." He also doubled-down on Canonical's promise to easily enable OpenStack customers to migrate from one version of OpenStack to another. Generally speaking, upgrading from one version of OpenStack is like a root canal: Long and painful but necessary. With Canonical OpenStack, you can step up all the way from the oldest supported version to the newest one with no more than a second of downtime. ' -- source: https://news.slashdot.org/story/18/11/17/1748205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Uber Joins Linux Foundation Cementing Commitment To Open Source Tools
by Peter Reutemann 15 Nov '18

15 Nov '18

'At the 2018 Uber Open Summit, Uber announced it was joining the Linux Foundation as a Gold Member, making a firm commitment to using and contributing to open source tools. TechCrunch reports: Uber CTO Thuan Pham sees the Linux Foundation as a place for companies like his to nurture and develop open source projects. "Open source technology is the backbone of many of Uber's core services and as we continue to mature, these solutions will become ever more important," he said in a blog post announcing the partnership. "Uber has made significant investments in shared software development and community collaboration through open source over the years, including contributing the popular open source project Jaeger, a distributed tracing system, to the Linux Foundation's Cloud Native Computing Foundation in 2017," an Uber spokesperson told TechCrunch. As the report mentions, it took the ride-hailing service a long time for them to join the Linux Foundation. "Uber has been long known for making use of open source in its core tools working on over 320 open source projects and repositories from 1500 contributors involving over 70,000 commits, according to data provided by the company," reports TechCrunch.' -- source: https://linux.slashdot.org/story/18/11/15/226212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla's 'Privacy Not Included' Gift Report Highlights Security Concerns
by Peter Reutemann 15 Nov '18

15 Nov '18

'Mozilla has released its second annual "Privacy Not Included" guide that rates 70 products to help give you an idea as to how secure or insecure they are. "We want to provide people information about how to make informed decisions when shopping for gifts that are connected to the internet," says Ashley Boyd, vice president of advocacy at Mozilla. "These products are becoming really popular. And in some cases, it's easy to forget that they're even connected to the internet." Wired reports: Among the important signifiers of a trustworthy stocking stuffer, according to Mozilla's rubric: the use of encryption, pushing automatic software security updates, strong password hygiene, a way to deal with vulnerabilities should they arise, and a privacy policy that doesn't take a PhD to parse. The most surprising result of Mozilla's testing may be how many products actually earned its seal of approval. Thirty-three of the 70 items in the "Privacy Not Included" guide passed muster; fans of the Nintendo Switch, Google Home, and Harry Potter Kano Coding Kit can sleep a little easier. On the other end of the scale, Mozilla highlighted seven products that may not hit the mark -- yes, including the sous vide wand, the Anova Precision Cooker. Also scoring low marks in Mozilla's accounting: the DJI Spark Selfie Drone (no encryption, does not require users to change the default password), the Parrot Bebop 2 drone (no encryption, complex privacy policy), and unsurprisingly, at least one baby monitor. The remaining 30 items on the list all exist somewhere in the murky middle, usually because Mozilla was unable to confirm at least one attribute. Which may be the real takeaway from the report: Typically, you have no reasonable way to find out if a given internet-connected device is secure. "If you can't tell, that says that there's a problem of communication between manufacturers and consumers," says Boyd. "We would love for makers of these products to be more clear and more transparent about what they're doing and not doing. That's a big place we think change is needed." ' -- source: https://tech.slashdot.org/story/18/11/15/0042210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A New Raspberry Pi 3 Model A+ Has Arrived With Bluetooth 4.2 and Dual-Band Wi-Fi For $25
by Peter Reutemann 15 Nov '18

15 Nov '18

'Raspberry Pi has introduced a new version of one of its most popular models just in time to stuff your stocking: the Model A+. And this time around, it's even more attractive. From a report: The Raspberry Pi 3 Model A+ costs $25, $5 more than the previous generation, but has a lot more going for it. Just like the top-of-the-line Model B+, the new Model A+ has a 1.4GHz 64-bit quad-core processor, and you'll also get dual-band Wi-Fi (2.4GHz + 5 GHz), a feature that was missing from the previous A+. And you'll have to use it, since the A+ doesn't have an Ethernet port. It does, however, have Bluetooth 4.2 on board. For $10 less than the $35 Model B+, you'll also only get a single USB port (versus four on the B+) as well as 512MB of RAM (versus 1GB on the B+). But otherwise, the devices are identical, with a full-size HDMI port, CSI camera port, DSI display port, stereo output and composite video port, and a micro SD port. The Raspberry Pi 3 Model A+ isn't the cheapest Pi model available -- the Zero costs $5 and the Zero W costs just $10 -- but it rounds out the options nicely. The new model is available now through Raspberry Pi retailers.' -- source: https://hardware.slashdot.org/story/18/11/15/1846205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AGM
by Peter Reutemann 15 Nov '18

15 Nov '18

Hi everyone For those who weren't at the meeting last night or aren't on meetup.com, the WLUG AGM is next month: https://www.meetup.com/WaikatoLinuxUsersGroup/events/246737212/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

ProtonVPN Passes 1 Million Users and Launches on iOS
by Peter Reutemann 14 Nov '18

14 Nov '18

'Encrypted email service provider ProtonMail has launched its standalone VPN app for iOS devices. From a report: The announcement comes more than a year after ProtonVPN launched globally for desktop users and 10 months after it landed on Android, so the iOS launch has been a long time coming. There is, of course, no shortage of VPN apps out there already, but ProtonMail has built a solid reputation in the encrypted communications realm since it was founded out of CERN in 2013. Following the launch of its privacy-focused email service nearly three years ago, the company subsequently added two-factor authentication (2FA), Tor support, an encrypted contacts manager, and of course a VPN service. ProtonMail offers various pricing tiers for ProtonVPN, ranging from free to $24 per month. Those who choose not to pay can access three countries' servers, with access on one device, but will have slower speeds, while the top $24/month tier offers access on 10 devices with server access in all available countries. In related news, ProtonMail said that ProtonVPN now has 1 million users globally.' -- source: https://yro.slashdot.org/story/18/11/14/1646222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Researchers Discover Seven New Meltdown and Spectre Attacks
by Peter Reutemann 14 Nov '18

14 Nov '18

'A team of nine academics has revealed today seven new CPU attacks. The seven impact AMD, ARM, and Intel CPUs to various degrees. From a report: Two of the seven new attacks are variations of the Meltdown attack, while the other five are variations on the original Spectre attack -- two well-known attacks that have been revealed at the start of the year and found to impact CPUs models going back to 1995. Researchers say they've discovered the seven new CPU attacks while performing "a sound and extensible systematization of transient execution attacks" -- a catch-all term the research team used to describe attacks on the various internal mechanisms that a CPU uses to process data, such as the speculative execution process, the CPU's internal caches, and other internal execution stages. The research team says they've successfully demonstrated all seven attacks with proof-of-concept code. Experiments to confirm six other Meltdown-attacks did not succeed, according to a graph published by researchers.' -- source: https://it.slashdot.org/story/18/11/14/181225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

USB Hardware Firewall
by Lawrence D'Oliveiro 14 Nov '18

14 Nov '18

You may know that it is possible for USB devices to be created that do malicious things to your PC by committing deceptions right at the USB protocol level. This kind of thing cannot be defeated by antivirus software or erased by, for example, reformatting a USB stick. For example, a device that is labelled as a USB storage stick could actually identify to the PC as two devices, one the actual storage device and the other a keyboard, that feeds malicious keystrokes at carefully-chosen times. Alternatively, it can detect when the PC is booting, and activate a separate partition containing a virus, which is otherwise invisible to antivirus software, at only that point. More details about such possibilities are available here <https://opensource.srlabs.de/projects/badusb>. Here <https://github.com/robertfisk/USG/wiki> is an interesting project to create a hardware device that will act as a “firewall” for untrusted USB devices, to prevent malicious protocol exchanges from occurring between them and your PC. If you don’t want to build your own, there’s a link in the readme to buy NZ-made ones.

1 0

World’s Top Three Most Powerful Supercomputers Are Non-Intel
by Lawrence D'Oliveiro 13 Nov '18

13 Nov '18

Machines based on IBM’s Power9 architecture have taken the top two spots in the list of the world’s most powerful (publicly-known) supercomputers <https://www.theregister.co.uk/2018/11/13/500_supercomputers_list/>. China’s Sunway TaihuLight machine, which is based on some derivative of MIPS, is in third place, with another Chinese machine, the highest-ranking Intel-based one, coming next. There is also the first ARM-based beastie, built by HP Enterprises, appearing on the list, at number 203.

1 0

Windows 10 Spontaneous Downgrade
by Lawrence D'Oliveiro 08 Nov '18

08 Nov '18

Some users of Windows 10 Pro are discovering that their machines are suddenly claiming to only have a Windows 10 Home licence <https://www.theregister.co.uk/2018/11/08/windows_10_activation/>. This isn’t confined to the “Insider” prereleases, but production releases as well (both upgrades and fresh installs). Seems some Microsoft support staff have confirmed that there is a “temporary issue” with the licence servers, which may take 1-2 days to fix.

2 1

WLinux, the First Paid-for Linux Distro for Windows 10, Goes On Sale on Microsoft Store
by Peter Reutemann 07 Nov '18

07 Nov '18

'WLinux is a $20 open-source, Debian-based distribution, designed to run on Windows 10's Windows Subsystem for Linux (WSL). The WSL allows Windows 10 to run various GNU/Linux distros inside Windows as Microsoft Store apps, providing access to Ubuntu, openSUSE, Debian, Fedora, Kali Linux, and others. The WSL has disadvantages over a running a dedicated GNU/Linux system. For example, there's no official support for desktop environments or graphical applications, and I/O performance bottlenecks, but it is being improved over time. The developers of WLinux describe it as a "fast Linux terminal environment for developers", saying it is the first distribution to be "pre-configured and optimized to run specifically on Windows Subsystem for Linux". Announcing WLinux's availability, Microsoft program manager Tara Raj, called out the wlinux-setup tool, "which allows users to easily set up common developer toolchains, and removes unsupported features like systemd."' -- source: https://linux.slashdot.org/story/18/11/07/1510223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How New, Polite Linus Torvalds Points Out Bad Kernel Code
by Peter Reutemann 06 Nov '18

06 Nov '18

'Linus Torvalds "has shown already for the new Linux 4.20~5.0 cycle he isn't relaxing his standards but is communicating better when it comes to bringing up coding," reports Phoronix, adding "So far it looks like Linus' brief retreat is paying off with still addressing code quality issues -- and not blatantly accepting new code into the kernel as some feared -- but in doing so in a professional manner compared to his past manner of exclaiming himself over capitalized sentences and profanity that at time put him at odds with some in the Linux kernel community." AmiMoJo quotes their report: Last Saturday he took issue with the HID pull request and its introduction of the BigBen game controller driver that was introduced: the developer enabled this new driver by default. Linus Torvalds has always frowned upon random new drivers being enabled by default in the kernel configuration driver. [H]e still voiced his opinion over this driver's default "Y" build configuration, but did so in a more professional manner than he has done in the past: We do *not* enable new random drivers by default. And we most *definitely* don't do it when they are odd-ball ones that most people have never heard of. Yet the new "BigBen Interactive" driver that was added this merge window did exactly that. Just don't do it. Yes, yes, every developer always thinks that _their_ driver is so special and so magically important that it should be enabled by default. But no. When we have thousands of drivers, we don't randomly pick one new driver to be enabled by default just because some developer thinks it is special. It's not.... Please don't do things like this. Phoronix also describes another "kernel oops" testing Torvalds' patience, in which Linus responded tactfully that "What makes me *very* unhappy about this is that if I'm right, I think it means that code was literally not tested at all by anybody who didn't have one of the entries in that list."' -- source: https://linux.slashdot.org/story/18/11/03/1833213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Explicating Neural Networks
by Lawrence D'Oliveiro 06 Nov '18

06 Nov '18

The usual problem with neural nets is, once you have trained them, you have no actual idea why they come to the decisions that they do. One classic example was a net that was being trained to distinguish between pictures of huskies and wolves, where it turned out it was actually assigning the highest weight to the area of snow in the background of the pictures. Enter LIME, which is a Python-based toolkit that tries to analyze the trained net to show you how each part of the dataset is being interpreted <https://www.theregister.co.uk/2018/11/05/hands_on_with_lime/>. The article shows example pictures where areas are colour-coded green or red to indicate whether they make a positive or negative contribution to a particular classification decision. This way, you can spot if any parts that should be ignored are being given an anomalously high weight. Or vice versa.

1 0

Microsoft Microsoft Working on Porting Sysinternals To Linux
by Peter Reutemann 05 Nov '18

05 Nov '18

'A Microsoft exec has confirmed yesterday that the company's engineers are working on porting the highly popular Sysinternals software package to Linux. Microsoft engineers have already ported the ProcDump utility and are currently working on porting ProcMon as well. More tools to follow. Microsoft's decision to port this highly popular debugging utility to Linux comes after two months ago, in September, Scott Guthrie, Microsoft's executive vice president of the cloud and enterprise group, revealed that "sometimes slightly over half of Azure VMs are Linux." With Linux's growing adoption as the preferred OS for running Azure VMs, it's only natural that Azure engineers are now looking into porting their favorite debugging utilities to Linux, for both themselves but also for the company's customers.' -- source: https://linux.slashdot.org/story/18/11/05/157226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Flaws in Self-Encrypting SSDs Let Attackers Bypass Disk Encryption
by Peter Reutemann 05 Nov '18

05 Nov '18

'Researchers have found flaws that can be exploited to bypass hardware encryption in well known and popular SSD drives. Master passwords and faulty standards implementations allow attackers access to encrypted data without needing to know the user-chosen password. SSDs from Micron (Crucial) and Samsung are affected. These are SSDs that support hardware-level encryption via a local built-in chip, separate from the main CPU. Some of these devices have a factory-set master password that bypasses the user-set password, while other SSDs store the encryption key on the hard drive, from where it can be retrieved. The issue is worse on Windows, where BitLocker defers software-level encryption to hardware encryption-capable SSDs, meaning user data is vulnerable to attacks without the user's knowledge. More in the research paper.' -- source: https://it.slashdot.org/story/18/11/05/213255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Slashdot poll: What do you make of programming languages and open source organizations adopting a code of conduct?
by Peter Reutemann 05 Nov '18

05 Nov '18

See this link for poll: https://slashdot.org/poll/3103 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Old School 'Sniffing' Attacks Can Still Reveal Your Browsing History
by Peter Reutemann 04 Nov '18

04 Nov '18

'Most modern browsers -- such as Chrome, Firefox, and Edge, and even browsers such as FuzzyFox and DeterFox (different, security-focused versions of Firefox) -- have vulnerabilities that allow hosts of malicious websites to extract hundreds to thousands of URLs in a user's web history, per new research from the University of California San Diego. What's worse, the vulnerabilities are built into the way they structure links, meaning that major structural changes will have to take place in these browsers in order to protect user privacy. The only browser that was immune to the attacks was Tor Browser, as the browser does not keep track of a user's internet history. The vulnerabilities have to do with why, for instance, unclicked links appear blue while visited links appear violet: there's a different set of rules and style that apply to links depending on whether they've been visited or not. However, a bad actor building a web page can manipulate this faster loading time for visited links by "sniffing," or inferting your browsing history. In essence, sniffing is finding and exploiting proxies that reveal your web history. As outlined in the UC San Diego report, this sniffing could happen in a couple of ways: they could force the browser to reload multiple complex images or image transformations that differ based on whether you've visited a link or not, which would create drastic differences in the loading time for each. With this strategy, actors can test 60 sensitive URLs per second. Bad actors could exploit a "bytecode cache," which speeds up the loading time for revisiting a link that you've already visited. "By embedding a special script in a web page, the actor can test how long it takes for a web page to load and infer whether you've visited it or not," reports Motherboard. "Actors can probe 3,000 URLs per second with this method. When the vulnerability was reported to Google, the company marked the issue as "security-sensitive" but "low-priority."' -- source: https://it.slashdot.org/story/18/11/04/0426252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel CPUs fall to new hyperthreading exploit that pilfers crypto keys
by Peter Reutemann 04 Nov '18

04 Nov '18

'Over the past 11 months, the processors running our computers, and in some cases phones, have succumbed to a host of attacks. Bearing names such as Meltdown and Spectre, BranchScope, TLBleed, and Foreshadow, the exploits threaten to siphon some of our most sensitive secrets—say passwords or cryptographic keys—out of the silicon microarchitecture in ways that can’t be detected or stopped by traditional security defenses. On Friday, researchers disclosed yet another leak that has already been shown to exist on a wide range of Intel chips and may also affect other makers, too. PortSmash, as the new attack is being called, exploits a largely overlooked side-channel in Intel’s hyperthreading technology. A proprietary implementation of simultaneous multithreading, hyperthreading reduces the amount of time needed to carry out parallel computing tasks, in which large numbers of calculations or executions are carried out simultaneously. The performance boost is the result of two logical processor cores sharing the hardware of a single physical processor. The added logical cores make it easier to divide large tasks into smaller ones that can be completed more quickly.' -- source: https://arstechnica.com/information-technology/2018/11/intel-cpus-fall-to-n… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Are Paper Books Still Legal?
by Lawrence D'Oliveiro 04 Nov '18

04 Nov '18

But how do they charge you the streaming fees? <http://www.dieselsweeties.com/ics/500/>

1 0

Booting a Raspberry-Pi 3B without using a SD-Card
by Ian Stewart 02 Nov '18

02 Nov '18

Hi, If you have a Raspberry Pi Model 3B, then you may be able use it with no micro SD-Card and have it boot Raspbian off a USB flash drive stick. I have found this possible with an Apacer AH356 64GB USB 3.1 Flash Drive<https://www.pbtech.co.nz/product/MEMAPC11464/Apacer-AH356-64GB-USB-31-Flash…> stick that I bought from PB-Tech a couple of weeks ago for $21.85. Admittedly you can buy a micro SD-card like the Apacer 64GB microSDXC UHS-I Class10<https://www.pbtech.co.nz/product/MEMAPC81064/Apacer-64GB-microSDXC-UHS-I-Cl…> from PB-Tech for $28.75 and put Raspbian onto it. So using the USB flash drive stick only saves a few dollars. However, there may be other advantages over using a USB flash drive vs. a micro SD-Card for the Raspbian OS. For example, you can shutdown the Raspberry Pi and remove the USB stick, take it to another computer, and backup your data. I also installed the Raspbian distro onto WD Elements Portable 2TB 2.5" USB 3.0 External HDD<https://www.pbtech.co.nz/product/HDDWDX2621/WD-Elements-Portable-2TB-25-USB…> which PB-Tech sell for $129. The R-Pi (with no SD-Card) would not boot this drive. Possibly because the USB drive is too slow to initialize after power on??? I also found that the R-Pi would not boot up Raspbian on an old 8GB Kingston USB flash drive. Maybe its too slow to initialize??? All the above tests were done using the current latest Raspbian release which is dated 2018_10_09. FYI: Below are details on how to install the Raspbian distro image onto a USB flash drive stick. cheers, Ian. Installing the Raspbian distro onto USB flash drive... Download the latest 1.4GB Raspbian distribution file: 2018-10-09-raspbian-stretch.zip Unzip the file to create a 4.1GB image file: 2018-10-09-raspbian-stretch.img Copy the 4.1GB image to a USB flash drive stick... $ sudo dd bs=4M if=2018-10-09-raspbian-stretch.img of=/dev/sdX status=progress conv=fsync Note: For the device /dev/sdX replace the X with the drive letter of your USB flash drive stick. e.g. /dev/sdc Insert the USB flash drive stick into the R-Pi model 3B. Remove any SD-Card that may be installed in the Raspberry Pi. Power on the R-Pi. After about 10 seconds the colourful POST display will appear, and the USB stick will commence its first boot. It will detect that it is a 4.1GB partition, expand to being a partition that fills the whole of the USB flash drive stick and reboot. The second reboot will be slow and takes about one minute. I assume it is expanding the squashed file system??? Subsequent reboots are faster.

3 6

Blockchain For International Trade
by Lawrence D'Oliveiro 01 Nov '18

01 Nov '18

ASB is close to offering a general blockchain-based service for international trading payments, starting with this <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=121526…>: ... the transaction was a landmark because the blockchain-based service meant digital payment and paperwork for the deal were wrapped up in an hour - compared to the two to four days it would take to process using more traditional means. Also: Trade is currently paperwork-heavy, Beehre says, making it susceptible to fraud or human error. Which is odd, because isn’t it precisely the point of all that paperwork to reduce the chance of fraud or human error? However: ... blockchain also appealed because of[sic] the technology was created to be unhackable. Every time I hear the word “unhackable”, I reach for my ... never mind.

1 0

IBM To Buy Red Hat, the Top Linux Distributor, For $34 Billion
by Peter Reutemann 01 Nov '18

01 Nov '18

'International Business Machines (IBM) is acquiring software maker Red Hat in a deal valued at $34 billion, the companies said Sunday. From a report: The purchase, announced on Sunday afternoon, is the latest competitive step among large business software companies to gain an edge in the fast-growing market for Internet-style cloud computing. In June, Microsoft acquired GitHub, a major code-sharing platform for software developers, for $7.5 billion. IBM said its acquisition of Red Hat was a move to open up software development on computer clouds, in which software developers write applications that run on remote data centers. >From a press release: This acquisition brings together the best-in-class hybrid cloud providers and will enable companies to securely move all business applications to the cloud. Companies today are already using multiple clouds. However, research shows that 80 percent of business workloads have yet to move to the cloud, held back by the proprietary nature of today's cloud market. This prevents portability of data and applications across multiple clouds, data security in a multi-cloud environment and consistent cloud management. IBM and Red Hat will be strongly positioned to address this issue and accelerate hybrid multi-cloud adoption. Together, they will help clients create cloud-native business applications faster, drive greater portability and security of data and applications across multiple public and private clouds, all with consistent cloud management. In doing so, they will draw on their shared leadership in key technologies, such as Linux, containers, Kubernetes, multi-cloud management, and cloud management and automation. IBM's and Red Hat's partnership has spanned 20 years, with IBM serving as an early supporter of Linux, collaborating with Red Hat to help develop and grow enterprise-grade Linux and more recently to bring enterprise Kubernetes and hybrid cloud solutions to customers. These innovations have become core technologies within IBM's $19 billion hybrid cloud business. Between them, IBM and Red Hat have contributed more to the open source community than any other organization.' -- source: https://linux.slashdot.org/story/18/10/28/1859245 That completely flew under the radar! I still remember from my Unix sysadmin course at uni back in the days (using IBM's AIX), when an IBM guy came in for some guest lectures and mentioned that they are ramping up their investment in Linux and also offer Linux next to their own AIX Unix systems. Well, Linux has definitely come a long way! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

'Open Source Creators: Red Hat Got $34 Billion and You Got $0. Here's Why.'
by Peter Reutemann 31 Oct '18

31 Oct '18

'Donald Fischer, who served as a product manager for Red Hat Enterprise Linux during its creation and early years of growth, writes: Red Hat saw, earlier than most, that the ascendance of open source made the need to pay for code go away, but the need for support and maintenance grew larger than ever. Thus Red Hat was never in the business of selling software, rather it was in the business of addressing the practical challenges that have always come along for the ride with software. [...] As an open source developer, you created that software. You can keep your package secure, legally documented, and maintained; who could possibly do it better? So why does Red Hat make the fat profits, and not you? Unfortunately, doing business with large companies requires a lot of bureaucratic toil. That's doubly true for organizations that require security, legal, and operational standards for every product they bring in the door. Working with these organizations requires a sales and marketing team, a customer support organization, a finance back-office, and lots of other "business stuff" in addition to technology. Red Hat has had that stuff, but you haven't. And just like you don't have time to sell to large companies, they don't have time to buy from you alongside a thousand other open source creators, one at a time. Sure, big companies know how to install and use your software. (And good news! They already do.) But they can't afford to put each of 1100 npm packages through a procurement process that costs $20k per iteration. Red Hat solved this problem for one corner of open source by collecting 2,000+ open source projects together, adding assurances on top, and selling it as one subscription product. That worked for them, to the tune of billions. But did you get paid for your contributions?' -- source: https://linux.slashdot.org/story/18/10/31/1520256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The CAP Theorem Strikes Again
by Lawrence D'Oliveiro 31 Oct '18

31 Oct '18

There is a fundamental rule with distributed databases: you can pick any two of: * Maintaining data Consistency across the entire network * Maintaining data Availability across the entire network * Being able to deal with a Partitioning of the network into two or more disconnected pieces but you can never have all three. An example of this is the outage at GitHub earlier this month <https://www.theregister.co.uk/2018/10/31/github_lost_a_network_link_for_43_…>. A link broke between the east-coast and west-coast halves of their network, and in an effort to maintain ongoing service availability on both sides of the partition, they ended up sacrificing consistency of the data. Which came back to bite them when the link was re-established, and the inconsistency could not easily be resolved.

1 0

The DNS Encryption Controversy
by Lawrence D'Oliveiro 31 Oct '18

31 Oct '18

There is a rather acrimonious argument currently going on among the Internet technorati over two different competing protocols for implementing encryption of domain name (DNS) queries <https://www.theregister.co.uk/2018/10/30/doh-contorversy/>. One of them is called “DNS-over-TLS” and the other is “DNS-over-HTTPS”. The former passes the DNS queries over its own TLS-encrypted connection, while the latter piggybacks on good old HTTP, using the latter’s TLS capability instead. The former is clearly simpler, and one might say “purer”, but the latter is deliberately designed to make it hard to tell what DNS queries a user might be making, since they become indistinguishable from regular HTTPS connections. So the question becomes, do you see this obfuscation as a good thing or a bad thing? It is intended to prevent snoops (both Governmental and non-Governmental) from invading the privacy of users, but it also blocks “legitimate” analysis of traffic by network admins trying to manage their systems as well. Clearly, you can’t do one without the other. So is the price worth paying?

1 0

Fedora 29 Released
by Peter Reutemann 30 Oct '18

30 Oct '18

'Fedora 29 is released today. Among the new features are the ability to allow parallel installation of packages such as Node.js. Fedora 29 also supports ZRAM (formerly called compcache) for ARMv7 and v8. In addition to the more efficient use of RAM, it also increases the lifespan of microSD cards on the Raspberry Pi as well as other SBCs. "Additionally, UEFI for ARMv7 is now supported in Fedora 29, which also benefits Raspberry Pi users," reports TechRepublic. "Fedora already supported UEFI on 64-bit ARM devices."' -- source: https://linux.slashdot.org/story/18/10/30/229249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

You Can Play Over 2, 600 Windows Games on Linux Via Steam Play
by Peter Reutemann 29 Oct '18

29 Oct '18

'At the end of August, Valve announced a new version of Steam Play for Linux that included Proton, a WINE fork that made many Windows games, including more recent ones ,such as Witcher 3, Dark Souls 3 and Dishonored, playable on Linux. Just two months later, ProtonDB says there are over 2,600 Windows games that users can play on Linux, and the number is rapidly growing daily. From a report: When Valve Software launched Steam Play with Proton, it made it easier for gamers to play Windows games that hadn't yet been ported to Linux with the click of a button. Not all games may run perfectly on Linux, but that's also often the case with Windows 10, which can not play older games as well as previous versions of Windows did, even under Compatibility Mode. In only two months, the database of games that work with Proton has increased to over 2,600 -- more than half of the 5,000 Linux-native games that can be obtained through the Steam store.' -- source: https://linux.slashdot.org/story/18/10/29/1721258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Easy-to-exploit privilege escalation bug bites OpenBSD and other big name OSes
by Peter Reutemann 29 Oct '18

29 Oct '18

'Several big-name Linux and BSD operating systems are vulnerable to an exploit that gives untrusted users powerful root privileges. The critical flaw in the X.org server—the open-source implementation of the X11 system that helps manage graphics displays—affects OpenBSD, widely considered to be among the most secure OSes. It also impacts some versions of the Red Hat, Ubuntu, Debian, and CentOS distributions of Linux. An advisory X.org developers published Thursday disclosed the 23-month-old bug that, depending on how OS developers configure it, lets hackers or untrusted users elevate very limited system rights to unfettered root. The vulnerability, which is active when OSes run X.org in privileged (setuid) mode, allows files to be overwritten using the -logfile and -modulepath parameters. It also makes it trivial for low-privilege users to escalate system rights. A variety of nuances are leading to widely divergent assessments of the bug's severity. “Depending on whom you talk to, the reported severity will vary greatly,” Louis Dion-Marcil, a security researcher at GoSecure, told Ars. “I think most people will tell you it is very severe, and I would agree with them. The bug allows you to write arbitrary data to arbitrary files, which might seem trivial and not that dangerous, but it effectively allows regular, unprivileged users to elevate their privileges to the one of complete administrator of the system.”' -- source: https://arstechnica.com/information-technology/2018/10/x-org-bug-that-gives… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

New Zealand Chooses Google Chromebooks Over Microsoft Windows 10 For Education
by Peter Reutemann 28 Oct '18

28 Oct '18

'Google announced this week that it has signed an agreement with New Zealand's Ministry of Education to provide all state and state integrated schools in the country with Chrome Education licenses. The three-year agreement goes into effect on November 1 next month. From a report: "Starting on November 1, as part of an agreement with Google and the New Zealand Ministry of Education, all state and state-integrated schools across New Zealand will be able to start claiming Ministry-funded Chrome Education licenses to manage new and existing unmanaged Chromebooks. The Chrome Education license was developed to make device management in schools a breeze, so that teachers and students can focus on what's most important -- teaching and learning. Equipped with the Chrome Education license, schools can utilize essential education features to better support the many ways Chromebooks are used in the classroom," says Suan Ye, Head of Google for Education, Australia and New Zealand.' -- source: https://news.slashdot.org/story/18/10/28/2214209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linus Torvalds and Greg K-H Talk About Linux Community, Dealing with Hardware Bugs, Chromebooks Gaining Traction, Microsoft, Companies Gleaning Data and More
by Peter Reutemann 28 Oct '18

28 Oct '18

'Swapnil Bhartiya, who runs the blog TFIR, had a chance to interview Linus Torvalds at Open Source Summit in the second half of August this year. (Some context: The interview, which was published this week, took place before Mr. Torvalds said he needs to take a step back to reflect on how he has dealt with the community over the years. Since then, we have learned that Mr. Torvalds is returning to his position.) In the wide-ranging interview, Mr. Torvalds has touched a wide-range of subjects, including formulating workarounds for the problematic hardware bugs (Meltdown, Spectre), and Chromebooks gaining traction (though it is still not a machine that he could use for his work yet). He also talked about companies gleaning a lot of data about their users, regulations, (a tad bit of politics), Linux community. Greg Kroah-Hartman (aka Greg K-H) joined Mr. Bhartiya and Mr. Torvalds for the second half of the interview. On Sunday, Mr. Bhartiya published an additional interview of Mr. Kroah-Hartman.' -- source: https://linux.slashdot.org/story/18/10/28/1437239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New SystemD Vulnerability Discovered
by Peter Reutemann 28 Oct '18

28 Oct '18

'The Register reports that a new security bug in systemd "can be exploited over the network to, at best, potentially crash a vulnerable Linux machine, or, at worst, execute malicious code on the box" by a malicious host on the same network segment as the victim. According to one Red Hat security engineer, "An attacker could exploit this via malicious DHCP server to corrupt heap memory on client machines, resulting in a denial of service or potential code execution." According to the bug description, systemd-networkd "contains a DHCPv6 client which is written from scratch and can be spawned automatically on managed interfaces when IPv6 router advertisements are received." OneHundredAndTen shared this article from the Register: In addition to Ubuntu and Red Hat Enterprise Linux, systemd has been adopted as a service manager for Debian, Fedora, CoreOS, Mint, and SUSE Linux Enterprise Server. We're told RHEL 7, at least, does not use the vulnerable component by default. Systemd creator Leonard Poettering has already published a security fix for the vulnerable component -- this should be weaving its way into distros as we type. If you run a systemd-based Linux system, and rely on systemd-networkd, update your operating system as soon as you can to pick up the fix when available and as necessary.' -- source: https://news.slashdot.org/story/18/10/27/196227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox and Google Drive: random download locations?
by Peter Reutemann 25 Oct '18

25 Oct '18

Hi everyone In case you're using Google Drive frequently in conjunction with Firefox and always wondered about the random download locations (when "always ask" is enabled), I just found the reason for this... Firefox has a boolean setting "browser.download.lastDir.savePerSite" (not defined by default) that defines whether to remember the download location per site. However, with Google Drive, you will get a random URL serving the file, turning the last known download directory into a useless feature unfortunately. So, just go into "about:config", and create the above mentioned boolean setting and use "false" as the value. Now you have a "global" last known download location. -- source: https://support.mozilla.org/en-US/questions/925960 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

New Study Claims Data Harvesting Among Android Apps Is 'Out of Control'
by Peter Reutemann 25 Oct '18

25 Oct '18

'A new study from Oxford University revealed that almost 90 percent of free apps on the Google Play store share data with Alphabet. "The researchers, who analyzed 959,000 apps from the U.S. and UK Google Play stores, said data harvesting and sharing by mobile apps was now 'out of control,'" reports TechSpot. "'We find that most apps contain third party tracking, and the distribution of trackers is long-tailed with several highly dominant trackers accounting for a large portion of the coverage,' reads the report." From the report: It's revealed that most of the apps, 88.4 percent, could share data with companies owned by Google parent Alphabet. Next came a firm that's no stranger to data sharing controversies, Facebook (42.5 percent), followed by Twitter (33.8 percent), Verizon (26.27 percent), Microsoft (22.75 percent), and Amazon (17.91 percent). [I]nformation shared by these third-party apps can include age, gender, location, and information about a user's other installed apps. The data "enables construction of detailed profiles about individuals, which could include inferences about shopping habits, socio-economic class or likely political opinions." Big firms then use the data for a variety of purposes, such as credit scoring and for targeting political messages, but its main use is often ad targeting. Not surprising, given that revenue from online advertising is now over $59 billion per year. According to the research, the average app transfers data to five tracker companies, which pass the data on to larger firms. The biggest culprits are news apps and those aimed at children, both of which tend to have the most third-party trackers associated with them.' -- source: https://yro.slashdot.org/story/18/10/24/2340207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The World’s First Video Game?
by Lawrence D'Oliveiro 24 Oct '18

24 Oct '18

Tennis For Two, almost certainly the first computer-controlled real-time video game, 60 years old this month <https://www.theregister.co.uk/2018/10/22/tennis_for_two_at_60/>. Note this was an analog computer, which would have been faster at simulating the physics than the digital ones available in 1958.

1 0

Google News App Bug Is Using Up Gigabytes of Background Data Without Users' Knowledge
by Peter Reutemann 23 Oct '18

23 Oct '18

'A bug in the Google News app for Android is reportedly causing the app to use up excessive amounts of background data, leading to overage charges. "According to dozens of posts on the Google News Help Forum, users have been experiencing this issue as early as June," reports The Verge. "The issue was verified and addressed by a Google News community manager in September, stating that the company was investigating and working toward a fix, but the issue is still ongoing." From the report: Verge reader Zach Dowdle emailed in with his experience, and screenshots of his app and Wi-Fi data usage: "The Google News app is randomly using a ridiculous amount of background data without users' knowledge. The app burned through over 12 gigs of data on my phone while I slept and my Wi-Fi had disconnected. It lead to $75 in overage charges." According to several users, the app burned through mobile data despite having "Download via Wi-Fi" turned on in the settings. In some extreme cases, the Google News app used up to 24GB of data, leading to overage charges of up to $385, users reported. So far, the only solutions seem to be disabling background data, and deleting the app altogether. ' -- source: https://tech.slashdot.org/story/18/10/23/0340211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Is Reportedly Going To Sell VPN Subscriptions Within Firefox
by Peter Reutemann 23 Oct '18

23 Oct '18

'Mozilla is reportedly preparing to offer a VPN service for Firefox users to help protect them when surfing the web. According to Trusted Reviews, Mozilla has partnered with the ProtonVPN service, "with a new notification piping-up when the browser detects an unsecured connection, or in a scenario when VPN might be preferable to users." >From the report: However, it appears Firefox users will have to pay for the privilege. Austrian site Soeren-hentzschel reports the premium VPN service will be $10 a month, which is what ProtonVPN charges its users. Users will receive a "Firefox Recommends" pop-up when browsing an unsecured wireless network. The pop-up says the VPN service will provide a "private and secure' internet connection. According to the reports, a subset of Firefox 62 users in the United States will begin receiving the pop-up from today. Mozilla will reportedly get a cut of any subscription fee handed over by users to access the VPN service. MSPowerUser points out that this will be the first advertised service that costs money for Firefox users.' -- source: https://tech.slashdot.org/story/18/10/23/0351220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 63 Arrives With Enhanced Tracking Protection, Search Shortcuts, and Picture-in-Picture on Android
by Peter Reutemann 23 Oct '18

23 Oct '18

'Mozilla today launched Firefox 63 for Windows, Mac, Linux, and Android. The release brings Enhanced Tracking Protection, performance improvements on Windows and macOS, search shortcuts, and Picture-In-Picture on Android. From a report: Firefox 63 for the desktop is available for download now on Firefox.com, and all existing users should be able to upgrade to it automatically. As always, the Android version is trickling out slowly on Google Play. According to Mozilla, Firefox has about 300 million active users. In other words, it's a major platform that web developers must consider. Firefox 63 for desktop brings support for Enhanced Tracking Protection. [...] Firefox 63's Enhanced Tracking Protection blocks cookies and storage access from third-party trackers, which Mozilla says targets the problem of cross-site tracking without breaking sites and impacting revenue streams like the original Tracking Protection. It does this by preventing known trackers from setting third-party cookies -- the primary method of tracking across sites -- but still gives you the option to block all known trackers (under Firefox Options/Preferences). [...] Search shortcuts essentially pins sites like Google and Amazon on the new tab page. When you click or tap them, you're redirected to Firefox's awesome bar, which automatically fills the corresponding keyword (@google or @amazon in this case) for the search engine. This way, you can type your query, hit enter, and get your search results without having to first load the Google or Amazon homepage. [...] The only major new feature for this Firefox for Android release is a picture-in-picture mode (Android Oreo and up). This means that if you're watching a video in full-screen, when you switch away from Firefox it will move the video into a small floating window, which you can tap to return to the full video player.' -- source: https://news.slashdot.org/story/18/10/23/149223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Richard Stallman Announces GNU Kind Communication Guidelines
by Peter Reutemann 23 Oct '18

23 Oct '18

'Richard Stallman has announced the GNU Kind Communication Guidelines, an effort "to start guiding people towards kinder communication." The Guidelines differ from a Code of Conduct in that it's trying to be proactive about kindness around free software development over being rules with possible actions when breaking them. These new GNU communication guidelines can be found at GNU.org along with Stallman's commentary. >From the guidelines: A code of conduct states rules, with punishments for anyone that violates them. It is the heavy-handed way of teaching people to behave differently, and since it only comes into action when people do something against the rules, it doesn't try to teach people to do better than what the rules require. To be sure, the appointed maintainer(s) of a GNU package can, if necessary, tell a contributor to go away; but we do not want to need to have recourse to that. The idea of the GNU Kind Communication Guidelines is to start guiding people towards kinder communication at a point well before one would even think of saying, "You are breaking the rules." The way we do this, rather than ordering people to be kind or else, is try to help people learn to make their communication more kind. I hope that kind communication guidelines will provide a kinder and less strict way of leading a project's discussions to be calmer, more welcoming to all participants of good will, and more effective.' -- source: https://news.slashdot.org/story/18/10/23/1418225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Motorola Becomes First Smartphone Company To Sell DIY Repair Kits To Its Customers
by Peter Reutemann 23 Oct '18

23 Oct '18

'As Apple continues to fight independent repair, Motorola has partnered with iFixit and pledged to support the right to repair movement. From a report: It is excellent news that Motorola has decided to make it as easy as possible for you to repair your phone. The company announced that it would begin selling replacement parts for all of its recent phones to customers, and it has partnered with iFixit to sell repair kits for phones like the Moto X, Z, G4, G5, and Droid Turbo 2. The kits come with tools, genuine Motorola-branded replacement parts, and instructions on how to fix your device. iFixit is currently selling replacement batteries, screens, and digitizer assemblies. "Motorola is setting an example for major manufacturers to embrace a more open attitude towards repair," iFixit wrote in a blog post announcing the partnership. "For fixers like us, this partnership is representative of a broader movement in support of our Right to Repair. It's proof that OEM manufacturers and independent repair can co-exist. Big business and social responsibility, and innovation and sustainability, don't need to be mutually exclusive."' -- source: https://hardware.slashdot.org/story/18/10/23/1526248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Rockstar Patent Consortium
by Lawrence D'Oliveiro 23 Oct '18

23 Oct '18

Hi folks. In our discussion on patents last night, I was trying to think of the name of this consortium that had acquired the patents from Nortel when it went bust. I was pretty sure it was called “Rockstar”, and I was right: <https://www.techdirt.com/articles/20131101/15353825101/patent-troll-shell-c…>. The outfit is/was owned by Microsoft and Apple, and one of the first things it did was to sue Google and a bunch of major makers of Android devices.

1 0

Now Apps Can Track You Even After You Uninstall Them
by Peter Reutemann 22 Oct '18

22 Oct '18

'If it seems as though the app you deleted last week is suddenly popping up everywhere, it may not be mere coincidence. From a report: Companies that cater to app makers have found ways to game both iOS and Android, enabling them to figure out which users have uninstalled a given piece of software lately -- and making it easy to pelt the departed with ads aimed at winning them back. Adjust, AppsFlyer, MoEngage, Localytics, and CleverTap are among the companies that offer uninstall trackers, usually as part of a broader set of developer tools. Their customers include T-Mobile US, Spotify Technology, and Yelp. Critics say they're a fresh reason to reassess online privacy rights and limit what companies can do with user data. "Most tech companies are not giving people nuanced privacy choices, if they give them choices at all," says Jeremy Gillula, tech policy director at the Electronic Frontier Foundation, a privacy advocate. Some providers say these tracking tools are meant to measure user reaction to app updates and other changes. Jude McColgan, chief executive officer of Boston's Localytics, says he hasn't seen clients use the technology to target former users with ads. Ehren Maedge, vice president for marketing and sales at MoEngage Inc. in San Francisco, says it's up to the app makers not to do so. "The dialogue is between our customers and their end users," he says. "If they violate users' trust, it's not going to go well for them." Adjust, AppsFlyer, and CleverTap didn't respond to requests for comment, nor did T-Mobile, Spotify, or Yelp. Uninstall tracking exploits a core element of Apple's and Google's mobile operating systems: push notifications. Developers have always been able to use so-called silent push notifications to ping installed apps at regular intervals without alerting the user -- to refresh an inbox or social media feed while the app is running in the background, for example. But if the app doesn't ping the developer back, the app is logged as uninstalled, and the uninstall tracking tools add those changes to the file associated with the given mobile device's unique advertising ID, details that make it easy to identify just who's holding the phone and advertise the app to them wherever they go.' -- source: https://yro.slashdot.org/story/18/10/22/1956257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds is Back in Charge of Linux
by Peter Reutemann 22 Oct '18

22 Oct '18

'At Open Source Summit Europe in Edinburgh, Scotland, Linus Torvalds is meeting with Linux's top 40 or so developers at the Maintainers' Summit. This is his first step back in taking over Linux's reins. From a report: A little over a month ago, Torvalds has stepped back from running the Linux development community. Then, in a note to the Linux Kernel Mailing List (LKML), Torvalds has said, "I need to change some of my behavior, and I want to apologize to the people that my personal behavior hurt and possibly drove away from kernel development entirely." To do, this he took time off "to change some of my behavior, and I want to apologize to the people that my personal behavior hurt and possibly drove away from kernel development entirely. I am going to take time off and get some assistance on how to understand people's emotions and respond appropriately." That time is over. Torvalds is back. Whether he'll be a kinder and gentler Torvalds remains to be seen. In the Linux 4.19 announcement, Greg Kroah-Hartman, Linux's temporary leader and maintainer of the stable branch, wrote: "Linus, I'm handing the kernel tree back to you. You can have the joy of dealing with the merge window :)"' -- source: https://linux.slashdot.org/story/18/10/22/1145234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

And Now, For Something Remarkably Soothing ...
by Lawrence D'Oliveiro 19 Oct '18

19 Oct '18

Here is Brian Eno’s famous Windows 95 startup sound, slowed down by 40:1, so it is now nearly 4 minutes long: <https://soundcloud.com/ideoforms/windows-95-startup-sound>.

2 1

OpenBSD 6.4 Released
by Peter Reutemann 19 Oct '18

19 Oct '18

'The 45th version of the OpenBSD project has been released, bringing more hardware support (Radeon driver updates, Intel microcode integration, and more), a virtualization tool that supports the disk format qcow2, and a network interface where you can quickly join and switch between different Wi-Fi networks. Root.cz also notes that audio recording is now disabled by default. If you need to record audio, it can be enabled with the new sysctl variable. An anonymous Slashdot reader first shared the announcement. You can download it from any of the mirrors here.' -- source: https://bsd.slashdot.org/story/18/10/18/2056242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday?
by Peter Reutemann 18 Oct '18

18 Oct '18

Hi everyone Any suggestions for a topic/presentation next Monday, the last meeting before the AGM in November? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Ubuntu Linux 18.10 'Cosmic Cuttlefish' Arrives
by Peter Reutemann 18 Oct '18

18 Oct '18

'Ubuntu 18.10 Cosmic Cuttlefish, the latest version of Ubuntu, is now available to download. From a report: Under the hood, the Cosmic Cuttlefish boasts the 4.18 Linux Kernel. This updates comes with better support for for AMD and Nvidia GPU, USB Type-C and Thunderbolt, a way for unprivileged users to mount Filesystem in Userspace (FUSE) can be mounted by, and CPUfreq performance improvements. On top of this, you'll find the freshest version of GNOME 3.30. You can, of course, use other desktops, but GNOME, since Ubuntu 17.10, is Ubuntu's default desktop. You'll be glad to know that GNOME is faster than it has been for a while. That's because some nasty memory leaks have been patched. Canonical has also added some performance tweaks that didn't make it into the GNOME 3.30 upstream. Ubuntu 18.10 also comes with a new desktop theme, the Yaru Community theme installed by default, for your visual enjoyment.' -- source: https://news.slashdot.org/story/18/10/18/1840201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

After $5 billion EU antitrust fine, Google will start charging for Android apps
by Peter Reutemann 17 Oct '18

17 Oct '18

'Google is adjusting to life in the EU after the $5.05 billion (€4.34 billion) antitrust fine levied against it by the European Commission earlier this year. Google is still appealing the initial ruling, which found that Google used Android to illegally dominate the search market, but for now Google will comply with the ruling and offer looser licensing agreements to Android device makers. In a post on the official Google Blog titled "Complying with the EC’s Android decision," Google outlined a few changes coming to the Google app licensing agreements that it offers to Android OEMs. As you might recall from the numerous times we've written about it, this announcement is a change to the secretive "Mobile Application Distribution Agreement" (MADA) document that is a requirement for getting access to the Play Store and other Google apps. What we think of as a commercial "Android" device comes in two parts. The core Android OS is free and open source—anyone can take it and do whatever they want with it without Google's involvement. If you want the Play Store, Google Maps, Gmail, and all the other Google apps you need to make a viable commercial smartphone, though, you need to talk to Google and sign a MADA, which comes with a ton of restrictions. Google's new MADA makes three big changes. First, Google's blog states "Android partners wishing to distribute Google apps may also build non-compatible, or forked, smartphones and tablets for the European Economic Area (EEA)." [...] Google says it will also unbundle Search and Chrome from the rest of the Google apps. [...] The last change is definitely a shocker. Breaking up Google's licensing agreement is going to have a financial impact on OEMs. As Google puts it, "Since the pre-installation of Google Search and Chrome together with our other apps helped us fund the development and free distribution of Android, we will introduce a new paid licensing agreement for smartphones and tablets shipped into the EEA." That's right, OEMs now have to pay to access the Google apps, but Google doesn't say how much. The core Android OS, Google says "will remain free and open source." [...]' -- source: https://arstechnica.com/gadgets/2018/10/google-to-charge-oems-for-android-a… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Researcher Finds Simple Way of Backdooring Windows PCs and Nobody Notices for Ten Months
by Peter Reutemann 17 Oct '18

17 Oct '18

' A security researcher from Colombia has found a way of gaining admin rights and boot persistence on Windows PCs that's simple to execute and hard to stop -- all the features that hackers and malware authors are looking for from an exploitation technique. From a report: What's more surprising, is that the technique was first detailed way back in December 2017, but despite its numerous benefits and ease of exploitation, it has not received either media coverage nor has it been seen employed in malware campaigns. Discovered by Sebastian Castro, a security researcher for CSL, the technique targets one of the parameters of Windows user accounts known as the Relative Identifier (RID). The RID is a code added at the end of account security identifiers (SIDs) that describes that user's permissions group. There are several RIDs available, but the most common ones are 501 for the standard guest account, and 500 for admin accounts. Castro, with help from CSL CEO Pedro Garcia, discovered that by tinkering with registry keys that store information about each Windows account, he could modify the RID associated with a specific account and grant it a different RID, for another account group. The technique does not allow a hacker to remotely infect a computer unless that computer has been foolishly left exposed on the Internet without a password. But in cases where a hacker has a foothold on a system -- via either malware or by brute-forcing an account with a weak password -- the hacker can give admin permissions to a compromised low-level account, and gain a permanent backdoor with full SYSTEM access on a Windows PC.' -- source: https://it.slashdot.org/story/18/10/17/1849255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Former Top Waymo Engineer Altered Code To Go on 'Forbidden Routes', Report Says
by Peter Reutemann 17 Oct '18

17 Oct '18

'In the early days of what ultimately became Waymo, Google's self-driving car division (known at the time as "Project Chauffeur"), there were "more than a dozen accidents, at least three of which were serious," according to a new article in The New Yorker . From a report: The magazine profiled Anthony Levandowski, the former Google engineer who was at the center of the Waymo v. Uber trade secrets lawsuit. According to the article, back in 2011, Levandowski also modified the autonomous software to take the prototype Priuses on "otherwise forbidden routes." Citing an anonymous source, The New Yorker reports that Levandowski sat behind the wheel as the safety driver, along with Isaac Taylor, a Google executive. But while they were in the car, the Prius "accidentally boxed in another vehicle," a Camry. As The New Yorker wrote: "A human driver could easily have handled the situation by slowing down and letting the Camry merge into traffic, but Google's software wasn't prepared for this scenario. The cars continued speeding down the freeway side by side. The Camry's driver jerked his car onto the right shoulder. Then, apparently trying to avoid a guard rail, he veered to the left; the Camry pinwheeled across the freeway and into the median. Levandowski, who was acting as the safety driver, swerved hard to avoid colliding with the Camry, causing Taylor to injure his spine so severely that he eventually required multiple surgeries." This was apparently just one of several accidents in Project Chauffeur's early days.' -- source: https://tech.slashdot.org/story/18/10/17/204215 Just another reason why self-driving cars should be open-sourced... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

MongoDB Switches Up Its Open-Source License
by Peter Reutemann 17 Oct '18

17 Oct '18

'MongoDB is taking action against cloud giants who are taking its open-source code and offering a hosted commercial version of its database to their users without playing by the open-source rules. The company announced today that it has issued a new software license, the Server Side Public License (SSPL), "that will apply to all new releases of its MongoDB Community Server, as well as all patch fixes for prior versions," reports TechCrunch. From the report: For virtually all regular users who are currently using the community server, nothing changes because the changes to the license don't apply to them. Instead, this is about what MongoDB sees as the misuse of the AGPLv3 license. "MongoDB was previously licensed under the GNU AGPLv3, which meant companies who wanted to run MongoDB as a publicly available service had to open source their software or obtain a commercial license from MongoDB," the company explains. "However, MongoDB's popularity has led some organizations to test the boundaries of the GNU AGPLv3." So while the SSPL isn't all that different from the GNU GPLv3, with all the usual freedoms to use, modify and redistribute the code (and virtually the same language), the SSPL explicitly states that anybody who wants to offer MongoDB as a service -- or really any other software that uses this license -- needs to either get a commercial license or open source the service to give back the community. "The market is increasingly consuming software as a service, creating an incredible opportunity to foster a new wave of great open source server-side software. Unfortunately, once an open source project becomes interesting, it is too easy for cloud vendors who have not developed the software to capture all of the value but contribute nothing back to the community," said Eliot Horowitz, the CTO and co-founder of MongoDB, in a statement. "We have greatly contributed to -- and benefited from -- open source and we are in a unique position to lead on an issue impacting many organizations. We hope this will help inspire more projects and protect open source innovation."' -- source: https://developers.slashdot.org/story/18/10/16/2039253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

libssh 0.8.4 and 0.7.6 security and bugfix release
by Peter Reutemann 16 Oct '18

16 Oct '18

'This is an important security and maintenance release in order to address CVE-2018-10933. libssh versions 0.6 and above have an authentication bypass vulnerability in the server code. By presenting the server an SSH2_MSG_USERAUTH_SUCCESS message in place of the SSH2_MSG_USERAUTH_REQUEST message which the server would expect to initiate authentication, the attacker could successfully authentciate without any credentials. The bug was discovered by Peter Winter-Smith of NCC Group.' -- source: https://www.libssh.org/2018/10/16/libssh-0-8-4-and-0-7-6-security-and-bugfi… -- via twitter: https://twitter.com/FioraAeterna/status/1052294419607506944 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

So It’s Not Just Me
by Lawrence D'Oliveiro 16 Oct '18

16 Oct '18

Given the number of tech-support scam calls I’ve been getting, I was starting to feel picked on. But it turns out it’s New Zealand as a whole that’s being picked on, with “more than three-quarters” of Kiwis sampled in a Microsoft study reporting that they had been targeted by these scammers <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=121434…>. We are also more likely than any other nation (out of the 16 that took part in the survey) to experience fake popup browser notifications. But then, thinking about it, the “global average” of 62% of respondents getting the scam attempts smells rather strongly of sampling bias to me. It’s hard to believe that nearly two-thirds of the entire world population has been getting these calls ...

1 0

Paul Allen Has Died
by Lawrence D'Oliveiro 15 Oct '18

15 Oct '18

The Microsoft co-founder you didn’t hear so much about has lost his decades-long battle with cancer <https://www.aljazeera.com/news/2018/10/microsoft-founder-paul-allen-dies-ag…>. He was a philanthropist who quietly supported many causes with his riches. One of these was the Seattle Living Computer Museum <https://www.youtube.com/watch?v=Jk4J6y37OkY>, which has been working on getting various old classic machines back in working condition.

1 0

Rivals ARM and Intel Make Peace To Secure Internet of Things
by Peter Reutemann 15 Oct '18

15 Oct '18

'Rival semiconductor giants ARM and Intel have agreed to work together to manage networks of connected devices from both firms, clearing a major stumbling block to market growth of the so-called Internet of Things (IoT). From a report: Britain's ARM, a unit of Japan's Softbank, said on Monday it had struck a strategic partnership with Intel to use common standards developed by Intel for managing IoT devices, connections and data. The IoT involves connecting simple chips that detect distance, motion, temperature, pressure and images to be used in an ever wider range of electronics such as lights, parking meters or refrigerators. Some of the world's dumbest electronics devices get smarter by becoming connected into cloud networks, but also harder to protect. ARM's agreement to adopt Intel standards for securely managing such networks marks a breakthrough that promises to drive the spread of IoT across many industries, the two companies said.' -- source: https://it.slashdot.org/story/18/10/15/1338259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Software Freedom Conservancy Shares Thoughts on Microsoft Joining Open Invention Network's Patent Non-Aggression Pact
by Peter Reutemann 14 Oct '18

14 Oct '18

'Earlier this week, Microsoft announced that it was joining the open-source patent consortium Open Invention Network (OIN). The press release the two shared this week was short on details on how the two organizations intend to work together and what does the move mean to, for instance, the billions of dollars Microsoft earns each year from its Android patents (since Google is a member of OIN, too.) Software Freedom Conservancy (SFC), a non-profit organization that promotes open-source software, has weighed in on the subject: While [this week's] announcement is a step forward, we call on Microsoft to make this just the beginning of their efforts to stop their patent aggression efforts against the software freedom community. The OIN patent non-aggression pact is governed by something called the Linux System Definition. This is the most important component of the OIN non-aggression pact, because it's often surprising what is not included in that Definition especially when compared with Microsoft's patent aggression activities. Most importantly, the non-aggression pact only applies to the upstream versions of software, including Linux itself. We know that Microsoft has done patent troll shakedowns in the past on Linux products related to the exfat filesystem. While we at Conservancy were successful in getting the code that implements exfat for Linux released under GPL (by Samsung), that code has not been upstreamed into Linux. So, Microsoft has not included any patents they might hold on exfat into the patent non-aggression pact. We now ask Microsoft, as a sign of good faith and to confirm its intention to end all patent aggression against Linux and its users, to now submit to upstream the exfat code themselves under GPLv2-or-later. This would provide two important protections to Linux users regarding exfat: (a) it would include any patents that read on exfat as part of OIN's non-aggression pact while Microsoft participates in OIN, and (b) it would provide the various benefits that GPLv2-or-later provides regarding patents, including an implied patent license and those protections provided by GPLv2 (and possibly other GPL protections and assurances as well).' -- source: https://yro.slashdot.org/story/18/10/14/2140221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The OS That Did Too Much
by Lawrence D'Oliveiro 13 Oct '18

13 Oct '18

You may have heard of the recent Windows 10 update (now withdrawn) that was causing some users to lose their files. There is an analysis of the problem, reported here <https://www.theregister.co.uk/2018/10/10/microsoft_windows_deletion_bug/>. It was a consequence of a feature known as “Known Folder Redirection”, which it seems only exists because of the drive-letter limitations of Windows. The closest analogue might be Linux mount points or symlinks, only the Windows version is more complicated, in usual Microsoft fashion. One mystery is that the bug was reported by multiple testers months before release, yet it seems their reports were ignored.

1 0

Facebook Offers Update On Recent Hack — And It's Bad. Here's How To Find Out If You Were Affected And What It Means
by Peter Reutemann 13 Oct '18

13 Oct '18

'Late last month Facebook announced the service had been hacked, resulting in the theft of data from 50 million users. Today Facebook finally issued an update on what the company's continuing investigation has found regarding the scale and scope of the attack. While the official press release presents the findings in a matter-of-fact manner, tech reporters have been quick to point out that the actual risks posed by what the attackers possess are alarming. The hackers used an exploit particular to the "View As" feature that allowed them to steal access tokens, letting the hackers take over accounts they did not already possess the passwords to. Facebook's press release notes that "the attackers already controlled a set of accounts, which were connected to Facebook friends." Starting by taking over friends of those initial accounts, the hackers stole tokens for "about 400,000" accounts. From there, the hackers used a portion of those accounts' friend lists to take over 30 million accounts. The press release is quick to note that this is less than Facebook's initial assessment that 50 million accounts had been compromised ("about 30 million actually had their tokens stolen," emphasis Facebook's).' -- source: http://digg.com/2018/facebook-hack-30-million-users-contact-info-2fa Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apple Rebukes Australia's 'Dangerously Ambiguous' Anti-Encryption Bill
by Peter Reutemann 13 Oct '18

13 Oct '18

'Apple has strongly criticized Australia's anti-encryption bill, calling it "dangerously ambiguous" and "alarming to every Australian." >From a report: The Australian government's draft law -- known as the Access and Assistance Bill -- would compel tech companies operating in the country, like Apple, to provide "assistance" to law enforcement and intelligence agencies in accessing electronic data. The government claims that encrypted communications are "increasingly being used by terrorist groups and organized criminals to avoid detection and disruption," without citing evidence. But critics say that the bill's "broad authorities that would undermine cybersecurity and human rights, including the right to privacy" by forcing companies to build backdoors and hand over user data -- even when it's encrypted. Now, Apple is the latest company after Google and Facebook joined civil and digital rights groups -- including Amnesty International -- to oppose the bill, amid fears that the government will rush through the bill before the end of the year. In a seven-page letter to the Australian parliament, Apple said that it "would be wrong to weaken security for millions of law-abiding customers in order to investigate the very few who pose a threat." The company adds, "We appreciate the government's outreach to Apple and other companies during the drafting of this bill. While we are pleased that some of the suggestions incorporated improve the legislation, the unfortunate fact is that the draft legislation remains dangerously ambiguous with respect to encryption and security. This is no time to weaken encryption. Rather than serving the interests of Australian law enforcement, it will just weaken the security and privacy of regular customers while pushing criminals further off the grid."' -- source: https://apple.slashdot.org/story/18/10/12/1856202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Mysterious Grey-Hat Is Patching People's Outdated MikroTik Routers
by Peter Reutemann 13 Oct '18

13 Oct '18

'A Russian-speaking grey-hat hacker is breaking into people's MikroTik routers and patching devices so they can't be abused by cryptojackers, botnet herders, or other cyber-criminals, ZDNet has learned. The hacker, who goes by the name of Alexey and says he works as a server administrator, claims to have disinfected over 100,000 MikroTik routers already. "I added firewall rules that blocked access to the router from outside the local network," Alexey said. "In the comments, I wrote information about the vulnerability and left the address of the @router_os Telegram channel, where it was possible for them to ask questions." But despite adjusting firewall settings for over 100,000 users, Alexey says that only 50 users reached out via Telegram. A few said "thanks," but most were outraged. The vigilante server administrator says he's been only fixing routers that have not been patched by their owners against a MikroTik vulnerability that came to light in late April.' -- source: https://mobile.slashdot.org/story/18/10/12/2052202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Over Nine Million Cameras and DVRs Open To APTs, Botnet Herders, and Voyeurs
by Peter Reutemann 11 Oct '18

11 Oct '18

'Millions of security cameras, DVRs, and NVRs contain vulnerabilities that can allow a remote attacker to take over devices with little effort, security researchers have revealed today. From a report: All vulnerable devices have been manufactured by Hangzhou Xiongmai Technology Co., Ltd. (Xiongmai hereinafter), a Chinese company based in the city of Hangzhou. But end users won't be able to tell that they're using a hackable device because the company doesn't sell any products with its name on them, but ships all equipment as white label products on which other companies put their logo on top. Security researchers from EU-based SEC Consult say they've identified over 100 companies that buy and re-brand Xiongmai devices as their own. All of these devices are vulnerable to easy hacks, researchers say. The source of all vulnerabilities is a feature found in all devices named the "XMEye P2P Cloud." The XMEye P2P Cloud works by creating a tunnel between a customer's device and an XMEye cloud account. Device owners can access this account via their browser or via a mobile app to view device video feeds in real time. SEC Consult researchers say that these XMEye cloud accounts have not been sufficiently protected. For starters, an attacker can guess account IDs because they've been based on devices' sequential physical addresses (MACs). Second, all new XMEye accounts use a default admin username of "admin" with no password.' -- source: https://yro.slashdot.org/story/18/10/11/1925256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Plex for Linux Now Available as a Snap
by Peter Reutemann 11 Oct '18

11 Oct '18

'Today, a very popular app, Plex Media Server, gets the Snap treatment. In other words, you can install the media server program without any headaches -- right from the Snap store. "In adopting the universal Linux app packaging format, Plex will make its multimedia platform available to an ever-growing community of Linux users, including those on KDE Neon, Debian, Fedora, Manjaro, OpenSUSE, Zorin and Ubuntu. Automatic updates and rollback capabilities are staples of Snap software, meaning Plex users will always have the best and latest version running," says Canonical.' -- source: https://linux.slashdot.org/story/18/10/11/193246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Apache OpenOffice, the Schrodinger's Application: No One Knows If It's Dead or Alive, No One Really Wants To Look Inside
by Peter Reutemann 11 Oct '18

11 Oct '18

'British IT news outlet The Register looks at the myriad of challenges Apache OpenOffice faces today. From the report: Last year Brett Porter, then chairman of the Apache Software Foundation, contemplated whether a proposed official blog post on the state of Apache OpenOffice (AOO) might discourage people from downloading the software due to lack of activity in the project. No such post from the software's developers surfaced. The languid pace of development at AOO, though, has been an issue since 2011 after Oracle (then patron of the project) got into a fork-fight with The Document Foundation, which created LibreOffice from the OpenOffice codebase, and asked developers backing the split to resign. Back in 2015, Red Hat developer Christian Schaller called OpenOffice "all but dead." Assertions to that effect have continued since, alongside claims to the contrary. Almost a year ago, Jim Jagielski, a member of the Apache OpenOffice Project Management Committee, insisted things were going well and claimed there was renewed interest in the project. For all the concern about AOO, no issues have been raised recently before the Apache Foundation board to suggest ongoing difficulties. The project is due to provide an update this month, according to a spokesperson for the foundation.' -- source: https://apache.slashdot.org/story/18/10/11/1719238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fwd: [NZOSS OpenChat] LCA2019 Sysadmin Miniconf -- Call for Presentations
by Peter Reutemann 10 Oct '18

10 Oct '18

Apologies for cross-posting, but I though this might be of interest to this list. Cheers, Peter ---------- Forwarded message --------- From: Ewen McNeill <...> Date: Thu, Oct 11, 2018 at 10:50 AM Subject: [NZOSS OpenChat] LCA2019 Sysadmin Miniconf -- Call for Presentations To: NZOSS Open Chat List <openchat(a)groups.nzoss.org.nz> Hi NZOSS, Linux.Conf.Au 2019 is being held in Christchurch, New Zealand at the end of January 2019 (21-25 January). Early Bird tickets are on sale *this month* (https://linux.conf.au/attend/tickets/) As usual at LCA, we (Simon Lyall and I) are running a System Administration Miniconf at LCA2019, and we're looking for your proposals for presentations: http://sysadmin.miniconf.org/cfp19.html Please pass this on anywhere else you think people might be interested. The LCA2019 Sysadmin Miniconf CFP text is included below for your convenience. Ewen PS: The Sysadmin Miniconf is part of LCA2019; you'll need a ticket to LCA2019 to attend/speak. Grab your ticket for LCA2019 while the Early Bird pricing is available :-) -=- cut here -=- Call for Presentations Linux.conf.au 2019 Systems Administration Miniconf There will be a one day mini conference on Linux Systems Administration held as part of linux.conf.au 2019. LCA2019 will be held in Christchurch, New Zealand on 21 - 25 January 2019. The organisers of the Systems Administration Miniconf would like to invite proposals for presentations to be delivered at the Miniconf. Please forward this CFP to your colleagues, peers, social networks, and other relevant mailing lists. Please help by encouraging submissions from people you would like to hear present at this Miniconf. This is our 13th Sysadmin Miniconf at Linux.conf.au. Previous presentations can be found at the website: https://sysadmin.miniconf.org/. Presentation Topics =================== We welcome talks on best current practice, new developments in Systems Administration, cutting edge techniques and technologies, and ways to better manage Linux environments large and small. Topics for presentations could include (but are not limited to): Virtualisation and Cloud Computing Kubernetes / Docker / Containers / Orchestration Infrastructure/Platform/Software as a Service (IAAS, PAAS, SAAS) Sysadmin Administration in a "serverless" environment (FAAS) DevOps and SysAdmin Culture Systems Administration Best Practice Monitoring and metrics. Collection, storage and presentation Networkng: IPv6, SDN (Software Defined Networking), performance DevOps, Configuration Management and provisioning Bootstrapping systems, Lifecycle Management Dealing with BYOD Backups in a virtual/distributed world Troubleshooting techniques Keeping legacy systems functioning War stories from the "Real World" Presentations should be of a technical nature and speakers should assume that members of the audience have at least a couple of years experience in professional Unix/Linux administration (many in the audience will have decades of experience). Format of Presentations ======================= We are now seeking proposals for presentations at the mini-conference. We have openings for: 15-25 minute short presentations 5-10 minute "lightning talks" Please note, due to the single day available (and whole-LCA opening before morning tea), we expect the majority of available timeslots to be 20 minutes or less, with possibly 1-2 slightly longer talks if there is space in the schedule. We have a general policy of accepting a high proportion of proposals but handing out relatively short timeslots. Please see previous years Miniconf schedules for examples of how the programme is organised. Submitting talks ================ Please note that in order to give a presentation or attend the Miniconf you must be registered (and paid up by the time the conference happens) for the main linux.conf.au conference. Presenting at the Miniconf does not entitle you to discounted or free registration at the main conference nor to priority with registration. Unfortunately the Miniconf has no budget for sponsorship of speakers. To submit a talk to the LCA2019 Sysadmin Miniconf, create an account on the LCA2019 website: https://linux.conf.au/dashboard create a speaker profile, and then select "SysAdmin Miniconf Talk" (in the "New Proposal" section of the Dashboard), or while logged into the LCA2019 site, go directly to: https://linux.conf.au/proposals/submit/sysadmin-miniconf/ Please pick a preferred length for your presentation from Short Presentation (15/20/25 minutes) or Lightning Talk (5/10 minutes) in the submission form; if you could do either (with more or less detail) use the Private Abstract field to describe the options and what you would prefer. In some cases we maybe able to add a few extra minutes to a few Short Presentations if there is any spare time left in the programme. Use the Private Abstract field to let us know a few more minutes would be useful for your presentation. Questions should be sent to: lca2019 at sysadmin.miniconf.org Dates and Deadlines =================== To encourage early submissions, priority (both of inclusion and scheduling) will be given to presentations submitted by 23:59 (any time zone) on 31st of October 2018. If you have a good presentation idea, please let us know early, even if you need time to finalise the presentation abstract. Please let us know directly if you need an early confirmation to assist you in arranging time off work or travel; we will do our best to help. 2018-10-31 - Deadline for early submissions 2018-11-18 - Deadline for submissions 2018-12-04 - LCA2019 Sysadmin Miniconf programme published 2019-01-21 - LCA2019 Sysadmin Miniconf held (Christchurch, NZ) Contact and Questions ===================== Please see our website at https://sysadmin.miniconf.org for more information on the miniconf, past presentations and presenting at it. If you have any questions please feel free to email the organisers at: lca2019 at sysadmin.miniconf.org -=- cut here -=- ―― View topic http://groups.nzoss.org.nz/r/topic/1uwhAyhI0xwJwbMnlKgBTZ Leave group mailto:openchat(a)groups.nzoss.org.nz?subject=Unsubscribe Start groups https://OnlineGroups.net -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

KDE Plasma 5.14 Released
by Peter Reutemann 09 Oct '18

09 Oct '18

'KDE has released Plasma 5.14 desktop. Among many other things, Plasma 5.14 simplifies managing multiple displays thanks to its new Display Configuration widget; Global Menus a la macOS now work also with GTK applications like GIMP; a new safeguard feature warns you if other users are logged in when you log out; and Discover now lets you install Snaps from all available channels (not just the default), orders software by release date, and shows package dependencies.' -- source: https://tech.slashdot.org/story/18/10/09/2159259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome 70's Upcoming Security Change Will Break Hundreds of Sites
by Peter Reutemann 09 Oct '18

09 Oct '18

'When Chrome 70 arrives on October 16th, it will drop trust for a major HTTPS certificate provider, putting hundreds of popular websites at risk of breaking. "Chrome 70 is expected to be released on or around October 16, when the browser will start blocking sites that run older Symantec certificates issued before June 2016, including legacy branded Thawte, VeriSign, Equifax, GeoTrust and RapidSSL certificates," reports TechCrunch. From the report: [D]espite more than a year to prepare, many popular sites are not ready. Security researcher Scott Helme found 1,139 sites in the top one million sites ranked by Alexa, including Citrus, SSRN, the Federal Bank of India, Pantone, the Tel-Aviv city government, Squatty Potty and Penn State Federal to name just a few. Ferrari, One Identity and Solidworks were named on the list but recently switched to new certificates, escaping any future outages. HTTPS certificates encrypt the data between your computer and the website or app you're using, making it near-impossible for anyone -- even on your public Wi-Fi hotspot -- to intercept your data. Not only that, HTTPS certificates prove the integrity of the the site you're visiting by ensuring the pages haven't been modified in some way by an attacker. Most websites obtain their HTTPS certificates from a certificate authority, which abide by certain rules and procedures that over time become trusted by web browsers. If you screw that up and lose their trust, the browsers can pull the plug on all of the certificates from that authority. For these reasons, Google stopped supporting Symantec certificates last year after it was found to be issuing misleading and wrong certificates, as well as allowing non-trusted organizations to issue certificates without the proper oversight.' -- source: https://it.slashdot.org/story/18/10/09/008210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Exposed Private Data of Hundreds of Thousands of Google+ Users and Then Opted Not To Disclose, Report Says
by Peter Reutemann 08 Oct '18

08 Oct '18

'Google exposed the private data of hundreds of thousands of users of the Google+ social network and then opted not to disclose the issue this past spring, in part because of fears that doing so would draw regulatory scrutiny and cause reputational damage, WSJ reported Monday, citing people briefed on the incident and documents. From the report: As part of its response to the incident, the Alphabet unit plans to announce a sweeping set of data privacy measures that include permanently shutting down all consumer functionality of Google+, the people said. The move effectively puts the final nail in the coffin of a product that was launched in 2011 to challenge Facebook and is widely seen as one of Google's biggest failures. A software glitch in the social site gave outside developers potential access to private Google+ profile data between 2015 and March 2018, [Editor's note: the link may be paywalled; alternative source] when internal investigators discovered and fixed the issue, according to the documents and people briefed on the incident. A memo reviewed by the Journal prepared by Google's legal and policy staff and shared with senior executives warned that disclosing the incident would likely trigger "immediate regulatory interest" and invite comparisons to Facebook's leak of user information to data firm Cambridge Analytica. Update: In an announcement Monday, Google said it was shutting down Google+ for consumers: We are shutting down Google+ for consumers. Over the years we've received feedback that people want to better understand how to control the data they choose to share with apps on Google+. So as part of Project Strobe, one of our first priorities was to closely review all the APIs associated with Google+. This review crystallized what we've known for a while: that while our engineering teams have put a lot of effort and dedication into building Google+ over the years, it has not achieved broad consumer or developer adoption, and has seen limited user interaction with apps. The consumer version of Google+ currently has low usage and engagement: 90 percent of Google+ user sessions are less than five seconds. Google+ still receives north of 200 million page views every month on the web, according to SimilarWeb, a third-party web analytics firm.' -- source: https://yro.slashdot.org/story/18/10/08/1710208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Greg Kroah-Hartman: Outside Phone Vendors Aren't Updating Their Linux Kernels
by Peter Reutemann 06 Oct '18

06 Oct '18

'"Linux runs the world, right? So we want to make sure that things are secure," says Linux kernel maintainer Greg Kroah-Hartman. When asked in a new video interview which bug makes them most angry, he first replies "the whole Spectre/Meltdown problem. What made us so mad, in a way, is we were fixing a bug in somebody else's layer!" One also interesting thing about the whole Spectre/Meltdown is the complexity of that black box of a CPU is much much larger than it used to be. Right? Because they're doing -- in order to eke out all the performance and all the new things like that, you have to do extra-special tricks and things like that. And they have been, and sometimes those tricks come back to bite you in the butt. And they have, in this case. So we have to work around that. But a companion article on Linux.com notes that "Intel has changed its approach in light of these events. 'They are reworking on how they approach security bugs and how they work with the community because they know they did it wrong,' Kroah-Hartman said." (And the article adds that "for those who want to build a career in kernel space, security is a good place to get started...") Kroah-Hartman points out in the video interview that "we're doing more and more testing, more and more builds," noting "This infrastructure we have is catching things at an earlier stage -- because it's there -- which is awesome to see." But security issues can persist thanks to outside vendors beyond their control. Linux.com reports: Hardening the kernel is not enough, vendors have to enable the new features and take advantage of them. That's not happening. Kroah-Hartman releases a stable kernel every week, and companies pick one to support for a longer period so that device manufacturers can take advantage of it. However, Kroah-Hartman has observed that, aside from the Google Pixel, most Android phones don't include the additional hardening features, meaning all those phones are vulnerable. "People need to enable this stuff," he said. "I went out and bought all the top of the line phones based on kernel 4.4 to see which one actually updated. I found only one company that updated their kernel," he said. "I'm working through the whole supply chain trying to solve that problem because it's a tough problem. There are many different groups involved -- the SoC manufacturers, the carriers, and so on. The point is that they have to push the kernel that we create out to people." "The good news," according to Linux.com, "is that unlike with consumer electronics, the big vendors like Red Hat and SUSE keep the kernel updated even in the enterprise environment. Modern systems with containers, pods, and virtualization make this even easier. It's effortless to update and reboot with no downtime."' -- source: https://linux.slashdot.org/story/18/10/06/1736258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

California Bans Default Passwords on Any Internet-Connected Device
by Peter Reutemann 06 Oct '18

06 Oct '18

'In less than two years, anything that can connect to the internet will come with a unique password -- that is, if it's produced or sold in California. From a report: The "Information Privacy: Connected Devices" bill that comes into effect on January 1, 2020, effectively bans pre-installed and hard-coded default passwords. It only took the authorities about two weeks to approve the proposal made by the state senate. The new regulation mandates device manufacturers to either create a unique password for each device at the time of production or require the user to create one when they interact with the device for the first time. According to the bill, it applies to any connected device, which is defined as a "physical object that is capable of connecting to the Internet, directly or indirectly, and that is assigned an Internet Protocol address or Bluetooth address."' -- source: https://it.slashdot.org/story/18/10/05/1814242 Good bye, "admin/admin"! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox To Support Google's WebP Image Format For a Faster Web
by Peter Reutemann 06 Oct '18

06 Oct '18

'Firefox has joined Google's WebP party, another endorsement for the internet giant's effort to speed up the web with a better image format. From a report: Google revealed WebP eight years ago and since then has built it into its Chrome web browser, Android phone software and many of its online properties in an effort to put websites on a diet and cut network data usage. But Google had trouble encouraging rival browser makers to embrace it. Mozilla initially rejected WebP as not offering enough of an improvement over more widely used image formats, JPEG and PNG. It seriously evaluated WebP but chose to try to squeeze more out of JPEG. But now Mozilla -- like Microsoft with its Edge browser earlier this week -- has had a change of heart. "Mozilla is moving forward with implementing support for WebP," the nonprofit organization said. WebP will work in versions of Firefox based on its Gecko browser engine, Firefox for personal computers and Android but not for iOS.' -- source: https://news.slashdot.org/story/18/10/05/1755247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Look at Facebook's Use of Systemd
by Peter Reutemann 06 Oct '18

06 Oct '18

'At an event this month (you can find the video of it here), Davide Cavalca, a production engineer at Facebook, spoke about the growing adoption of systemd at the data centers of the company. From a report: Facebook continues making use of systemd's many features inside their data centers. Some of their highlights for systemd use in 2018 includes: Facebook's servers have been relying on systemd for about the past two years. Facebook is using CentOS 7 everywhere from hosts to containers. While relying on CentOS 7, Facebook backports a lot of packages including new systemd releases, Meson, other dependencies, and of course new Linux kernel releases. Facebook is working on "pystemd" as a Python (Cython) wrapper on top of SD-BUS.' -- source: https://linux.slashdot.org/story/18/10/05/1717233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Is Embracing Android As the Mobile Version of Windows
by Peter Reutemann 03 Oct '18

03 Oct '18

'Microsoft unveiled a bunch of new hardware during a press event last night, but one of the most interesting announcements the company made was their new "Your Phone" app for Windows 10. Basically, the feature will let Android users mirror any app on their device to a Windows 10 desktop. The Verge's Tom Warren writes about how Microsoft is embracing Android as the mobile version of Windows: We've seen a variety of ways of bringing Android apps to Windows in recent years, including Bluestacks and even Dell's Mobile Connect software. This app mirroring is certainly easier to do with Android, as it's less restricted than iOS. Still, Microsoft's welcoming embrace of Android in Windows 10 with this app mirroring is just the latest in a number of steps the company has taken recently to really help align Android as the mobile equivalent of Windows. Microsoft Launcher is designed to replace the default Google experience on Android phones, and bring Microsoft's own services and Office connectivity to the home screen. It's a popular launcher that Microsoft keeps updating, and it's even getting support for the Windows 10 Timeline feature that lets you resume apps and sites across devices. All of this just reminds me of Windows Phone. It's only been three years since Microsoft launched its Lumia 950 Windows 10 Mobile device at a packed holiday hardware event. Windows Phone has vanished in the last couple of years, and Microsoft finally admitted Windows Phone was dead nearly a year ago. The software maker has now embraced the reality that people don't need Windows on a phone. Instead, it's embracing Android as the mobile version of Windows.' -- source: https://tech.slashdot.org/story/18/10/03/2051239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Alphabet's Intra App Encrypts DNS Queries To Help Users Bypass Online Censorship
by Peter Reutemann 03 Oct '18

03 Oct '18

'Catalin Cimpanu, writing for ZDNet: Jigsaw, a technology incubator created by Google and operated as a subsidiary under the Alphabet brand, has released today an Android app named Intra that can encrypt DNS queries as a protection against DNS manipulation at the ISP (internet service provider) level. DNS manipulation is one of the most common forms of online censorship used by oppressive regimes or unscrupulous ISPs, used to block access to news sites, information portals, social media platforms, undesirable software, and more. Intra protects against DNS manipulation by keeping DNS traffic hidden from third-parties with state-level surveillance capabilities, such as internet service providers in countries with autocratic regimes. Reports suggest that Alphabet tested the app with a few dozen political activists in Venezuela before the global roll-out.' -- source: https://yro.slashdot.org/story/18/10/03/2042219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ungoogled-chromium
by Lawrence D'Oliveiro 03 Oct '18

03 Oct '18

Even though the Chromium browser is Open Source, it still does a whole lot of communication with Google’s servers, when it’s built and when it runs. This project <https://github.com/Eloston/ungoogled-chromium> tries to strip out all of that, while preserving the user-visible behaviour as much as possible.

1 0

Aussie Law >> Maths
by Lawrence D'Oliveiro 02 Oct '18

02 Oct '18

"The laws of Australia prevail in Australia, I can assure you of that," [Malcolm Turnbull] said on Friday. "The laws of mathematics are very commendable, but the only law that applies in Australia is the law of Australia." <https://www.techdirt.com/articles/20170714/10385237789/aussie-prime-ministe…>

1 2

Who Needs Special Hardware Random Number Generators?
by Lawrence D'Oliveiro 02 Oct '18

02 Oct '18

The weak point in any encryption system has long been: how random are your random numbers? Providing special hardware for generating random numbers, special CPU instructions etc has always been open to the objection that their randomness could be subverted -- whether through some minor stupid mistake in implementation, or deliberately by certain powerful agencies -- and you would never know. Now, a new research paper <https://www.theregister.co.uk/2018/10/01/hardware_random_numbers/> proposes that normal CPU operation itself can be a source of random numbers. And the way these are obtained would in fact be very hard to subvert, since it is based on detecting subtle timing variations in the operations of various circuits. In other words, it is obtaining randomness from hardware that is not designed to be working randomly at all. And this should -- hopefully -- make the randomness very difficult to compromise.

1 0

NZ Customs Can Now Demand You Unlock Your Phone
by Lawrence D'Oliveiro 01 Oct '18

01 Oct '18

You can now face a $5,000 fine for not unlocking your phone if ordered to do so, when coming into NZ <https://www.theregister.co.uk/2018/10/01/nz_border_customs/>. Justice Minister Andrew Little says: “The bill provides for that power of search and examination, but in order to exercise that power, a customs officer, first of all, has to be satisfied, or at least to have a reasonable suspicion, that a person in possession of such a device—it would be a cellphone or a laptop or anything else that might be described as an 'e-device'—has been involved in criminal offending.” Howver, ... the Council of Civil Liberties criticised the “reasonable cause” protection as inadequate, because someone asked to unlock a device isn't told what that cause might be, and therefore has no way to challenge the request.

1 0

Five-Eyes Intelligence Services Choose Surveillance Over Security
by Lawrence D'Oliveiro 01 Oct '18

01 Oct '18

The “Five Eyes” intelligence group (which includes New Zealand) have issued a statement where they claim that the increasing use of secure encryption is endangering law and order and national security. Here is one of many reactions <https://www.schneier.com/blog/archives/2018/09/five-eyes_intel.html>. This whole claim has been repeated so many times it is getting tedious. This group, of all people, with access to the most qualified pool of cryptographic talent in the world, should be able to get an opinion from their own experts on whether this is doable or not -- and if it was, they could show us all how it’s done and make Bruce Schneier and all the rest of the open community of security researchers look like fools. But they won’t do that, because they can’t. Instead, we see this ongoing harping on the issue, as though it can magically be fixed by passing a law or two. The UK (among other countries) has already criminalized the failure to disclose decryption keys <https://en.wikipedia.org/wiki/Key_disclosure_law>, and decreed that forgetting the key is no excuse.

1 1

Wellywood’s Digital Edge Has Dulled
by Lawrence D'Oliveiro 01 Oct '18

01 Oct '18

You may have seen an item in the news lately about a report into the large amount of subsidies that the Government puts into the local film industry. This latest report says that these subsidies pay off in jobs and revenue elsewhere, but independent reviewers question this, saying such conclusions are very sensitive to initial assumptions <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=120795…>. This extract from one of the linked documents caught my eye: Weta Digital executives ... considered that 10 years ago they were at the forefront of technology and that studios were forced to use them to achieve particular effects, they said that this is no longer true: “the degrees of difference in technology are almost imperceptible”. It is no longer technical capability that wins work, it is price point; they consider themselves a price taker. “If the grant were to disappear tomorrow it would call into question the business itself…the subsidy allows us to compete.” There is “no scenario” where the US studios would pay 20% more for Weta Digital than its competitors. VFX have long been a commodity; it’s actually surprising that Weta Digital has managed to last this long, compared to, say, Rhythm & Hues, which went bust shortly after winning an Oscar for “Life Of Pi” <http://www.fresnobee.com/news/nation-world/national/article128729769.html>. I guess it’s all down to those Government subsidies...

1 1

PB Tech Pleads Guilty To Extended Warranty, Advertising Shenanigans
by Lawrence D'Oliveiro 01 Oct '18

01 Oct '18

PB Tech has admitted not properly informing customers of their rights over extended warranties, and also promoting a special offer on Apple watches to 100,000 people when it only had 14 in stock at that price. <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=120824…>

1 1

An Open Source Resistance Takes Shape as Tech Giants Race To Map the World
by Peter Reutemann 01 Oct '18

01 Oct '18

'Shadma Shaikh, reporting for FactorDaily: Chetan Gowda, 27, was speaking to a room full of students in IIIT Hyderabad for a workshop on OpenStreetMap for beginners organized by Swecha, a non-profit organization to support free software movement last month. There were close to 40 students in the room. Beginners often ask him: Why use open source maps when we already have Google Maps? For Gowda, it was the fact that Google Maps is a global, commercial product and did not capture local detail. Like the old banyan tree that was a major landmark in his hometown Hassan or public benches just outside the town where pedestrians could stop to catch a break or fire catchment areas in Bellandur lake in Bengaluru, India. "It was fascinating to add little but important details of my town to open maps," says Gowda who was introduced in 2013 to OSM or OpenStreetMap, a global community of mappers formed as a collaborative project to create a free editable map of the world in 2004. Since then he has been an active contributor to OpenStreetMap and has conducted many workshops in colleges and institutes to induct more people in the community. Gowda has made 8500 edits in the OpenStreetMap, mainly covering areas in Bengaluru, Hassan and Hyderabad. Gowda and a few other contributors from India are part of a tiny yet growing resistance movement which doesn't want giant corporations to own all the mapping data. For the average consumer, this may not seem like a big deal. But mapping is big business. The market opportunity for suppliers of mapping to the autonomous car industry is going to be worth over $24 billion by 2050, according to one estimate [PDF]. And that's just one industry. A study commissioned by Google in 2015 estimated that industries that run on top of the Global Positioning Satellite Systems and mapping generate nearly $73 billion in annual revenue. Worldwide, that industry is was estimated to generate $150- $270 billion in revenues. Although new research isn't available, with growing smartphone usage and the birth of companies such as Uber and many others it is safe to assume that the industry has only grown bigger. All the more reason why map data can't be held by only a few companies. With Google Maps beginning to charge small and medium-sized businesses and indie developers more for access to its platform, many have started to explore and switch to open source alternatives of Maps, and commercial services such as Here Maps. ' -- source: https://news.slashdot.org/story/18/10/01/1140259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

VideoLAN Announces Dav1d, a New Libre and Open Source AV1 Decoder
by Peter Reutemann 01 Oct '18

01 Oct '18

'Jean-Baptiste Kempf, president of VideoLan and developer of VLC media player, made the following announced Monday: AV1 is a new video codec by the Alliance for Open Media, composed of most of the important Web companies (Google, Facebook, Netflix, Amazon, Microsoft,...). AV1 has the potential to be up to 20% better than the HEVC codec, but the patents license is totally free, while HEVC patents licenses are insanely high and very confusing. The reference decoder for AV1 is great, but it's a research codebase, so it has a lot to improve. Therefore, the VideoLAN, VLC and FFmpeg communities have started to work on a new decoder, sponsored by the Alliance of Open Media. The goal of this new decoder is: be small, be as fast as possible, be very cross-platform, correctly threaded, libre and (actually) Open Source. Without further due, the code: https://code.videolan.org/videolan/dav1d ' -- source: https://news.slashdot.org/story/18/10/01/1946250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Diagnosing The Orion Health Buyout Deal
by Lawrence D'Oliveiro 01 Oct '18

01 Oct '18

This Herald article <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=121336…> reports that healthcare software maker Orion Health is selling off its only profitable division in a bid to get more capital to plough into its remaining businesses. What I found of note was in the answer to the last question in that article, “What went wrong?”: ... the company had faced a perfect storm as many of its Obamacare customers in the US (home to half Orion's revenue) ran out of money and started to cancel orders just as the company needed to invest heavily to move its software to the cloud. It didn't help that the health software Orion bought from Microsoft (which powers its Hospitals solution) turned out to be in much worse shape than it thought ...

1 0

Ubuntu Linux 18.10 Cosmic Cuttlefish Beta Now Available For Desktop, Cloud and Server Versions
by Peter Reutemann 01 Oct '18

01 Oct '18

'Roughly three weeks ahead of the scheduled release of Ubuntu Linux 18.10 "Cosmic Cuttlefish", the latest major update for the popular Linux distro, beta of all of its flavors -- desktop, cloud and server -- is now available for download. From a report: Codenamed 'Cosmic Cuttlefish,' 18.10 continues Ubuntu's proud tradition of integrating the latest and greatest open source technologies into a high-quality, easy-to-use Linux distribution. The team has been hard at work through this cycle, introducing new features and fixing bugs," says Adam Conrad, Software Engineer, Canonical. Conrad further says, "This beta release includes images from not only the Ubuntu Desktop, Server, and Cloud products, but also the Kubuntu, Lubuntu, Ubuntu Budgie, UbuntuKylin, Ubuntu MATE, Ubuntu Studio, and Xubuntu flavours. The beta images are known to be reasonably free of showstopper CD build or installer bugs, while representing a very recent snapshot of 18.10 that should be representative of the features intended to ship with the final release expected on October 18th, 2018."' -- source: https://linux.slashdot.org/story/18/09/30/1758245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Tim Berners-Lee Announces Solid, an Open Source Project Which Would Aim To Decentralize the Web
by Peter Reutemann 30 Sep '18

30 Sep '18

'Tim Berners-Lee, the founder of the World Wide Web, thinks it's broken and he has a plan to fix it. The British computer scientist has announced a new project that he hopes will radically change his creation by giving people full control over their data. Tim Berners-Lee: This is why I have, over recent years, been working with a few people at MIT and elsewhere to develop Solid, an open-source project to restore the power and agency of individuals on the web. Solid changes the current model where users have to hand over personal data to digital giants in exchange for perceived value. As we've all discovered, this hasn't been in our best interests. Solid is how we evolve the web in order to restore balance -- by giving every one of us complete control over data, personal or not, in a revolutionary way. Solid is a platform, built using the existing web. It gives every user a choice about where data is stored, which specific people and groups can access select elements, and which apps you use. It allows you, your family and colleagues, to link and share data with anyone. It allows people to look at the same data with different apps at the same time. Solid unleashes incredible opportunities for creativity, problem-solving and commerce. It will empower individuals, developers and businesses with entirely new ways to conceive, build and find innovative, trusted and beneficial applications and services. I see multiple market possibilities, including Solid apps and Solid data storage. Solid is guided by the principle of "personal empowerment through data" which we believe is fundamental to the success of the next era of the web. We believe data should empower each of us. Imagine if all your current apps talked to each other, collaborating and conceiving ways to enrich and streamline your personal life and business objectives? That's the kind of innovation, intelligence and creativity Solid apps will generate. With Solid, you will have far more personal agency over data -- you decide which apps can access it. In an interview with Fast Company, he shared more on Solid and its creation: "I have been imagining this for a very long time," says Berners-Lee. He opens up his laptop and starts tapping at his keyboard. Watching the inventor of the web work at his computer feels like what it might have been like to watch Beethoven compose a symphony: It's riveting but hard to fully grasp. "We are in the Solid world now," he says, his eyes lit up with excitement. He pushes the laptop toward me so I too can see. On his screen, there is a simple-looking web page with tabs across the top: Tim's to-do list, his calendar, chats, address book. He built this app -- one of the first on Solid -- for his personal use. It is simple, spare. In fact, it's so plain that, at first glance, it's hard to see its significance. But to Berners-Lee, this is where the revolution begins. The app, using Solid's decentralized technology, allows Berners-Lee to access all of his data seamlessly -- his calendar, his music library, videos, chat, research. It's like a mashup of Google Drive, Microsoft Outlook, Slack, Spotify, and WhatsApp. The difference here is that, on Solid, all the information is under his control. Every bit of data he creates or adds on Solid exists within a Solid pod -- which is an acronym for personal online data store. These pods are what give Solid users control over their applications and information on the web. Anyone using the platform will get a Solid identity and Solid pod. This is how people, Berners-Lee says, will take back the power of the web from corporations. Starting this week, developers around the world will be able to start building their own decentralized apps with tools through the Inrupt site. Berners-Lee will spend this fall crisscrossing the globe, giving tutorials and presentations to developers about Solid and Inrupt. "What's great about having a startup versus a research group is things get done," he says. These days, instead of heading into his lab at MIT, Berners-Lee comes to the Inrupt offices, which are currently based out of Janeiro Digital, a company he has contracted to help work on Inrupt. For now, the company consists of Berners-Lee; his partner John Bruce, who built Resilient, a security platform bought by IBM; a handful of on-staff developers contracted to work on the project; and a community of volunteer coders. Later this fall, Berners-Lee plans to start looking for more venture funding and grow his team. The aim, for now, is not to make billions of dollars. The man who gave the web away for free has never been motivated by money. Still, his plans could impact billion-dollar business models that profit off of control over data. It's not likely that the big powers of the web will give up control without a fight.' -- source: https://tech.slashdot.org/story/18/09/30/1122238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

NextGen: A Feature-Length Movie Done In Blender
by Lawrence D'Oliveiro 30 Sep '18

30 Sep '18

Some info here <https://www.youtube.com/watch?v=5TdmIpCAiKQ> about NextGen, an animated movie created by Canadian company Tangent Animation, and done almost entirely using the open-source Blender CG software. They recently sold the distribution rights for the rest of the world (outside China) to Netflix for USD30 million. There’s mention of some additional components (“Cryptomatte” and “Embree”) which are not (yet) part of the official Blender source code; I gather the plan is to merge them in at some point. The video description includes some useful links, including this one <https://www.youtube.com/watch?v=CqSEtTF8hPE> from the 2016 Blender conference, where the Tangent founders discuss why they moved away from Maya and decided to invest in Blender.

1 0

System76's Much-Anticipated Open Source 'Thelio' Linux Computer Will Be Available To Pre-Order Starting Next Month, But Shipping Date and Specs Remain Unclear
by Peter Reutemann 30 Sep '18

30 Sep '18

'Brian Fagioli, writing for BetaNews: When you buy a System76 computer today, you aren't buying a machine manufactured by the company. Instead, the company works with other makers to obtain laptops, which it then loads with a Linux-based operating system -- Ubuntu or its own Pop!_OS. There's nothing really wrong with this practice, but still, System76 wants to do better. The company is currently working to manufacture its own computers ("handcrafted") right here in the USA. By doing this, System76 controls the entire customer experience -- software, service, and hardware. This week, the company announces that the fruits of its labor -- an "open-source computer" -- will be available to pre-order in October. Now, keep in mind, this does not mean the desktop will be available next month. Hell, it may not even be sold in 2018. With that said, pre-ordering will essentially allow you to reserve your spot. To celebrate the upcoming computer, System76 is launching a clever animated video marketing campaign.' -- source: https://hardware.slashdot.org/story/18/09/30/1519240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

MX Player, a Video App Used By More Than 175 Million Users, Debuts OTT Service. Android Enthusiasts Express Concern.
by Peter Reutemann 30 Sep '18

30 Sep '18

MX Player, a video app which has been downloaded more than 500 million times across the globe, kickstarted its OTT (online video streaming) service in India, one of its largest markets, this week. MX Player, which is popular worldwide, has earned a loyal user base over the years for being the app that can run any video file you throw at it, even if your smartphone, tablet, or Android TV box doesn't have high-end specs or updated software. It was acquired by Times Internet, an India-based conglomerate this June, and now the big giant is beginning to show what it intends to do with the app. From a report: [...] All of these titles, including those produced by Times Internet, are now available to MX Player users in India at no charge, Karan Bedi, CEO of MX Player, told VentureBeat in an interview. Like most of Times Internet's properties, which include several TV channels and newspapers, MX Player will count on ads to generate revenue. Betting on ad-driven business model, a popular path in developing markets, could help MX Player quickly convince its existing user base to give the streaming offerings a try as it begins to compete in the Indian market. Star India's ad-supported service Hotstar, which offers about 80 percent of its catalog to customers for free, currently leads the video streaming market in the country. Going forward, Bedi said, the company remains committed to making investments in what made MX Player so popular among customers: The ability to play a plethora of video files on low-end devices. The company won't be bringing its new streaming offerings to the paid version of the MX Player app, MX Pro, he said. Additionally, MX Player's streaming offerings are limited to India, one of its largest markets, for now, although Bedi said the company is working on the right content catalog for other regions. Over at Android sub-reddit, where this story has been discussed, dozens of users expressed their concerns on the direction MX Player appears to be headed. -- source: https://tech.slashdot.org/story/18/09/30/1543213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Kernel Finally Nearing Support For The Apple Magic Trackpad 2, Thanks To a Google Employee
by Peter Reutemann 30 Sep '18

30 Sep '18

'Michael Larabel, writing for Phoronix: Apple announced the Magic Trackpad 2 almost three years ago to the day while the mainline Linux kernel will finally be supporting this multi-touch device soon. The Magic Trackpad 2 is a wired/wireless touchpad with haptic feedback support and is a much larger touchpad compared to the original Magic Trackpad. There unfortunately hasn't been any mainline Linux kernel support for the Magic Trackpad 2, but some out-of-tree options. [...] However, as seen by this bug report there have been plenty of people since 2015 interested in using the Magic Trackpad 2 on Linux. Fortunately, Sean O'Brien of Google's Chrome OS team has been working on Magic Trackpad 2 support with a focus on getting it mainlined. The patch, which was also reviewed by other Google/ChromeOS developers, is now up to its third and perhaps final revision.' -- source: https://linux.slashdot.org/story/18/09/30/1722239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Richard Stallman Says Linux Code Contributions Can't Be Rescinded
by Peter Reutemann 30 Sep '18

30 Sep '18

'Linux developers who contribute code to the kernel cannot rescind those contributions, according to the software programmer who devised the GNU General Public Licence version 2.0, the licence under which the kernel is released. Richard Stallman, the head of the Free Software Foundation and founder of the GNU Project, told iTWire in response to queries that contributors to a GPLv2-covered program could not ask for their code to be removed. "That's because they are bound by the GPLv2 themselves. I checked this with a lawyer," said Stallman, who started the free software movement in 1984. There have been claims made by many people, including journalists, that if any kernel developers are penalised under the new code of conduct for the kernel project -- which was put in place when Linux creator Linus Torvalds decided to take a break to fix his behavioural issues -- then they would ask for their code to be removed from the kernel... Stallman asked: "But what if they could? What would they achieve by doing so? They would cause harm to the whole free software community. The anonymous person who suggests that Linux contributors do this is urging them to [use a] set of nuclear weapons in pique over an internal matter of the development team for Linux. What a shame that would be." Slashdot reader dmoberhaus shared an article from Motherboard with more perspetives from Eric S. Raymond and LWN.net founder Jonathan Corbet, which also traces the origins of the suggestion. "[A]n anonymous user going by the handle 'unconditionedwitness' called for developers who end up getting banned through the Code of Conduct in the future to rescind their contributions to the Linux kernel 'in a bloc' to produce the greatest effect. "It is worth noting that the email address for unconditionedwitness pointed to redchan.it, a now defunct message board on 8chan that mostly hosted misogynistic memes, many of which were associated with gamergate."' -- source: https://news.slashdot.org/story/18/09/29/055210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Now Dominates Azure
by Peter Reutemann 28 Sep '18

28 Sep '18

'Three years ago, Mark Russinovich, CTO of Azure, Microsoft's cloud program, said, "One in four [Azure] instances are Linux." Then, in 2017, it was 40 percent Azure virtual machines (VM) were Linux. Today, Scott Guthrie, Microsoft's executive vice president of the cloud and enterprise group, said in an interview, "Slightly over half of Azure VMs are Linux. That's right. Microsoft's prize cloud, Linux, not Windows Server, is now the most popular operating system. Windows Server isn't going to be making a come back. Every month, Linux goes up," Guthrie said. And it's not just Azure users who are turning to Linux. "Native Azure services are often running on Linux," Guthrie added. "Microsoft is building more of these services. For example, Azure's Software Defined Network (SDN) is based on Linux." It's not just on Azure that Microsoft is embracing Linux. "Look at our simultaneous release of SQL Server on Linux. All of our projects now run on Linux," Guthrie said.' -- source: https://linux.slashdot.org/story/18/09/27/209211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Secretly Logs Users Into Chrome Whenever They Log Into a Google Site
by Peter Reutemann 27 Sep '18

27 Sep '18

'Catalin Cimpanu, writing for ZDNet: Starting with Chrome 69, whenever a Chrome user would access a Google-owned site, the browser would take that user's Google identity and log the user into the Chrome in-browser account system -- also known as Sync. This system, Sync, allows users to log in with their Google accounts inside Chrome and optionally upload and synchronize local browser data (history, passwords, bookmarks, and other) to Google's servers. Sync has been present in Chrome for years, but until now, the system worked independently from the logged-in state of Google accounts. This allowed users to surf the web while logged into a Google account but not upload any Chrome browsing data to Google's servers, data that may be tied to their accounts. Now, with the revelations of this new auto-login mechanism, a large number of users are angry that this sneaky modification would allow Google to link that person's traffic to a specific browser and device with a higher degree of accuracy. That criticism proved to be wrong, as Google engineers have clarified on Twitter that this auto-login operation does not start the process of synchronizing local data to Google's servers, which will require a user click. Furthermore, they also revealed that the reason why this mechanism was added was for privacy reasons in the first place. Chrome engineers said the auto-login mechanism was added in the browser because of shared computers/browsers. Well-respected cryptographer Matthew Green was disappointed by the move. In a post, he wrote: [...] In the rest of this post, I'm going to talk about why this matters. From my perspective, this comes down to basically four points: 1. Nobody on the Chrome development team can provide a clear rationale for why this change was necessary, and the explanations they've given don't make any sense. 2. This change has enormous implications for user privacy and trust, and Google seems unable to grapple with this. 3. The change makes a hash out of Google's own privacy policies for Chrome. 4. Google needs to stop treating customer trust like it's a renewable resource, because they're screwing up badly.' -- source: https://tech.slashdot.org/story/18/09/24/1351251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Password Managers Can Be Tricked Into Believing That Malicious Android Apps Are Legitimate
by Peter Reutemann 26 Sep '18

26 Sep '18

'A new academic study published today reveals that Android-based password managers have a hard time distinguishing between legitimate and fake applications, leading to easy phishing scenarios. From a report: The study looked at how password managers work on modern versions of the Android OS, and which of the OS features attackers can abuse to collect user credentials via phishing attacks carried out via fake, lookalike apps. What the research team found was that password managers, initially developed for desktop browsers, aren't as secure as their desktop versions. The problem comes from the fact that mobile password managers have a hard time associating a user's stored website credentials with a mobile application and then creating a link between that website and an official app. [...] Researchers say they tested the way five Android password managers create internal maps (connections) between a locally installed app and legitimate internet sites and found that four of the five were vulnerable to abuse. Android versions of password managers from Keeper, Dashlane, LastPass, and 1Password were found to be vulnerable and have prompted the user to auto-fill credentials on fake apps during tests. Researchers found that Google's Smart Lock app did not fall for this fake package name trick, and the reason was because it used a system named Digital Asset Links to authenticate and connect apps to a particular online service.' -- source: https://it.slashdot.org/story/18/09/26/1534203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Vivaldi 2.0 Desktop Browser Featuring Expanded Customization, Sync Across Devices and Privacy Tools Released [Q&A With Founder]
by Peter Reutemann 26 Sep '18

26 Sep '18

'Vivaldi announced Wednesday it has released a major update to its namesake desktop web browser, remaining as one of the rare companies that is still attempting to fight Google's monopoly in the space. Major features in Vivaldi 2.0 include: - Syncing browsers across computers:Version 2.0 allows users to sync data, including bookmarks, passwords, autofill information, and history. Vivaldi uses its own servers to store the data, which is all encrypted end-to-end. - Panels: These are expandable, multi-tasking dashboards that can be opened in the sidebar. - Tab management: Additional features are included that allow for better searching through tabs, stacking them, and even renaming them. - History: Offers new ways to track your usage, including generating statistics and a visual history feature. Vivaldi was founded by Jon von Tetzchner, who also co-founded Opera and served as its chief executive for a number of years. Jon has been vocal about what many find unfair tactics employed by Google and Microsoft to aggressively expand the user bases of their respective browsers.' -- source: https://tech.slashdot.org/story/18/09/26/0713254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fedora 29 Beta Now Available For Download With Improved Raspberry Pi Support
by Peter Reutemann 25 Sep '18

25 Sep '18

'The Fedora Project announced Tuesday the beta availability of Fedora 29 -- the latest version of the free and open-source Fedora OS. From a report: It features updated packages, improved support for Raspberry Pi, and more. "Highlighting Fedora 29 Beta is the addition of modularity across all Fedora editions. First delivered in Fedora 28 Server, modularity enables multiple versions of the same software (like Node.js) to be selected on a per-system basis, with parallel installation done through containers. This can provide some users the ability to use tried-and-true versions of software while enabling other users to work with just-released innovation without impacting the overall stability of the Fedora operating system," says Matthew Miller, Fedora Project Leader. Miller further says, "The importance of ARM to IoT has not been lost on Fedora, and Fedora 29 Beta aims to make the Fedora operating system a home for both ARM and IoT. These features start with enhanced ZRAM support for swap on ARMv7 and aarch64, which can improve the performance and reliability of Fedora 29 Beta on ARM Single Board Computers, like the Raspberry Pi. These devices are used by 'makers' and in developmental IoT solutions."' -- source: https://linux.slashdot.org/story/18/09/25/1939240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Monitor Will Inform You of Data Breaches
by Peter Reutemann 25 Sep '18

25 Sep '18

'Earlier this year, Mozilla announced Firefox Monitor, a service that will inform you if your online accounts were hacked in a recent data breach. It's now available to general public. A report adds: For the new security-focused tool, Mozilla partnered with Troy Hunt, the renowned security expert behind Have I Been Pwned? (HIBP), which is a database of data breaches that allows anyone to discover whether one of their online accounts has been compromised. The first iteration of Firefox Monitor is, for all intents and purposes, a clone of HIBP. After you enter your email address and hit the scan button, you're told which online services have leaked your personal details (if any). You can also sign up to be notified of any future data breaches involving one or more of your email addresses.' -- source: https://tech.slashdot.org/story/18/09/25/1928234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Slack Buys and Shuts Down Intelligent Email App Astro
by Peter Reutemann 25 Sep '18

25 Sep '18

Since we discussed matrix.org at last night's meeting, this might be of interest: 'Slack has acquired email app company Astro to incorporate it into Slack channels. As a result, Astro is shutting down its Mac, iOS, Android, Alexa and Slack apps. They're no longer taking new users and existing ones will lose access on October 10th. Engadget reports: The company said that with over 50 million channels created to date, they're increasingly becoming the platform through which teams collaborate. "But we all know that email is still a very important tool in business communication," said Slack. "We've taken some steps to make it possible to integrate email into Slack, but now we're in a position to make that interoperability much simpler and much, much more powerful." Last year, Astro launched its Astrobot Slack app, which let users manage their emails and check their Office 365 or Google calendars from within Slack. It also allowed them to do one search to pull up results from both Slack and email. "As we explored with Slack how to bring together messaging, email and calendar, it became evident that we would have the biggest impact on workplace communications and realize our original vision by joining Slack," the company said. ' -- source: https://tech.slashdot.org/story/18/09/24/2051256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Sky TV Wants ISPs To Block Pirate Sites
by Lawrence D'Oliveiro 25 Sep '18

25 Sep '18

From <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=121313…>: Sky says ISPs should introduce blocking, because other countries do it. But it doesn’t mention how effective such blocks actually are(n’t). Also, it appears 5% of NZers have discovered the usefulness of Kodi boxes. The article nicely points out one problem with trying to block some of these “pirate” sites: Sky has also taken at least a dozen cases against individuals who accessed illegal Facebook streams of Joseph Parker fights - although it only sought token costs, not damages. However, while Sky's action over illegal Parker fight streaming has been successful, it also illustrates the complications of Sky's website blocking request. It is unlikely any ISP would want to block Facebook.

1 0

topic(s) for this month's meeting?
by Peter Reutemann 23 Sep '18

23 Sep '18

Hi everyone In all that Alexa excitement at the last meeting, I completely forgot to figure out topic/speaker for this month's meeting. Anybody keen on presenting or an interesting topic to discuss? Is actually anybody running the latest 4.19 kernel and noticed significant performance drops (thanks to specter/meltdown)? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 4

Cloudflare Promotes The InterPlanetary File System
by Lawrence D'Oliveiro 19 Sep '18

19 Sep '18

Content-distribution company Cloudflare is trying to encourage use of the InterPlanetary File System (IPFS) as a way to do distributed hosting of static content <https://blog.cloudflare.com/distributed-web-gateway/>. Instead of using host-specific URLs to find what you want, you specify hashes for the items, and it finds them wherever they are, across all the available IPFS nodes. What Cloudflare is doing is offering an IPFS “gateway”, which means you put the hash into a URL pointing at a Cloudflare server to specify the item. That way you don’t have to set up an IPFS node yourself. Found from this news item <https://www.theregister.co.uk/2018/09/18/cloudflare_backs_interplanetary_fi…>.

1 0

Ampere’s ARM Server Shipping At Last
by Lawrence D'Oliveiro 18 Sep '18

18 Sep '18

A 32-core, 64-bit ARMv8 machine running at up to 3.3GHz in turbo mode is apparently now available <https://www.theregister.co.uk/2018/09/18/ampere_shipping/>. 125W sounds a pretty modest draw for such a grunty machine. And only a 3-figure price tag, too (OK, maybe 4 figures in NZD).

1 0

A Property Owner Can Be Forced To Trim Trees That Block Wi-Fi
by Lawrence D'Oliveiro 18 Sep '18

18 Sep '18

A recent High Court judgement <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=121272…> has ruled that a neighbour can force you to trim the trees on your property if they block their wireless Internet access. The article notes that this was more of an issue with the 2.6GHz frequency being used for this connection than it might have been for the 700MHz band employed by other providers.

1 0

Amazon Plans To Release At Least 8 New Alexa-Powered Devices, Including A Microwave, Amplifier, and In-Car Gadget
by Peter Reutemann 18 Sep '18

18 Sep '18

'Amazon is planning to release at least 8 new voice-controlled hardware devices before the end of the year, according to CNBC. "The devices include, among others, a microwave oven, an amplifier, a receiver, a subwoofer, and an in-car gadget, people familiar with the matter said," reports CNBC. "All of the devices will be Alexa-enabled, meaning they can easily connect to the voice assistant. Some of the devices will also have Alexa built in." From the report: Amazon is expected to reveal some of these devices at an event later this month, according to an internal document describing the plans. The new devices reflect Amazon's ambition to make its Alexa voice technology ubiquitous by focusing on areas where people spend most of their time -- at home and in the car. Alexa was initially considered a geeky experiment at Amazon. Now it is now one of the most popular voice assistants, leading the growth of the burgeoning smart speaker market, which is expected to be worth $30 billion by 2024, according to Global Market Insights. ' -- source: https://tech.slashdot.org/story/18/09/17/2149214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Vulnerability in WebKit Crashes and Restarts iPhones and iPads
by Peter Reutemann 16 Sep '18

16 Sep '18

'Catalin Cimpanu, writing for ZDNet: A security researcher has discovered a vulnerability in the WebKit rendering engine used by Safari that crashes and restarts the iOS devices -- iPhones and iPads. The vulnerability can be exploited by loading an HTML page that uses specially crafted CSS code. The CSS code isn't very complex and tries to apply a CSS effect known as backdrop-filter to a series of nested page segments (DIVs). Backdrop-filter is a relative new CSS property and works by blurring or color shifting to the area behind an element. This is a heavy processing task, and some software engineers and web developers have speculated that the rendering of this effect takes a toll on iOS' graphics processing library, eventually leading to a crash of the mobile OS altogether. ' -- source: https://apple.slashdot.org/story/18/09/16/239226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Linux Kernel Has Grown By 225, 000 Lines of Code This Year, With Contributions From About 3, 300 Developers
by Peter Reutemann 16 Sep '18

16 Sep '18

'Here's an analysis of the Linux kernel repository that attempts to find some fresh numbers on the current kernel development trends. He writes: The kernel repository is at 782,487 commits in total from around 19.009 different authors. The repository is made up of 61,725 files and from there around 25,584,633 lines -- keep in mind there is also documentation, Kconfig build files, various helpers/utilities, etc. So far this year there has been 49,647 commits that added 2,229,836 lines of code while dropping 2,004,759 lines of code. Or a net gain of just 225,077 lines. Keep in mind there was the removal of some old CPU architectures and other code removed in kernels this year so while a lot of new functionality was added, thanks to some cleaning, the kernel didn't bloat up as much as one might have otherwise expected. In 2017 there were 80,603 commits with 3,911,061 additions and 1,385,507 deletions. Given just over one quarter to go, on a commit and line count 2018 might come in lower than the two previous years. Linus Torvalds remains the most frequent committer at just over 3% while the other top contributions to the kernel this year are the usual suspects: David S. Miller, Arnd Bergmann, Colin Ian King, Chris Wilson, and Christoph Hellwig. So far in 2018 there were commits from 3,320 different email addresses. This is actually significantly lower than in previous years.' -- source: https://linux.slashdot.org/story/18/09/16/172217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Distro Elive Emerges Alive After 8-Year Hibernation
by Peter Reutemann 11 Sep '18

11 Sep '18

'Designed to run on minimal hardware, Elive is very much a passion project of its leader, Samuel F Baggen. Based on Debian, the first version took a bow in 2005. The second stable version made an appearance in 2010 and it has been a long eight years for the third stable version to become available. The Register: Elive has an impressively low bar to entry, with hardware requirements for the distribution coming in at 256 MB RAM and a 500 MHz CPU, meaning that some very elderly silicon is theoretically going to be able to enjoy the highly polished Enlightenment desktop. "Theoretically" because after The Register took Elive 3.0.0 out for a spin on a relatively low-powered laptop, we'd frankly baulk at running it on anything much slower than a 533MHz Core 2 with at least 512 MB RAM. However, the Enlightenment UI is undeniably an attractive desktop, particularly if a macOS-alike dock is your thing, and runs at an impressive lick even on hardware that lacks graphics acceleration. At its core, Elive is based on the Debian 8 distribution (aka Jessie), using the 3.16 kernel and version 0.17.6 of the Enlightenment X11 Window Manager. It comes replete with a full set of applications, including the ubiquitous LibreOffice and Gimp, along with a variety of productivity and entertainment tools, some of which are Elive's own. Unlike the previous version of Elive, 3.0.0 removes the requirement of donating to the project in order to install the thing locally (although Baggen was quick to tell The Reg that cost-free alternatives existed, but often with annoying processes).' -- source: https://linux.slashdot.org/story/18/09/11/1121223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Exploit Vendor Drops Tor Browser Zero-Day on Twitter
by Peter Reutemann 11 Sep '18

11 Sep '18

'Zerodium, a company that buys and sells vulnerabilities in popular software, has published details today on Twitter about a zero-day vulnerability in the Tor Browser, a Firefox-based browser used by privacy-conscious users for navigating the web through the anonymity provided by the Tor network. The vulnerability is a bypass of the NoScript extension that's included by default with all Tor Browser distributions. Once bypassed, an attacker can run malicious code inside the Tor Browser, code that under certain circumstances would have been stopped by NoScript. "This Tor Browser exploit was acquired by Zerodium many months ago as a zero-day and was shared with our government customers," Zerodium CEO Chaouki Bekrar told ZDNet in an interview. "We have decided to disclose this exploit as it has reached its end-of-life and it's not affecting Tor Browser version 8 which was released last week." The NoScript extension released a patch in record time today to fix the vulnerability, two hours after Zerodium dropped its code on Twitter.' -- source: https://tech.slashdot.org/story/18/09/10/216238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Working On Google Translate Integration In Firefox
by Peter Reutemann 10 Sep '18

10 Sep '18

' Back in 2014, Mozilla partnered with Bing to translate webpages via Firefox in a similar fashion to Chrome's implementation of Google Translate. The company also added support for Yandex Translate in Firefox 41 in mid-2015, but it went all dark soon after and very few updates were issued. Now, Mozilla is finally starting to add support for Google Translate to the translation engine built into Firefox. gHacks reports: While the feature is not fully functional yet, it is an indicator that Mozilla has not forgotten the translate feature completely. Users who enable the translate functionality in Firefox on about:config will notice that Google is the selected translation engine. Google Translate cannot be used currently in Firefox; the browser throws an error message when you hit the translate button in the UI. Bing and Yandex don't seem to work either at this point in time even though Firefox seems to try and translate the page. The "there has been an error translating this page" error is thrown eventually as well. Google Translate requires API access keys and that is usually only available if companies or users pay for the key. It is unclear if Mozilla plans to make a deal with Google or if users will be required to use their own API keys for the functionality. The latter would surely be very limiting. ' -- source: https://tech.slashdot.org/story/18/09/10/0238218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Worries Arise About Security of New WebAuthn Protocol
by Peter Reutemann 10 Sep '18

10 Sep '18

'"A team of security researchers has raised the alarm about some cryptography-related issues with the newly released WebAuthn passwordless authentication protocol," reports ZDNet. "The new WebAuthn protocol will allow users of a device -- such as a computer or a smartphone -- to authenticate on a website using a USB security key, a biometric solution, or his computer or smartphone's password." But researchers say that because WebAuthn uses weak algorithms for the operations of registering a new device, they can pull off some attacks against it. "If converted into a practical exploit, the ECDAA attacks discussed in the article would allow attackers to steal the key from a [server's] TPM, which would allow attackers to effectively clone the user's hardware security token remotely," Arciszewski, one of the researchers, told ZDNet. "The scenarios that follow depend on how much trust was placed into the hardware security token," he added. "At minimum, I imagine it would enable 2FA bypasses and re-enable phishing attacks. However, if companies elected to use hardware security tokens to obviate passwords, it would allow direct user impersonation by attackers." Attacks aren't practical, and experts say the root cause relies in badly written documentation that may fool some implementers into supporting the old algorithms instead of newer and more solid ones. The FIDO Alliance was notified and has started work on updating its docs so it won't look like it's recommending ECDAA or RSASSA-PKCS1-v1_5. "PKCS1v1.5 is bad. The exploits are almost old enough to legally drink alcohol in the United States," Arciszewski said.' -- source: https://it.slashdot.org/story/18/09/10/0227233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Popular VPNs Contained Code Execution Security Flaws, Despite Patches
by Peter Reutemann 10 Sep '18

10 Sep '18

'Researchers have uncovered vulnerabilities in popular virtual private network (VPN) software, ProtonVPN and NordVPN, which can lead to the execution of arbitrary code by attackers. From a report: Last week, Cisco Talos security researchers said the security flaws, CVE-2018-3952 and CVE-2018-4010, permit code execution by attackers on Microsoft Windows machines. The vulnerabilities are similar to a Windows privilege escalation security flaw uncovered by VerSprite, which is tracked as CVE-2018-10169. Security patches were applied in April by both clients to resolve the original security hole, but according to Talos, "despite the fix, it is still possible to execute code as an administrator on the system." The initial vulnerability was caused by similar design issues in both clients. The interface for both NordVPN and ProtonVPN execute binaries with the permission of a logged-in user, and this includes the selection of a VPN configuration option, such as a desired VPN server location. This information is sent to a service when "connect" is clicked by way of an OpenVPN configuration file. However, VerSprite was able to create a crafted OpenVPN file which could be sent to the service, loaded, and executed.' -- source: https://yro.slashdot.org/story/18/09/10/118217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Nearly Half of American Households Will Own a Smart Speaker by 2019, Study Says
by Peter Reutemann 10 Sep '18

10 Sep '18

'Almost half of American households will have a smart speaker by next year, according to a new study from Adobe. From a report: The study, released Monday, finds that 32% of the country already owns a smart speaker and another 16% plan on getting one this holiday season. And just as importantly, people are using those speakers. "Technology trends come and go, but we think voice is here to stay," said Colin Morris, director of product management for Adobe Analytics, in a statement. "Consumers continue to embrace voice as a means to engage their devices and the Internet. It's a trend that has fundamentally changed the face of computing." A notable indicator of the growing popularity of the speakers is how comfortable people are talking to the device in front of others. And that number is on the rise: 72% of smart speaker owners say they use voice assistants in front of others. (Only 29% of people without a smart speaker are comfortable with doing so.)' -- source: https://tech.slashdot.org/story/18/09/10/1833235 I thought, that this would be of interest, due to our Alexa topic last month. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

9 Useful Examples of Touch Command in Linux
by Peter Reutemann 10 Sep '18

10 Sep '18

'Touch command in Linux is used for changing file timestamps however one of the most common usages of touch command includes creating a new empty file. With the touch command, you can change access, modify and change time of files and folders in Linux. You can update the timestamps or modify them to a date in the past.' -- source: https://linuxhandbook.com/touch-command/ To be honest, I only ever use it to create an empty file... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Hollywood goes open source
by Peter Reutemann 10 Sep '18

10 Sep '18

'Out of 200 of the most popular movies of all time, the top 137 were either visual-effects driven or animated. What did many of these blockbusters have in common? They were made with open-source software. That was the message David Morin, chairman of the Joint Technology Committee on Virtual Production, brought to The Linux Foundation's Open Source Summit in Vancouver, Canada. To help movie makers bring rhyme and reason to open-source film-making, The Linux Foundation had joined forces with The Academy of Motion Picture Arts and Sciences to form the Academy Software Foundation. The academy is meant to be a neutral forum for open-source developers both in the motion picture and broader media industries to share resources and collaborate on technologies for image creation, visual effects, animation, and sound. The founding members include Blue Sky Studios, Cisco, DreamWorks Animation, Epic Games, Google Cloud, Intel, Walt Disney Studios, and Weta Digital. It's a true marriage of technology and media-driven businesses.' -- source: https://www.zdnet.com/article/hollywood-goes-open-source/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Beta Release Nears For BeOS-inspired Open Source OS Haiku
by Peter Reutemann 09 Sep '18

09 Sep '18

'Just over 17 years since the project launched, and more than 18 years since the last release of the operating system that inspired it, the open source Haiku OS is nearing a beta release.' -- source: https://tech.slashdot.org/story/18/09/08/2032253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Despite 'Painful' Spectre Response, Linus Torvalds Says He Still Loves Speculative Execution
by Peter Reutemann 09 Sep '18

09 Sep '18

'At this year's Open Source Summit, Linus Torvalds sat for a wide-ranging "keynote" interview with Dirk Hohndel, chief open source officer at VMWare, which has been partially transcribed below. And Linus explained, among other things, why the last merge window was harder than others: One of the issues we have is when we've had these hardware security issues, and they've kept happening now, the last year -- they're kept under wraps. So we knew about the issue for the last several months, but because it was secret and we weren't allowed to talk about it, we couldn't do our usual open development model. We do the best we can, and people really care deeply about getting a good product out, but when you have to do things in secret, and when you can't use all the nice infrastructure for development and for testing that we have for all the usual code, it just is way more painful than it should be. And then that just means that, especially when the information becomes public during what is otherwise a busy period anyway, it's just annoying... I still love speculative execution. Don't get me wrong. I used to work for a CPU company. We did it in software, back when I worked there. I think a CPU has to do speculative execution. It's somewhat sad that then people didn't always think about or didn't always heed the warnings about what can go wrong when you take a few shortcuts in the name of making it slightly simpler for everybody, because you're going to throw away all that work anyway, so why bother to do it right. And that's when the security -- every single security problem we've had has been basically of that kind, where people knew that "Hey, this is speculative work. If something goes wrong we'll throw all the data away, so we don't need to be as careful as we would otherwise." I think it was a good lesson for the industry, but it was certainly not a fun lesson for us on the OS side, where we had to do a lot of extra work for problems that weren't our problems. It feels somehow unfair. I mean, when we have a security bug that was our own fault, it's like, "Okay, it was us screwing up. It's fair that we have to do all the work to then fix our own bugs." But it feels slightly less fair when you have to fix somebody else's... "The good news -- I mean the really good news, and I'm serious about this -- is that the bugs have become clearly more and more esoteric," Linus adds. "So it impacts fewer and fewer cases, and clearly hardware people at Intel and other places are now so aware of it that I'm hoping we're really getting to the dregs of the hardware security bugs, and going forward we'll have much fewer of them. I think we're going to the better days, when A.) we got the bugs fixed, and B.) people were thinking about them beforehand."' -- source: https://linux.slashdot.org/story/18/09/09/0048248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Booting Debian Jessie On An SGI UV-1000 Supercomputer
by Lawrence D'Oliveiro 07 Sep '18

07 Sep '18

Just one of several YouTube vids showing a supercomputer run a stock-standard Linux kernel <https://www.youtube.com/watch?v=v8hKjPh5SVo>. Note the part where it says “System RAM: 2096630MB”.

1 0

Tor Browser Gets a Redesign, Switches To New Firefox Quantum Engine
by Peter Reutemann 06 Sep '18

06 Sep '18

'The Tor Browser has rolled out a new interface with the release of v8. From a report: The Tor Browser has always been based on the Firefox codebase, but it lagged behind a few releases. Mozilla rolled out a major overhaul of the Firefox codebase in November 2017, with the release of Firefox 57, the first release in the Firefox Quantum series. Firefox Quantum came with a new page rendering engine, a new add-ons API, and a new user interface called the Photon UI. Because these were major, code-breaking changes, it took the smaller Tor team some time to integrate all of them into the Tor Browser codebase and make sure everything worked as intended. The new Tor Browser 8, released yesterday, is now in sync with the most recent version of Firefox, the Quantum release, and also supports all of its features. This means the Tor Browser now uses the same modern Photon UI that current Firefox versions use, it supports the same speed-optimized page rendering engine and has also dropped support for the old XUL-based add-ons system for the new WebExtensions API system used by Chrome, Opera, Vivaldi, Brave, and the rest of the Chromium browsers.' -- source: https://yro.slashdot.org/story/18/09/06/1651255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

400, 000 Websites Vulnerable Through Exposed .git Directories
by Peter Reutemann 06 Sep '18

06 Sep '18

'Open .git directories are a bigger cybersecurity problem than many might imagine, at least according to a Czech security researcher who discovered almost 400,000 web pages with an open .git directory possibly exposing a wide variety of data. From a report: Vladimir Smitka began his .git directory odyssey in July when he began looking at Czech websites to find how many were improperly configured and allow access to their .git folders within the file versions repository. Open .git directories are a particularly dangerous issue, he said, because they can contain a great deal of sensitive information. "Information about the website's structure, and sometimes you can get very sensitive data such as database passwords, API keys, development IDE settings, and so on. However, this data shouldn't be stored in the repository, but in previous scans of various security issues, I have found many developers that do not follow these best practices," Smitka wrote. Smitka queried 230 million websites to discover the 390,000 allowing access to their .git directories. The vast majority of the websites with open directories had a .com TLD with .net, .de, .org and uk comprising most of the others.' -- source: https://tech.slashdot.org/story/18/09/06/1954253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Shutter screenshotting application - no edit button
by Peter Reutemann 06 Sep '18

06 Sep '18

Hi everyone In case you're a Shutter user for capturing screenshots, you may have noticed that the "Edit" button in the main window is disabled. Apparently, shutter hasn't been updated for a while and it is missing some older libraries, like on my Linux Mint 18. However, this is easily fixed: https://itsfoss.com/shutter-edit-button-disabled/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 62 Arrives With Variable Fonts, Automatic Dark Theme on macOS, and Better Scrolling on Android
by Peter Reutemann 05 Sep '18

05 Sep '18

'Mozilla today released Firefox 62 for Windows, Mac, Linux, and Android. The release builds on Firefox Quantum, which the company calls "by far the biggest update since Firefox 1.0 in 2004." Version 62 brings variable fonts, automatic dark theme on macOS, and better scrolling on Android. Firefox 62 for the desktop is available for download now on Firefox.com, and all existing users should be able to upgrade to it automatically. As always, the Android version is trickling out slowly on Google Play. The latest iOS version is available on Apple's App Store.' -- source: https://news.slashdot.org/story/18/09/05/1423259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Official Chrome Extension of Cloud Storage Service Mega Caught Stealing Passwords, Cryptocurrency Private Keys
by Peter Reutemann 05 Sep '18

05 Sep '18

'The official Chrome extension for the MEGA.nz file sharing service has been compromised with malicious code that steals usernames and passwords, but also private keys for cryptocurrency accounts, ZDNet reports. From the report: The malicious behavior was found in the source code of the MEGA.nz Chrome extension version 3.39.4, released as an update earlier today. Google engineers have already intervened and removed the extension from the official Chrome Web Store, and also disabled the extension for existing users. According to an analysis of the extension's source, the malicious code triggered on sites such as Amazon, Google, Microsoft, GitHub, the MyEtherWallet and MyMonero web wallet services, and the IDEX cryptocurrency trading platform. The malicious code would record usernames, passwords, and other session data that attackers would need to log in and impersonate users. If the website managed cryptocurrency, the attacker would also extract the private keys needed to access users' funds.' -- source: https://it.slashdot.org/story/18/09/05/1841240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mobile Spyware Maker mSpy Leaks Millions of Sensitive Records
by Peter Reutemann 05 Sep '18

05 Sep '18

'mSpy, the makers of a software-as-a-service product that claims to help more than a million paying customers spy on the mobile devices of their kids and partners, has leaked millions of sensitive records online, including passwords, call logs, text messages, contacts, notes and location data secretly collected from phones running the stealthy spyware. Krebs On Security reports: Less than a week ago, security researcher Nitish Shah directed KrebsOnSecurity to an open database on the Web that allowed anyone to query up-to-the-minute mSpy records for both customer transactions at mSpy's site and for mobile phone data collected by mSpy's software. The database required no authentication. Before it was taken offline sometime in the past 12 hours, the database contained millions of records, including the username, password and private encryption key of each mSpy customer who logged in to the mSpy site or purchased an mSpy license over the past six months. The private key would allow anyone to track and view details of a mobile device running the software, Shah said. In addition, the database included the Apple iCloud username and authentication token of mobile devices running mSpy, and what appear to be references to iCloud backup files. Anyone who stumbled upon this database also would have been able to browse the Whatsapp and Facebook messages uploaded from mobile devices equipped with mSpy. Other records exposed included the transaction details of all mSpy licenses purchased over the last six months, including customer name, email address, mailing address and amount paid. Also in the data set were mSpy user logs -- including the browser and Internet address information of people visiting the mSpy Web site. ' -- source: https://yro.slashdot.org/story/18/09/04/2236213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome 69 Arrives With Revamped Design, More Powerful Omnibox, and Better Password Manager
by Peter Reutemann 04 Sep '18

04 Sep '18

'Google today launched Chrome 69 for Windows, Mac, and Linux, Android, and iOS, just a few days after the browser's 10-year anniversary. The release includes a new design, more powerful omnibox, updated password manager, more accurate autofill, plenty of developer-specific changes, and a slew of security improvements. You can update to the latest version now using Chrome's built-in updater, download it directly from google.com/chrome, or grab it from Google Play and Apple's App Store.' -- source: https://tech.slashdot.org/story/18/09/04/1711250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

MikroTik Routers Are Forwarding Owners' Traffic To Unknown Attackers
by Peter Reutemann 04 Sep '18

04 Sep '18

'Attackers have been exploiting vulnerabilities in MikroTik routers to forward network traffic to a handful of IP addresses under their control. "The bug is in Winbox management component and allows a remote attacker to bypass authentication and read arbitrary files," reports Bleeping Computer. "Exploit code is freely available from at least three sources from at least three sources." From the report: 360Netlab announced in a blog post today that more than 7,500 MikroTik routers across the world are currently delivering their TZSP (TaZmen Sniffer Protocol) traffic to nine external IP addresses. According to the researchers, the attacker modified the device's packet sniffing settings to forward the data to their locations. "37.1.207.114 is the top player among all the attackers. A significant number of devices have their traffic going to this destination," Qihoo experts inform. The analysis shows that the attacker is particularly interested in ports 20, 21, 25, 110, and 144, which are for FTP-data, FTP, SMTP, POP3, and IMAP traffic. An unusual interest is in traffic from SNMP (Simple Network Management Protocol) ports 161 and 162, which researchers cannot explain at the moment. The largest number of compromised devices, 1,628, is in Russia, followed by Iran (637), Brazil (615), India (594) and Ukraine (544). The researchers say that security outfits in the affected countries can contact them at netlab[at]360.cn for a full list of IPs. ' -- source: https://it.slashdot.org/story/18/09/04/2116202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How Do Spectre/Meltdown Fixes Affect The Linux Kernel?
by Peter Reutemann 01 Sep '18

01 Sep '18

'"Using the newly minted Linux 4.19 feature code, fresh benchmarks were carried out looking at the performance cost of Spectre/Meltdown/Foreshadow mitigations on Intel Xeon v. AMD EPYC CPUs," writes an anonymous Slashdot reader: Workloads affected by these CPU vulnerabilities mainly deal with I/O and frequent kernel calls while CPU bound tests are still found to be minimally impacted. When toggling these mitigations on Linux 4.19, Intel Xeon CPUs were found to be 10~15% slower with the default kernel while AMD EPYC CPUs dropped to about 5% slower.' -- source: https://linux.slashdot.org/story/18/09/01/1727238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel Blocked Collaboration On Spectre/Meltdown Fixes, Says Linux Kernel Developer
by Peter Reutemann 01 Sep '18

01 Sep '18

'This week in Vancouver, Linux kernel developer Greg Kroah-Hartman criticized Intel's slow initial response to the Spectre and Meltdown bugs in a talk at the Open Source Summit North America. An anonymous reader quotes eWeek: Kroah-Hartman said that when Intel finally decided to tell Linux developers, the disclosure was siloed.... "Intel siloed SUSE, they siloed Red Hat, they siloed Canonical. They never told Oracle, and they wouldn't let us talk to each other." For an initial set of vulnerabilities, Kroah-Hartman said the different Linux vendors typically work together. However, in this case they ended up working on their own, and each came up with different solutions. "It really wasn't working, and a number of us kernel developers yelled at [Intel] and pleaded, and we finally got them to allow us to talk to each other the last week of December [2017]," he said. "All of our Christmas vacations were ruined. This was not good. Intel really messed up on this," Kroah-Hartman said... "The majority of the world runs Debian or they run their own kernel," Kroah-Hartman said. "Debian was not allowed to be part of the disclosure, so the majority of the world was caught with their pants down, and that's not good." To Intel's credit, Kroah-Hartman said that after Linux kernel developers complained loudly to the company in December 2017 and into January 2018, it fixed its disclosure process for future Meltdown- and Spectre-related vulnerabilities... "Intel has gotten better at this," he said. An interesting side effect of the Meltdown and Spectre vulnerabilities is that Linux and Windows developers are now working together, since both operating systems face similar risks from the CPU vulnerabilities. "Windows and Linux kernel developers now have this wonderful back channel. We're talking to each other and we're fixing bugs for each other," Kroah-Hartman said. "We are working well together. We have always wanted that."' -- source: https://it.slashdot.org/story/18/09/01/1736228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android Bug Allows Geolocation Tracking of Users
by Peter Reutemann 30 Aug '18

30 Aug '18

'Researchers have discovered a weakness in all version of Android except 9, the most recent release, that can allow an attacker to gather sensitive information such as the MAC address and BSSID name and pinpoint the location of an affected device. The vulnerability is a result of the way that Android broadcasts device information to apps installed on a device. The operating system uses a mechanism known as an intent to send out information between processes or applications, and some of the information about the device's WiFi network interface sent via a pair of intents can be used by an attacker to track a device closely. A malicious app -- or just one that is listening for the right broadcasts from Android -- would be able to identify any individual Android device and geolocate it. An attacker could use this weaknesses to track a given device, presumably without the user's knowledge. Although Android has had MAC address randomization implemented since version 6, released in 2015, Yakov Shafranovich of Nightwatch Cybersecurity said his research showed that an attacker can get around this restriction.' -- source: https://yro.slashdot.org/story/18/08/30/1725225 Cheers, peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

What Dropbox Dropping Linux Support Says
by Peter Reutemann 29 Aug '18

29 Aug '18

'Jack Wallen, writing for TechRepublic: For a company to support Linux, they have to consider supporting: Multiple file systems, multiple distributions, multiple desktops, multiple init systems, multiple kernels. If you're an open source developer, focusing on a single distribution, that's not a problem. If you're a company that produces a product (and you stake your living on that product), those multiple points of entry do become a problem. Let's consider Adobe (and Photoshop). If Adobe wanted to port their industry-leading product to Linux, how do they do that? Do they spend the time developing support for ext4, btrfs, Ubuntu, Fedora, GNOME, Mate, KDE, systemd? You see how that might look from the eyes of any given company? It becomes even more complicated when companies consider how accustomed to the idea of "free" (as in beer) Linux users are. Although I am very willing to pay for software on Linux, it's a rare occasion that I do (mostly because I haven't found a piece of must-have software that has an associated cost). Few companies will support the Linux desktop when the act of supporting means putting that much time and effort into a product that a large cross-section of users might wind up unwilling to pay the price of admission. That's not to say every Linux user is unwilling to shell out the cost for a piece of software. But many won't.' -- source: https://linux.slashdot.org/story/18/08/29/0949228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

The Linux Foundation Is Changing The Fabric Of Networking
by Peter Reutemann 29 Aug '18

29 Aug '18

'Will Townsend, a senior analyst at Moor Insights & Strategy research firm, writes: As it relates to networking, the Linux Foundation is currently focused on a number of projects that are bringing top networking vendors, operators, service providers, and users together. Among the top initiatives are the Open Network Automation Platform (ONAP) and Data Plane Development Kit (DPDK). In this article, I would like to dive into both of these initiatives and share my perspective on how each is transforming the nature of networking [Editor's note: the website may have auto-playing videos; an alternative link was not available]. It makes sense that ONAP's releases are named after global cities, considering the platform's growing global footprint. ONAP is aimed at bringing real-time automation and orchestration to both physical and virtualized network functions. The first release in the fall of 2017, named Amsterdam, delivered a unified architecture for providing closed-loop networking automation. The underlying framework ensured a level of modularity to facilitate future functionality as well as standards harmonization and critical upstream partner collaboration. Initial use cases centered on Voice Over LTE (VoLTE) services as well as Virtualized Consumer Premise Equipment (vCPE). Both are extremely cost disruptive from a deployment and management perspective and deliver enhanced service provider agility. What I find extremely compelling is that Amsterdam was only an eight-month development cycle from start to release. That's an amazing feat even in the fast-paced technology industry. [...] DPDK was an effort initially led by Intel at its inception nearly eight years ago, but became a part of the Linux Foundation back in 2017. At a high level, the technology accelerates packet processing workloads running on a variety of CPU architectures. DPDK is aimed at improving overall network performance, delivering enhanced encryption for improved security and optimizing lower latency applications that require lightning-fast response time. The transformative power of 5G networks lies in their potential to deliver low latency for applications such as augmented/virtual reality and self-driving cars -- DPDK will further extend that performance for next-generation wireless wide area networks. I had the opportunity recently to speak to project chair Jim St. Leger after the fifth DPDK release, and I was impressed with the depth and breadth of the open source project. Over 25 companies and 160 technologists are involved in advancing the effort. With the proliferation of data, cord cutting at home, and growing consumption of video over wired and wireless networks, high-quality compression techniques will dramatically improve performance and reliability. DPDK appears to be poised to contribute significantly to that effort.' -- source: https://linux.slashdot.org/story/18/08/29/1646231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

WireGuard VPN review: A new type of VPN offers serious advantages
by Peter Reutemann 29 Aug '18

29 Aug '18

'WireGuard is a new type of VPN that aims to be simpler to set up and maintain than current VPNs and to offer a higher degree of security. The software is free and open source—it's licensed GPLv2, the same license as the Linux kernel—which is always a big plus in my book. It's also designed to be easily portable between operating systems. All of that might lead you to ask: in a world that already has IPSEC, PPTP, L2TP, OpenVPN, and a bewildering array of proprietary SSL VPNs, do we need yet another type of VPN?' -- source: https://arstechnica.com/gadgets/2018/08/wireguard-vpn-review-fast-connectio… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Facebook, Apple and Microsoft Are Contributing To OpenStreetMap
by Peter Reutemann 28 Aug '18

28 Aug '18

'At the recently concluded State of the Map conference in Milan, teams from Microsoft, Apple and Facebook presented their projects, describing how they are working with communities. From a report: The Microsoft Open Maps team has recently released open data on building footprints in the US. Microsoft was among the first to release satellite imagery for use by OpenStreetMap and the images are now integrated into the default editor. It also has a community of mappers directly contributing to OpenStreetMap in Australia. Apple has an internal volunteer programme that has around 5,000 staff contributing to Missing Maps, they've released building data for France and Denmark, and are engaged with data improvement projects around the world. Facebook is exploring how artificial intelligence-assisted tracing can help to improve the quality of OpenStreetMap data in Thailand. DigitalGlobe has made its satellite imagery available under a licence that will allow it to be used by the OpenStreetMap community to improve their mapping efforts. Telenav launched OpenStreetCam to help collect openly-licensed street imagery and has now released open data and code to explore how machine learning can enable the images to be used to improve OpenStreetMap with stop signs and turn directions.' -- source: https://news.slashdot.org/story/18/08/27/2258229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi's PoE HAT Ships For $20, Tosses in a Free Fan
by Peter Reutemann 27 Aug '18

27 Aug '18

'Raspberry Pi is offering a Power-over-Ethernet HAT board for the RPi 3 Model B+ for $20 that ships with a small fan. Per blog LinuxGizmo, the "802.3af-compliant 'Raspberry Pi PoE HAT' allows delivery of up to 15W over the RPi 3 B+'s USB-based GbE port without reducing the port's up to 300Mbps bandwidth." From the report: The Raspberry Pi PoE HAT features a fully isolated switched-mode power supply with 37-57V DC, Class 2 input and 5V/2.5A DC output. The HAT connects to both the 40-pin header and a new PoE-specific 4-pin header introduced with the B+ located near the USB ports. To enable PoE, you need power sourcing equipment, which is either "provided by your network switch or with power injectors on an Ethernet cable," writes the foundation in a blog post.' -- source: https://hardware.slashdot.org/story/18/08/27/1916207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu and CentOS Are Undoing a GNOME Security Feature
by Peter Reutemann 27 Aug '18

27 Aug '18

'Current versions of Ubuntu and CentOS are disabling a security feature that was added to the GNOME desktop environment last year. The feature's name is Bubblewrap, which is a sandbox environment that the GNOME Project added to secure GNOME's thumbnail parsers in July 2017, with the release of GNOME 3.26. In recent years, security researchers have proven that thumbnail parses can be an attack vector [1, 2, 3]. Ubuntu Security Tech Lead Alex Murray said the Ubuntu team chose to disable Bubblewrap inside Ubuntu because they did not have the time to perform a security audit. Murray blamed the many CPU bugs (Spectre, Meltdown, etc.), which kept the team busy and prevented them to audit the feature.' -- source: https://news.slashdot.org/story/18/08/27/1815234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 4.19 Preparing Better CPU Security Mitigations, New EROFS File-System
by Peter Reutemann 27 Aug '18

27 Aug '18

'Linus Torvalds released on Sunday Linux 4.19-rc1 that he describes as a "fairly frustrating merge window" following the new features landing over the past two weeks. What does this "pretty big release" offer? Phoronix's Linux 4.19 feature overview sheds light on more Spectre CPU mitigations for x86/POWER/s390, the new EROFS read-only Android file-system, a Raspberry Pi voltage driver, ThinkPad calculator key support, an in-kernel GPS subsystem, the Google GASKET driver framework, virtual kernel mode-setting, Qualcomm Adreno 600 series support, and many other improvements.' -- source: https://linux.slashdot.org/story/18/08/26/2342240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Smartphones From 11 OEMs, Including Google, Samsung, HTC, Lenovo and Sony, Vulnerable To Attacks Via Hidden AT Commands
by Peter Reutemann 26 Aug '18

26 Aug '18

'In massive and groundbreaking research, a team of eleven scientists from the University of Florida, Stony Brook University, and Samsung Research America, have looked into what types of AT commands, or the Hayes command set, are currently supported on modern Android devices. The research team analyzed over 2,000 Android firmware images from eleven Android OEMs such as ASUS, Google, HTC, Huawei, Lenovo, LG, LineageOS, Motorola, Samsung, Sony, and ZTE. They say they discovered that these devices support over 3,500 different types of AT commands, some of which grant access to very dangerous functions. These AT commands are all exposed via the phone's USB interface, meaning an attacker would have to either gain access to a user's device, or hide a malicious component inside USB docks, chargers, or charging stations. Once an attacker is connected via the USB to a target's phone, s/he can use one of the phone's secret AT commands to rewrite device firmware, bypass Android security mechanisms, exfiltrate sensitive device information, perform screen unlocks, or even inject touch events solely through the use of AT commands.' -- source: https://mobile.slashdot.org/story/18/08/26/1910246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

E-Life In NZ
by Lawrence D'Oliveiro 25 Aug '18

25 Aug '18

The Herald website <https://www.nzherald.co.nz/> seems to be having trouble matching some of its headlines with subheads today. From the front page: * Man Hospitalised After Stuffing 15 Hard-Boiled Eggs Up His Bottom How many of these 'only-in-Auckland' dates have you been on? * Lizzie Marvelly: Haters, Trolls And Their Vile Words Kim Kardashian West is 'really proud' of her weight loss. Here's how she did it. * Why Restaurants Hate You The little Prince is getting a well-rounded education at his $38,000 a year school. * Six Reasons Why Superwoman Sucks Italian chef advises home cooks to reach for the most expensive varieties. * Ex-Playboy Model Found Strangled In Her Home Kyle MacDonald on whether or not the term applies to our Prime Minister. Interestingly, all of these are from the “Lifestyle” section.

1 0

“The following packages have been kept back:”
by Peter Reutemann 23 Aug '18

23 Aug '18

Every now and then, I get the message from "apt-get upgrade", that: “The following packages have been kept back:” The following answer on "ask ubuntu" explains this nicely and also several solutions to install these packages after all: https://askubuntu.com/questions/601/the-following-packages-have-been-kept-b… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0